The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/bwn/if_bwn.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
    5  * Copyright (c) 2016 Landon Fuller <landonf@FreeBSD.org>
    6  * Copyright (c) 2017 The FreeBSD Foundation
    7  * All rights reserved.
    8  * 
    9  * Portions of this software were developed by Landon Fuller
   10  * under sponsorship from the FreeBSD Foundation.
   11  *
   12  * Redistribution and use in source and binary forms, with or without
   13  * modification, are permitted provided that the following conditions
   14  * are met:
   15  * 1. Redistributions of source code must retain the above copyright
   16  *    notice, this list of conditions and the following disclaimer,
   17  *    without modification.
   18  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
   19  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
   20  *    redistribution must be conditioned upon including a substantially
   21  *    similar Disclaimer requirement for further binary redistribution.
   22  *
   23  * NO WARRANTY
   24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
   27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
   28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
   29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
   32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   34  * THE POSSIBILITY OF SUCH DAMAGES.
   35  */
   36 
   37 #include <sys/cdefs.h>
   38 __FBSDID("$FreeBSD$");
   39 
   40 /*
   41  * The Broadcom Wireless LAN controller driver.
   42  */
   43 
   44 #include "opt_bwn.h"
   45 #include "opt_wlan.h"
   46 
   47 #include <sys/param.h>
   48 #include <sys/systm.h>
   49 #include <sys/kernel.h>
   50 #include <sys/gpio.h>
   51 #include <sys/malloc.h>
   52 #include <sys/module.h>
   53 #include <sys/endian.h>
   54 #include <sys/errno.h>
   55 #include <sys/firmware.h>
   56 #include <sys/lock.h>
   57 #include <sys/mutex.h>
   58 #include <machine/bus.h>
   59 #include <machine/resource.h>
   60 #include <sys/bus.h>
   61 #include <sys/rman.h>
   62 #include <sys/socket.h>
   63 #include <sys/sockio.h>
   64 
   65 #include <net/ethernet.h>
   66 #include <net/if.h>
   67 #include <net/if_var.h>
   68 #include <net/if_arp.h>
   69 #include <net/if_dl.h>
   70 #include <net/if_llc.h>
   71 #include <net/if_media.h>
   72 #include <net/if_types.h>
   73 
   74 #include <net80211/ieee80211_var.h>
   75 #include <net80211/ieee80211_radiotap.h>
   76 #include <net80211/ieee80211_regdomain.h>
   77 #include <net80211/ieee80211_phy.h>
   78 #include <net80211/ieee80211_ratectl.h>
   79 
   80 #include <dev/bhnd/bhnd.h>
   81 #include <dev/bhnd/bhnd_ids.h>
   82 
   83 #include <dev/bhnd/cores/chipc/chipc.h>
   84 #include <dev/bhnd/cores/pmu/bhnd_pmu.h>
   85 
   86 #include <dev/bwn/if_bwnreg.h>
   87 #include <dev/bwn/if_bwnvar.h>
   88 
   89 #include <dev/bwn/if_bwn_debug.h>
   90 #include <dev/bwn/if_bwn_misc.h>
   91 #include <dev/bwn/if_bwn_util.h>
   92 #include <dev/bwn/if_bwn_phy_common.h>
   93 #include <dev/bwn/if_bwn_phy_g.h>
   94 #include <dev/bwn/if_bwn_phy_lp.h>
   95 #include <dev/bwn/if_bwn_phy_n.h>
   96 
   97 #include "bhnd_nvram_map.h"
   98 
   99 #include "gpio_if.h"
  100 
  101 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
  102     "Broadcom driver parameters");
  103 
  104 /*
  105  * Tunable & sysctl variables.
  106  */
  107 
  108 #ifdef BWN_DEBUG
  109 static  int bwn_debug = 0;
  110 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
  111     "Broadcom debugging printfs");
  112 #endif
  113 
  114 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
  115 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
  116     "uses Bad Frames Preemption");
  117 static int      bwn_bluetooth = 1;
  118 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
  119     "turns on Bluetooth Coexistence");
  120 static int      bwn_hwpctl = 0;
  121 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
  122     "uses H/W power control");
  123 static int      bwn_usedma = 1;
  124 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
  125     "uses DMA");
  126 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
  127 static int      bwn_wme = 1;
  128 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
  129     "uses WME support");
  130 
  131 static void     bwn_attach_pre(struct bwn_softc *);
  132 static int      bwn_attach_post(struct bwn_softc *);
  133 static int      bwn_retain_bus_providers(struct bwn_softc *sc);
  134 static void     bwn_release_bus_providers(struct bwn_softc *sc);
  135 static void     bwn_sprom_bugfixes(device_t);
  136 static int      bwn_init(struct bwn_softc *);
  137 static void     bwn_parent(struct ieee80211com *);
  138 static void     bwn_start(struct bwn_softc *);
  139 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
  140 static int      bwn_attach_core(struct bwn_mac *);
  141 static int      bwn_phy_getinfo(struct bwn_mac *, int);
  142 static int      bwn_chiptest(struct bwn_mac *);
  143 static int      bwn_setup_channels(struct bwn_mac *, int, int);
  144 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
  145                     uint16_t);
  146 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
  147                     const struct bwn_channelinfo *, const uint8_t []);
  148 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
  149                     const struct ieee80211_bpf_params *);
  150 static void     bwn_updateslot(struct ieee80211com *);
  151 static void     bwn_update_promisc(struct ieee80211com *);
  152 static void     bwn_wme_init(struct bwn_mac *);
  153 static int      bwn_wme_update(struct ieee80211com *);
  154 static void     bwn_wme_clear(struct bwn_softc *);
  155 static void     bwn_wme_load(struct bwn_mac *);
  156 static void     bwn_wme_loadparams(struct bwn_mac *,
  157                     const struct wmeParams *, uint16_t);
  158 static void     bwn_scan_start(struct ieee80211com *);
  159 static void     bwn_scan_end(struct ieee80211com *);
  160 static void     bwn_set_channel(struct ieee80211com *);
  161 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
  162                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
  163                     const uint8_t [IEEE80211_ADDR_LEN],
  164                     const uint8_t [IEEE80211_ADDR_LEN]);
  165 static void     bwn_vap_delete(struct ieee80211vap *);
  166 static void     bwn_stop(struct bwn_softc *);
  167 static int      bwn_core_forceclk(struct bwn_mac *, bool);
  168 static int      bwn_core_init(struct bwn_mac *);
  169 static void     bwn_core_start(struct bwn_mac *);
  170 static void     bwn_core_exit(struct bwn_mac *);
  171 static void     bwn_bt_disable(struct bwn_mac *);
  172 static int      bwn_chip_init(struct bwn_mac *);
  173 static void     bwn_set_txretry(struct bwn_mac *, int, int);
  174 static void     bwn_rate_init(struct bwn_mac *);
  175 static void     bwn_set_phytxctl(struct bwn_mac *);
  176 static void     bwn_spu_setdelay(struct bwn_mac *, int);
  177 static void     bwn_bt_enable(struct bwn_mac *);
  178 static void     bwn_set_macaddr(struct bwn_mac *);
  179 static void     bwn_crypt_init(struct bwn_mac *);
  180 static void     bwn_chip_exit(struct bwn_mac *);
  181 static int      bwn_fw_fillinfo(struct bwn_mac *);
  182 static int      bwn_fw_loaducode(struct bwn_mac *);
  183 static int      bwn_gpio_init(struct bwn_mac *);
  184 static int      bwn_fw_loadinitvals(struct bwn_mac *);
  185 static int      bwn_phy_init(struct bwn_mac *);
  186 static void     bwn_set_txantenna(struct bwn_mac *, int);
  187 static void     bwn_set_opmode(struct bwn_mac *);
  188 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
  189 static uint8_t  bwn_plcp_getcck(const uint8_t);
  190 static uint8_t  bwn_plcp_getofdm(const uint8_t);
  191 static void     bwn_pio_init(struct bwn_mac *);
  192 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
  193 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
  194                     int);
  195 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
  196                     struct bwn_pio_rxqueue *, int);
  197 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
  198 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
  199                     uint16_t);
  200 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
  201 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
  202 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
  203 static void     bwn_pio_handle_txeof(struct bwn_mac *,
  204                     const struct bwn_txstatus *);
  205 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
  206 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
  207 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
  208                     uint16_t);
  209 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
  210                     uint32_t);
  211 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
  212                     struct mbuf **);
  213 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
  214 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
  215                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
  216 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
  217                     uint16_t, uint32_t);
  218 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
  219                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
  220 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
  221                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
  222 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
  223                     uint16_t, struct bwn_pio_txpkt **);
  224 static void     bwn_dma_init(struct bwn_mac *);
  225 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
  226 static uint16_t bwn_dma_base(int, int);
  227 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
  228 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
  229                     int, struct bwn_dmadesc_generic **,
  230                     struct bwn_dmadesc_meta **);
  231 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
  232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
  233                     int, int);
  234 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
  235 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
  236 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
  237 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
  238 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
  239 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
  240                     int, struct bwn_dmadesc_generic **,
  241                     struct bwn_dmadesc_meta **);
  242 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
  243                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
  244                     int, int);
  245 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
  246 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
  247 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
  248 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
  249 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
  250 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
  251 static void     bwn_dma_setup(struct bwn_dma_ring *);
  252 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
  253 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
  254 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
  255 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
  256 static void     bwn_dma_rx(struct bwn_dma_ring *);
  257 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
  258 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
  259                     struct bwn_dmadesc_meta *);
  260 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
  261 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
  262 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
  263 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
  264 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
  265 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
  266                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
  267                     int);
  268 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
  269                     bus_size_t, int);
  270 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
  271 static void     bwn_ratectl_tx_complete(const struct ieee80211_node *,
  272                     const struct bwn_txstatus *);
  273 static void     bwn_dma_handle_txeof(struct bwn_mac *,
  274                     const struct bwn_txstatus *);
  275 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
  276                     struct mbuf **);
  277 static int      bwn_dma_getslot(struct bwn_dma_ring *);
  278 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
  279                     uint8_t);
  280 static int      bwn_dma_attach(struct bwn_mac *);
  281 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
  282                     int, int);
  283 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
  284                     const struct bwn_txstatus *, uint16_t, int *);
  285 static void     bwn_dma_free(struct bwn_mac *);
  286 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
  287 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
  288                     const char *, struct bwn_fwfile *);
  289 static void     bwn_release_firmware(struct bwn_mac *);
  290 static void     bwn_do_release_fw(struct bwn_fwfile *);
  291 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
  292 static int      bwn_fwinitvals_write(struct bwn_mac *,
  293                     const struct bwn_fwinitvals *, size_t, size_t);
  294 static uint16_t bwn_ant2phy(int);
  295 static void     bwn_mac_write_bssid(struct bwn_mac *);
  296 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
  297                     const uint8_t *);
  298 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
  299                     const uint8_t *, size_t, const uint8_t *);
  300 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
  301                     const uint8_t *);
  302 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
  303                     const uint8_t *);
  304 static void     bwn_phy_exit(struct bwn_mac *);
  305 static void     bwn_core_stop(struct bwn_mac *);
  306 static int      bwn_switch_band(struct bwn_softc *,
  307                     struct ieee80211_channel *);
  308 static int      bwn_phy_reset(struct bwn_mac *);
  309 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  310 static void     bwn_set_pretbtt(struct bwn_mac *);
  311 static int      bwn_intr(void *);
  312 static void     bwn_intrtask(void *, int);
  313 static void     bwn_restart(struct bwn_mac *, const char *);
  314 static void     bwn_intr_ucode_debug(struct bwn_mac *);
  315 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
  316 static void     bwn_intr_atim_end(struct bwn_mac *);
  317 static void     bwn_intr_beacon(struct bwn_mac *);
  318 static void     bwn_intr_pmq(struct bwn_mac *);
  319 static void     bwn_intr_noise(struct bwn_mac *);
  320 static void     bwn_intr_txeof(struct bwn_mac *);
  321 static void     bwn_hwreset(void *, int);
  322 static void     bwn_handle_fwpanic(struct bwn_mac *);
  323 static void     bwn_load_beacon0(struct bwn_mac *);
  324 static void     bwn_load_beacon1(struct bwn_mac *);
  325 static uint32_t bwn_jssi_read(struct bwn_mac *);
  326 static void     bwn_noise_gensample(struct bwn_mac *);
  327 static void     bwn_handle_txeof(struct bwn_mac *,
  328                     const struct bwn_txstatus *);
  329 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
  330 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
  331 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
  332                     struct mbuf *);
  333 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
  334 static int      bwn_set_txhdr(struct bwn_mac *,
  335                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
  336                     uint16_t);
  337 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
  338                     const uint8_t);
  339 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
  340 static uint8_t  bwn_get_fbrate(uint8_t);
  341 static void     bwn_txpwr(void *, int);
  342 static void     bwn_tasks(void *);
  343 static void     bwn_task_15s(struct bwn_mac *);
  344 static void     bwn_task_30s(struct bwn_mac *);
  345 static void     bwn_task_60s(struct bwn_mac *);
  346 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
  347                     uint8_t);
  348 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
  349 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
  350                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
  351                     int, int);
  352 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
  353 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
  354 static void     bwn_watchdog(void *);
  355 static void     bwn_dma_stop(struct bwn_mac *);
  356 static void     bwn_pio_stop(struct bwn_mac *);
  357 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
  358 static int      bwn_led_attach(struct bwn_mac *);
  359 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
  360 static void     bwn_led_event(struct bwn_mac *, int);
  361 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
  362 static void     bwn_led_blink_next(void *);
  363 static void     bwn_led_blink_end(void *);
  364 static void     bwn_rfswitch(void *);
  365 static void     bwn_rf_turnon(struct bwn_mac *);
  366 static void     bwn_rf_turnoff(struct bwn_mac *);
  367 static void     bwn_sysctl_node(struct bwn_softc *);
  368 
  369 static const struct bwn_channelinfo bwn_chantable_bg = {
  370         .channels = {
  371                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
  372                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
  373                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
  374                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
  375                 { 2472, 13, 30 }, { 2484, 14, 30 } },
  376         .nchannels = 14
  377 };
  378 
  379 static const struct bwn_channelinfo bwn_chantable_a = {
  380         .channels = {
  381                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
  382                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
  383                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
  384                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
  385                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
  386                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
  387                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
  388                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
  389                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
  390                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
  391                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
  392                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
  393                 { 6080, 216, 30 } },
  394         .nchannels = 37
  395 };
  396 
  397 #if 0
  398 static const struct bwn_channelinfo bwn_chantable_n = {
  399         .channels = {
  400                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
  401                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
  402                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
  403                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
  404                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
  405                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
  406                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
  407                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
  408                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
  409                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
  410                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
  411                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
  412                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
  413                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
  414                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
  415                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
  416                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
  417                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
  418                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
  419                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
  420                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
  421                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
  422                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
  423                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
  424                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
  425                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
  426                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
  427                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
  428                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
  429                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
  430                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
  431                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
  432                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
  433                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
  434                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
  435                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
  436                 { 6130, 226, 30 }, { 6140, 228, 30 } },
  437         .nchannels = 110
  438 };
  439 #endif
  440 
  441 #define VENDOR_LED_ACT(vendor)                          \
  442 {                                                       \
  443         .vid = PCI_VENDOR_##vendor,                     \
  444         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
  445 }
  446 
  447 static const struct {
  448         uint16_t        vid;
  449         uint8_t         led_act[BWN_LED_MAX];
  450 } bwn_vendor_led_act[] = {
  451         VENDOR_LED_ACT(HP_COMPAQ),
  452         VENDOR_LED_ACT(ASUSTEK)
  453 };
  454 
  455 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
  456         { BWN_VENDOR_LED_ACT_DEFAULT };
  457 
  458 #undef VENDOR_LED_ACT
  459 
  460 static const char *bwn_led_vars[] = {
  461         BHND_NVAR_LEDBH0,
  462         BHND_NVAR_LEDBH1,
  463         BHND_NVAR_LEDBH2,
  464         BHND_NVAR_LEDBH3
  465 };
  466 
  467 static const struct {
  468         int             on_dur;
  469         int             off_dur;
  470 } bwn_led_duration[109] = {
  471         [0]     = { 400, 100 },
  472         [2]     = { 150, 75 },
  473         [4]     = { 90, 45 },
  474         [11]    = { 66, 34 },
  475         [12]    = { 53, 26 },
  476         [18]    = { 42, 21 },
  477         [22]    = { 35, 17 },
  478         [24]    = { 32, 16 },
  479         [36]    = { 21, 10 },
  480         [48]    = { 16, 8 },
  481         [72]    = { 11, 5 },
  482         [96]    = { 9, 4 },
  483         [108]   = { 7, 3 }
  484 };
  485 
  486 static const uint16_t bwn_wme_shm_offsets[] = {
  487         [0] = BWN_WME_BESTEFFORT,
  488         [1] = BWN_WME_BACKGROUND,
  489         [2] = BWN_WME_VOICE,
  490         [3] = BWN_WME_VIDEO,
  491 };
  492 
  493 /* Supported D11 core revisions */
  494 #define BWN_DEV(_hwrev) {{                                      \
  495         BHND_MATCH_CORE(BHND_MFGID_BCM, BHND_COREID_D11),       \
  496         BHND_MATCH_CORE_REV(_hwrev),                            \
  497 }}
  498 static const struct bhnd_device bwn_devices[] = {
  499         BWN_DEV(HWREV_RANGE(5, 16)),
  500         BWN_DEV(HWREV_EQ(23)),
  501         BHND_DEVICE_END
  502 };
  503 
  504 /* D11 quirks when bridged via a PCI host bridge core */
  505 static const struct bhnd_device_quirk pci_bridge_quirks[] = {
  506         BHND_CORE_QUIRK (HWREV_LTE(10), BWN_QUIRK_UCODE_SLOWCLOCK_WAR),
  507         BHND_DEVICE_QUIRK_END
  508 };
  509 
  510 /* D11 quirks when bridged via a PCMCIA host bridge core */
  511 static const struct bhnd_device_quirk pcmcia_bridge_quirks[] = {
  512         BHND_CORE_QUIRK (HWREV_ANY,     BWN_QUIRK_NODMA),
  513         BHND_DEVICE_QUIRK_END
  514 };
  515 
  516 /* Host bridge cores for which D11 quirk flags should be applied */
  517 static const struct bhnd_device bridge_devices[] = {
  518         BHND_DEVICE(BCM, PCI,           NULL, pci_bridge_quirks),
  519         BHND_DEVICE(BCM, PCMCIA,        NULL, pcmcia_bridge_quirks),
  520         BHND_DEVICE_END
  521 };
  522 
  523 static int
  524 bwn_probe(device_t dev)
  525 {
  526         const struct bhnd_device *id;
  527 
  528         id = bhnd_device_lookup(dev, bwn_devices, sizeof(bwn_devices[0]));
  529         if (id == NULL)
  530                 return (ENXIO);
  531 
  532         bhnd_set_default_core_desc(dev);
  533         return (BUS_PROBE_DEFAULT);
  534 }
  535 
  536 static int
  537 bwn_attach(device_t dev)
  538 {
  539         struct bwn_mac          *mac;
  540         struct bwn_softc        *sc;
  541         device_t                 parent, hostb;
  542         char                     chip_name[BHND_CHIPID_MAX_NAMELEN];
  543         int                      error;
  544 
  545         sc = device_get_softc(dev);
  546         sc->sc_dev = dev;
  547 #ifdef BWN_DEBUG
  548         sc->sc_debug = bwn_debug;
  549 #endif
  550 
  551         mac = NULL;
  552 
  553         /* Determine the driver quirks applicable to this device, including any
  554          * quirks specific to the bus host bridge core (if any) */
  555         sc->sc_quirks = bhnd_device_quirks(dev, bwn_devices,
  556             sizeof(bwn_devices[0]));
  557 
  558         parent = device_get_parent(dev);
  559         if ((hostb = bhnd_bus_find_hostb_device(parent)) != NULL) {
  560                 sc->sc_quirks |= bhnd_device_quirks(hostb, bridge_devices,
  561                     sizeof(bridge_devices[0]));
  562         }
  563 
  564         /* DMA explicitly disabled? */
  565         if (!bwn_usedma)
  566                 sc->sc_quirks |= BWN_QUIRK_NODMA;
  567 
  568         /* Fetch our chip identification and board info */
  569         sc->sc_cid = *bhnd_get_chipid(dev);
  570         if ((error = bhnd_read_board_info(dev, &sc->sc_board_info))) {
  571                 device_printf(sc->sc_dev, "couldn't read board info\n");
  572                 return (error);
  573         }
  574 
  575         /* Allocate our D11 register block and PMU state */
  576         sc->sc_mem_rid = 0;
  577         sc->sc_mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
  578             &sc->sc_mem_rid, RF_ACTIVE);
  579         if (sc->sc_mem_res == NULL) {
  580                 device_printf(sc->sc_dev, "couldn't allocate registers\n");
  581                 return (error);
  582         }
  583 
  584         if ((error = bhnd_alloc_pmu(sc->sc_dev))) {
  585                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
  586                     sc->sc_mem_rid, sc->sc_mem_res);
  587                 return (error);
  588         }
  589 
  590         /* Retain references to all required bus service providers */
  591         if ((error = bwn_retain_bus_providers(sc)))
  592                 goto fail;
  593 
  594         /* Fetch mask of available antennas */
  595         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA2G,
  596             &sc->sc_ant2g);
  597         if (error) {
  598                 device_printf(sc->sc_dev, "error determining 2GHz antenna "
  599                     "availability from NVRAM: %d\n", error);
  600                 goto fail;
  601         }
  602 
  603         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA5G,
  604             &sc->sc_ant5g);
  605         if (error) {
  606                 device_printf(sc->sc_dev, "error determining 5GHz antenna "
  607                     "availability from NVRAM: %d\n", error);
  608                 goto fail;
  609         }
  610 
  611         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
  612                 bwn_attach_pre(sc);
  613                 bwn_sprom_bugfixes(dev);
  614                 sc->sc_flags |= BWN_FLAG_ATTACHED;
  615         }
  616 
  617         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
  618         mac->mac_sc = sc;
  619         mac->mac_status = BWN_MAC_STATUS_UNINIT;
  620         if (bwn_bfp != 0)
  621                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
  622 
  623         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
  624         NET_TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
  625         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
  626 
  627         error = bwn_attach_core(mac);
  628         if (error)
  629                 goto fail;
  630         error = bwn_led_attach(mac);
  631         if (error)
  632                 goto fail;
  633 
  634         bhnd_format_chip_id(chip_name, sizeof(chip_name), sc->sc_cid.chip_id);
  635         device_printf(sc->sc_dev, "WLAN (%s rev %u sromrev %u) "
  636             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
  637             chip_name, bhnd_get_hwrev(sc->sc_dev),
  638             sc->sc_board_info.board_srom_rev, mac->mac_phy.analog,
  639             mac->mac_phy.type, mac->mac_phy.rev, mac->mac_phy.rf_manuf,
  640             mac->mac_phy.rf_ver, mac->mac_phy.rf_rev);
  641         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
  642                 device_printf(sc->sc_dev, "DMA (%d bits)\n", mac->mac_dmatype);
  643         else
  644                 device_printf(sc->sc_dev, "PIO\n");
  645 
  646 #ifdef  BWN_GPL_PHY
  647         device_printf(sc->sc_dev,
  648             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
  649 #endif
  650 
  651         mac->mac_rid_irq = 0;
  652         mac->mac_res_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
  653             &mac->mac_rid_irq, RF_ACTIVE | RF_SHAREABLE);
  654 
  655         if (mac->mac_res_irq == NULL) {
  656                 device_printf(sc->sc_dev, "couldn't allocate IRQ resource\n");
  657                 error = ENXIO;
  658                 goto fail;
  659         }
  660 
  661         error = bus_setup_intr(dev, mac->mac_res_irq,
  662             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
  663             &mac->mac_intrhand);
  664         if (error != 0) {
  665                 device_printf(sc->sc_dev, "couldn't setup interrupt (%d)\n",
  666                     error);
  667                 goto fail;
  668         }
  669 
  670         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
  671 
  672         /*
  673          * calls attach-post routine
  674          */
  675         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
  676                 bwn_attach_post(sc);
  677 
  678         return (0);
  679 fail:
  680         if (mac != NULL && mac->mac_res_irq != NULL) {
  681                 bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
  682                     mac->mac_res_irq);
  683         }
  684 
  685         free(mac, M_DEVBUF);
  686         bhnd_release_pmu(dev);
  687         bwn_release_bus_providers(sc);
  688 
  689         if (sc->sc_mem_res != NULL) {
  690                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
  691                     sc->sc_mem_rid, sc->sc_mem_res);
  692         }
  693 
  694         return (error);
  695 }
  696 
  697 static int
  698 bwn_retain_bus_providers(struct bwn_softc *sc)
  699 {
  700         struct chipc_caps *ccaps;
  701 
  702         sc->sc_chipc = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_CHIPC);
  703         if (sc->sc_chipc == NULL) {
  704                 device_printf(sc->sc_dev, "ChipCommon device not found\n");
  705                 goto failed;
  706         }
  707 
  708         ccaps = BHND_CHIPC_GET_CAPS(sc->sc_chipc);
  709 
  710         sc->sc_gpio = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_GPIO);
  711         if (sc->sc_gpio == NULL) {
  712                 device_printf(sc->sc_dev, "GPIO device not found\n");
  713                 goto failed;
  714         }
  715 
  716         if (ccaps->pmu) {
  717                 sc->sc_pmu = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_PMU);
  718                 if (sc->sc_pmu == NULL) {
  719                         device_printf(sc->sc_dev, "PMU device not found\n");
  720                         goto failed;
  721                 }
  722         }
  723 
  724         return (0);
  725 
  726 failed:
  727         bwn_release_bus_providers(sc);
  728         return (ENXIO);
  729 }
  730 
  731 static void
  732 bwn_release_bus_providers(struct bwn_softc *sc)
  733 {
  734 #define BWN_RELEASE_PROV(_sc, _prov, _service)  do {                    \
  735         if ((_sc)-> _prov != NULL) {                                    \
  736                 bhnd_release_provider((_sc)->sc_dev, (_sc)-> _prov,     \
  737                     (_service));                                        \
  738                 (_sc)-> _prov = NULL;                                   \
  739         }                                                               \
  740 } while (0)
  741 
  742         BWN_RELEASE_PROV(sc, sc_chipc, BHND_SERVICE_CHIPC);
  743         BWN_RELEASE_PROV(sc, sc_gpio, BHND_SERVICE_GPIO);
  744         BWN_RELEASE_PROV(sc, sc_pmu, BHND_SERVICE_PMU);
  745 
  746 #undef  BWN_RELEASE_PROV
  747 }
  748 
  749 static int
  750 bwn_attach_post(struct bwn_softc *sc)
  751 {
  752         struct ieee80211com     *ic;
  753         const char              *mac_varname;
  754         u_int                    core_unit;
  755         int                      error;
  756 
  757         ic = &sc->sc_ic;
  758 
  759         ic->ic_softc = sc;
  760         ic->ic_name = device_get_nameunit(sc->sc_dev);
  761         /* XXX not right but it's not used anywhere important */
  762         ic->ic_phytype = IEEE80211_T_OFDM;
  763         ic->ic_opmode = IEEE80211_M_STA;
  764         ic->ic_caps =
  765                   IEEE80211_C_STA               /* station mode supported */
  766                 | IEEE80211_C_MONITOR           /* monitor mode */
  767                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
  768                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
  769                 | IEEE80211_C_SHSLOT            /* short slot time supported */
  770                 | IEEE80211_C_WME               /* WME/WMM supported */
  771                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
  772 #if 0
  773                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
  774 #endif
  775                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
  776                 ;
  777 
  778         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
  779 
  780         /* Determine the NVRAM variable containing our MAC address */
  781         core_unit = bhnd_get_core_unit(sc->sc_dev);
  782         mac_varname = NULL;
  783         if (sc->sc_board_info.board_srom_rev <= 2) {
  784                 if (core_unit == 0) {
  785                         mac_varname = BHND_NVAR_IL0MACADDR;
  786                 } else if (core_unit == 1) {
  787                         mac_varname = BHND_NVAR_ET1MACADDR;
  788                 }
  789         } else {
  790                 if (core_unit == 0) {
  791                         mac_varname = BHND_NVAR_MACADDR;
  792                 }
  793         }
  794 
  795         if (mac_varname == NULL) {
  796                 device_printf(sc->sc_dev, "missing MAC address variable for "
  797                     "D11 core %u", core_unit);
  798                 return (ENXIO);
  799         }
  800 
  801         /* Read the MAC address from NVRAM */
  802         error = bhnd_nvram_getvar_array(sc->sc_dev, mac_varname, ic->ic_macaddr,
  803             sizeof(ic->ic_macaddr), BHND_NVRAM_TYPE_UINT8_ARRAY);
  804         if (error) {
  805                 device_printf(sc->sc_dev, "error reading %s: %d\n", mac_varname,
  806                     error);
  807                 return (error);
  808         }
  809 
  810         /* call MI attach routine. */
  811         ieee80211_ifattach(ic);
  812 
  813         ic->ic_headroom = sizeof(struct bwn_txhdr);
  814 
  815         /* override default methods */
  816         ic->ic_raw_xmit = bwn_raw_xmit;
  817         ic->ic_updateslot = bwn_updateslot;
  818         ic->ic_update_promisc = bwn_update_promisc;
  819         ic->ic_wme.wme_update = bwn_wme_update;
  820         ic->ic_scan_start = bwn_scan_start;
  821         ic->ic_scan_end = bwn_scan_end;
  822         ic->ic_set_channel = bwn_set_channel;
  823         ic->ic_vap_create = bwn_vap_create;
  824         ic->ic_vap_delete = bwn_vap_delete;
  825         ic->ic_transmit = bwn_transmit;
  826         ic->ic_parent = bwn_parent;
  827 
  828         ieee80211_radiotap_attach(ic,
  829             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
  830             BWN_TX_RADIOTAP_PRESENT,
  831             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
  832             BWN_RX_RADIOTAP_PRESENT);
  833 
  834         bwn_sysctl_node(sc);
  835 
  836         if (bootverbose)
  837                 ieee80211_announce(ic);
  838         return (0);
  839 }
  840 
  841 static void
  842 bwn_phy_detach(struct bwn_mac *mac)
  843 {
  844 
  845         if (mac->mac_phy.detach != NULL)
  846                 mac->mac_phy.detach(mac);
  847 }
  848 
  849 static int
  850 bwn_detach(device_t dev)
  851 {
  852         struct bwn_softc *sc = device_get_softc(dev);
  853         struct bwn_mac *mac = sc->sc_curmac;
  854         struct ieee80211com *ic = &sc->sc_ic;
  855 
  856         sc->sc_flags |= BWN_FLAG_INVALID;
  857 
  858         if (device_is_attached(sc->sc_dev)) {
  859                 BWN_LOCK(sc);
  860                 bwn_stop(sc);
  861                 BWN_UNLOCK(sc);
  862                 bwn_dma_free(mac);
  863                 callout_drain(&sc->sc_led_blink_ch);
  864                 callout_drain(&sc->sc_rfswitch_ch);
  865                 callout_drain(&sc->sc_task_ch);
  866                 callout_drain(&sc->sc_watchdog_ch);
  867                 bwn_phy_detach(mac);
  868                 ieee80211_draintask(ic, &mac->mac_hwreset);
  869                 ieee80211_draintask(ic, &mac->mac_txpower);
  870                 ieee80211_ifdetach(ic);
  871         }
  872         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
  873         taskqueue_free(sc->sc_tq);
  874 
  875         if (mac->mac_intrhand != NULL) {
  876                 bus_teardown_intr(dev, mac->mac_res_irq, mac->mac_intrhand);
  877                 mac->mac_intrhand = NULL;
  878         }
  879 
  880         bhnd_release_pmu(dev);
  881         bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_mem_rid,
  882             sc->sc_mem_res);
  883         bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
  884             mac->mac_res_irq);
  885         mbufq_drain(&sc->sc_snd);
  886         bwn_release_firmware(mac);
  887         BWN_LOCK_DESTROY(sc);
  888 
  889         bwn_release_bus_providers(sc);
  890 
  891         return (0);
  892 }
  893 
  894 static void
  895 bwn_attach_pre(struct bwn_softc *sc)
  896 {
  897 
  898         BWN_LOCK_INIT(sc);
  899         TAILQ_INIT(&sc->sc_maclist);
