CoCalc -- if

GitHub Repository: freebsd/freebsd-src
Path: blob/main/sys/dev/bwn/if_bwn.c
³⁹⁵³⁶ views
1
/*-
2
 * SPDX-License-Identifier: BSD-2-Clause
3
 *
4
 * Copyright (c) 2009-2010 Weongyo Jeong <[email protected]>
5
 * Copyright (c) 2016 Landon Fuller <[email protected]>
6
 * Copyright (c) 2017 The FreeBSD Foundation
7
 * All rights reserved.
8
 * 
9
 * Portions of this software were developed by Landon Fuller
10
 * under sponsorship from the FreeBSD Foundation.
11
 *
12
 * Redistribution and use in source and binary forms, with or without
13
 * modification, are permitted provided that the following conditions
14
 * are met:
15
 * 1. Redistributions of source code must retain the above copyright
16
 *    notice, this list of conditions and the following disclaimer,
17
 *    without modification.
18
 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
19
 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
20
 *    redistribution must be conditioned upon including a substantially
21
 *    similar Disclaimer requirement for further binary redistribution.
22
 *
23
 * NO WARRANTY
24
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26
 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28
 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34
 * THE POSSIBILITY OF SUCH DAMAGES.
35
 */
36

37
#include <sys/cdefs.h>
38
/*
39
 * The Broadcom Wireless LAN controller driver.
40
 */
41

42
#include "opt_bwn.h"
43
#include "opt_wlan.h"
44

45
#include <sys/param.h>
46
#include <sys/systm.h>
47
#include <sys/kernel.h>
48
#include <sys/gpio.h>
49
#include <sys/malloc.h>
50
#include <sys/module.h>
51
#include <sys/endian.h>
52
#include <sys/errno.h>
53
#include <sys/firmware.h>
54
#include <sys/lock.h>
55
#include <sys/mutex.h>
56
#include <machine/bus.h>
57
#include <machine/resource.h>
58
#include <sys/bus.h>
59
#include <sys/rman.h>
60
#include <sys/socket.h>
61
#include <sys/sockio.h>
62

63
#include <net/ethernet.h>
64
#include <net/if.h>
65
#include <net/if_var.h>
66
#include <net/if_arp.h>
67
#include <net/if_dl.h>
68
#include <net/if_llc.h>
69
#include <net/if_media.h>
70
#include <net/if_types.h>
71

72
#include <net80211/ieee80211_var.h>
73
#include <net80211/ieee80211_radiotap.h>
74
#include <net80211/ieee80211_regdomain.h>
75
#include <net80211/ieee80211_phy.h>
76
#include <net80211/ieee80211_ratectl.h>
77

78
#include <dev/bhnd/bhnd.h>
79
#include <dev/bhnd/bhnd_ids.h>
80

81
#include <dev/bhnd/cores/chipc/chipc.h>
82
#include <dev/bhnd/cores/pmu/bhnd_pmu.h>
83

84
#include <dev/bwn/if_bwnreg.h>
85
#include <dev/bwn/if_bwnvar.h>
86

87
#include <dev/bwn/if_bwn_debug.h>
88
#include <dev/bwn/if_bwn_misc.h>
89
#include <dev/bwn/if_bwn_util.h>
90
#include <dev/bwn/if_bwn_phy_common.h>
91
#include <dev/bwn/if_bwn_phy_g.h>
92
#include <dev/bwn/if_bwn_phy_lp.h>
93
#include <dev/bwn/if_bwn_phy_n.h>
94

95
#include "bhnd_nvram_map.h"
96

97
#include "gpio_if.h"
98

99
static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
100
    "Broadcom driver parameters");
101

102
/*
103
 * Tunable & sysctl variables.
104
 */
105

106
#ifdef BWN_DEBUG
107
static	int bwn_debug = 0;
108
SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
109
    "Broadcom debugging printfs");
110
#endif
111

112
static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
113
SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
114
    "uses Bad Frames Preemption");
115
static int	bwn_bluetooth = 1;
116
SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
117
    "turns on Bluetooth Coexistence");
118
static int	bwn_hwpctl = 0;
119
SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
120
    "uses H/W power control");
121
static int	bwn_usedma = 1;
122
SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
123
    "uses DMA");
124
TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
125
static int	bwn_wme = 1;
126
SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
127
    "uses WME support");
128