  900         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
  901         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
  902         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
  903         mbufq_init(&sc->sc_snd, ifqmaxlen);
  904         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
  905                 taskqueue_thread_enqueue, &sc->sc_tq);
  906         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
  907                 "%s taskq", device_get_nameunit(sc->sc_dev));
  908 }
  909 
  910 static void
  911 bwn_sprom_bugfixes(device_t dev)
  912 {
  913         struct bwn_softc *sc = device_get_softc(dev);
  914 
  915 #define BWN_ISDEV(_device, _subvendor, _subdevice)              \
  916         ((sc->sc_board_info.board_devid == PCI_DEVID_##_device) &&      \
  917          (sc->sc_board_info.board_vendor == PCI_VENDOR_##_subvendor) && \
  918          (sc->sc_board_info.board_type == _subdevice))
  919 
  920          /* A subset of Apple Airport Extreme (BCM4306 rev 2) devices
  921           * were programmed with a missing PACTRL boardflag */
  922          if (sc->sc_board_info.board_vendor == PCI_VENDOR_APPLE &&
  923              sc->sc_board_info.board_type == 0x4e &&
  924              sc->sc_board_info.board_rev > 0x40)
  925                  sc->sc_board_info.board_flags |= BHND_BFL_PACTRL;
  926 
  927         if (BWN_ISDEV(BCM4318_D11G, ASUSTEK, 0x100f) ||
  928             BWN_ISDEV(BCM4306_D11G, DELL, 0x0003) ||
  929             BWN_ISDEV(BCM4306_D11G, HP, 0x12f8) ||
  930             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0013) ||
  931             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0014) ||
  932             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0015) ||
  933             BWN_ISDEV(BCM4306_D11G, MOTOROLA, 0x7010))
  934                 sc->sc_board_info.board_flags &= ~BHND_BFL_BTCOEX;
  935 #undef  BWN_ISDEV
  936 }
  937 
  938 static void
  939 bwn_parent(struct ieee80211com *ic)
  940 {
  941         struct bwn_softc *sc = ic->ic_softc;
  942         int startall = 0;
  943 
  944         BWN_LOCK(sc);
  945         if (ic->ic_nrunning > 0) {
  946                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
  947                         bwn_init(sc);
  948                         startall = 1;
  949                 } else
  950                         bwn_update_promisc(ic);
  951         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
  952                 bwn_stop(sc);
  953         BWN_UNLOCK(sc);
  954 
  955         if (startall)
  956                 ieee80211_start_all(ic);
  957 }
  958 
  959 static int
  960 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
  961 {
  962         struct bwn_softc *sc = ic->ic_softc;
  963         int error;
  964 
  965         BWN_LOCK(sc);
  966         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
  967                 BWN_UNLOCK(sc);
  968                 return (ENXIO);
  969         }
  970         error = mbufq_enqueue(&sc->sc_snd, m);
  971         if (error) {
  972                 BWN_UNLOCK(sc);
  973                 return (error);
  974         }
  975         bwn_start(sc);
  976         BWN_UNLOCK(sc);
  977         return (0);
  978 }
  979 
  980 static void
  981 bwn_start(struct bwn_softc *sc)
  982 {
  983         struct bwn_mac *mac = sc->sc_curmac;
  984         struct ieee80211_frame *wh;
  985         struct ieee80211_node *ni;
  986         struct ieee80211_key *k;
  987         struct mbuf *m;
  988 
  989         BWN_ASSERT_LOCKED(sc);
  990 
  991         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
  992             mac->mac_status < BWN_MAC_STATUS_STARTED)
  993                 return;
  994 
  995         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
  996                 if (bwn_tx_isfull(sc, m))
  997                         break;
  998                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
  999                 if (ni == NULL) {
 1000                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
 1001                         m_freem(m);
 1002                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 1003                         continue;
 1004                 }
 1005                 wh = mtod(m, struct ieee80211_frame *);
 1006                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 1007                         k = ieee80211_crypto_encap(ni, m);
 1008                         if (k == NULL) {
 1009                                 if_inc_counter(ni->ni_vap->iv_ifp,
 1010                                     IFCOUNTER_OERRORS, 1);
 1011                                 ieee80211_free_node(ni);
 1012                                 m_freem(m);
 1013                                 continue;
 1014                         }
 1015                 }
 1016                 wh = NULL;      /* Catch any invalid use */
 1017                 if (bwn_tx_start(sc, ni, m) != 0) {
 1018                         if (ni != NULL) {
 1019                                 if_inc_counter(ni->ni_vap->iv_ifp,
 1020                                     IFCOUNTER_OERRORS, 1);
 1021                                 ieee80211_free_node(ni);
 1022                         }
 1023                         continue;
 1024                 }
 1025                 sc->sc_watchdog_timer = 5;
 1026         }
 1027 }
 1028 
 1029 static int
 1030 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
 1031 {
 1032         struct bwn_dma_ring *dr;
 1033         struct bwn_mac *mac = sc->sc_curmac;
 1034         struct bwn_pio_txqueue *tq;
 1035         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 1036 
 1037         BWN_ASSERT_LOCKED(sc);
 1038 
 1039         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 1040                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
 1041                 if (dr->dr_stop == 1 ||
 1042                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
 1043                         dr->dr_stop = 1;
 1044                         goto full;
 1045                 }
 1046         } else {
 1047                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
 1048                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
 1049                     pktlen > (tq->tq_size - tq->tq_used))
 1050                         goto full;
 1051         }
 1052         return (0);
 1053 full:
 1054         mbufq_prepend(&sc->sc_snd, m);
 1055         return (1);
 1056 }
 1057 
 1058 static int
 1059 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
 1060 {
 1061         struct bwn_mac *mac = sc->sc_curmac;
 1062         int error;
 1063 
 1064         BWN_ASSERT_LOCKED(sc);
 1065 
 1066         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
 1067                 m_freem(m);
 1068                 return (ENXIO);
 1069         }
 1070 
 1071         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
 1072             bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
 1073         if (error) {
 1074                 m_freem(m);
 1075                 return (error);
 1076         }
 1077         return (0);
 1078 }
 1079 
 1080 static int
 1081 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
 1082     struct mbuf **mp)
 1083 {
 1084         struct bwn_pio_txpkt *tp;
 1085         struct bwn_pio_txqueue *tq;
 1086         struct bwn_softc *sc = mac->mac_sc;
 1087         struct bwn_txhdr txhdr;
 1088         struct mbuf *m, *m_new;
 1089         uint32_t ctl32;
 1090         int error;
 1091         uint16_t ctl16;
 1092 
 1093         BWN_ASSERT_LOCKED(sc);
 1094 
 1095         /* XXX TODO send packets after DTIM */
 1096 
 1097         m = *mp;
 1098         tq = bwn_pio_select(mac, M_WME_GETAC(m));
 1099         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
 1100         tp = TAILQ_FIRST(&tq->tq_pktlist);
 1101         tp->tp_ni = ni;
 1102         tp->tp_m = m;
 1103 
 1104         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
 1105         if (error) {
 1106                 device_printf(sc->sc_dev, "tx fail\n");
 1107                 return (error);
 1108         }
 1109 
 1110         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
 1111         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 1112         tq->tq_free--;
 1113 
 1114         if (bhnd_get_hwrev(sc->sc_dev) >= 8) {
 1115                 /*
 1116                  * XXX please removes m_defrag(9)
 1117                  */
 1118                 m_new = m_defrag(*mp, M_NOWAIT);
 1119                 if (m_new == NULL) {
 1120                         device_printf(sc->sc_dev,
 1121                             "%s: can't defrag TX buffer\n",
 1122                             __func__);
 1123                         return (ENOBUFS);
 1124                 }
 1125                 *mp = m_new;
 1126                 if (m_new->m_next != NULL)
 1127                         device_printf(sc->sc_dev,
 1128                             "TODO: fragmented packets for PIO\n");
 1129                 tp->tp_m = m_new;
 1130 
 1131                 /* send HEADER */
 1132                 ctl32 = bwn_pio_write_multi_4(mac, tq,
 1133                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
 1134                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
 1135                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 1136                 /* send BODY */
 1137                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
 1138                     mtod(m_new, const void *), m_new->m_pkthdr.len);
 1139                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
 1140                     ctl32 | BWN_PIO8_TXCTL_EOF);
 1141         } else {
 1142                 ctl16 = bwn_pio_write_multi_2(mac, tq,
 1143                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
 1144                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
 1145                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 1146                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
 1147                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
 1148                     ctl16 | BWN_PIO_TXCTL_EOF);
 1149         }
 1150 
 1151         return (0);
 1152 }
 1153 
 1154 static struct bwn_pio_txqueue *
 1155 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
 1156 {
 1157 
 1158         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
 1159                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
 1160 
 1161         switch (prio) {
 1162         case 0:
 1163                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
 1164         case 1:
 1165                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
 1166         case 2:
 1167                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
 1168         case 3:
 1169                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
 1170         }
 1171         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 1172         return (NULL);
 1173 }
 1174 
 1175 static int
 1176 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
 1177     struct mbuf **mp)
 1178 {
 1179 #define BWN_GET_TXHDRCACHE(slot)                                        \
 1180         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
 1181         struct bwn_dma *dma = &mac->mac_method.dma;
 1182         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
 1183         struct bwn_dmadesc_generic *desc;
 1184         struct bwn_dmadesc_meta *mt;
 1185         struct bwn_softc *sc = mac->mac_sc;
 1186         struct mbuf *m;
 1187         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
 1188         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
 1189 
 1190         BWN_ASSERT_LOCKED(sc);
 1191         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
 1192 
 1193         /* XXX send after DTIM */
 1194 
 1195         m = *mp;
 1196         slot = bwn_dma_getslot(dr);
 1197         dr->getdesc(dr, slot, &desc, &mt);
 1198         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
 1199             ("%s:%d: fail", __func__, __LINE__));
 1200 
 1201         error = bwn_set_txhdr(dr->dr_mac, ni, m,
 1202             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
 1203             BWN_DMA_COOKIE(dr, slot));
 1204         if (error)
 1205                 goto fail;
 1206         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
 1207             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
 1208             &mt->mt_paddr, BUS_DMA_NOWAIT);
 1209         if (error) {
 1210                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
 1211                     __func__, error);
 1212                 goto fail;
 1213         }
 1214         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
 1215             BUS_DMASYNC_PREWRITE);
 1216         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
 1217         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
 1218             BUS_DMASYNC_PREWRITE);
 1219 
 1220         slot = bwn_dma_getslot(dr);
 1221         dr->getdesc(dr, slot, &desc, &mt);
 1222         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
 1223             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
 1224         mt->mt_m = m;
 1225         mt->mt_ni = ni;
 1226 
 1227         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
 1228             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
 1229         if (error && error != EFBIG) {
 1230                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
 1231                     __func__, error);
 1232                 goto fail;
 1233         }
 1234         if (error) {    /* error == EFBIG */
 1235                 struct mbuf *m_new;
 1236 
 1237                 m_new = m_defrag(m, M_NOWAIT);
 1238                 if (m_new == NULL) {
 1239                         device_printf(sc->sc_dev,
 1240                             "%s: can't defrag TX buffer\n",
 1241                             __func__);
 1242                         error = ENOBUFS;
 1243                         goto fail;
 1244                 }
 1245                 *mp = m = m_new;
 1246 
 1247                 mt->mt_m = m;
 1248                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
 1249                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
 1250                 if (error) {
 1251                         device_printf(sc->sc_dev,
 1252                             "%s: can't load TX buffer (2) %d\n",
 1253                             __func__, error);
 1254                         goto fail;
 1255                 }
 1256         }
 1257         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
 1258         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
 1259         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
 1260             BUS_DMASYNC_PREWRITE);
 1261 
 1262         /* XXX send after DTIM */
 1263 
 1264         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
 1265         return (0);
 1266 fail:
 1267         dr->dr_curslot = backup[0];
 1268         dr->dr_usedslot = backup[1];
 1269         return (error);
 1270 #undef BWN_GET_TXHDRCACHE
 1271 }
 1272 
 1273 static void
 1274 bwn_watchdog(void *arg)
 1275 {
 1276         struct bwn_softc *sc = arg;
 1277 
 1278         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
 1279                 device_printf(sc->sc_dev, "device timeout\n");
 1280                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 1281         }
 1282         callout_schedule(&sc->sc_watchdog_ch, hz);
 1283 }
 1284 
 1285 static int
 1286 bwn_attach_core(struct bwn_mac *mac)
 1287 {
 1288         struct bwn_softc *sc = mac->mac_sc;
 1289         int error, have_bg = 0, have_a = 0;
 1290         uint16_t iost;
 1291 
 1292         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5,
 1293             ("unsupported revision %d", bhnd_get_hwrev(sc->sc_dev)));
 1294 
 1295         if ((error = bwn_core_forceclk(mac, true)))
 1296                 return (error);
 1297 
 1298         if ((error = bhnd_read_iost(sc->sc_dev, &iost))) {
 1299                 device_printf(sc->sc_dev, "error reading I/O status flags: "
 1300                     "%d\n", error);
 1301                 return (error);
 1302         }
 1303 
 1304         have_a = (iost & BWN_IOST_HAVE_5GHZ) ? 1 : 0;
 1305         have_bg = (iost & BWN_IOST_HAVE_2GHZ) ? 1 : 0;
 1306         if (iost & BWN_IOST_DUALPHY) {
 1307                 have_bg = 1;
 1308                 have_a = 1;
 1309         }
 1310 
 1311 #if 0
 1312         device_printf(sc->sc_dev, "%s: iost=0x%04hx, have_a=%d, have_bg=%d,"
 1313             " deviceid=0x%04x, siba_deviceid=0x%04x\n",
 1314             __func__,
 1315             iost,
 1316             have_a,
 1317             have_bg,
 1318             sc->sc_board_info.board_devid,
 1319             sc->sc_cid.chip_id);
 1320 #endif
 1321 
 1322         /*
 1323          * Guess at whether it has A-PHY or G-PHY.
 1324          * This is just used for resetting the core to probe things;
 1325          * we will re-guess once it's all up and working.
 1326          */
 1327         error = bwn_reset_core(mac, have_bg);
 1328         if (error)
 1329                 goto fail;
 1330 
 1331         /*
 1332          * Determine the DMA engine type
 1333          */
 1334         if (iost & BHND_IOST_DMA64) {
 1335                 mac->mac_dmatype = BHND_DMA_ADDR_64BIT;
 1336         } else {
 1337                 uint32_t tmp;
 1338                 uint16_t base;
 1339 
 1340                 base = bwn_dma_base(0, 0);
 1341                 BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL,
 1342                     BWN_DMA32_TXADDREXT_MASK);
 1343                 tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
 1344                 if (tmp & BWN_DMA32_TXADDREXT_MASK) {
 1345                         mac->mac_dmatype = BHND_DMA_ADDR_32BIT;
 1346                 } else {
 1347                         mac->mac_dmatype = BHND_DMA_ADDR_30BIT;
 1348                 }
 1349         }
 1350 
 1351         /*
 1352          * Get the PHY version.
 1353          */
 1354         error = bwn_phy_getinfo(mac, have_bg);
 1355         if (error)
 1356                 goto fail;
 1357 
 1358         /*
 1359          * This is the whitelist of devices which we "believe"
 1360          * the SPROM PHY config from.  The rest are "guessed".
 1361          */
 1362         if (sc->sc_board_info.board_devid != PCI_DEVID_BCM4311_D11DUAL &&
 1363             sc->sc_board_info.board_devid != PCI_DEVID_BCM4328_D11G &&
 1364             sc->sc_board_info.board_devid != PCI_DEVID_BCM4318_D11DUAL &&
 1365             sc->sc_board_info.board_devid != PCI_DEVID_BCM4306_D11DUAL &&
 1366             sc->sc_board_info.board_devid != PCI_DEVID_BCM4321_D11N &&
 1367             sc->sc_board_info.board_devid != PCI_DEVID_BCM4322_D11N) {
 1368                 have_a = have_bg = 0;
 1369                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
 1370                         have_a = 1;
 1371                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
 1372                     mac->mac_phy.type == BWN_PHYTYPE_N ||
 1373                     mac->mac_phy.type == BWN_PHYTYPE_LP)
 1374                         have_bg = 1;
 1375                 else
 1376                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
 1377                             mac->mac_phy.type));
 1378         }
 1379 
 1380         /*
 1381          * XXX The PHY-G support doesn't do 5GHz operation.
 1382          */
 1383         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
 1384             mac->mac_phy.type != BWN_PHYTYPE_N) {
 1385                 device_printf(sc->sc_dev,
 1386                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
 1387                     __func__);
 1388                 have_a = 0;
 1389                 have_bg = 1;
 1390         }
 1391 
 1392         mac->mac_phy.phy_n = NULL;
 1393 
 1394         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
 1395                 mac->mac_phy.attach = bwn_phy_g_attach;
 1396                 mac->mac_phy.detach = bwn_phy_g_detach;
 1397                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
 1398                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
 1399                 mac->mac_phy.init = bwn_phy_g_init;
 1400                 mac->mac_phy.exit = bwn_phy_g_exit;
 1401                 mac->mac_phy.phy_read = bwn_phy_g_read;
 1402                 mac->mac_phy.phy_write = bwn_phy_g_write;
 1403                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
 1404                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
 1405                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
 1406                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
 1407                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
 1408                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
 1409                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
 1410                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
 1411                 mac->mac_phy.set_im = bwn_phy_g_im;
 1412                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
 1413                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
 1414                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
 1415                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
 1416         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
 1417                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
 1418                 mac->mac_phy.init = bwn_phy_lp_init;
 1419                 mac->mac_phy.phy_read = bwn_phy_lp_read;
 1420                 mac->mac_phy.phy_write = bwn_phy_lp_write;
 1421                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
 1422                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
 1423                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
 1424                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
 1425                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
 1426                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
 1427                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
 1428                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
 1429                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
 1430         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
 1431                 mac->mac_phy.attach = bwn_phy_n_attach;
 1432                 mac->mac_phy.detach = bwn_phy_n_detach;
 1433                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
 1434                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
 1435                 mac->mac_phy.init = bwn_phy_n_init;
 1436                 mac->mac_phy.exit = bwn_phy_n_exit;
 1437                 mac->mac_phy.phy_read = bwn_phy_n_read;
 1438                 mac->mac_phy.phy_write = bwn_phy_n_write;
 1439                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
 1440                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
 1441                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
 1442                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
 1443                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
 1444                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
 1445                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
 1446                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
 1447                 mac->mac_phy.set_im = bwn_phy_n_im;
 1448                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
 1449                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
 1450                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
 1451                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
 1452         } else {
 1453                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
 1454                     mac->mac_phy.type);
 1455                 error = ENXIO;
 1456                 goto fail;
 1457         }
 1458 
 1459         mac->mac_phy.gmode = have_bg;
 1460         if (mac->mac_phy.attach != NULL) {
 1461                 error = mac->mac_phy.attach(mac);
 1462                 if (error) {
 1463                         device_printf(sc->sc_dev, "failed\n");
 1464                         goto fail;
 1465                 }
 1466         }
 1467 
 1468         error = bwn_reset_core(mac, have_bg);
 1469         if (error)
 1470                 goto fail;
 1471 
 1472         error = bwn_chiptest(mac);
 1473         if (error)
 1474                 goto fail;
 1475         error = bwn_setup_channels(mac, have_bg, have_a);
 1476         if (error) {
 1477                 device_printf(sc->sc_dev, "failed to setup channels\n");
 1478                 goto fail;
 1479         }
 1480 
 1481         if (sc->sc_curmac == NULL)
 1482                 sc->sc_curmac = mac;
 1483 
 1484         error = bwn_dma_attach(mac);
 1485         if (error != 0) {
 1486                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
 1487                 goto fail;
 1488         }
 1489 
 1490         mac->mac_phy.switch_analog(mac, 0);
 1491 
 1492 fail:
 1493         bhnd_suspend_hw(sc->sc_dev, 0);
 1494         bwn_release_firmware(mac);
 1495         return (error);
 1496 }
 1497 
 1498 /*
 1499  * Reset
 1500  */
 1501 int
 1502 bwn_reset_core(struct bwn_mac *mac, int g_mode)
 1503 {
 1504         struct bwn_softc        *sc;
 1505         uint32_t                 ctl;
 1506         uint16_t                 ioctl, ioctl_mask;
 1507         int                      error;
 1508 
 1509         sc = mac->mac_sc;
 1510 
 1511         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
 1512 
 1513         /* Reset core */
 1514         ioctl = (BWN_IOCTL_PHYCLOCK_ENABLE | BWN_IOCTL_PHYRESET);
 1515         if (g_mode)
 1516                 ioctl |= BWN_IOCTL_SUPPORT_G;
 1517 
 1518         /* XXX N-PHY only; and hard-code to 20MHz for now */
 1519         if (mac->mac_phy.type == BWN_PHYTYPE_N)
 1520                 ioctl |= BWN_IOCTL_PHY_BANDWIDTH_20MHZ;
 1521 
 1522         if ((error = bhnd_reset_hw(sc->sc_dev, ioctl, ioctl))) {
 1523                 device_printf(sc->sc_dev, "core reset failed: %d", error);
 1524                 return (error);
 1525         }
 1526 
 1527         DELAY(2000);
 1528 
 1529         /* Take PHY out of reset */
 1530         ioctl = BHND_IOCTL_CLK_FORCE;
 1531         ioctl_mask = BHND_IOCTL_CLK_FORCE |
 1532                      BWN_IOCTL_PHYRESET |
 1533                      BWN_IOCTL_PHYCLOCK_ENABLE;
 1534 
 1535         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
 1536                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
 1537                     "%d\n", error);
 1538                 return (error);
 1539         }
 1540 
 1541         DELAY(2000);
 1542 
 1543         ioctl = BWN_IOCTL_PHYCLOCK_ENABLE;
 1544         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
 1545                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
 1546                     "%d\n", error);
 1547                 return (error);
 1548         }
 1549 
 1550         DELAY(2000);
 1551 
 1552         if (mac->mac_phy.switch_analog != NULL)
 1553                 mac->mac_phy.switch_analog(mac, 1);
 1554 
 1555         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
 1556         if (g_mode)
 1557                 ctl |= BWN_MACCTL_GMODE;
 1558         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
 1559 
 1560         return (0);
 1561 }
 1562 
 1563 static int
 1564 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
 1565 {
 1566         struct bwn_phy *phy = &mac->mac_phy;
 1567         struct bwn_softc *sc = mac->mac_sc;
 1568         uint32_t tmp;
 1569 
 1570         /* PHY */
 1571         tmp = BWN_READ_2(mac, BWN_PHYVER);
 1572         phy->gmode = gmode;
 1573         phy->rf_on = 1;
 1574         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
 1575         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
 1576         phy->rev = (tmp & BWN_PHYVER_VERSION);
 1577         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
 1578             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
 1579                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
 1580             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
 1581             (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
 1582             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
 1583                 goto unsupphy;
 1584 
 1585         /* RADIO */
 1586         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
 1587         tmp = BWN_READ_2(mac, BWN_RFDATALO);
 1588         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
 1589         tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
 1590 
 1591         phy->rf_rev = (tmp & 0xf0000000) >> 28;
 1592         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
 1593         phy->rf_manuf = (tmp & 0x00000fff);
 1594 
 1595         /*
 1596          * For now, just always do full init (ie, what bwn has traditionally
 1597          * done)
 1598          */
 1599         phy->phy_do_full_init = 1;
 1600 
 1601         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
 1602                 goto unsupradio;
 1603         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
 1604              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
 1605             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
 1606             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
 1607             (phy->type == BWN_PHYTYPE_N &&
 1608              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
 1609             (phy->type == BWN_PHYTYPE_LP &&
 1610              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
 1611                 goto unsupradio;
 1612 
 1613         return (0);
 1614 unsupphy:
 1615         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
 1616             "analog %#x)\n",
 1617             phy->type, phy->rev, phy->analog);
 1618         return (ENXIO);
 1619 unsupradio:
 1620         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
 1621             "rev %#x)\n",
 1622             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
 1623         return (ENXIO);
 1624 }
 1625 
 1626 static int
 1627 bwn_chiptest(struct bwn_mac *mac)
 1628 {
 1629 #define TESTVAL0        0x55aaaa55
 1630 #define TESTVAL1        0xaa5555aa
 1631         struct bwn_softc *sc = mac->mac_sc;
 1632         uint32_t v, backup;
 1633 
 1634         BWN_LOCK(sc);
 1635 
 1636         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
 1637 
 1638         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
 1639         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
 1640                 goto error;
 1641         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
 1642         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
 1643                 goto error;
 1644 
 1645         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
 1646 
 1647         if ((bhnd_get_hwrev(sc->sc_dev) >= 3) &&
 1648             (bhnd_get_hwrev(sc->sc_dev) <= 10)) {
 1649                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
 1650                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
 1651                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
 1652                         goto error;
 1653                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
 1654                         goto error;
 1655         }
 1656         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
 1657 
 1658         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
 1659         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
 1660                 goto error;
 1661 
 1662         BWN_UNLOCK(sc);
 1663         return (0);
 1664 error:
 1665         BWN_UNLOCK(sc);
 1666         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
 1667         return (ENODEV);
 1668 }
 1669 
 1670 static int
 1671 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
 1672 {
 1673         struct bwn_softc *sc = mac->mac_sc;
 1674         struct ieee80211com *ic = &sc->sc_ic;
 1675         uint8_t bands[IEEE80211_MODE_BYTES];
 1676 
 1677         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
 1678         ic->ic_nchans = 0;
 1679 
 1680         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
 1681             __func__,
 1682             have_bg,
 1683             have_a);
 1684 
 1685         if (have_bg) {
 1686                 memset(bands, 0, sizeof(bands));
 1687                 setbit(bands, IEEE80211_MODE_11B);
 1688                 setbit(bands, IEEE80211_MODE_11G);
 1689                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
 1690                     &ic->ic_nchans, &bwn_chantable_bg, bands);
 1691         }
 1692 
 1693         if (have_a) {
 1694                 memset(bands, 0, sizeof(bands));
 1695                 setbit(bands, IEEE80211_MODE_11A);
 1696                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
 1697                     &ic->ic_nchans, &bwn_chantable_a, bands);
 1698         }
 1699 
 1700         mac->mac_phy.supports_2ghz = have_bg;
 1701         mac->mac_phy.supports_5ghz = have_a;
 1702 
 1703         return (ic->ic_nchans == 0 ? ENXIO : 0);
 1704 }
 1705 
 1706 uint32_t
 1707 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
 1708 {
 1709         uint32_t ret;
 1710 
 1711         BWN_ASSERT_LOCKED(mac->mac_sc);
 1712 
 1713         if (way == BWN_SHARED) {
 1714                 KASSERT((offset & 0x0001) == 0,
 1715                     ("%s:%d warn", __func__, __LINE__));
 1716                 if (offset & 0x0003) {
 1717                         bwn_shm_ctlword(mac, way, offset >> 2);
 1718                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
 1719                         ret <<= 16;
 1720                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
 1721                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
 1722                         goto out;
 1723                 }
 1724                 offset >>= 2;
 1725         }
 1726         bwn_shm_ctlword(mac, way, offset);
 1727         ret = BWN_READ_4(mac, BWN_SHM_DATA);
 1728 out:
 1729         return (ret);
 1730 }
 1731 
 1732 uint16_t
 1733 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
 1734 {
 1735         uint16_t ret;
 1736 
 1737         BWN_ASSERT_LOCKED(mac->mac_sc);
 1738 
 1739         if (way == BWN_SHARED) {
 1740                 KASSERT((offset & 0x0001) == 0,
 1741                     ("%s:%d warn", __func__, __LINE__));
 1742                 if (offset & 0x0003) {
 1743                         bwn_shm_ctlword(mac, way, offset >> 2);
 1744                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
 1745                         goto out;
 1746                 }
 1747                 offset >>= 2;
 1748         }
 1749         bwn_shm_ctlword(mac, way, offset);
 1750         ret = BWN_READ_2(mac, BWN_SHM_DATA);
 1751 out:
 1752 
 1753         return (ret);
 1754 }
 1755 
 1756 static void
 1757 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
 1758     uint16_t offset)
 1759 {
 1760         uint32_t control;
 1761 
 1762         control = way;
 1763         control <<= 16;
 1764         control |= offset;
 1765         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
 1766 }
 1767 
 1768 void
 1769 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
 1770     uint32_t value)
 1771 {
 1772         BWN_ASSERT_LOCKED(mac->mac_sc);
 1773 
 1774         if (way == BWN_SHARED) {
 1775                 KASSERT((offset & 0x0001) == 0,
 1776                     ("%s:%d warn", __func__, __LINE__));
 1777                 if (offset & 0x0003) {
 1778                         bwn_shm_ctlword(mac, way, offset >> 2);
 1779                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
 1780                                     (value >> 16) & 0xffff);
 1781                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
 1782                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
 1783                         return;
 1784                 }
 1785                 offset >>= 2;
 1786         }
 1787         bwn_shm_ctlword(mac, way, offset);
 1788         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
 1789 }
 1790 
 1791 void
 1792 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
 1793     uint16_t value)
 1794 {
 1795         BWN_ASSERT_LOCKED(mac->mac_sc);
 1796 
 1797         if (way == BWN_SHARED) {
 1798                 KASSERT((offset & 0x0001) == 0,
 1799                     ("%s:%d warn", __func__, __LINE__));
 1800                 if (offset & 0x0003) {
 1801                         bwn_shm_ctlword(mac, way, offset >> 2);
 1802                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
 1803                         return;
 1804                 }
 1805                 offset >>= 2;
 1806         }
 1807         bwn_shm_ctlword(mac, way, offset);
 1808         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
 1809 }
 1810 
 1811 static void
 1812 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
 1813     const struct bwn_channelinfo *ci, const uint8_t bands[])
 1814 {
 1815         int i, error;
 1816 
 1817         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
 1818                 const struct bwn_channel *hc = &ci->channels[i];
 1819 
 1820                 error = ieee80211_add_channel(chans, maxchans, nchans,
 1821                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
 1822         }
 1823 }
 1824 
 1825 static int
 1826 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1827         const struct ieee80211_bpf_params *params)
 1828 {
 1829         struct ieee80211com *ic = ni->ni_ic;
 1830         struct bwn_softc *sc = ic->ic_softc;
 1831         struct bwn_mac *mac = sc->sc_curmac;
 1832         int error;
 1833 
 1834         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
 1835             mac->mac_status < BWN_MAC_STATUS_STARTED) {
 1836                 m_freem(m);
 1837                 return (ENETDOWN);
 1838         }
 1839 
 1840         BWN_LOCK(sc);
 1841         if (bwn_tx_isfull(sc, m)) {
 1842                 m_freem(m);
 1843                 BWN_UNLOCK(sc);
 1844                 return (ENOBUFS);
 1845         }
 1846 
 1847         error = bwn_tx_start(sc, ni, m);
 1848         if (error == 0)
 1849                 sc->sc_watchdog_timer = 5;
 1850         BWN_UNLOCK(sc);
 1851         return (error);
 1852 }
 1853 
 1854 /*
 1855  * Callback from the 802.11 layer to update the slot time
 1856  * based on the current setting.  We use it to notify the
 1857  * firmware of ERP changes and the f/w takes care of things
 1858  * like slot time and preamble.
 1859  */
 1860 static void
 1861 bwn_updateslot(struct ieee80211com *ic)
 1862 {
 1863         struct bwn_softc *sc = ic->ic_softc;
 1864         struct bwn_mac *mac;
 1865 
 1866         BWN_LOCK(sc);
 1867         if (sc->sc_flags & BWN_FLAG_RUNNING) {
 1868                 mac = (struct bwn_mac *)sc->sc_curmac;
 1869                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
 1870         }
 1871         BWN_UNLOCK(sc);
 1872 }
 1873 
 1874 /*
 1875  * Callback from the 802.11 layer after a promiscuous mode change.
 1876  * Note this interface does not check the operating mode as this
 1877  * is an internal callback and we are expected to honor the current
 1878  * state (e.g. this is used for setting the interface in promiscuous
 1879  * mode when operating in hostap mode to do ACS).
 1880  */
 1881 static void
 1882 bwn_update_promisc(struct ieee80211com *ic)
 1883 {
 1884         struct bwn_softc *sc = ic->ic_softc;
 1885         struct bwn_mac *mac = sc->sc_curmac;
 1886 
 1887         BWN_LOCK(sc);
 1888         mac = sc->sc_curmac;
 1889         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
 1890                 if (ic->ic_promisc > 0)
 1891                         sc->sc_filters |= BWN_MACCTL_PROMISC;
 1892                 else
 1893                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
 1894                 bwn_set_opmode(mac);
 1895         }
 1896         BWN_UNLOCK(sc);
 1897 }
 1898 
 1899 /*
 1900  * Callback from the 802.11 layer to update WME parameters.
 1901  */
 1902 static int
 1903 bwn_wme_update(struct ieee80211com *ic)
 1904 {
 1905         struct bwn_softc *sc = ic->ic_softc;
 1906         struct bwn_mac *mac = sc->sc_curmac;
 1907         struct chanAccParams chp;
 1908         struct wmeParams *wmep;
 1909         int i;
 1910 
 1911         ieee80211_wme_ic_getparams(ic, &chp);
 1912 
 1913         BWN_LOCK(sc);
 1914         mac = sc->sc_curmac;
 1915         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
 1916                 bwn_mac_suspend(mac);
 1917                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
 1918                         wmep = &chp.cap_wmeParams[i];
 1919                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
 1920                 }
 1921                 bwn_mac_enable(mac);
 1922         }
 1923         BWN_UNLOCK(sc);
 1924         return (0);
 1925 }
 1926 
 1927 static void
 1928 bwn_scan_start(struct ieee80211com *ic)
 1929 {
 1930         struct bwn_softc *sc = ic->ic_softc;
 1931         struct bwn_mac *mac;
 1932 
 1933         BWN_LOCK(sc);
 1934         mac = sc->sc_curmac;
 1935         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
 1936                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
 1937                 bwn_set_opmode(mac);
 1938                 /* disable CFP update during scan */
 1939                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
 1940         }
 1941         BWN_UNLOCK(sc);
 1942 }
 1943 
 1944 static void
 1945 bwn_scan_end(struct ieee80211com *ic)
 1946 {
 1947         struct bwn_softc *sc = ic->ic_softc;
 1948         struct bwn_mac *mac;
 1949 
 1950         BWN_LOCK(sc);
 1951         mac = sc->sc_curmac;
 1952         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
 1953                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
 1954                 bwn_set_opmode(mac);
 1955                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
 1956         }
 1957         BWN_UNLOCK(sc);
 1958 }
 1959 
 1960 static void
 1961 bwn_set_channel(struct ieee80211com *ic)
 1962 {
 1963         struct bwn_softc *sc = ic->ic_softc;
 1964         struct bwn_mac *mac = sc->sc_curmac;
 1965         struct bwn_phy *phy = &mac->mac_phy;
 1966         int chan, error;
 1967 
 1968         BWN_LOCK(sc);
 1969 
 1970         error = bwn_switch_band(sc, ic->ic_curchan);
 1971         if (error)
 1972                 goto fail;
 1973         bwn_mac_suspend(mac);
 1974         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
 1975         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
 1976         if (chan != phy->chan)
 1977                 bwn_switch_channel(mac, chan);
 1978 
 1979         /* TX power level */
 1980         if (ic->ic_curchan->ic_maxpower != 0 &&
 1981             ic->ic_curchan->ic_maxpower != phy->txpower) {
 1982                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
 1983                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
 1984                     BWN_TXPWR_IGNORE_TSSI);
 1985         }
 1986 
 1987         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
 1988         if (phy->set_antenna)
 1989                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
 1990 
 1991         if (sc->sc_rf_enabled != phy->rf_on) {
 1992                 if (sc->sc_rf_enabled) {
 1993                         bwn_rf_turnon(mac);
 1994                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
 1995                                 device_printf(sc->sc_dev,
 1996                                     "please turn on the RF switch\n");
 1997                 } else
 1998                         bwn_rf_turnoff(mac);
 1999         }
 2000 
 2001         bwn_mac_enable(mac);
 2002 
 2003 fail:
 2004         BWN_UNLOCK(sc);
 2005 }
 2006 
 2007 static struct ieee80211vap *
 2008 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 2009     enum ieee80211_opmode opmode, int flags,
 2010     const uint8_t bssid[IEEE80211_ADDR_LEN],
 2011     const uint8_t mac[IEEE80211_ADDR_LEN])
 2012 {
 2013         struct ieee80211vap *vap;
 2014         struct bwn_vap *bvp;
 2015 
 2016         switch (opmode) {
 2017         case IEEE80211_M_HOSTAP:
 2018         case IEEE80211_M_MBSS:
 2019         case IEEE80211_M_STA:
 2020         case IEEE80211_M_WDS:
 2021         case IEEE80211_M_MONITOR:
 2022         case IEEE80211_M_IBSS:
 2023         case IEEE80211_M_AHDEMO:
 2024                 break;
 2025         default:
 2026                 return (NULL);
 2027         }
 2028 
 2029         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 2030         vap = &bvp->bv_vap;
 2031         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
 2032         /* override with driver methods */
 2033         bvp->bv_newstate = vap->iv_newstate;
 2034         vap->iv_newstate = bwn_newstate;
 2035 
 2036         /* override max aid so sta's cannot assoc when we're out of sta id's */
 2037         vap->iv_max_aid = BWN_STAID_MAX;
 2038 
 2039         ieee80211_ratectl_init(vap);
 2040 
 2041         /* complete setup */
 2042         ieee80211_vap_attach(vap, ieee80211_media_change,
 2043             ieee80211_media_status, mac);
 2044         return (vap);
 2045 }
 2046 
 2047 static void
 2048 bwn_vap_delete(struct ieee80211vap *vap)
 2049 {
 2050         struct bwn_vap *bvp = BWN_VAP(vap);
 2051 
 2052         ieee80211_ratectl_deinit(vap);
 2053         ieee80211_vap_detach(vap);
 2054         free(bvp, M_80211_VAP);
 2055 }
 2056 
 2057 static int
 2058 bwn_init(struct bwn_softc *sc)
 2059 {
 2060         struct bwn_mac *mac;
 2061         int error;
 2062 
 2063         BWN_ASSERT_LOCKED(sc);
 2064 
 2065         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
 2066 
 2067         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
 2068         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
 2069         sc->sc_filters = 0;
 2070         bwn_wme_clear(sc);
 2071         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
 2072         sc->sc_rf_enabled = 1;
 2073 
 2074         mac = sc->sc_curmac;
 2075         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
 2076                 error = bwn_core_init(mac);
 2077                 if (error != 0)
 2078                         return (error);
 2079         }
 2080         if (mac->mac_status == BWN_MAC_STATUS_INITED)
 2081                 bwn_core_start(mac);
 2082 
 2083         bwn_set_opmode(mac);
 2084         bwn_set_pretbtt(mac);
 2085         bwn_spu_setdelay(mac, 0);
 2086         bwn_set_macaddr(mac);
 2087 
 2088         sc->sc_flags |= BWN_FLAG_RUNNING;
 2089         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
 2090         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
 2091 
 2092         return (0);
 2093 }
 2094 
 2095 static void
 2096 bwn_stop(struct bwn_softc *sc)
 2097 {
 2098         struct bwn_mac *mac = sc->sc_curmac;
 2099 
 2100         BWN_ASSERT_LOCKED(sc);
 2101 
 2102         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
 2103 
 2104         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
 2105                 /* XXX FIXME opmode not based on VAP */
 2106                 bwn_set_opmode(mac);
 2107                 bwn_set_macaddr(mac);
 2108         }
 2109 
 2110         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
 2111                 bwn_core_stop(mac);
 2112 
 2113         callout_stop(&sc->sc_led_blink_ch);
 2114         sc->sc_led_blinking = 0;
 2115 
 2116         bwn_core_exit(mac);
 2117         sc->sc_rf_enabled = 0;
 2118 
 2119         sc->sc_flags &= ~BWN_FLAG_RUNNING;
 2120 }
 2121 
 2122 static void
 2123 bwn_wme_clear(struct bwn_softc *sc)
 2124 {
 2125         struct wmeParams *p;
 2126         unsigned int i;
 2127 
 2128         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
 2129             ("%s:%d: fail", __func__, __LINE__));
 2130 
 2131         for (i = 0; i < N(sc->sc_wmeParams); i++) {
 2132                 p = &(sc->sc_wmeParams[i]);
 2133 
 2134                 switch (bwn_wme_shm_offsets[i]) {
 2135                 case BWN_WME_VOICE:
 2136                         p->wmep_txopLimit = 0;
 2137                         p->wmep_aifsn = 2;
 2138                         /* XXX FIXME: log2(cwmin) */
 2139                         p->wmep_logcwmin =
 2140                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
 2141                         p->wmep_logcwmax =
 2142                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMAX);
 2143                         break;
 2144                 case BWN_WME_VIDEO:
 2145                         p->wmep_txopLimit = 0;
 2146                         p->wmep_aifsn = 2;
 2147                         /* XXX FIXME: log2(cwmin) */
 2148                         p->wmep_logcwmin =
 2149                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
 2150                         p->wmep_logcwmax =
 2151                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMAX);
 2152                         break;
 2153                 case BWN_WME_BESTEFFORT:
 2154                         p->wmep_txopLimit = 0;
 2155                         p->wmep_aifsn = 3;
 2156                         /* XXX FIXME: log2(cwmin) */
 2157                         p->wmep_logcwmin =
 2158                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
 2159                         p->wmep_logcwmax =
 2160                             _IEEE80211_MASKSHIFT(0x03ff, WME_PARAM_LOGCWMAX);
 2161                         break;
 2162                 case BWN_WME_BACKGROUND:
 2163                         p->wmep_txopLimit = 0;
 2164                         p->wmep_aifsn = 7;
 2165                         /* XXX FIXME: log2(cwmin) */
 2166                         p->wmep_logcwmin =
 2167                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
 2168                         p->wmep_logcwmax =
 2169                             _IEEE80211_MASKSHIFT(0x03ff, WME_PARAM_LOGCWMAX);
 2170                         break;
 2171                 default:
 2172                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 2173                 }
 2174         }
 2175 }
 2176 
 2177 static int
 2178 bwn_core_forceclk(struct bwn_mac *mac, bool force)
 2179 {
 2180         struct bwn_softc        *sc;
 2181         bhnd_clock               clock;
 2182         int                      error;
 2183 
 2184         sc = mac->mac_sc;
 2185 
 2186         /* On PMU equipped devices, we do not need to force the HT clock */
 2187         if (sc->sc_pmu != NULL)
 2188                 return (0);
 2189 
 2190         /* Issue a PMU clock request */
 2191         if (force)
 2192                 clock = BHND_CLOCK_HT;
 2193         else
 2194                 clock = BHND_CLOCK_DYN;
 2195 
 2196         if ((error = bhnd_request_clock(sc->sc_dev, clock))) {
 2197                 device_printf(sc->sc_dev, "%d clock request failed: %d\n",
 2198                     clock, error);
 2199                 return (error);
 2200         }
 2201 
 2202         return (0);
 2203 }
 2204 
 2205 static int
 2206 bwn_core_init(struct bwn_mac *mac)
 2207 {
 2208         struct bwn_softc *sc = mac->mac_sc;
 2209         uint64_t hf;
 2210         int error;
 2211 
 2212         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
 2213             ("%s:%d: fail", __func__, __LINE__));
 2214 
 2215         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
 2216 
 2217         if ((error = bwn_core_forceclk(mac, true)))
 2218                 return (error);
 2219 
 2220         if (bhnd_is_hw_suspended(sc->sc_dev)) {
 2221                 if ((error = bwn_reset_core(mac, mac->mac_phy.gmode)))
 2222                         goto fail0;
 2223         }
 2224 
 2225         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
 2226         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
 2227         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
 2228         BWN_GETTIME(mac->mac_phy.nexttime);
 2229         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
 2230         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
 2231         mac->mac_stats.link_noise = -95;
 2232         mac->mac_reason_intr = 0;
 2233         bzero(mac->mac_reason, sizeof(mac->mac_reason));
 2234         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
 2235 #ifdef BWN_DEBUG
 2236         if (sc->sc_debug & BWN_DEBUG_XMIT)
 2237                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
 2238 #endif
 2239         mac->mac_suspended = 1;
 2240         mac->mac_task_state = 0;
 2241         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
 2242 
 2243         mac->mac_phy.init_pre(mac);
 2244 
 2245         bwn_bt_disable(mac);
 2246         if (mac->mac_phy.prepare_hw) {
 2247                 error = mac->mac_phy.prepare_hw(mac);
 2248                 if (error)
 2249                         goto fail0;
 2250         }
 2251         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
 2252         error = bwn_chip_init(mac);
 2253         if (error)
 2254                 goto fail0;
 2255         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
 2256             bhnd_get_hwrev(sc->sc_dev));
 2257         hf = bwn_hf_read(mac);
 2258         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
 2259                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
 2260                 if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL)
 2261                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
 2262                 if (mac->mac_phy.rev == 1)
 2263                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
 2264         }
 2265         if (mac->mac_phy.rf_ver == 0x2050) {
 2266                 if (mac->mac_phy.rf_rev < 6)
 2267                         hf |= BWN_HF_FORCE_VCO_RECALC;
 2268                 if (mac->mac_phy.rf_rev == 6)
 2269                         hf |= BWN_HF_4318_TSSI;
 2270         }
 2271         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
 2272                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
 2273         if (sc->sc_quirks & BWN_QUIRK_UCODE_SLOWCLOCK_WAR)
 2274                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
 2275         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
 2276         bwn_hf_write(mac, hf);
 2277 
 2278         /* Tell the firmware about the MAC capabilities */
 2279         if (bhnd_get_hwrev(sc->sc_dev) >= 13) {
 2280                 uint32_t cap;
 2281                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
 2282                 DPRINTF(sc, BWN_DEBUG_RESET,
 2283                     "%s: hw capabilities: 0x%08x\n",
 2284                     __func__, cap);
 2285                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
 2286                     cap & 0xffff);
 2287                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
 2288                     (cap >> 16) & 0xffff);
 2289         }
 2290 
 2291         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
 2292         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
 2293         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
 2294         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
 2295 
 2296         bwn_rate_init(mac);
 2297         bwn_set_phytxctl(mac);
 2298 
 2299         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
 2300             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
 2301         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
 2302 
 2303         if (sc->sc_quirks & BWN_QUIRK_NODMA)
 2304                 bwn_pio_init(mac);
 2305         else
 2306                 bwn_dma_init(mac);
 2307         bwn_wme_init(mac);
 2308         bwn_spu_setdelay(mac, 1);
 2309         bwn_bt_enable(mac);
 2310 
 2311         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
 2312         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
 2313                 bwn_core_forceclk(mac, true);
 2314         else
 2315                 bwn_core_forceclk(mac, false);
 2316 
 2317         bwn_set_macaddr(mac);
 2318         bwn_crypt_init(mac);
 2319 
 2320         /* XXX LED initializatin */
 2321 
 2322         mac->mac_status = BWN_MAC_STATUS_INITED;
 2323 
 2324         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
 2325         return (error);
 2326 
 2327 fail0:
 2328         bhnd_suspend_hw(sc->sc_dev, 0);
 2329         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
 2330             ("%s:%d: fail", __func__, __LINE__));
 2331         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
 2332         return (error);
 2333 }
 2334 
 2335 static void
 2336 bwn_core_start(struct bwn_mac *mac)
 2337 {
 2338         struct bwn_softc *sc = mac->mac_sc;
 2339         uint32_t tmp;
 2340 
 2341         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
 2342             ("%s:%d: fail", __func__, __LINE__));
 2343 
 2344         if (bhnd_get_hwrev(sc->sc_dev) < 5)
 2345                 return;
 2346 
 2347         while (1) {
 2348                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
 2349                 if (!(tmp & 0x00000001))
 2350                         break;
 2351                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
 2352         }
 2353 
 2354         bwn_mac_enable(mac);
 2355         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
 2356         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
 2357 
 2358         mac->mac_status = BWN_MAC_STATUS_STARTED;
 2359 }
 2360 
 2361 static void
 2362 bwn_core_exit(struct bwn_mac *mac)
 2363 {
 2364         struct bwn_softc *sc = mac->mac_sc;
 2365         uint32_t macctl;
 2366 
 2367         BWN_ASSERT_LOCKED(mac->mac_sc);
 2368 
 2369         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
 2370             ("%s:%d: fail", __func__, __LINE__));
 2371 
 2372         if (mac->mac_status != BWN_MAC_STATUS_INITED)
 2373                 return;
 2374         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 2375 
 2376         macctl = BWN_READ_4(mac, BWN_MACCTL);
 2377         macctl &= ~BWN_MACCTL_MCODE_RUN;
 2378         macctl |= BWN_MACCTL_MCODE_JMP0;
 2379         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
 2380 
 2381         bwn_dma_stop(mac);
 2382         bwn_pio_stop(mac);
 2383         bwn_chip_exit(mac);
 2384         mac->mac_phy.switch_analog(mac, 0);
 2385         bhnd_suspend_hw(sc->sc_dev, 0);
 2386 }
 2387 
 2388 static void
 2389 bwn_bt_disable(struct bwn_mac *mac)
 2390 {
 2391         struct bwn_softc *sc = mac->mac_sc;
 2392 
 2393         (void)sc;
 2394         /* XXX do nothing yet */
 2395 }
 2396 
 2397 static int
 2398 bwn_chip_init(struct bwn_mac *mac)
 2399 {
 2400         struct bwn_softc *sc = mac->mac_sc;
 2401         struct bwn_phy *phy = &mac->mac_phy;
 2402         uint32_t macctl;
 2403         u_int delay;
 2404         int error;
 2405 
 2406         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
 2407         if (phy->gmode)
 2408                 macctl |= BWN_MACCTL_GMODE;
 2409         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
 2410 
 2411         error = bwn_fw_fillinfo(mac);
 2412         if (error)
 2413                 return (error);
 2414         error = bwn_fw_loaducode(mac);
 2415         if (error)
 2416                 return (error);
 2417 
 2418         error = bwn_gpio_init(mac);
 2419         if (error)
 2420                 return (error);
 2421 
 2422         error = bwn_fw_loadinitvals(mac);
 2423         if (error)
 2424                 return (error);
 2425 
 2426         phy->switch_analog(mac, 1);
 2427         error = bwn_phy_init(mac);
 2428         if (error)
 2429                 return (error);
 2430 
 2431         if (phy->set_im)
 2432                 phy->set_im(mac, BWN_IMMODE_NONE);
 2433         if (phy->set_antenna)
 2434                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
 2435         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
 2436 
 2437         if (phy->type == BWN_PHYTYPE_B)
 2438                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
 2439         BWN_WRITE_4(mac, 0x0100, 0x01000000);
 2440         if (bhnd_get_hwrev(sc->sc_dev) < 5)
 2441                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
 2442 
 2443         BWN_WRITE_4(mac, BWN_MACCTL,
 2444             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
 2445         BWN_WRITE_4(mac, BWN_MACCTL,
 2446             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
 2447         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
 2448 
 2449         bwn_set_opmode(mac);
 2450         if (bhnd_get_hwrev(sc->sc_dev) < 3) {
 2451                 BWN_WRITE_2(mac, 0x060e, 0x0000);
 2452                 BWN_WRITE_2(mac, 0x0610, 0x8000);
 2453                 BWN_WRITE_2(mac, 0x0604, 0x0000);
 2454                 BWN_WRITE_2(mac, 0x0606, 0x0200);
 2455         } else {
 2456                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
 2457                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
 2458         }
 2459         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
 2460         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
 2461         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
 2462         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
 2463         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
 2464         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
 2465         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
 2466 
 2467         bwn_mac_phy_clock_set(mac, true);
 2468 
 2469         /* Provide the HT clock transition latency to the MAC core */
 2470         error = bhnd_get_clock_latency(sc->sc_dev, BHND_CLOCK_HT, &delay);
 2471         if (error) {
 2472                 device_printf(sc->sc_dev, "failed to fetch HT clock latency: "
 2473                     "%d\n", error);
 2474                 return (error);
 2475         }
 2476 
 2477         if (delay > UINT16_MAX) {
 2478                 device_printf(sc->sc_dev, "invalid HT clock latency: %u\n",
 2479                     delay);
 2480                 return (ENXIO);
 2481         }
 2482 
 2483         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, delay);
 2484         return (0);
 2485 }
 2486 
 2487 /* read hostflags */
 2488 uint64_t
 2489 bwn_hf_read(struct bwn_mac *mac)
 2490 {
 2491         uint64_t ret;
 2492 
 2493         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
 2494         ret <<= 16;
 2495         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
 2496         ret <<= 16;
 2497         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
 2498         return (ret);
 2499 }
 2500 
 2501 void
 2502 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
 2503 {
 2504 
 2505         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
 2506             (value & 0x00000000ffffull));
 2507         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
 2508             (value & 0x0000ffff0000ull) >> 16);
 2509         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
 2510             (value & 0xffff00000000ULL) >> 32);
 2511 }
 2512 
 2513 static void
 2514 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
 2515 {
 2516 
 2517         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
 2518         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
 2519 }
 2520 
 2521 static void
 2522 bwn_rate_init(struct bwn_mac *mac)
 2523 {
 2524 
 2525         switch (mac->mac_phy.type) {
 2526         case BWN_PHYTYPE_A:
 2527         case BWN_PHYTYPE_G:
 2528         case BWN_PHYTYPE_LP:
 2529         case BWN_PHYTYPE_N:
 2530                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
 2531                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
 2532                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
 2533                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
 2534                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
 2535                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
 2536                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
 2537                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
 2538                         break;
 2539                 /* FALLTHROUGH */
 2540         case BWN_PHYTYPE_B:
 2541                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
 2542                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
 2543                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
 2544                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
 2545                 break;
 2546         default:
 2547                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 2548         }
 2549 }
 2550 
 2551 static void
 2552 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
 2553 {
 2554         uint16_t offset;
 2555 
 2556         if (ofdm) {
 2557                 offset = 0x480;
 2558                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
 2559         } else {
 2560                 offset = 0x4c0;
 2561                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
 2562         }
 2563         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
 2564             bwn_shm_read_2(mac, BWN_SHARED, offset));
 2565 }
 2566 
 2567 static uint8_t
 2568 bwn_plcp_getcck(const uint8_t bitrate)
 2569 {
 2570 
 2571         switch (bitrate) {
 2572         case BWN_CCK_RATE_1MB:
 2573                 return (0x0a);
 2574         case BWN_CCK_RATE_2MB:
 2575                 return (0x14);
 2576         case BWN_CCK_RATE_5MB:
 2577                 return (0x37);
 2578         case BWN_CCK_RATE_11MB:
 2579                 return (0x6e);
 2580         }
 2581         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 2582         return (0);
 2583 }
 2584 
 2585 static uint8_t
 2586 bwn_plcp_getofdm(const uint8_t bitrate)
 2587 {
 2588 
 2589         switch (bitrate) {
 2590         case BWN_OFDM_RATE_6MB:
 2591                 return (0xb);
 2592         case BWN_OFDM_RATE_9MB:
 2593                 return (0xf);
 2594         case BWN_OFDM_RATE_12MB:
 2595                 return (0xa);
 2596         case BWN_OFDM_RATE_18MB:
 2597                 return (0xe);
 2598         case BWN_OFDM_RATE_24MB:
 2599                 return (0x9);
 2600         case BWN_OFDM_RATE_36MB:
 2601                 return (0xd);
 2602         case BWN_OFDM_RATE_48MB:
 2603                 return (0x8);
 2604         case BWN_OFDM_RATE_54MB:
 2605                 return (0xc);
 2606         }
 2607         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 2608         return (0);
 2609 }
 2610 
 2611 static void
 2612 bwn_set_phytxctl(struct bwn_mac *mac)
 2613 {
 2614         uint16_t ctl;
 2615 
 2616         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
 2617             BWN_TX_PHY_TXPWR);
 2618         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
 2619         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
 2620         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
 2621 }
 2622 
 2623 static void
 2624 bwn_pio_init(struct bwn_mac *mac)
 2625 {
 2626         struct bwn_pio *pio = &mac->mac_method.pio;
 2627 
 2628         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
 2629             & ~BWN_MACCTL_BIGENDIAN);
 2630         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
 2631 
 2632         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
 2633         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
 2634         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
 2635         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
 2636         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
 2637         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
 2638 }
 2639 
 2640 static void
 2641 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
 2642     int index)
 2643 {
 2644         struct bwn_pio_txpkt *tp;
 2645         struct bwn_softc *sc = mac->mac_sc;
 2646         unsigned int i;
 2647 
 2648         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
 2649         tq->tq_index = index;
 2650 
 2651         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
 2652         if (bhnd_get_hwrev(sc->sc_dev) >= 8)
 2653                 tq->tq_size = 1920;
 2654         else {
 2655                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
 2656                 tq->tq_size -= 80;
 2657         }
 2658 
 2659         TAILQ_INIT(&tq->tq_pktlist);
 2660         for (i = 0; i < N(tq->tq_pkts); i++) {
 2661                 tp = &(tq->tq_pkts[i]);
 2662                 tp->tp_index = i;
 2663                 tp->tp_queue = tq;
 2664                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
 2665         }
 2666 }
 2667 
 2668 static uint16_t
 2669 bwn_pio_idx2base(struct bwn_mac *mac, int index)
 2670 {
 2671         struct bwn_softc *sc = mac->mac_sc;
 2672         static const uint16_t bases[] = {
 2673                 BWN_PIO_BASE0,
 2674                 BWN_PIO_BASE1,
 2675                 BWN_PIO_BASE2,
 2676                 BWN_PIO_BASE3,
 2677                 BWN_PIO_BASE4,
 2678                 BWN_PIO_BASE5,
 2679                 BWN_PIO_BASE6,
 2680                 BWN_PIO_BASE7,
 2681         };
 2682         static const uint16_t bases_rev11[] = {
 2683                 BWN_PIO11_BASE0,
 2684                 BWN_PIO11_BASE1,
 2685                 BWN_PIO11_BASE2,
 2686                 BWN_PIO11_BASE3,
 2687                 BWN_PIO11_BASE4,
 2688                 BWN_PIO11_BASE5,
 2689         };
 2690 
 2691         if (bhnd_get_hwrev(sc->sc_dev) >= 11) {
 2692                 if (index >= N(bases_rev11))
 2693                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
 2694                 return (bases_rev11[index]);
 2695         }
 2696         if (index >= N(bases))
 2697                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
 2698         return (bases[index]);
 2699 }
 2700 
 2701 static void
 2702 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
 2703     int index)
 2704 {
 2705         struct bwn_softc *sc = mac->mac_sc;
 2706 
 2707         prq->prq_mac = mac;
 2708         prq->prq_rev = bhnd_get_hwrev(sc->sc_dev);
 2709         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
 2710         bwn_dma_rxdirectfifo(mac, index, 1);
 2711 }
 2712 
 2713 static void
 2714 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
 2715 {
 2716         if (tq == NULL)
 2717                 return;
 2718         bwn_pio_cancel_tx_packets(tq);
 2719 }
 2720 
 2721 static void
 2722 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
 2723 {
 2724 
 2725         bwn_destroy_pioqueue_tx(pio);
 2726 }
 2727 
 2728 static uint16_t
 2729 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
 2730     uint16_t offset)
 2731 {
 2732 
 2733         return (BWN_READ_2(mac, tq->tq_base + offset));
 2734 }
 2735 
 2736 static void
 2737 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
 2738 {
 2739         uint32_t ctl;
 2740         uint16_t base;
 2741 
 2742         base = bwn_dma_base(mac->mac_dmatype, idx);
 2743         if (mac->mac_dmatype == BHND_DMA_ADDR_64BIT) {
 2744                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
 2745                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
 2746                 if (enable)
 2747                         ctl |= BWN_DMA64_RXDIRECTFIFO;
 2748                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
 2749         } else {
 2750                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
 2751                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
 2752                 if (enable)
 2753                         ctl |= BWN_DMA32_RXDIRECTFIFO;
 2754                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
 2755         }
 2756 }
 2757 
 2758 static void
 2759 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
 2760 {
 2761         struct bwn_pio_txpkt *tp;
 2762         unsigned int i;
 2763 
 2764         for (i = 0; i < N(tq->tq_pkts); i++) {
 2765                 tp = &(tq->tq_pkts[i]);
 2766                 if (tp->tp_m) {
 2767                         m_freem(tp->tp_m);
 2768                         tp->tp_m = NULL;
 2769                 }
 2770         }
 2771 }
 2772 
 2773 static uint16_t
 2774 bwn_dma_base(int type, int controller_idx)
 2775 {
 2776         static const uint16_t map64[] = {
 2777                 BWN_DMA64_BASE0,
 2778                 BWN_DMA64_BASE1,
 2779                 BWN_DMA64_BASE2,
 2780                 BWN_DMA64_BASE3,
 2781                 BWN_DMA64_BASE4,
 2782                 BWN_DMA64_BASE5,
 2783         };
 2784         static const uint16_t map32[] = {
 2785                 BWN_DMA32_BASE0,
 2786                 BWN_DMA32_BASE1,
 2787                 BWN_DMA32_BASE2,
 2788                 BWN_DMA32_BASE3,
 2789                 BWN_DMA32_BASE4,
 2790                 BWN_DMA32_BASE5,
 2791         };
 2792 
 2793         if (type == BHND_DMA_ADDR_64BIT) {
 2794                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
 2795                     ("%s:%d: fail", __func__, __LINE__));
 2796                 return (map64[controller_idx]);
 2797         }
 2798         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
 2799             ("%s:%d: fail", __func__, __LINE__));
 2800         return (map32[controller_idx]);
 2801 }
 2802 
 2803 static void
 2804 bwn_dma_init(struct bwn_mac *mac)
 2805 {
 2806         struct bwn_dma *dma = &mac->mac_method.dma;
 2807 
 2808         /* setup TX DMA channels. */
 2809         bwn_dma_setup(dma->wme[WME_AC_BK]);
 2810         bwn_dma_setup(dma->wme[WME_AC_BE]);
 2811         bwn_dma_setup(dma->wme[WME_AC_VI]);
 2812         bwn_dma_setup(dma->wme[WME_AC_VO]);
 2813         bwn_dma_setup(dma->mcast);
 2814         /* setup RX DMA channel. */
 2815         bwn_dma_setup(dma->rx);
 2816 }
 2817 
 2818 static struct bwn_dma_ring *
 2819 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
 2820     int for_tx)
 2821 {
 2822         struct bwn_dma *dma = &mac->mac_method.dma;
 2823         struct bwn_dma_ring *dr;
 2824         struct bwn_dmadesc_generic *desc;
 2825         struct bwn_dmadesc_meta *mt;
 2826         struct bwn_softc *sc = mac->mac_sc;
 2827         int error, i;
 2828 
 2829         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
 2830         if (dr == NULL)
 2831                 goto out;
 2832         dr->dr_numslots = BWN_RXRING_SLOTS;
 2833         if (for_tx)
 2834                 dr->dr_numslots = BWN_TXRING_SLOTS;
 2835 
 2836         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
 2837             M_DEVBUF, M_NOWAIT | M_ZERO);
 2838         if (dr->dr_meta == NULL)
 2839                 goto fail0;
 2840 
 2841         dr->dr_type = mac->mac_dmatype;
 2842         dr->dr_mac = mac;
 2843         dr->dr_base = bwn_dma_base(dr->dr_type, controller_index);
 2844         dr->dr_index = controller_index;
 2845         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
 2846                 dr->getdesc = bwn_dma_64_getdesc;
 2847                 dr->setdesc = bwn_dma_64_setdesc;
 2848                 dr->start_transfer = bwn_dma_64_start_transfer;
 2849                 dr->suspend = bwn_dma_64_suspend;
 2850                 dr->resume = bwn_dma_64_resume;
 2851                 dr->get_curslot = bwn_dma_64_get_curslot;
 2852                 dr->set_curslot = bwn_dma_64_set_curslot;
 2853         } else {
 2854                 dr->getdesc = bwn_dma_32_getdesc;
 2855                 dr->setdesc = bwn_dma_32_setdesc;
 2856                 dr->start_transfer = bwn_dma_32_start_transfer;
 2857                 dr->suspend = bwn_dma_32_suspend;
 2858                 dr->resume = bwn_dma_32_resume;
 2859                 dr->get_curslot = bwn_dma_32_get_curslot;
 2860                 dr->set_curslot = bwn_dma_32_set_curslot;
 2861         }
 2862         if (for_tx) {
 2863                 dr->dr_tx = 1;
 2864                 dr->dr_curslot = -1;
 2865         } else {
 2866                 if (dr->dr_index == 0) {
 2867                         switch (mac->mac_fw.fw_hdr_format) {
 2868                         case BWN_FW_HDR_351:
 2869                         case BWN_FW_HDR_410:
 2870                                 dr->dr_rx_bufsize =
 2871                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
 2872                                 dr->dr_frameoffset =
 2873                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
 2874                                 break;
 2875                         case BWN_FW_HDR_598:
 2876                                 dr->dr_rx_bufsize =
 2877                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
 2878                                 dr->dr_frameoffset =
 2879                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
 2880                                 break;
 2881                         }
 2882                 } else
 2883                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 2884         }
 2885 
 2886         error = bwn_dma_allocringmemory(dr);
 2887         if (error)
 2888                 goto fail2;
 2889 
 2890         if (for_tx) {
 2891                 /*
 2892                  * Assumption: BWN_TXRING_SLOTS can be divided by
 2893                  * BWN_TX_SLOTS_PER_FRAME
 2894                  */
 2895                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
 2896                     ("%s:%d: fail", __func__, __LINE__));
 2897 
 2898                 dr->dr_txhdr_cache = contigmalloc(
 2899                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
 2900                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
 2901                     0, BUS_SPACE_MAXADDR, 8, 0);
 2902                 if (dr->dr_txhdr_cache == NULL) {
 2903                         device_printf(sc->sc_dev,
 2904                             "can't allocate TX header DMA memory\n");
 2905                         goto fail1;
 2906                 }
 2907 
 2908                 /*
 2909                  * Create TX ring DMA stuffs
 2910                  */
 2911                 error = bus_dma_tag_create(dma->parent_dtag,
 2912                                     BWN_ALIGN, 0,
 2913                                     BUS_SPACE_MAXADDR,
 2914                                     BUS_SPACE_MAXADDR,
 2915                                     NULL, NULL,
 2916                                     BWN_HDRSIZE(mac),
 2917                                     1,
 2918                                     BUS_SPACE_MAXSIZE_32BIT,
 2919                                     0,
 2920                                     NULL, NULL,
 2921                                     &dr->dr_txring_dtag);
 2922                 if (error) {
 2923                         device_printf(sc->sc_dev,
 2924                             "can't create TX ring DMA tag: TODO frees\n");
 2925                         goto fail2;
 2926                 }
 2927 
 2928                 for (i = 0; i < dr->dr_numslots; i += 2) {
 2929                         dr->getdesc(dr, i, &desc, &mt);
 2930 
 2931                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
 2932                         mt->mt_m = NULL;
 2933                         mt->mt_ni = NULL;
 2934                         mt->mt_islast = 0;
 2935                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
 2936                             &mt->mt_dmap);
 2937                         if (error) {
 2938                                 device_printf(sc->sc_dev,
 2939                                      "can't create RX buf DMA map\n");
 2940                                 goto fail2;
 2941                         }
 2942 
 2943                         dr->getdesc(dr, i + 1, &desc, &mt);
 2944 
 2945                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
 2946                         mt->mt_m = NULL;
 2947                         mt->mt_ni = NULL;
 2948                         mt->mt_islast = 1;
 2949                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
 2950                             &mt->mt_dmap);
 2951                         if (error) {
 2952                                 device_printf(sc->sc_dev,
 2953                                      "can't create RX buf DMA map\n");
 2954                                 goto fail2;
 2955                         }
 2956                 }
 2957         } else {
 2958                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
 2959                     &dr->dr_spare_dmap);
 2960                 if (error) {
 2961                         device_printf(sc->sc_dev,
 2962                             "can't create RX buf DMA map\n");
 2963                         goto out;               /* XXX wrong! */
 2964                 }
 2965 
 2966                 for (i = 0; i < dr->dr_numslots; i++) {
 2967                         dr->getdesc(dr, i, &desc, &mt);
 2968 
 2969                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
 2970                             &mt->mt_dmap);
 2971                         if (error) {
 2972                                 device_printf(sc->sc_dev,
 2973                                     "can't create RX buf DMA map\n");
 2974                                 goto out;       /* XXX wrong! */
 2975                         }
 2976                         error = bwn_dma_newbuf(dr, desc, mt, 1);
 2977                         if (error) {
 2978                                 device_printf(sc->sc_dev,
 2979                                     "failed to allocate RX buf\n");
 2980                                 goto out;       /* XXX wrong! */
 2981                         }
 2982                 }
 2983 
 2984                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
 2985                     BUS_DMASYNC_PREWRITE);
 2986 
 2987                 dr->dr_usedslot = dr->dr_numslots;
 2988         }
 2989 
 2990       out:
 2991         return (dr);
 2992 
 2993 fail2:
 2994         if (dr->dr_txhdr_cache != NULL) {
 2995                 contigfree(dr->dr_txhdr_cache,
 2996                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
 2997                     BWN_MAXTXHDRSIZE, M_DEVBUF);
 2998         }
 2999 fail1:
 3000         free(dr->dr_meta, M_DEVBUF);
 3001 fail0:
 3002         free(dr, M_DEVBUF);
 3003         return (NULL);
 3004 }
 3005 
 3006 static void
 3007 bwn_dma_ringfree(struct bwn_dma_ring **dr)
 3008 {
 3009 
 3010         if (dr == NULL)
 3011                 return;
 3012 
 3013         bwn_dma_free_descbufs(*dr);
 3014         bwn_dma_free_ringmemory(*dr);
 3015 
 3016         if ((*dr)->dr_txhdr_cache != NULL) {
 3017                 contigfree((*dr)->dr_txhdr_cache,
 3018                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
 3019                     BWN_MAXTXHDRSIZE, M_DEVBUF);
 3020         }
 3021         free((*dr)->dr_meta, M_DEVBUF);
 3022         free(*dr, M_DEVBUF);
 3023 
 3024         *dr = NULL;
 3025 }
 3026 
 3027 static void
 3028 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
 3029     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
 3030 {
 3031         struct bwn_dmadesc32 *desc;
 3032 
 3033         *meta = &(dr->dr_meta[slot]);
 3034         desc = dr->dr_ring_descbase;
 3035         desc = &(desc[slot]);
 3036 
 3037         *gdesc = (struct bwn_dmadesc_generic *)desc;
 3038 }
 3039 
 3040 static void
 3041 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
 3042     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
 3043     int start, int end, int irq)
 3044 {
 3045         struct bwn_dmadesc32            *descbase;
 3046         struct bwn_dma                  *dma;
 3047         struct bhnd_dma_translation     *dt;
 3048         uint32_t                         addr, addrext, ctl;
 3049         int                              slot;
 3050 
 3051         descbase = dr->dr_ring_descbase;
 3052         dma = &dr->dr_mac->mac_method.dma;
 3053         dt = &dma->translation;
 3054 
 3055         slot = (int)(&(desc->dma.dma32) - descbase);
 3056         KASSERT(slot >= 0 && slot < dr->dr_numslots,
 3057             ("%s:%d: fail", __func__, __LINE__));
 3058 
 3059         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
 3060         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
 3061         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
 3062         if (slot == dr->dr_numslots - 1)
 3063                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
 3064         if (start)
 3065                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
 3066         if (end)
 3067                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
 3068         if (irq)
 3069                 ctl |= BWN_DMA32_DCTL_IRQ;
 3070         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
 3071             & BWN_DMA32_DCTL_ADDREXT_MASK;
 3072 
 3073         desc->dma.dma32.control = htole32(ctl);
 3074         desc->dma.dma32.address = htole32(addr);
 3075 }
 3076 
 3077 static void
 3078 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
 3079 {
 3080 
 3081         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
 3082             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
 3083 }
 3084 
 3085 static void
 3086 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
 3087 {
 3088 
 3089         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
 3090             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
 3091 }
 3092 
 3093 static void
 3094 bwn_dma_32_resume(struct bwn_dma_ring *dr)
 3095 {
 3096 
 3097         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
 3098             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
 3099 }
 3100 
 3101 static int
 3102 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
 3103 {
 3104         uint32_t val;
 3105 
 3106         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
 3107         val &= BWN_DMA32_RXDPTR;
 3108 
 3109         return (val / sizeof(struct bwn_dmadesc32));
 3110 }
 3111 
 3112 static void
 3113 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
 3114 {
 3115 
 3116         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
 3117             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
 3118 }
 3119 
 3120 static void
 3121 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
 3122     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
 3123 {
 3124         struct bwn_dmadesc64 *desc;
 3125 
 3126         *meta = &(dr->dr_meta[slot]);
 3127         desc = dr->dr_ring_descbase;
 3128         desc = &(desc[slot]);
 3129 
 3130         *gdesc = (struct bwn_dmadesc_generic *)desc;
 3131 }
 3132 
 3133 static void
 3134 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
 3135     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
 3136     int start, int end, int irq)
 3137 {
 3138         struct bwn_dmadesc64            *descbase;
 3139         struct bwn_dma                  *dma;
 3140         struct bhnd_dma_translation     *dt;
 3141         bhnd_addr_t                      addr;
 3142         uint32_t                         addrhi, addrlo;
 3143         uint32_t                         addrext;
 3144         uint32_t                         ctl0, ctl1;
 3145         int                              slot;
 3146 
 3147         descbase = dr->dr_ring_descbase;
 3148         dma = &dr->dr_mac->mac_method.dma;
 3149         dt = &dma->translation;
 3150 
 3151         slot = (int)(&(desc->dma.dma64) - descbase);
 3152         KASSERT(slot >= 0 && slot < dr->dr_numslots,
 3153             ("%s:%d: fail", __func__, __LINE__));
 3154 
 3155         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
 3156         addrhi = (addr >> 32);
 3157         addrlo = (addr & UINT32_MAX);
 3158         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
 3159 
 3160         ctl0 = 0;
 3161         if (slot == dr->dr_numslots - 1)
 3162                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
 3163         if (start)
 3164                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
 3165         if (end)
 3166                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
 3167         if (irq)
 3168                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
 3169 
 3170         ctl1 = 0;
 3171         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
 3172         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
 3173             & BWN_DMA64_DCTL1_ADDREXT_MASK;
 3174 
 3175         desc->dma.dma64.control0 = htole32(ctl0);
 3176         desc->dma.dma64.control1 = htole32(ctl1);
 3177         desc->dma.dma64.address_low = htole32(addrlo);
 3178         desc->dma.dma64.address_high = htole32(addrhi);
 3179 }
 3180 
 3181 static void
 3182 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
 3183 {
 3184 
 3185         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
 3186             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
 3187 }
 3188 
 3189 static void
 3190 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
 3191 {
 3192 
 3193         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
 3194             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
 3195 }
 3196 
 3197 static void
 3198 bwn_dma_64_resume(struct bwn_dma_ring *dr)
 3199 {
 3200 
 3201         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
 3202             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
 3203 }
 3204 
 3205 static int
 3206 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
 3207 {
 3208         uint32_t val;
 3209 
 3210         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
 3211         val &= BWN_DMA64_RXSTATDPTR;
 3212 
 3213         return (val / sizeof(struct bwn_dmadesc64));
 3214 }
 3215 
 3216 static void
 3217 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
 3218 {
 3219 
 3220         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
 3221             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
 3222 }
 3223 
 3224 static int
 3225 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
 3226 {
 3227         struct bwn_mac *mac = dr->dr_mac;
 3228         struct bwn_dma *dma = &mac->mac_method.dma;
 3229         struct bwn_softc *sc = mac->mac_sc;
 3230         int error;
 3231 
 3232         error = bus_dma_tag_create(dma->parent_dtag,
 3233                             BWN_ALIGN, 0,
 3234                             BUS_SPACE_MAXADDR,
 3235                             BUS_SPACE_MAXADDR,
 3236                             NULL, NULL,
 3237                             BWN_DMA_RINGMEMSIZE,
 3238                             1,
 3239                             BUS_SPACE_MAXSIZE_32BIT,
 3240                             0,
 3241                             NULL, NULL,
 3242                             &dr->dr_ring_dtag);
 3243         if (error) {
 3244                 device_printf(sc->sc_dev,
 3245                     "can't create TX ring DMA tag: TODO frees\n");
 3246                 return (-1);
 3247         }
 3248 
 3249         error = bus_dmamem_alloc(dr->dr_ring_dtag,
 3250             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
 3251             &dr->dr_ring_dmap);
 3252         if (error) {
 3253                 device_printf(sc->sc_dev,
 3254                     "can't allocate DMA mem: TODO frees\n");
 3255                 return (-1);
 3256         }
 3257         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
 3258             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
 3259             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
 3260         if (error) {
 3261                 device_printf(sc->sc_dev,
 3262                     "can't load DMA mem: TODO free\n");
 3263                 return (-1);
 3264         }
 3265 
 3266         return (0);
 3267 }
 3268 
 3269 static void
 3270 bwn_dma_setup(struct bwn_dma_ring *dr)
 3271 {
 3272         struct bwn_mac                  *mac;
 3273         struct bwn_dma                  *dma;
 3274         struct bhnd_dma_translation     *dt;
 3275         bhnd_addr_t                      addr, paddr;
 3276         uint32_t                         addrhi, addrlo, addrext, value;
 3277 
 3278         mac = dr->dr_mac;
 3279         dma = &mac->mac_method.dma;
 3280         dt = &dma->translation;
 3281 
 3282         paddr = dr->dr_ring_dmabase;
 3283         addr = (paddr & dt->addr_mask) | dt->base_addr;
 3284         addrhi = (addr >> 32);
 3285         addrlo = (addr & UINT32_MAX);
 3286         addrext = ((paddr & dt->addrext_mask) >> dma->addrext_shift);
 3287 
 3288         if (dr->dr_tx) {
 3289                 dr->dr_curslot = -1;
 3290 
 3291                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
 3292                         value = BWN_DMA64_TXENABLE;
 3293                         value |= BWN_DMA64_TXPARITY_DISABLE;
 3294                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
 3295                             & BWN_DMA64_TXADDREXT_MASK;
 3296                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
 3297                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, addrlo);
 3298                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, addrhi);
 3299                 } else {
 3300                         value = BWN_DMA32_TXENABLE;
 3301                         value |= BWN_DMA32_TXPARITY_DISABLE;
 3302                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
 3303                             & BWN_DMA32_TXADDREXT_MASK;
 3304                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
 3305                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, addrlo);
 3306                 }
 3307                 return;
 3308         }
 3309 
 3310         /*
 3311          * set for RX
 3312          */
 3313         dr->dr_usedslot = dr->dr_numslots;
 3314 
 3315         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
 3316                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
 3317                 value |= BWN_DMA64_RXENABLE;
 3318                 value |= BWN_DMA64_RXPARITY_DISABLE;
 3319                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
 3320                     & BWN_DMA64_RXADDREXT_MASK;
 3321                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
 3322                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, addrlo);
 3323                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, addrhi);
 3324                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
 3325                     sizeof(struct bwn_dmadesc64));
 3326         } else {
 3327                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
 3328                 value |= BWN_DMA32_RXENABLE;
 3329                 value |= BWN_DMA32_RXPARITY_DISABLE;
 3330                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
 3331                     & BWN_DMA32_RXADDREXT_MASK;
 3332                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
 3333                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, addrlo);
 3334                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
 3335                     sizeof(struct bwn_dmadesc32));
 3336         }
 3337 }
 3338 
 3339 static void
 3340 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
 3341 {
 3342 
 3343         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
 3344         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
 3345             dr->dr_ring_dmap);
 3346 }
 3347 
 3348 static void
 3349 bwn_dma_cleanup(struct bwn_dma_ring *dr)
 3350 {
 3351 
 3352         if (dr->dr_tx) {
 3353                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
 3354                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
 3355                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
 3356                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
 3357                 } else
 3358                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
 3359         } else {
 3360                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
 3361                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
 3362                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
 3363                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
 3364                 } else
 3365                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
 3366         }
 3367 }
 3368 
 3369 static void
 3370 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
 3371 {
 3372         struct bwn_dmadesc_generic *desc;
 3373         struct bwn_dmadesc_meta *meta;
 3374         struct bwn_mac *mac = dr->dr_mac;
 3375         struct bwn_dma *dma = &mac->mac_method.dma;
 3376         struct bwn_softc *sc = mac->mac_sc;
 3377         int i;
 3378 
 3379         if (!dr->dr_usedslot)
 3380                 return;
 3381         for (i = 0; i < dr->dr_numslots; i++) {
 3382                 dr->getdesc(dr, i, &desc, &meta);
 3383 
 3384                 if (meta->mt_m == NULL) {
 3385                         if (!dr->dr_tx)
 3386                                 device_printf(sc->sc_dev, "%s: not TX?\n",
 3387                                     __func__);
 3388                         continue;
 3389                 }
 3390                 if (dr->dr_tx) {
 3391                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
 3392                                 bus_dmamap_unload(dr->dr_txring_dtag,
 3393                                     meta->mt_dmap);
 3394                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
 3395                                 bus_dmamap_unload(dma->txbuf_dtag,
 3396                                     meta->mt_dmap);
 3397                 } else
 3398                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
 3399                 bwn_dma_free_descbuf(dr, meta);
 3400         }
 3401 }
 3402 
 3403 static int
 3404 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
 3405     int type)
 3406 {
 3407         struct bwn_softc *sc = mac->mac_sc;
 3408         uint32_t value;
 3409         int i;
 3410         uint16_t offset;
 3411 
 3412         for (i = 0; i < 10; i++) {
 3413                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
 3414                     BWN_DMA32_TXSTATUS;
 3415                 value = BWN_READ_4(mac, base + offset);
 3416                 if (type == BHND_DMA_ADDR_64BIT) {
 3417                         value &= BWN_DMA64_TXSTAT;
 3418                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
 3419                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
 3420                             value == BWN_DMA64_TXSTAT_STOPPED)
 3421                                 break;
 3422                 } else {
 3423                         value &= BWN_DMA32_TXSTATE;
 3424                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
 3425                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
 3426                             value == BWN_DMA32_TXSTAT_STOPPED)
 3427                                 break;
 3428                 }
 3429                 DELAY(1000);
 3430         }
 3431         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXCTL :
 3432             BWN_DMA32_TXCTL;
 3433         BWN_WRITE_4(mac, base + offset, 0);
 3434         for (i = 0; i < 10; i++) {
 3435                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
 3436                     BWN_DMA32_TXSTATUS;
 3437                 value = BWN_READ_4(mac, base + offset);
 3438                 if (type == BHND_DMA_ADDR_64BIT) {
 3439                         value &= BWN_DMA64_TXSTAT;
 3440                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
 3441                                 i = -1;
 3442                                 break;
 3443                         }
 3444                 } else {
 3445                         value &= BWN_DMA32_TXSTATE;
 3446                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
 3447                                 i = -1;
 3448                                 break;
 3449                         }
 3450                 }
 3451                 DELAY(1000);
 3452         }
 3453         if (i != -1) {
 3454                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
 3455                 return (ENODEV);
 3456         }
 3457         DELAY(1000);
 3458 
 3459         return (0);
 3460 }
 3461 
 3462 static int
 3463 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
 3464     int type)
 3465 {
 3466         struct bwn_softc *sc = mac->mac_sc;
 3467         uint32_t value;
 3468         int i;
 3469         uint16_t offset;
 3470 
 3471         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXCTL :
 3472             BWN_DMA32_RXCTL;
 3473         BWN_WRITE_4(mac, base + offset, 0);
 3474         for (i = 0; i < 10; i++) {
 3475                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXSTATUS :
 3476                     BWN_DMA32_RXSTATUS;
 3477                 value = BWN_READ_4(mac, base + offset);
 3478                 if (type == BHND_DMA_ADDR_64BIT) {
 3479                         value &= BWN_DMA64_RXSTAT;
 3480                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
 3481                                 i = -1;
 3482                                 break;
 3483                         }
 3484                 } else {
 3485                         value &= BWN_DMA32_RXSTATE;
 3486                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
 3487                                 i = -1;
 3488                                 break;
 3489                         }
 3490                 }
 3491                 DELAY(1000);
 3492         }
 3493         if (i != -1) {
 3494                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
 3495                 return (ENODEV);
 3496         }
 3497 
 3498         return (0);
 3499 }
 3500 
 3501 static void
 3502 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
 3503     struct bwn_dmadesc_meta *meta)
 3504 {
 3505 
 3506         if (meta->mt_m != NULL) {
 3507                 m_freem(meta->mt_m);
 3508                 meta->mt_m = NULL;
 3509         }
 3510         if (meta->mt_ni != NULL) {
 3511                 ieee80211_free_node(meta->mt_ni);
 3512                 meta->mt_ni = NULL;
 3513         }
 3514 }
 3515 
 3516 static void
 3517 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
 3518 {
 3519         struct bwn_rxhdr4 *rxhdr;
 3520         unsigned char *frame;
 3521 
 3522         rxhdr = mtod(m, struct bwn_rxhdr4 *);
 3523         rxhdr->frame_len = 0;
 3524 
 3525         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
 3526             sizeof(struct bwn_plcp6) + 2,
 3527             ("%s:%d: fail", __func__, __LINE__));
 3528         frame = mtod(m, char *) + dr->dr_frameoffset;
 3529         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
 3530 }
 3531 
 3532 static uint8_t
 3533 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
 3534 {
 3535         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
 3536 
 3537         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
 3538             == 0xff);
 3539 }
 3540 
 3541 static void
 3542 bwn_wme_init(struct bwn_mac *mac)
 3543 {
 3544 
 3545         bwn_wme_load(mac);
 3546 
 3547         /* enable WME support. */
 3548         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
 3549         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
 3550             BWN_IFSCTL_USE_EDCF);
 3551 }
 3552 
 3553 static void
 3554 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
 3555 {
 3556         struct bwn_softc *sc = mac->mac_sc;
 3557         struct ieee80211com *ic = &sc->sc_ic;
 3558         uint16_t delay; /* microsec */
 3559 
 3560         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
 3561         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
 3562                 delay = 500;
 3563         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
 3564                 delay = max(delay, (uint16_t)2400);
 3565 
 3566         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
 3567 }
 3568 
 3569 static void
 3570 bwn_bt_enable(struct bwn_mac *mac)
 3571 {
 3572         struct bwn_softc *sc = mac->mac_sc;
 3573         uint64_t hf;
 3574 
 3575         if (bwn_bluetooth == 0)
 3576                 return;
 3577         if ((sc->sc_board_info.board_flags & BHND_BFL_BTCOEX) == 0)
 3578                 return;
 3579         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
 3580                 return;
 3581 
 3582         hf = bwn_hf_read(mac);
 3583         if (sc->sc_board_info.board_flags & BHND_BFL_BTC2WIRE_ALTGPIO)
 3584                 hf |= BWN_HF_BT_COEXISTALT;
 3585         else
 3586                 hf |= BWN_HF_BT_COEXIST;
 3587         bwn_hf_write(mac, hf);
 3588 }
 3589 
 3590 static void
 3591 bwn_set_macaddr(struct bwn_mac *mac)
 3592 {
 3593 
 3594         bwn_mac_write_bssid(mac);
 3595         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
 3596             mac->mac_sc->sc_ic.ic_macaddr);
 3597 }
 3598 
 3599 static void
 3600 bwn_clear_keys(struct bwn_mac *mac)
 3601 {
 3602         int i;
 3603 
 3604         for (i = 0; i < mac->mac_max_nr_keys; i++) {
 3605                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
 3606                     ("%s:%d: fail", __func__, __LINE__));
 3607 
 3608                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
 3609                     NULL, BWN_SEC_KEYSIZE, NULL);
 3610                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
 3611                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
 3612                             NULL, BWN_SEC_KEYSIZE, NULL);
 3613                 }
 3614                 mac->mac_key[i].keyconf = NULL;
 3615         }
 3616 }
 3617 
 3618 static void
 3619 bwn_crypt_init(struct bwn_mac *mac)
 3620 {
 3621         struct bwn_softc *sc = mac->mac_sc;
 3622 
 3623         mac->mac_max_nr_keys = (bhnd_get_hwrev(sc->sc_dev) >= 5) ? 58 : 20;
 3624         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
 3625             ("%s:%d: fail", __func__, __LINE__));
 3626         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
 3627         mac->mac_ktp *= 2;
 3628         if (bhnd_get_hwrev(sc->sc_dev) >= 5)
 3629                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
 3630         bwn_clear_keys(mac);
 3631 }
 3632 
 3633 static void
 3634 bwn_chip_exit(struct bwn_mac *mac)
 3635 {
 3636         bwn_phy_exit(mac);
 3637 }
 3638 
 3639 static int
 3640 bwn_fw_fillinfo(struct bwn_mac *mac)
 3641 {
 3642         int error;
 3643 
 3644         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
 3645         if (error == 0)
 3646                 return (0);
 3647         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
 3648         if (error == 0)
 3649                 return (0);
 3650         return (error);
 3651 }
 3652 
 3653 /**
 3654  * Request that the GPIO controller tristate all pins set in @p mask, granting
 3655  * the MAC core control over the pins.
 3656  * 
 3657  * @param mac   bwn MAC state.
 3658  * @param pins  If the bit position for a pin number is set to one, tristate the
 3659  *              pin.
 3660  */
 3661 int
 3662 bwn_gpio_control(struct bwn_mac *mac, uint32_t pins)
 3663 {
 3664         struct bwn_softc        *sc;
 3665         uint32_t                 flags[32];
 3666         int                      error;
 3667 
 3668         sc = mac->mac_sc;
 3669 
 3670         /* Determine desired pin flags */
 3671         for (size_t pin = 0; pin < nitems(flags); pin++) {
 3672                 uint32_t pinbit = (1 << pin);
 3673 
 3674                 if (pins & pinbit) {
 3675                         /* Tristate output */
 3676                         flags[pin] = GPIO_PIN_OUTPUT|GPIO_PIN_TRISTATE;
 3677                 } else {
 3678                         /* Leave unmodified */
 3679                         flags[pin] = 0;
 3680                 }
 3681         }
 3682 
 3683         /* Configure all pins */
 3684         error = GPIO_PIN_CONFIG_32(sc->sc_gpio, 0, nitems(flags), flags);
 3685         if (error) {
 3686                 device_printf(sc->sc_dev, "error configuring %s pin flags: "
 3687                     "%d\n", device_get_nameunit(sc->sc_gpio), error);
 3688                 return (error);
 3689         }
 3690 
 3691         return (0);
 3692 }
 3693 
 3694 static int
 3695 bwn_gpio_init(struct bwn_mac *mac)
 3696 {
 3697         struct bwn_softc        *sc;
 3698         uint32_t                 pins;
 3699 
 3700         sc = mac->mac_sc;
 3701 
 3702         pins = 0xF;
 3703 
 3704         BWN_WRITE_4(mac, BWN_MACCTL,
 3705             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
 3706         BWN_WRITE_2(mac, BWN_GPIO_MASK,
 3707             BWN_READ_2(mac, BWN_GPIO_MASK) | pins);
 3708 
 3709         if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL) {
 3710                 /* MAC core is responsible for toggling PAREF via gpio9 */
 3711                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
 3712                     BWN_READ_2(mac, BWN_GPIO_MASK) | BHND_GPIO_BOARD_PACTRL);
 3713 
 3714                 pins |= BHND_GPIO_BOARD_PACTRL;
 3715         }
 3716 
 3717         return (bwn_gpio_control(mac, pins));
 3718 }
 3719 
 3720 static int
 3721 bwn_fw_loadinitvals(struct bwn_mac *mac)
 3722 {
 3723 #define GETFWOFFSET(fwp, offset)                                \
 3724         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
 3725         const size_t hdr_len = sizeof(struct bwn_fwhdr);
 3726         const struct bwn_fwhdr *hdr;
 3727         struct bwn_fw *fw = &mac->mac_fw;
 3728         int error;
 3729 
 3730         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
 3731         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
 3732             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
 3733         if (error)
 3734                 return (error);
 3735         if (fw->initvals_band.fw) {
 3736                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
 3737                 error = bwn_fwinitvals_write(mac,
 3738                     GETFWOFFSET(fw->initvals_band, hdr_len),
 3739                     be32toh(hdr->size),
 3740                     fw->initvals_band.fw->datasize - hdr_len);
 3741         }
 3742         return (error);
 3743 #undef GETFWOFFSET
 3744 }
 3745 
 3746 static int
 3747 bwn_phy_init(struct bwn_mac *mac)
 3748 {
 3749         struct bwn_softc *sc = mac->mac_sc;
 3750         int error;
 3751 
 3752         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
 3753         mac->mac_phy.rf_onoff(mac, 1);
 3754         error = mac->mac_phy.init(mac);
 3755         if (error) {
 3756                 device_printf(sc->sc_dev, "PHY init failed\n");
 3757                 goto fail0;
 3758         }
 3759         error = bwn_switch_channel(mac,
 3760             mac->mac_phy.get_default_chan(mac));
 3761         if (error) {
 3762                 device_printf(sc->sc_dev,
 3763                     "failed to switch default channel\n");
 3764                 goto fail1;
 3765         }
 3766         return (0);
 3767 fail1:
 3768         if (mac->mac_phy.exit)
 3769                 mac->mac_phy.exit(mac);
 3770 fail0:
 3771         mac->mac_phy.rf_onoff(mac, 0);
 3772 
 3773         return (error);
 3774 }
 3775 
 3776 static void
 3777 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
 3778 {
 3779         uint16_t ant;
 3780         uint16_t tmp;
 3781 
 3782         ant = bwn_ant2phy(antenna);
 3783 
 3784         /* For ACK/CTS */
 3785         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
 3786         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
 3787         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
 3788         /* For Probe Resposes */
 3789         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
 3790         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
 3791         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
 3792 }
 3793 
 3794 static void
 3795 bwn_set_opmode(struct bwn_mac *mac)
 3796 {
 3797         struct bwn_softc *sc = mac->mac_sc;
 3798         struct ieee80211com *ic = &sc->sc_ic;
 3799         uint32_t ctl;
 3800         uint16_t cfp_pretbtt;
 3801 
 3802         ctl = BWN_READ_4(mac, BWN_MACCTL);
 3803         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
 3804             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
 3805             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
 3806         ctl |= BWN_MACCTL_STA;
 3807 
 3808         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
 3809             ic->ic_opmode == IEEE80211_M_MBSS)
 3810                 ctl |= BWN_MACCTL_HOSTAP;
 3811         else if (ic->ic_opmode == IEEE80211_M_IBSS)
 3812                 ctl &= ~BWN_MACCTL_STA;
 3813         ctl |= sc->sc_filters;
 3814 
 3815         if (bhnd_get_hwrev(sc->sc_dev) <= 4)
 3816                 ctl |= BWN_MACCTL_PROMISC;
 3817 
 3818         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
 3819 
 3820         cfp_pretbtt = 2;
 3821         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
 3822                 if (sc->sc_cid.chip_id == BHND_CHIPID_BCM4306 &&
 3823                     sc->sc_cid.chip_rev == 3)
 3824                         cfp_pretbtt = 100;
 3825                 else
 3826                         cfp_pretbtt = 50;
 3827         }
 3828         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
 3829 }
 3830 
 3831 static void
 3832 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
 3833 {
 3834         if (!error) {
 3835                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
 3836                 *((bus_addr_t *)arg) = seg->ds_addr;
 3837         }
 3838 }
 3839 
 3840 void
 3841 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
 3842 {
 3843         struct bwn_phy *phy = &mac->mac_phy;
 3844         struct bwn_softc *sc = mac->mac_sc;
 3845         unsigned int i, max_loop;
 3846         uint16_t value;
 3847         uint32_t buffer[5] = {
 3848                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
 3849         };
 3850 
 3851         if (ofdm) {
 3852                 max_loop = 0x1e;
 3853                 buffer[0] = 0x000201cc;
 3854         } else {
 3855                 max_loop = 0xfa;
 3856                 buffer[0] = 0x000b846e;
 3857         }
 3858 
 3859         BWN_ASSERT_LOCKED(mac->mac_sc);
 3860 
 3861         for (i = 0; i < 5; i++)
 3862                 bwn_ram_write(mac, i * 4, buffer[i]);
 3863 
 3864         BWN_WRITE_2(mac, 0x0568, 0x0000);
 3865         BWN_WRITE_2(mac, 0x07c0,
 3866             (bhnd_get_hwrev(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
 3867 
 3868         value = (ofdm ? 0x41 : 0x40);
 3869         BWN_WRITE_2(mac, 0x050c, value);
 3870 
 3871         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
 3872             phy->type == BWN_PHYTYPE_LCN)
 3873                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
 3874         BWN_WRITE_2(mac, 0x0508, 0x0000);
 3875         BWN_WRITE_2(mac, 0x050a, 0x0000);
 3876         BWN_WRITE_2(mac, 0x054c, 0x0000);
 3877         BWN_WRITE_2(mac, 0x056a, 0x0014);
 3878         BWN_WRITE_2(mac, 0x0568, 0x0826);
 3879         BWN_WRITE_2(mac, 0x0500, 0x0000);
 3880 
 3881         /* XXX TODO: n phy pa override? */
 3882 
 3883         switch (phy->type) {
 3884         case BWN_PHYTYPE_N:
 3885         case BWN_PHYTYPE_LCN:
 3886                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
 3887                 break;
 3888         case BWN_PHYTYPE_LP:
 3889                 BWN_WRITE_2(mac, 0x0502, 0x0050);
 3890                 break;
 3891         default:
 3892                 BWN_WRITE_2(mac, 0x0502, 0x0030);
 3893                 break;
 3894         }
 3895 
 3896         /* flush */
 3897         BWN_READ_2(mac, 0x0502);
 3898 
 3899         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
 3900                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
 3901         for (i = 0x00; i < max_loop; i++) {
 3902                 value = BWN_READ_2(mac, 0x050e);
 3903                 if (value & 0x0080)
 3904                         break;
 3905                 DELAY(10);
 3906         }
 3907         for (i = 0x00; i < 0x0a; i++) {
 3908                 value = BWN_READ_2(mac, 0x050e);
 3909                 if (value & 0x0400)
 3910                         break;
 3911                 DELAY(10);
 3912         }
 3913         for (i = 0x00; i < 0x19; i++) {
 3914                 value = BWN_READ_2(mac, 0x0690);
 3915                 if (!(value & 0x0100))
 3916                         break;
 3917                 DELAY(10);
 3918         }
 3919         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
 3920                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
 3921 }
 3922 
 3923 void
 3924 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
 3925 {
 3926         uint32_t macctl;
 3927 
 3928         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
 3929 
 3930         macctl = BWN_READ_4(mac, BWN_MACCTL);
 3931         if (macctl & BWN_MACCTL_BIGENDIAN)
 3932                 printf("TODO: need swap\n");
 3933 
 3934         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
 3935         BWN_BARRIER(mac, BWN_RAM_CONTROL, 4, BUS_SPACE_BARRIER_WRITE);
 3936         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
 3937 }
 3938 
 3939 void
 3940 bwn_mac_suspend(struct bwn_mac *mac)
 3941 {
 3942         struct bwn_softc *sc = mac->mac_sc;
 3943         int i;
 3944         uint32_t tmp;
 3945 
 3946         KASSERT(mac->mac_suspended >= 0,
 3947             ("%s:%d: fail", __func__, __LINE__));
 3948 
 3949         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
 3950             __func__, mac->mac_suspended);
 3951 
 3952         if (mac->mac_suspended == 0) {
 3953                 bwn_psctl(mac, BWN_PS_AWAKE);
 3954                 BWN_WRITE_4(mac, BWN_MACCTL,
 3955                             BWN_READ_4(mac, BWN_MACCTL)
 3956                             & ~BWN_MACCTL_ON);
 3957                 BWN_READ_4(mac, BWN_MACCTL);
 3958                 for (i = 35; i; i--) {
 3959                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
 3960                         if (tmp & BWN_INTR_MAC_SUSPENDED)
 3961                                 goto out;
 3962                         DELAY(10);
 3963                 }
 3964                 for (i = 40; i; i--) {
 3965                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
 3966                         if (tmp & BWN_INTR_MAC_SUSPENDED)
 3967                                 goto out;
 3968                         DELAY(1000);
 3969                 }
 3970                 device_printf(sc->sc_dev, "MAC suspend failed\n");
 3971         }
 3972 out:
 3973         mac->mac_suspended++;
 3974 }
 3975 
 3976 void
 3977 bwn_mac_enable(struct bwn_mac *mac)
 3978 {
 3979         struct bwn_softc *sc = mac->mac_sc;
 3980         uint16_t state;
 3981 
 3982         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
 3983             __func__, mac->mac_suspended);
 3984 
 3985         state = bwn_shm_read_2(mac, BWN_SHARED,
 3986             BWN_SHARED_UCODESTAT);
 3987         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
 3988             state != BWN_SHARED_UCODESTAT_SLEEP) {
 3989                 DPRINTF(sc, BWN_DEBUG_FW,
 3990                     "%s: warn: firmware state (%d)\n",
 3991                     __func__, state);
 3992         }
 3993 
 3994         mac->mac_suspended--;
 3995         KASSERT(mac->mac_suspended >= 0,
 3996             ("%s:%d: fail", __func__, __LINE__));
 3997         if (mac->mac_suspended == 0) {
 3998                 BWN_WRITE_4(mac, BWN_MACCTL,
 3999                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
 4000                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
 4001                 BWN_READ_4(mac, BWN_MACCTL);
 4002                 BWN_READ_4(mac, BWN_INTR_REASON);
 4003                 bwn_psctl(mac, 0);
 4004         }
 4005 }
 4006 
 4007 void
 4008 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
 4009 {
 4010         struct bwn_softc *sc = mac->mac_sc;
 4011         int i;
 4012         uint16_t ucstat;
 4013 
 4014         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
 4015             ("%s:%d: fail", __func__, __LINE__));
 4016         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
 4017             ("%s:%d: fail", __func__, __LINE__));
 4018 
 4019         /* XXX forcibly awake and hwps-off */
 4020 
 4021         BWN_WRITE_4(mac, BWN_MACCTL,
 4022             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
 4023             ~BWN_MACCTL_HWPS);
 4024         BWN_READ_4(mac, BWN_MACCTL);
 4025         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
 4026                 for (i = 0; i < 100; i++) {
 4027                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
 4028                             BWN_SHARED_UCODESTAT);
 4029                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
 4030                                 break;
 4031                         DELAY(10);
 4032                 }
 4033         }
 4034         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
 4035             ucstat);
 4036 }
 4037 
 4038 static int
 4039 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
 4040 {
 4041         struct bwn_softc *sc = mac->mac_sc;
 4042         struct bwn_fw *fw = &mac->mac_fw;
 4043         const uint8_t rev = bhnd_get_hwrev(sc->sc_dev);
 4044         const char *filename;
 4045         uint16_t iost;
 4046         int error;
 4047 
 4048         /* microcode */
 4049         filename = NULL;
 4050         switch (rev) {
 4051         case 42:
 4052                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
 4053                         filename = "ucode42";
 4054                 break;
 4055         case 40:
 4056                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
 4057                         filename = "ucode40";
 4058                 break;
 4059         case 33:
 4060                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
 4061                         filename = "ucode33_lcn40";
 4062                 break;
 4063         case 30:
 4064                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
 4065                         filename = "ucode30_mimo";
 4066                 break;
 4067         case 29:
 4068                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
 4069                         filename = "ucode29_mimo";
 4070                 break;
 4071         case 26:
 4072                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
 4073                         filename = "ucode26_mimo";
 4074                 break;
 4075         case 28:
 4076         case 25:
 4077                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
 4078                         filename = "ucode25_mimo";
 4079                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
 4080                         filename = "ucode25_lcn";
 4081                 break;
 4082         case 24:
 4083                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
 4084                         filename = "ucode24_lcn";
 4085                 break;
 4086         case 23:
 4087                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
 4088                         filename = "ucode16_mimo";
 4089                 break;
 4090         case 16:
 4091         case 17:
 4092         case 18:
 4093         case 19:
 4094                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
 4095                         filename = "ucode16_mimo";
 4096                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
 4097                         filename = "ucode16_lp";
 4098                 break;
 4099         case 15:
 4100                 filename = "ucode15";
 4101                 break;
 4102         case 14:
 4103                 filename = "ucode14";
 4104                 break;
 4105         case 13:
 4106                 filename = "ucode13";
 4107                 break;
 4108         case 12:
 4109         case 11:
 4110                 filename = "ucode11";
 4111                 break;
 4112         case 10:
 4113         case 9:
 4114         case 8:
 4115         case 7:
 4116         case 6:
 4117         case 5:
 4118                 filename = "ucode5";
 4119                 break;
 4120         default:
 4121                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
 4122                 bwn_release_firmware(mac);
 4123                 return (EOPNOTSUPP);
 4124         }
 4125 
 4126         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
 4127         error = bwn_fw_get(mac, type, filename, &fw->ucode);
 4128         if (error) {
 4129                 bwn_release_firmware(mac);
 4130                 return (error);
 4131         }
 4132 
 4133         /* PCM */
 4134         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
 4135         if (rev >= 5 && rev <= 10) {
 4136                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
 4137                 if (error == ENOENT)
 4138                         fw->no_pcmfile = 1;
 4139                 else if (error) {
 4140                         bwn_release_firmware(mac);
 4141                         return (error);
 4142                 }
 4143         } else if (rev < 11) {
 4144                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
 4145                 bwn_release_firmware(mac);
 4146                 return (EOPNOTSUPP);
 4147         }
 4148 
 4149         /* initvals */
 4150         error = bhnd_read_iost(sc->sc_dev, &iost);
 4151         if (error)
 4152                 goto fail1;
 4153 
 4154         switch (mac->mac_phy.type) {
 4155         case BWN_PHYTYPE_A:
 4156                 if (rev < 5 || rev > 10)
 4157                         goto fail1;
 4158                 if (iost & BWN_IOST_HAVE_2GHZ)
 4159                         filename = "a0g1initvals5";
 4160                 else
 4161                         filename = "a0g0initvals5";
 4162                 break;
 4163         case BWN_PHYTYPE_G:
 4164                 if (rev >= 5 && rev <= 10)
 4165                         filename = "b0g0initvals5";
 4166                 else if (rev >= 13)
 4167                         filename = "b0g0initvals13";
 4168                 else
 4169                         goto fail1;
 4170                 break;
 4171         case BWN_PHYTYPE_LP:
 4172                 if (rev == 13)
 4173                         filename = "lp0initvals13";
 4174                 else if (rev == 14)
 4175                         filename = "lp0initvals14";
 4176                 else if (rev >= 15)
 4177                         filename = "lp0initvals15";
 4178                 else
 4179                         goto fail1;
 4180                 break;
 4181         case BWN_PHYTYPE_N:
 4182                 if (rev == 30)
 4183                         filename = "n16initvals30";
 4184                 else if (rev == 28 || rev == 25)
 4185                         filename = "n0initvals25";
 4186                 else if (rev == 24)
 4187                         filename = "n0initvals24";
 4188                 else if (rev == 23)
 4189                         filename = "n0initvals16";
 4190                 else if (rev >= 16 && rev <= 18)
 4191                         filename = "n0initvals16";
 4192                 else if (rev >= 11 && rev <= 12)
 4193                         filename = "n0initvals11";
 4194                 else
 4195                         goto fail1;
 4196                 break;
 4197         default:
 4198                 goto fail1;
 4199         }
 4200         error = bwn_fw_get(mac, type, filename, &fw->initvals);
 4201         if (error) {
 4202                 bwn_release_firmware(mac);
 4203                 return (error);
 4204         }
 4205 
 4206         /* bandswitch initvals */
 4207         switch (mac->mac_phy.type) {
 4208         case BWN_PHYTYPE_A:
 4209                 if (rev >= 5 && rev <= 10) {
 4210                         if (iost & BWN_IOST_HAVE_2GHZ)
 4211                                 filename = "a0g1bsinitvals5";
 4212                         else
 4213                                 filename = "a0g0bsinitvals5";
 4214                 } else if (rev >= 11)
 4215                         filename = NULL;
 4216                 else
 4217                         goto fail1;
 4218                 break;
 4219         case BWN_PHYTYPE_G:
 4220                 if (rev >= 5 && rev <= 10)
 4221                         filename = "b0g0bsinitvals5";
 4222                 else if (rev >= 11)
 4223                         filename = NULL;
 4224                 else
 4225                         goto fail1;
 4226                 break;
 4227         case BWN_PHYTYPE_LP:
 4228                 if (rev == 13)
 4229                         filename = "lp0bsinitvals13";
 4230                 else if (rev == 14)
 4231                         filename = "lp0bsinitvals14";
 4232                 else if (rev >= 15)
 4233                         filename = "lp0bsinitvals15";
 4234                 else
 4235                         goto fail1;
 4236                 break;
 4237         case BWN_PHYTYPE_N:
 4238                 if (rev == 30)
 4239                         filename = "n16bsinitvals30";
 4240                 else if (rev == 28 || rev == 25)
 4241                         filename = "n0bsinitvals25";
 4242                 else if (rev == 24)
 4243                         filename = "n0bsinitvals24";
 4244                 else if (rev == 23)
 4245                         filename = "n0bsinitvals16";
 4246                 else if (rev >= 16 && rev <= 18)
 4247                         filename = "n0bsinitvals16";
 4248                 else if (rev >= 11 && rev <= 12)
 4249                         filename = "n0bsinitvals11";
 4250                 else
 4251                         goto fail1;
 4252                 break;
 4253         default:
 4254                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
 4255                     mac->mac_phy.type);
 4256                 goto fail1;
 4257         }
 4258         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
 4259         if (error) {
 4260                 bwn_release_firmware(mac);
 4261                 return (error);
 4262         }
 4263         return (0);
 4264 fail1:
 4265         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
 4266             rev, mac->mac_phy.type);
 4267         bwn_release_firmware(mac);
 4268         return (EOPNOTSUPP);
 4269 }
 4270 
 4271 static int
 4272 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
 4273     const char *name, struct bwn_fwfile *bfw)
 4274 {
 4275         const struct bwn_fwhdr *hdr;
 4276         struct bwn_softc *sc = mac->mac_sc;
 4277         const struct firmware *fw;
 4278         char namebuf[64];
 4279 
 4280         if (name == NULL) {
 4281                 bwn_do_release_fw(bfw);
 4282                 return (0);
 4283         }
 4284         if (bfw->filename != NULL) {
 4285                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
 4286                         return (0);
 4287                 bwn_do_release_fw(bfw);
 4288         }
 4289 
 4290         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
 4291             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
 4292             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
 4293         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
 4294         fw = firmware_get(namebuf);
 4295         if (fw == NULL) {
 4296                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
 4297                     namebuf);
 4298                 return (ENOENT);
 4299         }
 4300         if (fw->datasize < sizeof(struct bwn_fwhdr))
 4301                 goto fail;
 4302         hdr = (const struct bwn_fwhdr *)(fw->data);
 4303         switch (hdr->type) {
 4304         case BWN_FWTYPE_UCODE:
 4305         case BWN_FWTYPE_PCM:
 4306                 if (be32toh(hdr->size) !=
 4307                     (fw->datasize - sizeof(struct bwn_fwhdr)))
 4308                         goto fail;
 4309                 /* FALLTHROUGH */
 4310         case BWN_FWTYPE_IV:
 4311                 if (hdr->ver != 1)
 4312                         goto fail;
 4313                 break;
 4314         default:
 4315                 goto fail;
 4316         }
 4317         bfw->filename = name;
 4318         bfw->fw = fw;
 4319         bfw->type = type;
 4320         return (0);
 4321 fail:
 4322         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
 4323         if (fw != NULL)
 4324                 firmware_put(fw, FIRMWARE_UNLOAD);
 4325         return (EPROTO);
 4326 }
 4327 
 4328 static void
 4329 bwn_release_firmware(struct bwn_mac *mac)
 4330 {
 4331 
 4332         bwn_do_release_fw(&mac->mac_fw.ucode);
 4333         bwn_do_release_fw(&mac->mac_fw.pcm);
 4334         bwn_do_release_fw(&mac->mac_fw.initvals);
 4335         bwn_do_release_fw(&mac->mac_fw.initvals_band);
 4336 }
 4337 
 4338 static void
 4339 bwn_do_release_fw(struct bwn_fwfile *bfw)
 4340 {
 4341 
 4342         if (bfw->fw != NULL)
 4343                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
 4344         bfw->fw = NULL;
 4345         bfw->filename = NULL;
 4346 }
 4347 
 4348 static int
 4349 bwn_fw_loaducode(struct bwn_mac *mac)
 4350 {
 4351 #define GETFWOFFSET(fwp, offset)        \
 4352         ((const uint32_t *)((const char *)fwp.fw->data + offset))
 4353 #define GETFWSIZE(fwp, offset)  \
 4354         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
 4355         struct bwn_softc *sc = mac->mac_sc;
 4356         const uint32_t *data;
 4357         unsigned int i;
 4358         uint32_t ctl;
 4359         uint16_t date, fwcaps, time;
 4360         int error = 0;
 4361 
 4362         ctl = BWN_READ_4(mac, BWN_MACCTL);
 4363         ctl |= BWN_MACCTL_MCODE_JMP0;
 4364         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
 4365             __LINE__));
 4366         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
 4367         for (i = 0; i < 64; i++)
 4368                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
 4369         for (i = 0; i < 4096; i += 2)
 4370                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
 4371 
 4372         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
 4373         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
 4374         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
 4375              i++) {
 4376                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
 4377                 DELAY(10);
 4378         }
 4379 
 4380         if (mac->mac_fw.pcm.fw) {
 4381                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
 4382                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
 4383                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
 4384                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
 4385                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
 4386                     sizeof(struct bwn_fwhdr)); i++) {
 4387                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
 4388                         DELAY(10);
 4389                 }
 4390         }
 4391 
 4392         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
 4393         BWN_WRITE_4(mac, BWN_MACCTL,
 4394             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
 4395             BWN_MACCTL_MCODE_RUN);
 4396 
 4397         for (i = 0; i < 21; i++) {
 4398                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
 4399                         break;
 4400                 if (i >= 20) {
 4401                         device_printf(sc->sc_dev, "ucode timeout\n");
 4402                         error = ENXIO;
 4403                         goto error;
 4404                 }
 4405                 DELAY(50000);
 4406         }
 4407         BWN_READ_4(mac, BWN_INTR_REASON);
 4408 
 4409         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
 4410         if (mac->mac_fw.rev <= 0x128) {
 4411                 device_printf(sc->sc_dev, "the firmware is too old\n");
 4412                 error = EOPNOTSUPP;
 4413                 goto error;
 4414         }
 4415 
 4416         /*
 4417          * Determine firmware header version; needed for TX/RX packet
 4418          * handling.
 4419          */
 4420         if (mac->mac_fw.rev >= 598)
 4421                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
 4422         else if (mac->mac_fw.rev >= 410)
 4423                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
 4424         else
 4425                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
 4426 
 4427         /*
 4428          * We don't support rev 598 or later; that requires
 4429          * another round of changes to the TX/RX descriptor
 4430          * and status layout.
 4431          *
 4432          * So, complain this is the case and exit out, rather
 4433          * than attaching and then failing.
 4434          */
 4435 #if 0
 4436         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
 4437                 device_printf(sc->sc_dev,
 4438                     "firmware is too new (>=598); not supported\n");
 4439                 error = EOPNOTSUPP;
 4440                 goto error;
 4441         }
 4442 #endif
 4443 
 4444         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
 4445             BWN_SHARED_UCODE_PATCH);
 4446         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
 4447         mac->mac_fw.opensource = (date == 0xffff);
 4448         if (bwn_wme != 0)
 4449                 mac->mac_flags |= BWN_MAC_FLAG_WME;
 4450         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
 4451 
 4452         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
 4453         if (mac->mac_fw.opensource == 0) {
 4454                 device_printf(sc->sc_dev,
 4455                     "firmware version (rev %u patch %u date %#x time %#x)\n",
 4456                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
 4457                 if (mac->mac_fw.no_pcmfile)
 4458                         device_printf(sc->sc_dev,
 4459                             "no HW crypto acceleration due to pcm5\n");
 4460         } else {
 4461                 mac->mac_fw.patch = time;
 4462                 fwcaps = bwn_fwcaps_read(mac);
 4463                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
 4464                         device_printf(sc->sc_dev,
 4465                             "disabling HW crypto acceleration\n");
 4466                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
 4467                 }
 4468                 if (!(fwcaps & BWN_FWCAPS_WME)) {
 4469                         device_printf(sc->sc_dev, "disabling WME support\n");
 4470                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
 4471                 }
 4472         }
 4473 
 4474         if (BWN_ISOLDFMT(mac))
 4475                 device_printf(sc->sc_dev, "using old firmware image\n");
 4476 
 4477         return (0);
 4478 
 4479 error:
 4480         BWN_WRITE_4(mac, BWN_MACCTL,
 4481             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
 4482             BWN_MACCTL_MCODE_JMP0);
 4483 
 4484         return (error);
 4485 #undef GETFWSIZE
 4486 #undef GETFWOFFSET
 4487 }
 4488 
 4489 /* OpenFirmware only */
 4490 static uint16_t
 4491 bwn_fwcaps_read(struct bwn_mac *mac)
 4492 {
 4493 
 4494         KASSERT(mac->mac_fw.opensource == 1,
 4495             ("%s:%d: fail", __func__, __LINE__));
 4496         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
 4497 }
 4498 
 4499 static int
 4500 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
 4501     size_t count, size_t array_size)
 4502 {
 4503 #define GET_NEXTIV16(iv)                                                \
 4504         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
 4505             sizeof(uint16_t) + sizeof(uint16_t)))
 4506 #define GET_NEXTIV32(iv)                                                \
 4507         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
 4508             sizeof(uint16_t) + sizeof(uint32_t)))
 4509         struct bwn_softc *sc = mac->mac_sc;
 4510         const struct bwn_fwinitvals *iv;
 4511         uint16_t offset;
 4512         size_t i;
 4513         uint8_t bit32;
 4514 
 4515         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
 4516             ("%s:%d: fail", __func__, __LINE__));
 4517         iv = ivals;
 4518         for (i = 0; i < count; i++) {
 4519                 if (array_size < sizeof(iv->offset_size))
 4520                         goto fail;
 4521                 array_size -= sizeof(iv->offset_size);
 4522                 offset = be16toh(iv->offset_size);
 4523                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
 4524                 offset &= BWN_FWINITVALS_OFFSET_MASK;
 4525                 if (offset >= 0x1000)
 4526                         goto fail;
 4527                 if (bit32) {
 4528                         if (array_size < sizeof(iv->data.d32))
 4529                                 goto fail;
 4530                         array_size -= sizeof(iv->data.d32);
 4531                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
 4532                         iv = GET_NEXTIV32(iv);
 4533                 } else {
 4534                         if (array_size < sizeof(iv->data.d16))
 4535                                 goto fail;
 4536                         array_size -= sizeof(iv->data.d16);
 4537                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
 4538 
 4539                         iv = GET_NEXTIV16(iv);
 4540                 }
 4541         }
 4542         if (array_size != 0)
 4543                 goto fail;
 4544         return (0);
 4545 fail:
 4546         device_printf(sc->sc_dev, "initvals: invalid format\n");
 4547         return (EPROTO);
 4548 #undef GET_NEXTIV16
 4549 #undef GET_NEXTIV32
 4550 }
 4551 
 4552 int
 4553 bwn_switch_channel(struct bwn_mac *mac, int chan)
 4554 {
 4555         struct bwn_phy *phy = &(mac->mac_phy);
 4556         struct bwn_softc *sc = mac->mac_sc;
 4557         struct ieee80211com *ic = &sc->sc_ic;
 4558         uint16_t channelcookie, savedcookie;
 4559         int error;
 4560 
 4561         if (chan == 0xffff)
 4562                 chan = phy->get_default_chan(mac);
 4563 
 4564         channelcookie = chan;
 4565         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
 4566                 channelcookie |= 0x100;
 4567         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
 4568         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
 4569         error = phy->switch_channel(mac, chan);
 4570         if (error)
 4571                 goto fail;
 4572 
 4573         mac->mac_phy.chan = chan;
 4574         DELAY(8000);
 4575         return (0);
 4576 fail:
 4577         device_printf(sc->sc_dev, "failed to switch channel\n");
 4578         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
 4579         return (error);
 4580 }
 4581 
 4582 static uint16_t
 4583 bwn_ant2phy(int antenna)
 4584 {
 4585 
 4586         switch (antenna) {
 4587         case BWN_ANT0:
 4588                 return (BWN_TX_PHY_ANT0);
 4589         case BWN_ANT1:
 4590                 return (BWN_TX_PHY_ANT1);
 4591         case BWN_ANT2:
 4592                 return (BWN_TX_PHY_ANT2);
 4593         case BWN_ANT3:
 4594                 return (BWN_TX_PHY_ANT3);
 4595         case BWN_ANTAUTO:
 4596                 return (BWN_TX_PHY_ANT01AUTO);
 4597         }
 4598         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 4599         return (0);
 4600 }
 4601 
 4602 static void
 4603 bwn_wme_load(struct bwn_mac *mac)
 4604 {
 4605         struct bwn_softc *sc = mac->mac_sc;
 4606         int i;
 4607 
 4608         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
 4609             ("%s:%d: fail", __func__, __LINE__));
 4610 
 4611         bwn_mac_suspend(mac);
 4612         for (i = 0; i < N(sc->sc_wmeParams); i++)
 4613                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
 4614                     bwn_wme_shm_offsets[i]);
 4615         bwn_mac_enable(mac);
 4616 }
 4617 
 4618 static void
 4619 bwn_wme_loadparams(struct bwn_mac *mac,
 4620     const struct wmeParams *p, uint16_t shm_offset)
 4621 {
 4622         struct bwn_softc *sc = mac->mac_sc;
 4623         uint16_t params[BWN_NR_WMEPARAMS];
 4624         int slot, tmp;
 4625         unsigned int i;
 4626 
 4627         slot = BWN_READ_2(mac, BWN_RNG) &
 4628             _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
 4629 
 4630         memset(&params, 0, sizeof(params));
 4631 
 4632         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
 4633             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
 4634             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
 4635 
 4636         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
 4637         params[BWN_WMEPARAM_CWMIN] =
 4638             _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
 4639         params[BWN_WMEPARAM_CWMAX] =
 4640              _IEEE80211_SHIFTMASK(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
 4641         params[BWN_WMEPARAM_CWCUR] =
 4642              _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
 4643         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
 4644         params[BWN_WMEPARAM_BSLOTS] = slot;
 4645         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
 4646 
 4647         for (i = 0; i < N(params); i++) {
 4648                 if (i == BWN_WMEPARAM_STATUS) {
 4649                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
 4650                             shm_offset + (i * 2));
 4651                         tmp |= 0x100;
 4652                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
 4653                             tmp);
 4654                 } else {
 4655                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
 4656                             params[i]);
 4657                 }
 4658         }
 4659 }
 4660 
 4661 static void
 4662 bwn_mac_write_bssid(struct bwn_mac *mac)
 4663 {
 4664         struct bwn_softc *sc = mac->mac_sc;
 4665         uint32_t tmp;
 4666         int i;
 4667         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
 4668 
 4669         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
 4670         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
 4671         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
 4672             IEEE80211_ADDR_LEN);
 4673 
 4674         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
 4675                 tmp = (uint32_t) (mac_bssid[i + 0]);
 4676                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
 4677                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
 4678                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
 4679                 bwn_ram_write(mac, 0x20 + i, tmp);
 4680         }
 4681 }
 4682 
 4683 static void
 4684 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
 4685     const uint8_t *macaddr)
 4686 {
 4687         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
 4688         uint16_t data;
 4689 
 4690         if (!mac)
 4691                 macaddr = zero;
 4692 
 4693         offset |= 0x0020;
 4694         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
 4695 
 4696         data = macaddr[0];
 4697         data |= macaddr[1] << 8;
 4698         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
 4699         data = macaddr[2];
 4700         data |= macaddr[3] << 8;
 4701         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
 4702         data = macaddr[4];
 4703         data |= macaddr[5] << 8;
 4704         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
 4705 }
 4706 
 4707 static void
 4708 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
 4709     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
 4710 {
 4711         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
 4712         uint8_t per_sta_keys_start = 8;
 4713 
 4714         if (BWN_SEC_NEWAPI(mac))
 4715                 per_sta_keys_start = 4;
 4716 
 4717         KASSERT(index < mac->mac_max_nr_keys,
 4718             ("%s:%d: fail", __func__, __LINE__));
 4719         KASSERT(key_len <= BWN_SEC_KEYSIZE,
 4720             ("%s:%d: fail", __func__, __LINE__));
 4721 
 4722         if (index >= per_sta_keys_start)
 4723                 bwn_key_macwrite(mac, index, NULL);
 4724         if (key)
 4725                 memcpy(buf, key, key_len);
 4726         bwn_key_write(mac, index, algorithm, buf);
 4727         if (index >= per_sta_keys_start)
 4728                 bwn_key_macwrite(mac, index, mac_addr);
 4729 
 4730         mac->mac_key[index].algorithm = algorithm;
 4731 }
 4732 
 4733 static void
 4734 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
 4735 {
 4736         struct bwn_softc *sc = mac->mac_sc;
 4737         uint32_t addrtmp[2] = { 0, 0 };
 4738         uint8_t start = 8;
 4739 
 4740         if (BWN_SEC_NEWAPI(mac))
 4741                 start = 4;
 4742 
 4743         KASSERT(index >= start,
 4744             ("%s:%d: fail", __func__, __LINE__));
 4745         index -= start;
 4746 
 4747         if (addr) {
 4748                 addrtmp[0] = addr[0];
 4749                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
 4750                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
 4751                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
 4752                 addrtmp[1] = addr[4];
 4753                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
 4754         }
 4755 
 4756         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
 4757                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
 4758                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
 4759         } else {
 4760                 if (index >= 8) {
 4761                         bwn_shm_write_4(mac, BWN_SHARED,
 4762                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
 4763                         bwn_shm_write_2(mac, BWN_SHARED,
 4764                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
 4765                 }
 4766         }
 4767 }
 4768 
 4769 static void
 4770 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
 4771     const uint8_t *key)
 4772 {
 4773         unsigned int i;
 4774         uint32_t offset;
 4775         uint16_t kidx, value;
 4776 
 4777         kidx = BWN_SEC_KEY2FW(mac, index);
 4778         bwn_shm_write_2(mac, BWN_SHARED,
 4779             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
 4780 
 4781         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
 4782         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
 4783                 value = key[i];
 4784                 value |= (uint16_t)(key[i + 1]) << 8;
 4785                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
 4786         }
 4787 }
 4788 
 4789 static void
 4790 bwn_phy_exit(struct bwn_mac *mac)
 4791 {
 4792 
 4793         mac->mac_phy.rf_onoff(mac, 0);
 4794         if (mac->mac_phy.exit != NULL)
 4795                 mac->mac_phy.exit(mac);
 4796 }
 4797 
 4798 static void
 4799 bwn_dma_free(struct bwn_mac *mac)
 4800 {
 4801         struct bwn_dma *dma;
 4802 
 4803         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
 4804                 return;
 4805         dma = &mac->mac_method.dma;
 4806 
 4807         bwn_dma_ringfree(&dma->rx);
 4808         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
 4809         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
 4810         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
 4811         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
 4812         bwn_dma_ringfree(&dma->mcast);
 4813 }
 4814 
 4815 static void
 4816 bwn_core_stop(struct bwn_mac *mac)
 4817 {
 4818         struct bwn_softc *sc = mac->mac_sc;
 4819 
 4820         BWN_ASSERT_LOCKED(sc);
 4821 
 4822         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
 4823                 return;
 4824 
 4825         callout_stop(&sc->sc_rfswitch_ch);
 4826         callout_stop(&sc->sc_task_ch);
 4827         callout_stop(&sc->sc_watchdog_ch);
 4828         sc->sc_watchdog_timer = 0;
 4829         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
 4830         BWN_READ_4(mac, BWN_INTR_MASK);
 4831         bwn_mac_suspend(mac);
 4832 
 4833         mac->mac_status = BWN_MAC_STATUS_INITED;
 4834 }
 4835 
 4836 static int
 4837 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
 4838 {
 4839         struct bwn_mac *up_dev = NULL;
 4840         struct bwn_mac *down_dev;
 4841         struct bwn_mac *mac;
 4842         int err, status;
 4843         uint8_t gmode;
 4844 
 4845         BWN_ASSERT_LOCKED(sc);
 4846 
 4847         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
 4848                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
 4849                     mac->mac_phy.supports_2ghz) {
 4850                         up_dev = mac;
 4851                         gmode = 1;
 4852                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
 4853                     mac->mac_phy.supports_5ghz) {
 4854                         up_dev = mac;
 4855                         gmode = 0;
 4856                 } else {
 4857                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 4858                         return (EINVAL);
 4859                 }
 4860                 if (up_dev != NULL)
 4861                         break;
 4862         }
 4863         if (up_dev == NULL) {
 4864                 device_printf(sc->sc_dev, "Could not find a device\n");
 4865                 return (ENODEV);
 4866         }
 4867         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
 4868                 return (0);
 4869 
 4870         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
 4871             "switching to %s-GHz band\n",
 4872             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
 4873 
 4874         down_dev = sc->sc_curmac;
 4875         status = down_dev->mac_status;
 4876         if (status >= BWN_MAC_STATUS_STARTED)
 4877                 bwn_core_stop(down_dev);
 4878         if (status >= BWN_MAC_STATUS_INITED)
 4879                 bwn_core_exit(down_dev);
 4880 
 4881         if (down_dev != up_dev) {
 4882                 err = bwn_phy_reset(down_dev);
 4883                 if (err)
 4884                         goto fail;
 4885         }
 4886 
 4887         up_dev->mac_phy.gmode = gmode;
 4888         if (status >= BWN_MAC_STATUS_INITED) {
 4889                 err = bwn_core_init(up_dev);
 4890                 if (err) {
 4891                         device_printf(sc->sc_dev,
 4892                             "fatal: failed to initialize for %s-GHz\n",
 4893                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
 4894                         goto fail;
 4895                 }
 4896         }
 4897         if (status >= BWN_MAC_STATUS_STARTED)
 4898                 bwn_core_start(up_dev);
 4899         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
 4900         sc->sc_curmac = up_dev;
 4901 
 4902         return (0);
 4903 fail:
 4904         sc->sc_curmac = NULL;
 4905         return (err);
 4906 }
 4907 
 4908 static void
 4909 bwn_rf_turnon(struct bwn_mac *mac)
 4910 {
 4911 
 4912         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
 4913 
 4914         bwn_mac_suspend(mac);
 4915         mac->mac_phy.rf_onoff(mac, 1);
 4916         mac->mac_phy.rf_on = 1;
 4917         bwn_mac_enable(mac);
 4918 }
 4919 
 4920 static void
 4921 bwn_rf_turnoff(struct bwn_mac *mac)
 4922 {
 4923 
 4924         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
 4925 
 4926         bwn_mac_suspend(mac);
 4927         mac->mac_phy.rf_onoff(mac, 0);
 4928         mac->mac_phy.rf_on = 0;
 4929         bwn_mac_enable(mac);
 4930 }
 4931 
 4932 /*
 4933  * PHY reset.
 4934  */
 4935 static int
 4936 bwn_phy_reset(struct bwn_mac *mac)
 4937 {
 4938         struct bwn_softc        *sc;
 4939         uint16_t                 iost, mask;
 4940         int                      error;
 4941 
 4942         sc = mac->mac_sc;
 4943 
 4944         iost = BWN_IOCTL_PHYRESET | BHND_IOCTL_CLK_FORCE;
 4945         mask = iost | BWN_IOCTL_SUPPORT_G;
 4946 
 4947         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
 4948                 return (error);
 4949 
 4950         DELAY(1000);
 4951 
 4952         iost &= ~BHND_IOCTL_CLK_FORCE;
 4953 
 4954         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
 4955                 return (error);
 4956 
 4957         DELAY(1000);
 4958 
 4959         return (0);
 4960 }
 4961 
 4962 static int
 4963 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 4964 {
 4965         struct bwn_vap *bvp = BWN_VAP(vap);
 4966         struct ieee80211com *ic= vap->iv_ic;
 4967         enum ieee80211_state ostate = vap->iv_state;
 4968         struct bwn_softc *sc = ic->ic_softc;
 4969         struct bwn_mac *mac = sc->sc_curmac;
 4970         int error;
 4971 
 4972         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
 4973             ieee80211_state_name[vap->iv_state],
 4974             ieee80211_state_name[nstate]);
 4975 
 4976         error = bvp->bv_newstate(vap, nstate, arg);
 4977         if (error != 0)
 4978                 return (error);
 4979 
 4980         BWN_LOCK(sc);
 4981 
 4982         bwn_led_newstate(mac, nstate);
 4983 
 4984         /*
 4985          * Clear the BSSID when we stop a STA
 4986          */
 4987         if (vap->iv_opmode == IEEE80211_M_STA) {
 4988                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
 4989                         /*
 4990                          * Clear out the BSSID.  If we reassociate to
 4991                          * the same AP, this will reinialize things
 4992                          * correctly...
 4993                          */
 4994                         if (ic->ic_opmode == IEEE80211_M_STA &&
 4995                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
 4996                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
 4997                                 bwn_set_macaddr(mac);
 4998                         }
 4999                 }
 5000         }
 5001 
 5002         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
 5003             vap->iv_opmode == IEEE80211_M_AHDEMO) {
 5004                 /* XXX nothing to do? */
 5005         } else if (nstate == IEEE80211_S_RUN) {
 5006                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
 5007                 bwn_set_opmode(mac);
 5008                 bwn_set_pretbtt(mac);
 5009                 bwn_spu_setdelay(mac, 0);
 5010                 bwn_set_macaddr(mac);
 5011         }
 5012 
 5013         BWN_UNLOCK(sc);
 5014 
 5015         return (error);
 5016 }
 5017 
 5018 static void
 5019 bwn_set_pretbtt(struct bwn_mac *mac)
 5020 {
 5021         struct bwn_softc *sc = mac->mac_sc;
 5022         struct ieee80211com *ic = &sc->sc_ic;
 5023         uint16_t pretbtt;
 5024 
 5025         if (ic->ic_opmode == IEEE80211_M_IBSS)
 5026                 pretbtt = 2;
 5027         else
 5028                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
 5029         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
 5030         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
 5031 }
 5032 
 5033 static int
 5034 bwn_intr(void *arg)
 5035 {
 5036         struct bwn_mac *mac = arg;
 5037         struct bwn_softc *sc = mac->mac_sc;
 5038         uint32_t reason;
 5039 
 5040         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
 5041             (sc->sc_flags & BWN_FLAG_INVALID))
 5042                 return (FILTER_STRAY);
 5043 
 5044         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
 5045 
 5046         reason = BWN_READ_4(mac, BWN_INTR_REASON);
 5047         if (reason == 0xffffffff)       /* shared IRQ */
 5048                 return (FILTER_STRAY);
 5049         reason &= mac->mac_intr_mask;
 5050         if (reason == 0)
 5051                 return (FILTER_HANDLED);
 5052         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
 5053 
 5054         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
 5055         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
 5056         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
 5057         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
 5058         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
 5059         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
 5060         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
 5061         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
 5062         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
 5063         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
 5064         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
 5065 
 5066         /* Disable interrupts. */
 5067         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
 5068 
 5069         mac->mac_reason_intr = reason;
 5070 
 5071         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
 5072 
 5073         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
 5074         return (FILTER_HANDLED);
 5075 }
 5076 
 5077 static void
 5078 bwn_intrtask(void *arg, int npending)
 5079 {
 5080         struct epoch_tracker et;
 5081         struct bwn_mac *mac = arg;
 5082         struct bwn_softc *sc = mac->mac_sc;
 5083         uint32_t merged = 0;
 5084         int i, tx = 0, rx = 0;
 5085 
 5086         BWN_LOCK(sc);
 5087         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
 5088             (sc->sc_flags & BWN_FLAG_INVALID)) {
 5089                 BWN_UNLOCK(sc);
 5090                 return;
 5091         }
 5092 
 5093         for (i = 0; i < N(mac->mac_reason); i++)
 5094                 merged |= mac->mac_reason[i];
 5095 
 5096         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
 5097                 device_printf(sc->sc_dev, "MAC trans error\n");
 5098 
 5099         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
 5100                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
 5101                 mac->mac_phy.txerrors--;
 5102                 if (mac->mac_phy.txerrors == 0) {
 5103                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
 5104                         bwn_restart(mac, "PHY TX errors");
 5105                 }
 5106         }
 5107 
 5108         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
 5109                 if (merged & BWN_DMAINTR_FATALMASK) {
 5110                         device_printf(sc->sc_dev,
 5111                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
 5112                             mac->mac_reason[0], mac->mac_reason[1],
 5113                             mac->mac_reason[2], mac->mac_reason[3],
 5114                             mac->mac_reason[4], mac->mac_reason[5]);
 5115                         bwn_restart(mac, "DMA error");
 5116                         BWN_UNLOCK(sc);
 5117                         return;
 5118                 }
 5119                 if (merged & BWN_DMAINTR_NONFATALMASK) {
 5120                         device_printf(sc->sc_dev,
 5121                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
 5122                             mac->mac_reason[0], mac->mac_reason[1],
 5123                             mac->mac_reason[2], mac->mac_reason[3],
 5124                             mac->mac_reason[4], mac->mac_reason[5]);
 5125                 }
 5126         }
 5127 
 5128         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
 5129                 bwn_intr_ucode_debug(mac);
 5130         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
 5131                 bwn_intr_tbtt_indication(mac);
 5132         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
 5133                 bwn_intr_atim_end(mac);
 5134         if (mac->mac_reason_intr & BWN_INTR_BEACON)
 5135                 bwn_intr_beacon(mac);
 5136         if (mac->mac_reason_intr & BWN_INTR_PMQ)
 5137                 bwn_intr_pmq(mac);
 5138         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
 5139                 bwn_intr_noise(mac);
 5140 
 5141         NET_EPOCH_ENTER(et);
 5142         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 5143                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
 5144                         bwn_dma_rx(mac->mac_method.dma.rx);
 5145                         rx = 1;
 5146                 }
 5147         } else
 5148                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
 5149         NET_EPOCH_EXIT(et);
 5150 
 5151         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
 5152         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
 5153         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
 5154         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
 5155         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
 5156 
 5157         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
 5158                 bwn_intr_txeof(mac);
 5159                 tx = 1;
 5160         }
 5161 
 5162         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
 5163 
 5164         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
 5165                 int evt = BWN_LED_EVENT_NONE;
 5166 
 5167                 if (tx && rx) {
 5168                         if (sc->sc_rx_rate > sc->sc_tx_rate)
 5169                                 evt = BWN_LED_EVENT_RX;
 5170                         else
 5171                                 evt = BWN_LED_EVENT_TX;
 5172                 } else if (tx) {
 5173                         evt = BWN_LED_EVENT_TX;
 5174                 } else if (rx) {
 5175                         evt = BWN_LED_EVENT_RX;
 5176                 } else if (rx == 0) {
 5177                         evt = BWN_LED_EVENT_POLL;
 5178                 }
 5179 
 5180                 if (evt != BWN_LED_EVENT_NONE)
 5181                         bwn_led_event(mac, evt);
 5182        }
 5183 
 5184         if (mbufq_first(&sc->sc_snd) != NULL)
 5185                 bwn_start(sc);
 5186 
 5187         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
 5188 
 5189         BWN_UNLOCK(sc);
 5190 }
 5191 
 5192 static void
 5193 bwn_restart(struct bwn_mac *mac, const char *msg)
 5194 {
 5195         struct bwn_softc *sc = mac->mac_sc;
 5196         struct ieee80211com *ic = &sc->sc_ic;
 5197 
 5198         if (mac->mac_status < BWN_MAC_STATUS_INITED)
 5199                 return;
 5200 
 5201         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
 5202         ieee80211_runtask(ic, &mac->mac_hwreset);
 5203 }
 5204 
 5205 static void
 5206 bwn_intr_ucode_debug(struct bwn_mac *mac)
 5207 {
 5208         struct bwn_softc *sc = mac->mac_sc;
 5209         uint16_t reason;
 5210 
 5211         if (mac->mac_fw.opensource == 0)
 5212                 return;
 5213 
 5214         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
 5215         switch (reason) {
 5216         case BWN_DEBUGINTR_PANIC:
 5217                 bwn_handle_fwpanic(mac);
 5218                 break;
 5219         case BWN_DEBUGINTR_DUMP_SHM:
 5220                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
 5221                 break;
 5222         case BWN_DEBUGINTR_DUMP_REGS:
 5223                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
 5224                 break;
 5225         case BWN_DEBUGINTR_MARKER:
 5226                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
 5227                 break;
 5228         default:
 5229                 device_printf(sc->sc_dev,
 5230                     "ucode debug unknown reason: %#x\n", reason);
 5231         }
 5232 
 5233         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
 5234             BWN_DEBUGINTR_ACK);
 5235 }
 5236 
 5237 static void
 5238 bwn_intr_tbtt_indication(struct bwn_mac *mac)
 5239 {
 5240         struct bwn_softc *sc = mac->mac_sc;
 5241         struct ieee80211com *ic = &sc->sc_ic;
 5242 
 5243         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
 5244                 bwn_psctl(mac, 0);
 5245         if (ic->ic_opmode == IEEE80211_M_IBSS)
 5246                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
 5247 }
 5248 
 5249 static void
 5250 bwn_intr_atim_end(struct bwn_mac *mac)
 5251 {
 5252 
 5253         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
 5254                 BWN_WRITE_4(mac, BWN_MACCMD,
 5255                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
 5256                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
 5257         }
 5258 }
 5259 
 5260 static void
 5261 bwn_intr_beacon(struct bwn_mac *mac)
 5262 {
 5263         struct bwn_softc *sc = mac->mac_sc;
 5264         struct ieee80211com *ic = &sc->sc_ic;
 5265         uint32_t cmd, beacon0, beacon1;
 5266 
 5267         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
 5268             ic->ic_opmode == IEEE80211_M_MBSS)
 5269                 return;
 5270 
 5271         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
 5272 
 5273         cmd = BWN_READ_4(mac, BWN_MACCMD);
 5274         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
 5275         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
 5276 
 5277         if (beacon0 && beacon1) {
 5278                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
 5279                 mac->mac_intr_mask |= BWN_INTR_BEACON;
 5280                 return;
 5281         }
 5282 
 5283         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
 5284                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
 5285                 bwn_load_beacon0(mac);
 5286                 bwn_load_beacon1(mac);
 5287                 cmd = BWN_READ_4(mac, BWN_MACCMD);
 5288                 cmd |= BWN_MACCMD_BEACON0_VALID;
 5289                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
 5290         } else {
 5291                 if (!beacon0) {
 5292                         bwn_load_beacon0(mac);
 5293                         cmd = BWN_READ_4(mac, BWN_MACCMD);
 5294                         cmd |= BWN_MACCMD_BEACON0_VALID;
 5295                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
 5296                 } else if (!beacon1) {
 5297                         bwn_load_beacon1(mac);
 5298                         cmd = BWN_READ_4(mac, BWN_MACCMD);
 5299                         cmd |= BWN_MACCMD_BEACON1_VALID;
 5300                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
 5301                 }
 5302         }
 5303 }
 5304 
 5305 static void
 5306 bwn_intr_pmq(struct bwn_mac *mac)
 5307 {
 5308         uint32_t tmp;
 5309 
 5310         while (1) {
 5311                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
 5312                 if (!(tmp & 0x00000008))
 5313                         break;
 5314         }
 5315         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
 5316 }
 5317 
 5318 static void
 5319 bwn_intr_noise(struct bwn_mac *mac)
 5320 {
 5321         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
 5322         uint16_t tmp;
 5323         uint8_t noise[4];
 5324         uint8_t i, j;
 5325         int32_t average;
 5326 
 5327         if (mac->mac_phy.type != BWN_PHYTYPE_G)
 5328                 return;
 5329 
 5330         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
 5331         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
 5332         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
 5333             noise[3] == 0x7f)
 5334                 goto new;
 5335 
 5336         KASSERT(mac->mac_noise.noi_nsamples < 8,
 5337             ("%s:%d: fail", __func__, __LINE__));
 5338         i = mac->mac_noise.noi_nsamples;
 5339         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
 5340         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
 5341         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
 5342         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
 5343         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
 5344         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
 5345         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
 5346         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
 5347         mac->mac_noise.noi_nsamples++;
 5348         if (mac->mac_noise.noi_nsamples == 8) {
 5349                 average = 0;
 5350                 for (i = 0; i < 8; i++) {
 5351                         for (j = 0; j < 4; j++)
 5352                                 average += mac->mac_noise.noi_samples[i][j];
 5353                 }
 5354                 average = (((average / 32) * 125) + 64) / 128;
 5355                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
 5356                 if (tmp >= 8)
 5357                         average += 2;
 5358                 else
 5359                         average -= 25;
 5360                 average -= (tmp == 8) ? 72 : 48;
 5361 
 5362                 mac->mac_stats.link_noise = average;
 5363                 mac->mac_noise.noi_running = 0;
 5364                 return;
 5365         }
 5366 new:
 5367         bwn_noise_gensample(mac);
 5368 }
 5369 
 5370 static int
 5371 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
 5372 {
 5373         struct bwn_mac *mac = prq->prq_mac;
 5374         struct bwn_softc *sc = mac->mac_sc;
 5375         unsigned int i;
 5376 
 5377         BWN_ASSERT_LOCKED(sc);
 5378 
 5379         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
 5380                 return (0);
 5381 
 5382         for (i = 0; i < 5000; i++) {
 5383                 if (bwn_pio_rxeof(prq) == 0)
 5384                         break;
 5385         }
 5386         if (i >= 5000)
 5387                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
 5388         return ((i > 0) ? 1 : 0);
 5389 }
 5390 
 5391 static void
 5392 bwn_dma_rx(struct bwn_dma_ring *dr)
 5393 {
 5394         int slot, curslot;
 5395 
 5396         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
 5397         curslot = dr->get_curslot(dr);
 5398         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
 5399             ("%s:%d: fail", __func__, __LINE__));
 5400 
 5401         slot = dr->dr_curslot;
 5402         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
 5403                 bwn_dma_rxeof(dr, &slot);
 5404 
 5405         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
 5406             BUS_DMASYNC_PREWRITE);
 5407 
 5408         dr->set_curslot(dr, slot);
 5409         dr->dr_curslot = slot;
 5410 }
 5411 
 5412 static void
 5413 bwn_intr_txeof(struct bwn_mac *mac)
 5414 {
 5415         struct bwn_txstatus stat;
 5416         uint32_t stat0, stat1;
 5417         uint16_t tmp;
 5418 
 5419         BWN_ASSERT_LOCKED(mac->mac_sc);
 5420 
 5421         while (1) {
 5422                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
 5423                 if (!(stat0 & 0x00000001))
 5424                         break;
 5425                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
 5426 
 5427                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
 5428                     "%s: stat0=0x%08x, stat1=0x%08x\n",
 5429                     __func__,
 5430                     stat0,
 5431                     stat1);
 5432 
 5433                 stat.cookie = (stat0 >> 16);
 5434                 stat.seq = (stat1 & 0x0000ffff);
 5435                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
 5436                 tmp = (stat0 & 0x0000ffff);
 5437                 stat.framecnt = ((tmp & 0xf000) >> 12);
 5438                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
 5439                 stat.sreason = ((tmp & 0x001c) >> 2);
 5440                 stat.pm = (tmp & 0x0080) ? 1 : 0;
 5441                 stat.im = (tmp & 0x0040) ? 1 : 0;
 5442                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
 5443                 stat.ack = (tmp & 0x0002) ? 1 : 0;
 5444 
 5445                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
 5446                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
 5447                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
 5448                     __func__,
 5449                     stat.cookie,
 5450                     stat.seq,
 5451                     stat.phy_stat,
 5452                     stat.framecnt,
 5453                     stat.rtscnt,
 5454                     stat.sreason,
 5455                     stat.pm,
 5456                     stat.im,
 5457                     stat.ampdu,
 5458                     stat.ack);
 5459 
 5460                 bwn_handle_txeof(mac, &stat);
 5461         }
 5462 }
 5463 
 5464 static void
 5465 bwn_hwreset(void *arg, int npending)
 5466 {
 5467         struct bwn_mac *mac = arg;
 5468         struct bwn_softc *sc = mac->mac_sc;
 5469         int error = 0;
 5470         int prev_status;
 5471 
 5472         BWN_LOCK(sc);
 5473 
 5474         prev_status = mac->mac_status;
 5475         if (prev_status >= BWN_MAC_STATUS_STARTED)
 5476                 bwn_core_stop(mac);
 5477         if (prev_status >= BWN_MAC_STATUS_INITED)
 5478                 bwn_core_exit(mac);
 5479 
 5480         if (prev_status >= BWN_MAC_STATUS_INITED) {
 5481                 error = bwn_core_init(mac);
 5482                 if (error)
 5483                         goto out;
 5484         }
 5485         if (prev_status >= BWN_MAC_STATUS_STARTED)
 5486                 bwn_core_start(mac);
 5487 out:
 5488         if (error) {
 5489                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
 5490                 sc->sc_curmac = NULL;
 5491         }
 5492         BWN_UNLOCK(sc);
 5493 }
 5494 
 5495 static void
 5496 bwn_handle_fwpanic(struct bwn_mac *mac)
 5497 {
 5498         struct bwn_softc *sc = mac->mac_sc;
 5499         uint16_t reason;
 5500 
 5501         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
 5502         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
 5503 
 5504         if (reason == BWN_FWPANIC_RESTART)
 5505                 bwn_restart(mac, "ucode panic");
 5506 }
 5507 
 5508 static void
 5509 bwn_load_beacon0(struct bwn_mac *mac)
 5510 {
 5511 
 5512         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 5513 }
 5514 
 5515 static void
 5516 bwn_load_beacon1(struct bwn_mac *mac)
 5517 {
 5518 
 5519         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 5520 }
 5521 
 5522 static uint32_t
 5523 bwn_jssi_read(struct bwn_mac *mac)
 5524 {
 5525         uint32_t val = 0;
 5526 
 5527         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
 5528         val <<= 16;
 5529         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
 5530 
 5531         return (val);
 5532 }
 5533 
 5534 static void
 5535 bwn_noise_gensample(struct bwn_mac *mac)
 5536 {
 5537         uint32_t jssi = 0x7f7f7f7f;
 5538 
 5539         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
 5540         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
 5541         BWN_WRITE_4(mac, BWN_MACCMD,
 5542             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
 5543 }
 5544 
 5545 static int
 5546 bwn_dma_freeslot(struct bwn_dma_ring *dr)
 5547 {
 5548         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
 5549 
 5550         return (dr->dr_numslots - dr->dr_usedslot);
 5551 }
 5552 
 5553 static int
 5554 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
 5555 {
 5556         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
 5557 
 5558         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
 5559             ("%s:%d: fail", __func__, __LINE__));
 5560         if (slot == dr->dr_numslots - 1)
 5561                 return (0);
 5562         return (slot + 1);
 5563 }
 5564 
 5565 static void
 5566 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
 5567 {
 5568         struct bwn_mac *mac = dr->dr_mac;
 5569         struct bwn_softc *sc = mac->mac_sc;
 5570         struct bwn_dma *dma = &mac->mac_method.dma;
 5571         struct bwn_dmadesc_generic *desc;
 5572         struct bwn_dmadesc_meta *meta;
 5573         struct bwn_rxhdr4 *rxhdr;
 5574         struct mbuf *m;
 5575         uint32_t macstat;
 5576         int32_t tmp;
 5577         int cnt = 0;
 5578         uint16_t len;
 5579 
 5580         dr->getdesc(dr, *slot, &desc, &meta);
 5581 
 5582         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
 5583         m = meta->mt_m;
 5584 
 5585         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
 5586                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
 5587                 return;
 5588         }
 5589 
 5590         rxhdr = mtod(m, struct bwn_rxhdr4 *);
 5591         len = le16toh(rxhdr->frame_len);
 5592         if (len <= 0) {
 5593                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
 5594                 return;
 5595         }
 5596         if (bwn_dma_check_redzone(dr, m)) {
 5597                 device_printf(sc->sc_dev, "redzone error.\n");
 5598                 bwn_dma_set_redzone(dr, m);
 5599                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
 5600                     BUS_DMASYNC_PREWRITE);
 5601                 return;
 5602         }
 5603         if (len > dr->dr_rx_bufsize) {
 5604                 tmp = len;
 5605                 while (1) {
 5606                         dr->getdesc(dr, *slot, &desc, &meta);
 5607                         bwn_dma_set_redzone(dr, meta->mt_m);
 5608                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
 5609                             BUS_DMASYNC_PREWRITE);
 5610                         *slot = bwn_dma_nextslot(dr, *slot);
 5611                         cnt++;
 5612                         tmp -= dr->dr_rx_bufsize;
 5613                         if (tmp <= 0)
 5614                                 break;
 5615                 }
 5616                 device_printf(sc->sc_dev, "too small buffer "
 5617                        "(len %u buffer %u dropped %d)\n",
 5618                        len, dr->dr_rx_bufsize, cnt);
 5619                 return;
 5620         }
 5621 
 5622         switch (mac->mac_fw.fw_hdr_format) {
 5623         case BWN_FW_HDR_351:
 5624         case BWN_FW_HDR_410:
 5625                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
 5626                 break;
 5627         case BWN_FW_HDR_598:
 5628                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
 5629                 break;
 5630         }
 5631 
 5632         if (macstat & BWN_RX_MAC_FCSERR) {
 5633                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
 5634                         device_printf(sc->sc_dev, "RX drop\n");
 5635                         return;
 5636                 }
 5637         }
 5638 
 5639         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
 5640         m_adj(m, dr->dr_frameoffset);
 5641 
 5642         bwn_rxeof(dr->dr_mac, m, rxhdr);
 5643 }
 5644 
 5645 static void
 5646 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
 5647 {
 5648         struct bwn_softc *sc = mac->mac_sc;
 5649         struct bwn_stats *stats = &mac->mac_stats;
 5650 
 5651         BWN_ASSERT_LOCKED(mac->mac_sc);
 5652 
 5653         if (status->im)
 5654                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
 5655         if (status->ampdu)
 5656                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
 5657         if (status->rtscnt) {
 5658                 if (status->rtscnt == 0xf)
 5659                         stats->rtsfail++;
 5660                 else
 5661                         stats->rts++;
 5662         }
 5663 
 5664         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 5665                 bwn_dma_handle_txeof(mac, status);
 5666         } else {
 5667                 bwn_pio_handle_txeof(mac, status);
 5668         }
 5669 
 5670         bwn_phy_txpower_check(mac, 0);
 5671 }
 5672 
 5673 static uint8_t
 5674 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
 5675 {
 5676         struct bwn_mac *mac = prq->prq_mac;
 5677         struct bwn_softc *sc = mac->mac_sc;
 5678         struct bwn_rxhdr4 rxhdr;
 5679         struct mbuf *m;
 5680         uint32_t ctl32, macstat, v32;
 5681         unsigned int i, padding;
 5682         uint16_t ctl16, len, totlen, v16;
 5683         unsigned char *mp;
 5684         char *data;
 5685 
 5686         memset(&rxhdr, 0, sizeof(rxhdr));
 5687 
 5688         if (prq->prq_rev >= 8) {
 5689                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
 5690                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
 5691                         return (0);
 5692                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
 5693                     BWN_PIO8_RXCTL_FRAMEREADY);
 5694                 for (i = 0; i < 10; i++) {
 5695                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
 5696                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
 5697                                 goto ready;
 5698                         DELAY(10);
 5699                 }
 5700         } else {
 5701                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
 5702                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
 5703                         return (0);
 5704                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
 5705                     BWN_PIO_RXCTL_FRAMEREADY);
 5706                 for (i = 0; i < 10; i++) {
 5707                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
 5708                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
 5709                                 goto ready;
 5710                         DELAY(10);
 5711                 }
 5712         }
 5713         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
 5714         return (1);
 5715 ready:
 5716         if (prq->prq_rev >= 8) {
 5717                 bus_read_multi_4(sc->sc_mem_res,
 5718                     prq->prq_base + BWN_PIO8_RXDATA, (void *)&rxhdr,
 5719                     sizeof(rxhdr));
 5720         } else {
 5721                 bus_read_multi_2(sc->sc_mem_res,
 5722                     prq->prq_base + BWN_PIO_RXDATA, (void *)&rxhdr,
 5723                     sizeof(rxhdr));
 5724         }
 5725         len = le16toh(rxhdr.frame_len);
 5726         if (len > 0x700) {
 5727                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
 5728                 goto error;
 5729         }
 5730         if (len == 0) {
 5731                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
 5732                 goto error;
 5733         }
 5734 
 5735         switch (mac->mac_fw.fw_hdr_format) {
 5736         case BWN_FW_HDR_351:
 5737         case BWN_FW_HDR_410:
 5738                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
 5739                 break;
 5740         case BWN_FW_HDR_598:
 5741                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
 5742                 break;
 5743         }
 5744 
 5745         if (macstat & BWN_RX_MAC_FCSERR) {
 5746                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
 5747                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
 5748                         goto error;
 5749                 }
 5750         }
 5751 
 5752         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
 5753         totlen = len + padding;
 5754         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
 5755         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 5756         if (m == NULL) {
 5757                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
 5758                 goto error;
 5759         }
 5760         mp = mtod(m, unsigned char *);
 5761         if (prq->prq_rev >= 8) {
 5762                 bus_read_multi_4(sc->sc_mem_res,
 5763                     prq->prq_base + BWN_PIO8_RXDATA, (void *)mp, (totlen & ~3));
 5764                 if (totlen & 3) {
 5765                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
 5766                         data = &(mp[totlen - 1]);
 5767                         switch (totlen & 3) {
 5768                         case 3:
 5769                                 *data = (v32 >> 16);
 5770                                 data--;
 5771                         case 2:
 5772                                 *data = (v32 >> 8);
 5773                                 data--;
 5774                         case 1:
 5775                                 *data = v32;
 5776                         }
 5777                 }
 5778         } else {
 5779                 bus_read_multi_2(sc->sc_mem_res,
 5780                     prq->prq_base + BWN_PIO_RXDATA, (void *)mp, (totlen & ~1));
 5781                 if (totlen & 1) {
 5782                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
 5783                         mp[totlen - 1] = v16;
 5784                 }
 5785         }
 5786 
 5787         m->m_len = m->m_pkthdr.len = totlen;
 5788 
 5789         bwn_rxeof(prq->prq_mac, m, &rxhdr);
 5790 
 5791         return (1);
 5792 error:
 5793         if (prq->prq_rev >= 8)
 5794                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
 5795                     BWN_PIO8_RXCTL_DATAREADY);
 5796         else
 5797                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
 5798         return (1);
 5799 }
 5800 
 5801 static int
 5802 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
 5803     struct bwn_dmadesc_meta *meta, int init)
 5804 {
 5805         struct bwn_mac *mac = dr->dr_mac;
 5806         struct bwn_dma *dma = &mac->mac_method.dma;
 5807         struct bwn_rxhdr4 *hdr;
 5808         bus_dmamap_t map;
 5809         bus_addr_t paddr;
 5810         struct mbuf *m;
 5811         int error;
 5812 
 5813         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 5814         if (m == NULL) {
 5815                 error = ENOBUFS;
 5816 
 5817                 /*
 5818                  * If the NIC is up and running, we need to:
 5819                  * - Clear RX buffer's header.
 5820                  * - Restore RX descriptor settings.
 5821                  */
 5822                 if (init)
 5823                         return (error);
 5824                 else
 5825                         goto back;
 5826         }
 5827         m->m_len = m->m_pkthdr.len = MCLBYTES;
 5828 
 5829         bwn_dma_set_redzone(dr, m);
 5830 
 5831         /*
 5832          * Try to load RX buf into temporary DMA map
 5833          */
 5834         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
 5835             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
 5836         if (error) {
 5837                 m_freem(m);
 5838 
 5839                 /*
 5840                  * See the comment above
 5841                  */
 5842                 if (init)
 5843                         return (error);
 5844                 else
 5845                         goto back;
 5846         }
 5847 
 5848         if (!init)
 5849                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
 5850         meta->mt_m = m;
 5851         meta->mt_paddr = paddr;
 5852 
 5853         /*
 5854          * Swap RX buf's DMA map with the loaded temporary one
 5855          */
 5856         map = meta->mt_dmap;
 5857         meta->mt_dmap = dr->dr_spare_dmap;
 5858         dr->dr_spare_dmap = map;
 5859 
 5860 back:
 5861         /*
 5862          * Clear RX buf header
 5863          */
 5864         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
 5865         bzero(hdr, sizeof(*hdr));
 5866         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
 5867             BUS_DMASYNC_PREWRITE);
 5868 
 5869         /*
 5870          * Setup RX buf descriptor
 5871          */
 5872         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
 5873             sizeof(*hdr), 0, 0, 0);
 5874         return (error);
 5875 }
 5876 
 5877 static void
 5878 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
 5879                  bus_size_t mapsz __unused, int error)
 5880 {
 5881 
 5882         if (!error) {
 5883                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
 5884                 *((bus_addr_t *)arg) = seg->ds_addr;
 5885         }
 5886 }
 5887 
 5888 static int
 5889 bwn_hwrate2ieeerate(int rate)
 5890 {
 5891 
 5892         switch (rate) {
 5893         case BWN_CCK_RATE_1MB:
 5894                 return (2);
 5895         case BWN_CCK_RATE_2MB:
 5896                 return (4);
 5897         case BWN_CCK_RATE_5MB:
 5898                 return (11);
 5899         case BWN_CCK_RATE_11MB:
 5900                 return (22);
 5901         case BWN_OFDM_RATE_6MB:
 5902                 return (12);
 5903         case BWN_OFDM_RATE_9MB:
 5904                 return (18);
 5905         case BWN_OFDM_RATE_12MB:
 5906                 return (24);
 5907         case BWN_OFDM_RATE_18MB:
 5908                 return (36);
 5909         case BWN_OFDM_RATE_24MB:
 5910                 return (48);
 5911         case BWN_OFDM_RATE_36MB:
 5912                 return (72);
 5913         case BWN_OFDM_RATE_48MB:
 5914                 return (96);
 5915         case BWN_OFDM_RATE_54MB:
 5916                 return (108);
 5917         default:
 5918                 printf("Ooops\n");
 5919                 return (0);
 5920         }
 5921 }
 5922 
 5923 /*
 5924  * Post process the RX provided RSSI.
 5925  *
 5926  * Valid for A, B, G, LP PHYs.
 5927  */
 5928 static int8_t
 5929 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
 5930     int ofdm, int adjust_2053, int adjust_2050)
 5931 {
 5932         struct bwn_phy *phy = &mac->mac_phy;
 5933         struct bwn_phy_g *gphy = &phy->phy_g;
 5934         int tmp;
 5935 
 5936         switch (phy->rf_ver) {
 5937         case 0x2050:
 5938                 if (ofdm) {
 5939                         tmp = in_rssi;
 5940                         if (tmp > 127)
 5941                                 tmp -= 256;
 5942                         tmp = tmp * 73 / 64;
 5943                         if (adjust_2050)
 5944                                 tmp += 25;
 5945                         else
 5946                                 tmp -= 3;
 5947                 } else {
 5948                         if (mac->mac_sc->sc_board_info.board_flags
 5949                             & BHND_BFL_ADCDIV) {
 5950                                 if (in_rssi > 63)
 5951                                         in_rssi = 63;
 5952                                 tmp = gphy->pg_nrssi_lt[in_rssi];
 5953                                 tmp = (31 - tmp) * -131 / 128 - 57;
 5954                         } else {
 5955                                 tmp = in_rssi;
 5956                                 tmp = (31 - tmp) * -149 / 128 - 68;
 5957                         }
 5958                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
 5959                                 tmp += 25;
 5960                 }
 5961                 break;
 5962         case 0x2060:
 5963                 if (in_rssi > 127)
 5964                         tmp = in_rssi - 256;
 5965                 else
 5966                         tmp = in_rssi;
 5967                 break;
 5968         default:
 5969                 tmp = in_rssi;
 5970                 tmp = (tmp - 11) * 103 / 64;
 5971                 if (adjust_2053)
 5972                         tmp -= 109;
 5973                 else
 5974                         tmp -= 83;
 5975         }
 5976 
 5977         return (tmp);
 5978 }
 5979 
 5980 static void
 5981 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
 5982 {
 5983         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
 5984         struct bwn_plcp6 *plcp;
 5985         struct bwn_softc *sc = mac->mac_sc;
 5986         struct ieee80211_frame_min *wh;
 5987         struct ieee80211_node *ni;
 5988         struct ieee80211com *ic = &sc->sc_ic;
 5989         uint32_t macstat;
 5990         int padding, rate, rssi = 0, noise = 0;
 5991         uint16_t phytype, phystat0, phystat3, chanstat;
 5992         unsigned char *mp = mtod(m, unsigned char *);
 5993 
 5994         BWN_ASSERT_LOCKED(sc);
 5995 
 5996         phystat0 = le16toh(rxhdr->phy_status0);
 5997 
 5998         /*
 5999          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
 6000          * used for LP-PHY.
 6001          */
 6002         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
 6003 
 6004         switch (mac->mac_fw.fw_hdr_format) {
 6005         case BWN_FW_HDR_351:
 6006         case BWN_FW_HDR_410:
 6007                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
 6008                 chanstat = le16toh(rxhdr->ps4.r351.channel);
 6009                 break;
 6010         case BWN_FW_HDR_598:
 6011                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
 6012                 chanstat = le16toh(rxhdr->ps4.r598.channel);
 6013                 break;
 6014         }
 6015 
 6016         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
 6017 
 6018         if (macstat & BWN_RX_MAC_FCSERR)
 6019                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
 6020         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
 6021                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
 6022         if (macstat & BWN_RX_MAC_DECERR)
 6023                 goto drop;
 6024 
 6025         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
 6026         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
 6027                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
 6028                     m->m_pkthdr.len);
 6029                 goto drop;
 6030         }
 6031         plcp = (struct bwn_plcp6 *)(mp + padding);
 6032         m_adj(m, sizeof(struct bwn_plcp6) + padding);
 6033         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
 6034                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
 6035                     m->m_pkthdr.len);
 6036                 goto drop;
 6037         }
 6038         wh = mtod(m, struct ieee80211_frame_min *);
 6039 
 6040         if (macstat & BWN_RX_MAC_DEC) {
 6041                 DPRINTF(sc, BWN_DEBUG_HWCRYPTO,
 6042                     "RX decryption attempted (old %d keyidx %#x)\n",
 6043                     BWN_ISOLDFMT(mac),
 6044                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
 6045         }
 6046 
 6047         if (phystat0 & BWN_RX_PHYST0_OFDM)
 6048                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
 6049                     phytype == BWN_PHYTYPE_A);
 6050         else
 6051                 rate = bwn_plcp_get_cckrate(mac, plcp);
 6052         if (rate == -1) {
 6053                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
 6054                         goto drop;
 6055         }
 6056         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
 6057 
 6058         /* rssi/noise */
 6059         switch (phytype) {
 6060         case BWN_PHYTYPE_A:
 6061         case BWN_PHYTYPE_B:
 6062         case BWN_PHYTYPE_G:
 6063         case BWN_PHYTYPE_LP:
 6064                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
 6065                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
 6066                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
 6067                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
 6068                 break;
 6069         case BWN_PHYTYPE_N:
 6070                 /* Broadcom has code for min/avg, but always used max */
 6071                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
 6072                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
 6073                 else
 6074                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
 6075 #if 0
 6076                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
 6077                     "%s: power0=%d, power1=%d, power2=%d\n",
 6078                     __func__,
 6079                     rxhdr->phy.n.power0,
 6080                     rxhdr->phy.n.power1,
 6081                     rxhdr->ps2.n.power2);
 6082 #endif
 6083                 break;
 6084         default:
 6085                 /* XXX TODO: implement rssi for other PHYs */
 6086                 break;
 6087         }
 6088 
 6089         /*
 6090          * RSSI here is absolute, not relative to the noise floor.
 6091          */
 6092         noise = mac->mac_stats.link_noise;
 6093         rssi = rssi - noise;
 6094 
 6095         /* RX radio tap */
 6096         if (ieee80211_radiotap_active(ic))
 6097                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
 6098         m_adj(m, -IEEE80211_CRC_LEN);
 6099 
 6100         BWN_UNLOCK(sc);
 6101 
 6102         ni = ieee80211_find_rxnode(ic, wh);
 6103         if (ni != NULL) {
 6104                 ieee80211_input(ni, m, rssi, noise);
 6105                 ieee80211_free_node(ni);
 6106         } else
 6107                 ieee80211_input_all(ic, m, rssi, noise);
 6108 
 6109         BWN_LOCK(sc);
 6110         return;
 6111 drop:
 6112         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
 6113 }
 6114 
 6115 static void
 6116 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
 6117     const struct bwn_txstatus *status)
 6118 {
 6119         struct ieee80211_ratectl_tx_status txs;
 6120         int retrycnt = 0;
 6121 
 6122         /*
 6123          * If we don't get an ACK, then we should log the
 6124          * full framecnt.  That may be 0 if it's a PHY
 6125          * failure, so ensure that gets logged as some
 6126          * retry attempt.
 6127          */
 6128         txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
 6129         if (status->ack) {
 6130                 txs.status = IEEE80211_RATECTL_TX_SUCCESS;
 6131                 retrycnt = status->framecnt - 1;
 6132         } else {
 6133                 txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
 6134                 retrycnt = status->framecnt;
 6135                 if (retrycnt == 0)
 6136                         retrycnt = 1;
 6137         }
 6138         txs.long_retries = retrycnt;
 6139         ieee80211_ratectl_tx_complete(ni, &txs);
 6140 }
 6141 
 6142 static void
 6143 bwn_dma_handle_txeof(struct bwn_mac *mac,
 6144     const struct bwn_txstatus *status)
 6145 {
 6146         struct bwn_dma *dma = &mac->mac_method.dma;
 6147         struct bwn_dma_ring *dr;
 6148         struct bwn_dmadesc_generic *desc;
 6149         struct bwn_dmadesc_meta *meta;
 6150         struct bwn_softc *sc = mac->mac_sc;
 6151         int slot;
 6152 
 6153         BWN_ASSERT_LOCKED(sc);
 6154 
 6155         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
 6156         if (dr == NULL) {
 6157                 device_printf(sc->sc_dev, "failed to parse cookie\n");
 6158                 return;
 6159         }
 6160         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
 6161 
 6162         while (1) {
 6163                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
 6164                     ("%s:%d: fail", __func__, __LINE__));
 6165                 dr->getdesc(dr, slot, &desc, &meta);
 6166 
 6167                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
 6168                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
 6169                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
 6170                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
 6171 
 6172                 if (meta->mt_islast) {
 6173                         KASSERT(meta->mt_m != NULL,
 6174                             ("%s:%d: fail", __func__, __LINE__));
 6175 
 6176                         bwn_ratectl_tx_complete(meta->mt_ni, status);
 6177                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
 6178                         meta->mt_ni = NULL;
 6179                         meta->mt_m = NULL;
 6180                 } else
 6181                         KASSERT(meta->mt_m == NULL,
 6182                             ("%s:%d: fail", __func__, __LINE__));
 6183 
 6184                 dr->dr_usedslot--;
 6185                 if (meta->mt_islast)
 6186                         break;
 6187                 slot = bwn_dma_nextslot(dr, slot);
 6188         }
 6189         sc->sc_watchdog_timer = 0;
 6190         if (dr->dr_stop) {
 6191                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
 6192                     ("%s:%d: fail", __func__, __LINE__));
 6193                 dr->dr_stop = 0;
 6194         }
 6195 }
 6196 
 6197 static void
 6198 bwn_pio_handle_txeof(struct bwn_mac *mac,
 6199     const struct bwn_txstatus *status)
 6200 {
 6201         struct bwn_pio_txqueue *tq;
 6202         struct bwn_pio_txpkt *tp = NULL;
 6203         struct bwn_softc *sc = mac->mac_sc;
 6204 
 6205         BWN_ASSERT_LOCKED(sc);
 6206 
 6207         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
 6208         if (tq == NULL)
 6209                 return;
 6210 
 6211         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 6212         tq->tq_free++;
 6213 
 6214         if (tp->tp_ni != NULL) {
 6215                 /*
 6216                  * Do any tx complete callback.  Note this must
 6217                  * be done before releasing the node reference.
 6218                  */
 6219                 bwn_ratectl_tx_complete(tp->tp_ni, status);
 6220         }
 6221         ieee80211_tx_complete(tp->tp_ni, tp->tp_m, 0);
 6222         tp->tp_ni = NULL;
 6223         tp->tp_m = NULL;
 6224         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
 6225 
 6226         sc->sc_watchdog_timer = 0;
 6227 }
 6228 
 6229 static void
 6230 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
 6231 {
 6232         struct bwn_softc *sc = mac->mac_sc;
 6233         struct bwn_phy *phy = &mac->mac_phy;
 6234         struct ieee80211com *ic = &sc->sc_ic;
 6235         unsigned long now;
 6236         bwn_txpwr_result_t result;
 6237 
 6238         BWN_GETTIME(now);
 6239 
 6240         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
 6241                 return;
 6242         phy->nexttime = now + 2 * 1000;
 6243 
 6244         if (sc->sc_board_info.board_vendor == PCI_VENDOR_BROADCOM &&
 6245             sc->sc_board_info.board_type == BHND_BOARD_BU4306)
 6246                 return;
 6247 
 6248         if (phy->recalc_txpwr != NULL) {
 6249                 result = phy->recalc_txpwr(mac,
 6250                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
 6251                 if (result == BWN_TXPWR_RES_DONE)
 6252                         return;
 6253                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
 6254                     ("%s: fail", __func__));
 6255                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
 6256 
 6257                 ieee80211_runtask(ic, &mac->mac_txpower);
 6258         }
 6259 }
 6260 
 6261 static uint16_t
 6262 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
 6263 {
 6264 
 6265         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
 6266 }
 6267 
 6268 static uint32_t
 6269 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
 6270 {
 6271 
 6272         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
 6273 }
 6274 
 6275 static void
 6276 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
 6277 {
 6278 
 6279         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
 6280 }
 6281 
 6282 static void
 6283 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
 6284 {
 6285 
 6286         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
 6287 }
 6288 
 6289 static int
 6290 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
 6291 {
 6292 
 6293         switch (rate) {
 6294         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 6295         case 12:
 6296                 return (BWN_OFDM_RATE_6MB);
 6297         case 18:
 6298                 return (BWN_OFDM_RATE_9MB);
 6299         case 24:
 6300                 return (BWN_OFDM_RATE_12MB);
 6301         case 36:
 6302                 return (BWN_OFDM_RATE_18MB);
 6303         case 48:
 6304                 return (BWN_OFDM_RATE_24MB);
 6305         case 72:
 6306                 return (BWN_OFDM_RATE_36MB);
 6307         case 96:
 6308                 return (BWN_OFDM_RATE_48MB);
 6309         case 108:
 6310                 return (BWN_OFDM_RATE_54MB);
 6311         /* CCK rates (NB: not IEEE std, device-specific) */
 6312         case 2:
 6313                 return (BWN_CCK_RATE_1MB);
 6314         case 4:
 6315                 return (BWN_CCK_RATE_2MB);
 6316         case 11:
 6317                 return (BWN_CCK_RATE_5MB);
 6318         case 22:
 6319                 return (BWN_CCK_RATE_11MB);
 6320         }
 6321 
 6322         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
 6323         return (BWN_CCK_RATE_1MB);
 6324 }
 6325 
 6326 static uint16_t
 6327 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
 6328 {
 6329         struct bwn_phy *phy = &mac->mac_phy;
 6330         uint16_t control = 0;
 6331         uint16_t bw;
 6332 
 6333         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
 6334         bw = BWN_TXH_PHY1_BW_20;
 6335 
 6336         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
 6337                 control = bw;
 6338         } else {
 6339                 control = bw;
 6340                 /* Figure out coding rate and modulation */
 6341                 /* XXX TODO: table-ize, for MCS transmit */
 6342                 /* Note: this is BWN_*_RATE values */
 6343                 switch (bitrate) {
 6344                 case BWN_CCK_RATE_1MB:
 6345                         control |= 0;
 6346                         break;
 6347                 case BWN_CCK_RATE_2MB:
 6348                         control |= 1;
 6349                         break;
 6350                 case BWN_CCK_RATE_5MB:
 6351                         control |= 2;
 6352                         break;
 6353                 case BWN_CCK_RATE_11MB:
 6354                         control |= 3;
 6355                         break;
 6356                 case BWN_OFDM_RATE_6MB:
 6357                         control |= BWN_TXH_PHY1_CRATE_1_2;
 6358                         control |= BWN_TXH_PHY1_MODUL_BPSK;
 6359                         break;
 6360                 case BWN_OFDM_RATE_9MB:
 6361                         control |= BWN_TXH_PHY1_CRATE_3_4;
 6362                         control |= BWN_TXH_PHY1_MODUL_BPSK;
 6363                         break;
 6364                 case BWN_OFDM_RATE_12MB:
 6365                         control |= BWN_TXH_PHY1_CRATE_1_2;
 6366                         control |= BWN_TXH_PHY1_MODUL_QPSK;
 6367                         break;
 6368                 case BWN_OFDM_RATE_18MB:
 6369                         control |= BWN_TXH_PHY1_CRATE_3_4;
 6370                         control |= BWN_TXH_PHY1_MODUL_QPSK;
 6371                         break;
 6372                 case BWN_OFDM_RATE_24MB:
 6373                         control |= BWN_TXH_PHY1_CRATE_1_2;
 6374                         control |= BWN_TXH_PHY1_MODUL_QAM16;
 6375                         break;
 6376                 case BWN_OFDM_RATE_36MB:
 6377                         control |= BWN_TXH_PHY1_CRATE_3_4;
 6378                         control |= BWN_TXH_PHY1_MODUL_QAM16;
 6379                         break;
 6380                 case BWN_OFDM_RATE_48MB:
 6381                         control |= BWN_TXH_PHY1_CRATE_1_2;
 6382                         control |= BWN_TXH_PHY1_MODUL_QAM64;
 6383                         break;
 6384                 case BWN_OFDM_RATE_54MB:
 6385                         control |= BWN_TXH_PHY1_CRATE_3_4;
 6386                         control |= BWN_TXH_PHY1_MODUL_QAM64;
 6387                         break;
 6388                 default:
 6389                         break;
 6390                 }
 6391                 control |= BWN_TXH_PHY1_MODE_SISO;
 6392         }
 6393 
 6394         return control;
 6395 }
 6396 
 6397 static int
 6398 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
 6399     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
 6400 {
 6401         const struct bwn_phy *phy = &mac->mac_phy;
 6402         struct bwn_softc *sc = mac->mac_sc;
 6403         struct ieee80211_frame *wh;
 6404         struct ieee80211_frame *protwh;
 6405         const struct ieee80211_txparam *tp = ni->ni_txparms;
 6406         struct ieee80211vap *vap = ni->ni_vap;
 6407         struct ieee80211com *ic = &sc->sc_ic;
 6408         struct mbuf *mprot;
 6409         uint8_t *prot_ptr;
 6410         unsigned int len;
 6411         uint32_t macctl = 0;
 6412         int rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
 6413         uint16_t phyctl = 0;
 6414         uint8_t rate, rate_fb;
 6415         int fill_phy_ctl1 = 0;
 6416 
 6417         wh = mtod(m, struct ieee80211_frame *);
 6418         memset(txhdr, 0, sizeof(*txhdr));
 6419 
 6420         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 6421         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
 6422         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
 6423 
 6424         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
 6425             || (phy->type == BWN_PHYTYPE_HT))
 6426                 fill_phy_ctl1 = 1;
 6427 
 6428         /*
 6429          * Find TX rate
 6430          */
 6431         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
 6432                 rate = rate_fb = tp->mgmtrate;
 6433         else if (ismcast)
 6434                 rate = rate_fb = tp->mcastrate;
 6435         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
 6436                 rate = rate_fb = tp->ucastrate;
 6437         else {
 6438                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
 6439                 rate = ni->ni_txrate;
 6440 
 6441                 if (rix > 0)
 6442                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
 6443                             IEEE80211_RATE_VAL;
 6444                 else
 6445                         rate_fb = rate;
 6446         }
 6447 
 6448         sc->sc_tx_rate = rate;
 6449 
 6450         /* Note: this maps the select ieee80211 rate to hardware rate */
 6451         rate = bwn_ieeerate2hwrate(sc, rate);
 6452         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
 6453 
 6454         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
 6455             bwn_plcp_getcck(rate);
 6456         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
 6457         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
 6458 
 6459         /* XXX rate/rate_fb is the hardware rate */
 6460         if ((rate_fb == rate) ||
 6461             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
 6462             (*(u_int16_t *)wh->i_dur == htole16(0)))
 6463                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
 6464         else
 6465                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
 6466                     m->m_pkthdr.len, rate, isshort);
 6467 
 6468         /* XXX TX encryption */
 6469 
 6470         switch (mac->mac_fw.fw_hdr_format) {
 6471         case BWN_FW_HDR_351:
 6472                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
 6473                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
 6474                 break;
 6475         case BWN_FW_HDR_410:
 6476                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
 6477                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
 6478                 break;
 6479         case BWN_FW_HDR_598:
 6480                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
 6481                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
 6482                 break;
 6483         }
 6484 
 6485         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
 6486             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
 6487 
 6488         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
 6489             BWN_TX_EFT_FB_CCK;
 6490         txhdr->chan = phy->chan;
 6491         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
 6492             BWN_TX_PHY_ENC_CCK;
 6493         /* XXX preamble? obey net80211 */
 6494         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
 6495              rate == BWN_CCK_RATE_11MB))
 6496                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
 6497 
 6498         if (! phy->gmode)
 6499                 macctl |= BWN_TX_MAC_5GHZ;
 6500 
 6501         /* XXX TX antenna selection */
 6502 
 6503         switch (bwn_antenna_sanitize(mac, 0)) {
 6504         case 0:
 6505                 phyctl |= BWN_TX_PHY_ANT01AUTO;
 6506                 break;
 6507         case 1:
 6508                 phyctl |= BWN_TX_PHY_ANT0;
 6509                 break;
 6510         case 2:
 6511                 phyctl |= BWN_TX_PHY_ANT1;
 6512                 break;
 6513         case 3:
 6514                 phyctl |= BWN_TX_PHY_ANT2;
 6515                 break;
 6516         case 4:
 6517                 phyctl |= BWN_TX_PHY_ANT3;
 6518                 break;
 6519         default:
 6520                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 6521         }
 6522 
 6523         if (!ismcast)
 6524                 macctl |= BWN_TX_MAC_ACK;
 6525 
 6526         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
 6527         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 6528             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
 6529                 macctl |= BWN_TX_MAC_LONGFRAME;
 6530 
 6531         if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
 6532             ic->ic_protmode != IEEE80211_PROT_NONE) {
 6533                 /* Note: don't fall back to CCK rates for 5G */
 6534                 if (phy->gmode)
 6535                         rts_rate = BWN_CCK_RATE_1MB;
 6536                 else
 6537                         rts_rate = BWN_OFDM_RATE_6MB;
 6538                 rts_rate_fb = bwn_get_fbrate(rts_rate);
 6539 
 6540                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
 6541                 mprot = ieee80211_alloc_prot(ni, m, rate, ic->ic_protmode);
 6542                 if (mprot == NULL) {
 6543                         if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
 6544                         device_printf(sc->sc_dev,
 6545                             "could not allocate mbuf for protection mode %d\n",
 6546                             ic->ic_protmode);
 6547                         return (ENOBUFS);
 6548                 }
 6549 
 6550                 switch (mac->mac_fw.fw_hdr_format) {
 6551                 case BWN_FW_HDR_351:
 6552                         prot_ptr = txhdr->body.r351.rts_frame;
 6553                         break;
 6554                 case BWN_FW_HDR_410:
 6555                         prot_ptr = txhdr->body.r410.rts_frame;
 6556                         break;
 6557                 case BWN_FW_HDR_598:
 6558                         prot_ptr = txhdr->body.r598.rts_frame;
 6559                         break;
 6560                 }
 6561 
 6562                 bcopy(mtod(mprot, uint8_t *), prot_ptr, mprot->m_pkthdr.len);
 6563                 m_freem(mprot);
 6564 
 6565                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
 6566                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
 6567                         len = sizeof(struct ieee80211_frame_cts);
 6568                 } else {
 6569                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
 6570                         len = sizeof(struct ieee80211_frame_rts);
 6571                 }
 6572                 len += IEEE80211_CRC_LEN;
 6573 
 6574                 switch (mac->mac_fw.fw_hdr_format) {
 6575                 case BWN_FW_HDR_351:
 6576                         bwn_plcp_genhdr((struct bwn_plcp4 *)
 6577                             &txhdr->body.r351.rts_plcp, len, rts_rate);
 6578                         break;
 6579                 case BWN_FW_HDR_410:
 6580                         bwn_plcp_genhdr((struct bwn_plcp4 *)
 6581                             &txhdr->body.r410.rts_plcp, len, rts_rate);
 6582                         break;
 6583                 case BWN_FW_HDR_598:
 6584                         bwn_plcp_genhdr((struct bwn_plcp4 *)
 6585                             &txhdr->body.r598.rts_plcp, len, rts_rate);
 6586                         break;
 6587                 }
 6588 
 6589                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
 6590                     rts_rate_fb);
 6591 
 6592                 switch (mac->mac_fw.fw_hdr_format) {
 6593                 case BWN_FW_HDR_351:
 6594                         protwh = (struct ieee80211_frame *)
 6595                             &txhdr->body.r351.rts_frame;
 6596                         break;
 6597                 case BWN_FW_HDR_410:
 6598                         protwh = (struct ieee80211_frame *)
 6599                             &txhdr->body.r410.rts_frame;
 6600                         break;
 6601                 case BWN_FW_HDR_598:
 6602                         protwh = (struct ieee80211_frame *)
 6603                             &txhdr->body.r598.rts_frame;
 6604                         break;
 6605                 }
 6606 
 6607                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
 6608 
 6609                 if (BWN_ISOFDMRATE(rts_rate)) {
 6610                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
 6611                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
 6612                 } else {
 6613                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
 6614                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
 6615                 }
 6616                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
 6617                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
 6618 
 6619                 if (fill_phy_ctl1) {
 6620                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
 6621                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
 6622                 }
 6623         }
 6624 
 6625         if (fill_phy_ctl1) {
 6626                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
 6627                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
 6628         }
 6629 
 6630         switch (mac->mac_fw.fw_hdr_format) {
 6631         case BWN_FW_HDR_351:
 6632                 txhdr->body.r351.cookie = htole16(cookie);
 6633                 break;
 6634         case BWN_FW_HDR_410:
 6635                 txhdr->body.r410.cookie = htole16(cookie);
 6636                 break;
 6637         case BWN_FW_HDR_598:
 6638                 txhdr->body.r598.cookie = htole16(cookie);
 6639                 break;
 6640         }
 6641 
 6642         txhdr->macctl = htole32(macctl);
 6643         txhdr->phyctl = htole16(phyctl);
 6644 
 6645         /*
 6646          * TX radio tap
 6647          */
 6648         if (ieee80211_radiotap_active_vap(vap)) {
 6649                 sc->sc_tx_th.wt_flags = 0;
 6650                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
 6651                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 6652                 if (isshort &&
 6653                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
 6654                      rate == BWN_CCK_RATE_11MB))
 6655                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
 6656                 sc->sc_tx_th.wt_rate = rate;
 6657 
 6658                 ieee80211_radiotap_tx(vap, m);
 6659         }
 6660 
 6661         return (0);
 6662 }
 6663 
 6664 static void
 6665 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
 6666     const uint8_t rate)
 6667 {
 6668         uint32_t d, plen;
 6669         uint8_t *raw = plcp->o.raw;
 6670 
 6671         if (BWN_ISOFDMRATE(rate)) {
 6672                 d = bwn_plcp_getofdm(rate);
 6673                 KASSERT(!(octets & 0xf000),
 6674                     ("%s:%d: fail", __func__, __LINE__));
 6675                 d |= (octets << 5);
 6676                 plcp->o.data = htole32(d);
 6677         } else {
 6678                 plen = octets * 16 / rate;
 6679                 if ((octets * 16 % rate) > 0) {
 6680                         plen++;
 6681                         if ((rate == BWN_CCK_RATE_11MB)
 6682                             && ((octets * 8 % 11) < 4)) {
 6683                                 raw[1] = 0x84;
 6684                         } else
 6685                                 raw[1] = 0x04;
 6686                 } else
 6687                         raw[1] = 0x04;
 6688                 plcp->o.data |= htole32(plen << 16);
 6689                 raw[0] = bwn_plcp_getcck(rate);
 6690         }
 6691 }
 6692 
 6693 static uint8_t
 6694 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
 6695 {
 6696         struct bwn_softc *sc = mac->mac_sc;
 6697         uint8_t mask;
 6698 
 6699         if (n == 0)
 6700                 return (0);
 6701         if (mac->mac_phy.gmode)
 6702                 mask = sc->sc_ant2g;
 6703         else
 6704                 mask = sc->sc_ant5g;
 6705         if (!(mask & (1 << (n - 1))))
 6706                 return (0);
 6707         return (n);
 6708 }
 6709 
 6710 /*
 6711  * Return a fallback rate for the given rate.
 6712  *
 6713  * Note: Don't fall back from OFDM to CCK.
 6714  */
 6715 static uint8_t
 6716 bwn_get_fbrate(uint8_t bitrate)
 6717 {
 6718         switch (bitrate) {
 6719         /* CCK */
 6720         case BWN_CCK_RATE_1MB:
 6721                 return (BWN_CCK_RATE_1MB);
 6722         case BWN_CCK_RATE_2MB:
 6723                 return (BWN_CCK_RATE_1MB);
 6724         case BWN_CCK_RATE_5MB:
 6725                 return (BWN_CCK_RATE_2MB);
 6726         case BWN_CCK_RATE_11MB:
 6727                 return (BWN_CCK_RATE_5MB);
 6728 
 6729         /* OFDM */
 6730         case BWN_OFDM_RATE_6MB:
 6731                 return (BWN_OFDM_RATE_6MB);
 6732         case BWN_OFDM_RATE_9MB:
 6733                 return (BWN_OFDM_RATE_6MB);
 6734         case BWN_OFDM_RATE_12MB:
 6735                 return (BWN_OFDM_RATE_9MB);
 6736         case BWN_OFDM_RATE_18MB:
 6737                 return (BWN_OFDM_RATE_12MB);
 6738         case BWN_OFDM_RATE_24MB:
 6739                 return (BWN_OFDM_RATE_18MB);
 6740         case BWN_OFDM_RATE_36MB:
 6741                 return (BWN_OFDM_RATE_24MB);
 6742         case BWN_OFDM_RATE_48MB:
 6743                 return (BWN_OFDM_RATE_36MB);
 6744         case BWN_OFDM_RATE_54MB:
 6745                 return (BWN_OFDM_RATE_48MB);
 6746         }
 6747         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 6748         return (0);
 6749 }
 6750 
 6751 static uint32_t
 6752 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
 6753     uint32_t ctl, const void *_data, int len)
 6754 {
 6755         struct bwn_softc *sc = mac->mac_sc;
 6756         uint32_t value = 0;
 6757         const uint8_t *data = _data;
 6758 
 6759         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
 6760             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
 6761         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
 6762 
 6763         bus_write_multi_4(sc->sc_mem_res, tq->tq_base + BWN_PIO8_TXDATA,
 6764             __DECONST(void *, data), (len & ~3));
 6765         if (len & 3) {
 6766                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
 6767                     BWN_PIO8_TXCTL_24_31);
 6768                 data = &(data[len - 1]);
 6769                 switch (len & 3) {
 6770                 case 3:
 6771                         ctl |= BWN_PIO8_TXCTL_16_23;
 6772                         value |= (uint32_t)(*data) << 16;
 6773                         data--;
 6774                 case 2:
 6775                         ctl |= BWN_PIO8_TXCTL_8_15;
 6776                         value |= (uint32_t)(*data) << 8;
 6777                         data--;
 6778                 case 1:
 6779                         value |= (uint32_t)(*data);
 6780                 }
 6781                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
 6782                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
 6783         }
 6784 
 6785         return (ctl);
 6786 }
 6787 
 6788 static void
 6789 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
 6790     uint16_t offset, uint32_t value)
 6791 {
 6792 
 6793         BWN_WRITE_4(mac, tq->tq_base + offset, value);
 6794 }
 6795 
 6796 static uint16_t
 6797 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
 6798     uint16_t ctl, const void *_data, int len)
 6799 {
 6800         struct bwn_softc *sc = mac->mac_sc;
 6801         const uint8_t *data = _data;
 6802 
 6803         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
 6804         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
 6805 
 6806         bus_write_multi_2(sc->sc_mem_res, tq->tq_base + BWN_PIO_TXDATA,
 6807             __DECONST(void *, data), (len & ~1));
 6808         if (len & 1) {
 6809                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
 6810                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
 6811                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
 6812         }
 6813 
 6814         return (ctl);
 6815 }
 6816 
 6817 static uint16_t
 6818 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
 6819     uint16_t ctl, struct mbuf *m0)
 6820 {
 6821         int i, j = 0;
 6822         uint16_t data = 0;
 6823         const uint8_t *buf;
 6824         struct mbuf *m = m0;
 6825 
 6826         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
 6827         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
 6828 
 6829         for (; m != NULL; m = m->m_next) {
 6830                 buf = mtod(m, const uint8_t *);
 6831                 for (i = 0; i < m->m_len; i++) {
 6832                         if (!((j++) % 2))
 6833                                 data |= buf[i];
 6834                         else {
 6835                                 data |= (buf[i] << 8);
 6836                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
 6837                                 data = 0;
 6838                         }
 6839                 }
 6840         }
 6841         if (m0->m_pkthdr.len % 2) {
 6842                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
 6843                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
 6844                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
 6845         }
 6846 
 6847         return (ctl);
 6848 }
 6849 
 6850 static void
 6851 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
 6852 {
 6853 
 6854         /* XXX should exit if 5GHz band .. */
 6855         if (mac->mac_phy.type != BWN_PHYTYPE_G)
 6856                 return;
 6857 
 6858         BWN_WRITE_2(mac, 0x684, 510 + time);
 6859         /* Disabled in Linux b43, can adversely effect performance */
 6860 #if 0
 6861         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
 6862 #endif
 6863 }
 6864 
 6865 static struct bwn_dma_ring *
 6866 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
 6867 {
 6868 
 6869         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
 6870                 return (mac->mac_method.dma.wme[WME_AC_BE]);
 6871 
 6872         switch (prio) {
 6873         case 3:
 6874                 return (mac->mac_method.dma.wme[WME_AC_VO]);
 6875         case 2:
 6876                 return (mac->mac_method.dma.wme[WME_AC_VI]);
 6877         case 0:
 6878                 return (mac->mac_method.dma.wme[WME_AC_BE]);
 6879         case 1:
 6880                 return (mac->mac_method.dma.wme[WME_AC_BK]);
 6881         }
 6882         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
 6883         return (NULL);
 6884 }
 6885 
 6886 static int
 6887 bwn_dma_getslot(struct bwn_dma_ring *dr)
 6888 {
 6889         int slot;
 6890 
 6891         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
 6892 
 6893         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
 6894         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
 6895         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
 6896 
 6897         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
 6898         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
 6899         dr->dr_curslot = slot;
 6900         dr->dr_usedslot++;
 6901 
 6902         return (slot);
 6903 }
 6904 
 6905 static struct bwn_pio_txqueue *
 6906 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
 6907     struct bwn_pio_txpkt **pack)
 6908 {
 6909         struct bwn_pio *pio = &mac->mac_method.pio;
 6910         struct bwn_pio_txqueue *tq = NULL;
 6911         unsigned int index;
 6912 
 6913         switch (cookie & 0xf000) {
 6914         case 0x1000:
 6915                 tq = &pio->wme[WME_AC_BK];
 6916                 break;
 6917         case 0x2000:
 6918                 tq = &pio->wme[WME_AC_BE];
 6919                 break;
 6920         case 0x3000:
 6921                 tq = &pio->wme[WME_AC_VI];
 6922                 break;
 6923         case 0x4000:
 6924                 tq = &pio->wme[WME_AC_VO];
 6925                 break;
 6926         case 0x5000:
 6927                 tq = &pio->mcast;
 6928                 break;
 6929         }
 6930         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
 6931         if (tq == NULL)
 6932                 return (NULL);
 6933         index = (cookie & 0x0fff);
 6934         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
 6935         if (index >= N(tq->tq_pkts))
 6936                 return (NULL);
 6937         *pack = &tq->tq_pkts[index];
 6938         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
 6939         return (tq);
 6940 }
 6941 
 6942 static void
 6943 bwn_txpwr(void *arg, int npending)
 6944 {
 6945         struct bwn_mac *mac = arg;
 6946         struct bwn_softc *sc;
 6947 
 6948         if (mac == NULL)
 6949                 return;
 6950 
 6951         sc = mac->mac_sc;
 6952 
 6953         BWN_LOCK(sc);
 6954         if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
 6955             mac->mac_phy.set_txpwr != NULL)
 6956                 mac->mac_phy.set_txpwr(mac);
 6957         BWN_UNLOCK(sc);
 6958 }
 6959 
 6960 static void
 6961 bwn_task_15s(struct bwn_mac *mac)
 6962 {
 6963         uint16_t reg;
 6964 
 6965         if (mac->mac_fw.opensource) {
 6966                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
 6967                 if (reg) {
 6968                         bwn_restart(mac, "fw watchdog");
 6969                         return;
 6970                 }
 6971                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
 6972         }
 6973         if (mac->mac_phy.task_15s)
 6974                 mac->mac_phy.task_15s(mac);
 6975 
 6976         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
 6977 }
 6978 
 6979 static void
 6980 bwn_task_30s(struct bwn_mac *mac)
 6981 {
 6982 
 6983         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
 6984                 return;
 6985         mac->mac_noise.noi_running = 1;
 6986         mac->mac_noise.noi_nsamples = 0;
 6987 
 6988         bwn_noise_gensample(mac);
 6989 }
 6990 
 6991 static void
 6992 bwn_task_60s(struct bwn_mac *mac)
 6993 {
 6994 
 6995         if (mac->mac_phy.task_60s)
 6996                 mac->mac_phy.task_60s(mac);
 6997         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
 6998 }
 6999 
 7000 static void
 7001 bwn_tasks(void *arg)
 7002 {
 7003         struct bwn_mac *mac = arg;
 7004         struct bwn_softc *sc = mac->mac_sc;
 7005 
 7006         BWN_ASSERT_LOCKED(sc);
 7007         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
 7008                 return;
 7009 
 7010         if (mac->mac_task_state % 4 == 0)
 7011                 bwn_task_60s(mac);
 7012         if (mac->mac_task_state % 2 == 0)
 7013                 bwn_task_30s(mac);
 7014         bwn_task_15s(mac);
 7015 
 7016         mac->mac_task_state++;
 7017         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
 7018 }
 7019 
 7020 static int
 7021 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
 7022 {
 7023         struct bwn_softc *sc = mac->mac_sc;
 7024 
 7025         KASSERT(a == 0, ("not support APHY\n"));
 7026 
 7027         switch (plcp->o.raw[0] & 0xf) {
 7028         case 0xb:
 7029                 return (BWN_OFDM_RATE_6MB);
 7030         case 0xf:
 7031                 return (BWN_OFDM_RATE_9MB);
 7032         case 0xa:
 7033                 return (BWN_OFDM_RATE_12MB);
 7034         case 0xe:
 7035                 return (BWN_OFDM_RATE_18MB);
 7036         case 0x9:
 7037                 return (BWN_OFDM_RATE_24MB);
 7038         case 0xd:
 7039                 return (BWN_OFDM_RATE_36MB);
 7040         case 0x8:
 7041                 return (BWN_OFDM_RATE_48MB);
 7042         case 0xc:
 7043                 return (BWN_OFDM_RATE_54MB);
 7044         }
 7045         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
 7046             plcp->o.raw[0] & 0xf);
 7047         return (-1);
 7048 }
 7049 
 7050 static int
 7051 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
 7052 {
 7053         struct bwn_softc *sc = mac->mac_sc;
 7054 
 7055         switch (plcp->o.raw[0]) {
 7056         case 0x0a:
 7057                 return (BWN_CCK_RATE_1MB);
 7058         case 0x14:
 7059                 return (BWN_CCK_RATE_2MB);
 7060         case 0x37:
 7061                 return (BWN_CCK_RATE_5MB);
 7062         case 0x6e:
 7063                 return (BWN_CCK_RATE_11MB);
 7064         }
 7065         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
 7066         return (-1);
 7067 }
 7068 
 7069 static void
 7070 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
 7071     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
 7072     int rssi, int noise)
 7073 {
 7074         struct bwn_softc *sc = mac->mac_sc;
 7075         const struct ieee80211_frame_min *wh;
 7076         uint64_t tsf;
 7077         uint16_t low_mactime_now;
 7078         uint16_t mt;
 7079 
 7080         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
 7081                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
 7082 
 7083         wh = mtod(m, const struct ieee80211_frame_min *);
 7084         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
 7085                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
 7086 
 7087         bwn_tsf_read(mac, &tsf);
 7088         low_mactime_now = tsf;
 7089         tsf = tsf & ~0xffffULL;
 7090 
 7091         switch (mac->mac_fw.fw_hdr_format) {
 7092         case BWN_FW_HDR_351:
 7093         case BWN_FW_HDR_410:
 7094                 mt = le16toh(rxhdr->ps4.r351.mac_time);
 7095                 break;
 7096         case BWN_FW_HDR_598:
 7097                 mt = le16toh(rxhdr->ps4.r598.mac_time);
 7098                 break;
 7099         }
 7100 
 7101         tsf += mt;
 7102         if (low_mactime_now < mt)
 7103                 tsf -= 0x10000;
 7104 
 7105         sc->sc_rx_th.wr_tsf = tsf;
 7106         sc->sc_rx_th.wr_rate = rate;
 7107         sc->sc_rx_th.wr_antsignal = rssi;
 7108         sc->sc_rx_th.wr_antnoise = noise;
 7109 }
 7110 
 7111 static void
 7112 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
 7113 {
 7114         uint32_t low, high;
 7115 
 7116         KASSERT(bhnd_get_hwrev(mac->mac_sc->sc_dev) >= 3,
 7117             ("%s:%d: fail", __func__, __LINE__));
 7118 
 7119         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
 7120         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
 7121         *tsf = high;
 7122         *tsf <<= 32;
 7123         *tsf |= low;
 7124 }
 7125 
 7126 static int
 7127 bwn_dma_attach(struct bwn_mac *mac)
 7128 {
 7129         struct bwn_dma                  *dma;
 7130         struct bwn_softc                *sc;
 7131         struct bhnd_dma_translation     *dt, dma_translation;
 7132         bhnd_addr_t                      addrext_req;
 7133         bus_dma_tag_t                    dmat;
 7134         bus_addr_t                       lowaddr;
 7135         u_int                            addrext_shift, addr_width;
 7136         int                              error;
 7137 
 7138         dma = &mac->mac_method.dma;
 7139         sc = mac->mac_sc;
 7140         dt = NULL;
 7141 
 7142         if (sc->sc_quirks & BWN_QUIRK_NODMA)
 7143                 return (0);
 7144 
 7145         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5, ("%s: fail", __func__));
 7146 
 7147         /* Use the DMA engine's maximum host address width to determine the
 7148          * addrext constraints, and supported device address width. */
 7149         switch (mac->mac_dmatype) {
 7150         case BHND_DMA_ADDR_30BIT:
 7151                 /* 32-bit engine without addrext support */
 7152                 addrext_req = 0x0;
 7153                 addrext_shift = 0;
 7154 
 7155                 /* We can address the full 32-bit device address space */
 7156                 addr_width = BHND_DMA_ADDR_32BIT;
 7157                 break;
 7158 
 7159         case BHND_DMA_ADDR_32BIT:
 7160                 /* 32-bit engine with addrext support */
 7161                 addrext_req = BWN_DMA32_ADDREXT_MASK;
 7162                 addrext_shift = BWN_DMA32_ADDREXT_SHIFT;
 7163                 addr_width = BHND_DMA_ADDR_32BIT;
 7164                 break;
 7165 
 7166         case BHND_DMA_ADDR_64BIT:
 7167                 /* 64-bit engine with addrext support */
 7168                 addrext_req = BWN_DMA64_ADDREXT_MASK;
 7169                 addrext_shift = BWN_DMA64_ADDREXT_SHIFT;
 7170                 addr_width = BHND_DMA_ADDR_64BIT;
 7171                 break;
 7172 
 7173         default:
 7174                 device_printf(sc->sc_dev, "unsupported DMA address width: %d\n",
 7175                     mac->mac_dmatype);
 7176                 return (ENXIO);
 7177         }
 7178 
 7179         /* Fetch our device->host DMA translation and tag */
 7180         error = bhnd_get_dma_translation(sc->sc_dev, addr_width, 0, &dmat,
 7181             &dma_translation);
 7182         if (error) {
 7183                 device_printf(sc->sc_dev, "error fetching DMA translation: "
 7184                     "%d\n", error);
 7185                 return (error);
 7186         }
 7187 
 7188         /* Verify that our DMA engine's addrext constraints are compatible with
 7189          * our DMA translation */
 7190         if (addrext_req != 0x0 &&
 7191             (dma_translation.addrext_mask & addrext_req) != addrext_req)
 7192         {
 7193                 device_printf(sc->sc_dev, "bus addrext mask %#jx incompatible "
 7194                     "with device addrext mask %#jx, disabling extended address "
 7195                     "support\n", (uintmax_t)dma_translation.addrext_mask,
 7196                     (uintmax_t)addrext_req);
 7197 
 7198                 addrext_req = 0x0;
 7199                 addrext_shift = 0;
 7200         }
 7201 
 7202         /* Apply our addrext translation constraint */
 7203         dma_translation.addrext_mask = addrext_req;
 7204 
 7205         /* Initialize our DMA engine configuration */
 7206         mac->mac_flags |= BWN_MAC_FLAG_DMA;
 7207 
 7208         dma->addrext_shift = addrext_shift;
 7209         dma->translation = dma_translation;
 7210 
 7211         dt = &dma->translation;
 7212 
 7213         /* Dermine our translation's maximum supported address */
 7214         lowaddr = MIN((dt->addr_mask | dt->addrext_mask), BUS_SPACE_MAXADDR);
 7215 
 7216         /*
 7217          * Create top level DMA tag
 7218          */
 7219         error = bus_dma_tag_create(dmat,                /* parent */
 7220                                BWN_ALIGN, 0,            /* alignment, bounds */
 7221                                lowaddr,                 /* lowaddr */
 7222                                BUS_SPACE_MAXADDR,       /* highaddr */
 7223                                NULL, NULL,              /* filter, filterarg */
 7224                                BUS_SPACE_MAXSIZE,       /* maxsize */
 7225                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
 7226                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
 7227                                0,                       /* flags */
 7228                                NULL, NULL,              /* lockfunc, lockarg */
 7229                                &dma->parent_dtag);
 7230         if (error) {
 7231                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
 7232                 return (error);
 7233         }
 7234 
 7235         /*
 7236          * Create TX/RX mbuf DMA tag
 7237          */
 7238         error = bus_dma_tag_create(dma->parent_dtag,
 7239                                 1,
 7240                                 0,
 7241                                 BUS_SPACE_MAXADDR,
 7242                                 BUS_SPACE_MAXADDR,
 7243                                 NULL, NULL,
 7244                                 MCLBYTES,
 7245                                 1,
 7246                                 BUS_SPACE_MAXSIZE_32BIT,
 7247                                 0,
 7248                                 NULL, NULL,
 7249                                 &dma->rxbuf_dtag);
 7250         if (error) {
 7251                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
 7252                 goto fail0;
 7253         }
 7254         error = bus_dma_tag_create(dma->parent_dtag,
 7255                                 1,
 7256                                 0,
 7257                                 BUS_SPACE_MAXADDR,
 7258                                 BUS_SPACE_MAXADDR,
 7259                                 NULL, NULL,
 7260                                 MCLBYTES,
 7261                                 1,
 7262                                 BUS_SPACE_MAXSIZE_32BIT,
 7263                                 0,
 7264                                 NULL, NULL,
 7265                                 &dma->txbuf_dtag);
 7266         if (error) {
 7267                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
 7268                 goto fail1;
 7269         }
 7270 
 7271         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1);
 7272         if (!dma->wme[WME_AC_BK])
 7273                 goto fail2;
 7274 
 7275         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1);
 7276         if (!dma->wme[WME_AC_BE])
 7277                 goto fail3;
 7278 
 7279         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1);
 7280         if (!dma->wme[WME_AC_VI])
 7281                 goto fail4;
 7282 
 7283         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1);
 7284         if (!dma->wme[WME_AC_VO])
 7285                 goto fail5;
 7286 
 7287         dma->mcast = bwn_dma_ringsetup(mac, 4, 1);
 7288         if (!dma->mcast)
 7289                 goto fail6;
 7290         dma->rx = bwn_dma_ringsetup(mac, 0, 0);
 7291         if (!dma->rx)
 7292                 goto fail7;
 7293 
 7294         return (error);
 7295 
 7296 fail7:  bwn_dma_ringfree(&dma->mcast);
 7297 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
 7298 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
 7299 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
 7300 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
 7301 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
 7302 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
 7303 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
 7304         return (error);
 7305 }
 7306 
 7307 static struct bwn_dma_ring *
 7308 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
 7309     uint16_t cookie, int *slot)
 7310 {
 7311         struct bwn_dma *dma = &mac->mac_method.dma;
 7312         struct bwn_dma_ring *dr;
 7313         struct bwn_softc *sc = mac->mac_sc;
 7314 
 7315         BWN_ASSERT_LOCKED(mac->mac_sc);
 7316 
 7317         switch (cookie & 0xf000) {
 7318         case 0x1000:
 7319                 dr = dma->wme[WME_AC_BK];
 7320                 break;
 7321         case 0x2000:
 7322                 dr = dma->wme[WME_AC_BE];
 7323                 break;
 7324         case 0x3000:
 7325                 dr = dma->wme[WME_AC_VI];
 7326                 break;
 7327         case 0x4000:
 7328                 dr = dma->wme[WME_AC_VO];
 7329                 break;
 7330         case 0x5000:
 7331                 dr = dma->mcast;
 7332                 break;
 7333         default:
 7334                 dr = NULL;
 7335                 KASSERT(0 == 1,
 7336                     ("invalid cookie value %d", cookie & 0xf000));
 7337         }
 7338         *slot = (cookie & 0x0fff);
 7339         if (*slot < 0 || *slot >= dr->dr_numslots) {
 7340                 /*
 7341                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
 7342                  * that it occurs events which have same H/W sequence numbers.
 7343                  * When it's occurred just prints a WARNING msgs and ignores.
 7344                  */
 7345                 KASSERT(status->seq == dma->lastseq,
 7346                     ("%s:%d: fail", __func__, __LINE__));
 7347                 device_printf(sc->sc_dev,
 7348                     "out of slot ranges (0 < %d < %d)\n", *slot,
 7349                     dr->dr_numslots);
 7350                 return (NULL);
 7351         }
 7352         dma->lastseq = status->seq;
 7353         return (dr);
 7354 }
 7355 
 7356 static void
 7357 bwn_dma_stop(struct bwn_mac *mac)
 7358 {
 7359         struct bwn_dma *dma;
 7360 
 7361         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
 7362                 return;
 7363         dma = &mac->mac_method.dma;
 7364 
 7365         bwn_dma_ringstop(&dma->rx);
 7366         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
 7367         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
 7368         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
 7369         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
 7370         bwn_dma_ringstop(&dma->mcast);
 7371 }
 7372 
 7373 static void
 7374 bwn_dma_ringstop(struct bwn_dma_ring **dr)
 7375 {
 7376 
 7377         if (dr == NULL)
 7378                 return;
 7379 
 7380         bwn_dma_cleanup(*dr);
 7381 }
 7382 
 7383 static void
 7384 bwn_pio_stop(struct bwn_mac *mac)
 7385 {
 7386         struct bwn_pio *pio;
 7387 
 7388         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 7389                 return;
 7390         pio = &mac->mac_method.pio;
 7391 
 7392         bwn_destroy_queue_tx(&pio->mcast);
 7393         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
 7394         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
 7395         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
 7396         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
 7397 }
 7398 
 7399 static int
 7400 bwn_led_attach(struct bwn_mac *mac)
 7401 {
 7402         struct bwn_softc *sc = mac->mac_sc;
 7403         const uint8_t *led_act = NULL;
 7404         int error;
 7405         int i;
 7406 
 7407         sc->sc_led_idle = (2350 * hz) / 1000;
 7408         sc->sc_led_blink = 1;
 7409 
 7410         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
 7411                 if (sc->sc_board_info.board_vendor ==
 7412                     bwn_vendor_led_act[i].vid) {
 7413                         led_act = bwn_vendor_led_act[i].led_act;
 7414                         break;
 7415                 }
 7416         }
 7417         if (led_act == NULL)
 7418                 led_act = bwn_default_led_act;
 7419 
 7420         _Static_assert(nitems(bwn_led_vars) == BWN_LED_MAX,
 7421             "invalid NVRAM variable name array");
 7422 
 7423         for (i = 0; i < BWN_LED_MAX; ++i) {
 7424                 struct bwn_led  *led;
 7425                 uint8_t          val;
 7426 
 7427                 led = &sc->sc_leds[i];
 7428 
 7429                 KASSERT(i < nitems(bwn_led_vars), ("unknown LED index"));
 7430                 error = bhnd_nvram_getvar_uint8(sc->sc_dev, bwn_led_vars[i],
 7431                     &val);
 7432                 if (error) {
 7433                         if (error != ENOENT) {
 7434                                 device_printf(sc->sc_dev, "NVRAM variable %s "
 7435                                     "unreadable: %d", bwn_led_vars[i], error);
 7436                                 return (error);
 7437                         }
 7438 
 7439                         /* Not found; use default */
 7440                         led->led_act = led_act[i];
 7441                 } else {
 7442                         if (val & BWN_LED_ACT_LOW)
 7443                                 led->led_flags |= BWN_LED_F_ACTLOW;
 7444                         led->led_act = val & BWN_LED_ACT_MASK;
 7445                 }
 7446                 led->led_mask = (1 << i);
 7447 
 7448                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
 7449                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
 7450                     led->led_act == BWN_LED_ACT_BLINK) {
 7451                         led->led_flags |= BWN_LED_F_BLINK;
 7452                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
 7453                                 led->led_flags |= BWN_LED_F_POLLABLE;
 7454                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
 7455                                 led->led_flags |= BWN_LED_F_SLOW;
 7456 
 7457                         if (sc->sc_blink_led == NULL) {
 7458                                 sc->sc_blink_led = led;
 7459                                 if (led->led_flags & BWN_LED_F_SLOW)
 7460                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
 7461                         }
 7462                 }
 7463 
 7464                 DPRINTF(sc, BWN_DEBUG_LED,
 7465                     "%dth led, act %d, lowact %d\n", i,
 7466                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
 7467         }
 7468         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
 7469 
 7470         return (0);
 7471 }
 7472 
 7473 static __inline uint16_t
 7474 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
 7475 {
 7476 
 7477         if (led->led_flags & BWN_LED_F_ACTLOW)
 7478                 on = !on;
 7479         if (on)
 7480                 val |= led->led_mask;
 7481         else
 7482                 val &= ~led->led_mask;
 7483         return val;
 7484 }
 7485 
 7486 static void
 7487 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
 7488 {
 7489         struct bwn_softc *sc = mac->mac_sc;
 7490         struct ieee80211com *ic = &sc->sc_ic;
 7491         uint16_t val;
 7492         int i;
 7493 
 7494         if (nstate == IEEE80211_S_INIT) {
 7495                 callout_stop(&sc->sc_led_blink_ch);
 7496                 sc->sc_led_blinking = 0;
 7497         }
 7498 
 7499         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
 7500                 return;
 7501 
 7502         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
 7503         for (i = 0; i < BWN_LED_MAX; ++i) {
 7504                 struct bwn_led *led = &sc->sc_leds[i];
 7505                 int on;
 7506 
 7507                 if (led->led_act == BWN_LED_ACT_UNKN ||
 7508                     led->led_act == BWN_LED_ACT_NULL)
 7509                         continue;
 7510 
 7511                 if ((led->led_flags & BWN_LED_F_BLINK) &&
 7512                     nstate != IEEE80211_S_INIT)
 7513                         continue;
 7514 
 7515                 switch (led->led_act) {
 7516                 case BWN_LED_ACT_ON:    /* Always on */
 7517                         on = 1;
 7518                         break;
 7519                 case BWN_LED_ACT_OFF:   /* Always off */
 7520                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
 7521                         on = 0;
 7522                         break;
 7523                 default:
 7524                         on = 1;
 7525                         switch (nstate) {
 7526                         case IEEE80211_S_INIT:
 7527                                 on = 0;
 7528                                 break;
 7529                         case IEEE80211_S_RUN:
 7530                                 if (led->led_act == BWN_LED_ACT_11G &&
 7531                                     ic->ic_curmode != IEEE80211_MODE_11G)
 7532                                         on = 0;
 7533                                 break;
 7534                         default:
 7535                                 if (led->led_act == BWN_LED_ACT_ASSOC)
 7536                                         on = 0;
 7537                                 break;
 7538                         }
 7539                         break;
 7540                 }
 7541 
 7542                 val = bwn_led_onoff(led, val, on);
 7543         }
 7544         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
 7545 }
 7546 
 7547 static void
 7548 bwn_led_event(struct bwn_mac *mac, int event)
 7549 {
 7550         struct bwn_softc *sc = mac->mac_sc;
 7551         struct bwn_led *led = sc->sc_blink_led;
 7552         int rate;
 7553 
 7554         if (event == BWN_LED_EVENT_POLL) {
 7555                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
 7556                         return;
 7557                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
 7558                         return;
 7559         }
 7560 
 7561         sc->sc_led_ticks = ticks;
 7562         if (sc->sc_led_blinking)
 7563                 return;
 7564 
 7565         switch (event) {
 7566         case BWN_LED_EVENT_RX:
 7567                 rate = sc->sc_rx_rate;
 7568                 break;
 7569         case BWN_LED_EVENT_TX:
 7570                 rate = sc->sc_tx_rate;
 7571                 break;
 7572         case BWN_LED_EVENT_POLL:
 7573                 rate = 0;
 7574                 break;
 7575         default:
 7576                 panic("unknown LED event %d\n", event);
 7577                 break;
 7578         }
 7579         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
 7580             bwn_led_duration[rate].off_dur);
 7581 }
 7582 
 7583 static void
 7584 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
 7585 {
 7586         struct bwn_softc *sc = mac->mac_sc;
 7587         struct bwn_led *led = sc->sc_blink_led;
 7588         uint16_t val;
 7589 
 7590         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
 7591         val = bwn_led_onoff(led, val, 1);
 7592         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
 7593 
 7594         if (led->led_flags & BWN_LED_F_SLOW) {
 7595                 BWN_LED_SLOWDOWN(on_dur);
 7596                 BWN_LED_SLOWDOWN(off_dur);
 7597         }
 7598 
 7599         sc->sc_led_blinking = 1;
 7600         sc->sc_led_blink_offdur = off_dur;
 7601 
 7602         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
 7603 }
 7604 
 7605 static void
 7606 bwn_led_blink_next(void *arg)
 7607 {
 7608         struct bwn_mac *mac = arg;
 7609         struct bwn_softc *sc = mac->mac_sc;
 7610         uint16_t val;
 7611 
 7612         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
 7613         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
 7614         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
 7615 
 7616         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
 7617             bwn_led_blink_end, mac);
 7618 }
 7619 
 7620 static void
 7621 bwn_led_blink_end(void *arg)
 7622 {
 7623         struct bwn_mac *mac = arg;
 7624         struct bwn_softc *sc = mac->mac_sc;
 7625 
 7626         sc->sc_led_blinking = 0;
 7627 }
 7628 
 7629 static int
 7630 bwn_suspend(device_t dev)
 7631 {
 7632         struct bwn_softc *sc = device_get_softc(dev);
 7633 
 7634         BWN_LOCK(sc);
 7635         bwn_stop(sc);
 7636         BWN_UNLOCK(sc);
 7637         return (0);
 7638 }
 7639 
 7640 static int
 7641 bwn_resume(device_t dev)
 7642 {
 7643         struct bwn_softc *sc = device_get_softc(dev);
 7644         int error = EDOOFUS;
 7645 
 7646         BWN_LOCK(sc);
 7647         if (sc->sc_ic.ic_nrunning > 0)
 7648                 error = bwn_init(sc);
 7649         BWN_UNLOCK(sc);
 7650         if (error == 0)
 7651                 ieee80211_start_all(&sc->sc_ic);
 7652         return (0);
 7653 }
 7654 
 7655 static void
 7656 bwn_rfswitch(void *arg)
 7657 {
 7658         struct bwn_softc *sc = arg;
 7659         struct bwn_mac *mac = sc->sc_curmac;
 7660         int cur = 0, prev = 0;
 7661 
 7662         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
 7663             ("%s: invalid MAC status %d", __func__, mac->mac_status));
 7664 
 7665         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
 7666             || mac->mac_phy.type == BWN_PHYTYPE_N) {
 7667                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
 7668                         & BWN_RF_HWENABLED_HI_MASK))
 7669                         cur = 1;
 7670         } else {
 7671                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
 7672                     & BWN_RF_HWENABLED_LO_MASK)
 7673                         cur = 1;
 7674         }
 7675 
 7676         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
 7677                 prev = 1;
 7678 
 7679         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
 7680             __func__, cur, prev);
 7681 
 7682         if (cur != prev) {
 7683                 if (cur)
 7684                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
 7685                 else
 7686                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
 7687 
 7688                 device_printf(sc->sc_dev,
 7689                     "status of RF switch is changed to %s\n",
 7690                     cur ? "ON" : "OFF");
 7691                 if (cur != mac->mac_phy.rf_on) {
 7692                         if (cur)
 7693                                 bwn_rf_turnon(mac);
 7694                         else
 7695                                 bwn_rf_turnoff(mac);
 7696                 }
 7697         }
 7698 
 7699         callout_schedule(&sc->sc_rfswitch_ch, hz);
 7700 }
 7701 
 7702 static void
 7703 bwn_sysctl_node(struct bwn_softc *sc)
 7704 {
 7705         device_t dev = sc->sc_dev;
 7706         struct bwn_mac *mac;
 7707         struct bwn_stats *stats;
 7708 
 7709         /* XXX assume that count of MAC is only 1. */
 7710 
 7711         if ((mac = sc->sc_curmac) == NULL)
 7712                 return;
 7713         stats = &mac->mac_stats;
 7714 
 7715         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
 7716             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
 7717             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
 7718         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
 7719             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
 7720             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
 7721         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
 7722             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
 7723             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
 7724 
 7725 #ifdef BWN_DEBUG
 7726         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
 7727             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
 7728             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
 7729 #endif
 7730 }
 7731 
 7732 static device_method_t bwn_methods[] = {
 7733         /* Device interface */
 7734         DEVMETHOD(device_probe,         bwn_probe),
 7735         DEVMETHOD(device_attach,        bwn_attach),
 7736         DEVMETHOD(device_detach,        bwn_detach),
 7737         DEVMETHOD(device_suspend,       bwn_suspend),
 7738         DEVMETHOD(device_resume,        bwn_resume),
 7739         DEVMETHOD_END
 7740 };
 7741 
 7742 static driver_t bwn_driver = {
 7743         "bwn",
 7744         bwn_methods,
 7745         sizeof(struct bwn_softc)
 7746 };
 7747 
 7748 DRIVER_MODULE(bwn, bhnd, bwn_driver, 0, 0);
 7749 MODULE_DEPEND(bwn, bhnd, 1, 1, 1);
 7750 MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
 7751 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
 7752 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
 7753 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
 7754 MODULE_VERSION(bwn, 1);

Cache object: 99281730eb3ad1b9e4df4c5f8f051af6


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.