129
static void	bwn_attach_pre(struct bwn_softc *);
130
static int	bwn_attach_post(struct bwn_softc *);
131
static int	bwn_retain_bus_providers(struct bwn_softc *sc);
132
static void	bwn_release_bus_providers(struct bwn_softc *sc);
133
static void	bwn_sprom_bugfixes(device_t);
134
static int	bwn_init(struct bwn_softc *);
135
static void	bwn_parent(struct ieee80211com *);
136
static void	bwn_start(struct bwn_softc *);
137
static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
138
static int	bwn_attach_core(struct bwn_mac *);
139
static int	bwn_phy_getinfo(struct bwn_mac *, int);
140
static int	bwn_chiptest(struct bwn_mac *);
141
static int	bwn_setup_channels(struct bwn_mac *, int, int);
142
static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
143
		    uint16_t);
144
static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
145
		    const struct bwn_channelinfo *, const uint8_t []);
146
static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
147
		    const struct ieee80211_bpf_params *);
148
static void	bwn_updateslot(struct ieee80211com *);
149
static void	bwn_update_promisc(struct ieee80211com *);
150
static void	bwn_wme_init(struct bwn_mac *);
151
static int	bwn_wme_update(struct ieee80211com *);
152
static void	bwn_wme_clear(struct bwn_softc *);
153
static void	bwn_wme_load(struct bwn_mac *);
154
static void	bwn_wme_loadparams(struct bwn_mac *,
155
		    const struct wmeParams *, uint16_t);
156
static void	bwn_scan_start(struct ieee80211com *);
157
static void	bwn_scan_end(struct ieee80211com *);
158
static void	bwn_set_channel(struct ieee80211com *);
159
static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
160
		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
161
		    const uint8_t [IEEE80211_ADDR_LEN],
162
		    const uint8_t [IEEE80211_ADDR_LEN]);
163
static void	bwn_vap_delete(struct ieee80211vap *);
164
static void	bwn_stop(struct bwn_softc *);
165
static int	bwn_core_forceclk(struct bwn_mac *, bool);
166
static int	bwn_core_init(struct bwn_mac *);
167
static void	bwn_core_start(struct bwn_mac *);
168
static void	bwn_core_exit(struct bwn_mac *);
169
static void	bwn_bt_disable(struct bwn_mac *);
170
static int	bwn_chip_init(struct bwn_mac *);
171
static void	bwn_set_txretry(struct bwn_mac *, int, int);
172
static void	bwn_rate_init(struct bwn_mac *);
173
static void	bwn_set_phytxctl(struct bwn_mac *);
174
static void	bwn_spu_setdelay(struct bwn_mac *, int);
175
static void	bwn_bt_enable(struct bwn_mac *);
176
static void	bwn_set_macaddr(struct bwn_mac *);
177
static void	bwn_crypt_init(struct bwn_mac *);
178
static void	bwn_chip_exit(struct bwn_mac *);
179
static int	bwn_fw_fillinfo(struct bwn_mac *);
180
static int	bwn_fw_loaducode(struct bwn_mac *);
181
static int	bwn_gpio_init(struct bwn_mac *);
182
static int	bwn_fw_loadinitvals(struct bwn_mac *);
183
static int	bwn_phy_init(struct bwn_mac *);
184
static void	bwn_set_txantenna(struct bwn_mac *, int);
185
static void	bwn_set_opmode(struct bwn_mac *);
186
static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
187
static uint8_t	bwn_plcp_getcck(const uint8_t);
188
static uint8_t	bwn_plcp_getofdm(const uint8_t);
189
static void	bwn_pio_init(struct bwn_mac *);
190
static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
191
static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
192
		    int);
193
static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
194
		    struct bwn_pio_rxqueue *, int);
195
static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
196
static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
197
		    uint16_t);
198
static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
199
static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
200
static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
201
static void	bwn_pio_handle_txeof(struct bwn_mac *,
202
		    const struct bwn_txstatus *);
203
static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
204
static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
205
static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
206
		    uint16_t);
207
static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
208
		    uint32_t);
209
static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
210
		    struct mbuf **);
211
static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
212
static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
213
		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
214
static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
215
		    uint16_t, uint32_t);
216
static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
217
		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
218
static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
219
		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
220
static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
221
		    uint16_t, struct bwn_pio_txpkt **);
222
static void	bwn_dma_init(struct bwn_mac *);
223
static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
224
static uint16_t	bwn_dma_base(int, int);
225
static void	bwn_dma_ringfree(struct bwn_dma_ring **);
226
static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
227
		    int, struct bwn_dmadesc_generic **,
228
		    struct bwn_dmadesc_meta **);
229
static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
230
		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
231
		    int, int);
232
static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
233
static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
234
static void	bwn_dma_32_resume(struct bwn_dma_ring *);
235
static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
236
static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
237
static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
238
		    int, struct bwn_dmadesc_generic **,
239
		    struct bwn_dmadesc_meta **);
240
static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
241
		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
242
		    int, int);
243
static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
244
static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
245
static void	bwn_dma_64_resume(struct bwn_dma_ring *);
246
static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
247
static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
248
static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
249
static void	bwn_dma_setup(struct bwn_dma_ring *);
250
static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
251
static void	bwn_dma_cleanup(struct bwn_dma_ring *);
252
static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
253
static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
254
static void	bwn_dma_rx(struct bwn_dma_ring *);
255
static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
256
static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
257
		    struct bwn_dmadesc_meta *);
258
static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
259
static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
260
static int	bwn_dma_freeslot(struct bwn_dma_ring *);
261
static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
262
static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
263
static int	bwn_dma_newbuf(struct bwn_dma_ring *,
264
		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
265
		    int);
266
static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
267
		    bus_size_t, int);
268
static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
269
static void	bwn_ratectl_tx_complete(const struct ieee80211_node *,
270
		    const struct bwn_txstatus *);
271
static void	bwn_dma_handle_txeof(struct bwn_mac *,
272
		    const struct bwn_txstatus *);
273
static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
274
		    struct mbuf **);
275
static int	bwn_dma_getslot(struct bwn_dma_ring *);
276
static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
277
		    uint8_t);
278
static int	bwn_dma_attach(struct bwn_mac *);
279
static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
280
		    int, int);
281
static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
282
		    const struct bwn_txstatus *, uint16_t, int *);
283
static void	bwn_dma_free(struct bwn_mac *);
284
static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
285
static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
286
		    const char *, struct bwn_fwfile *);
287
static void	bwn_release_firmware(struct bwn_mac *);
288
static void	bwn_do_release_fw(struct bwn_fwfile *);
289
static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
290
static int	bwn_fwinitvals_write(struct bwn_mac *,
291
		    const struct bwn_fwinitvals *, size_t, size_t);
292
static uint16_t	bwn_ant2phy(int);
293
static void	bwn_mac_write_bssid(struct bwn_mac *);
294
static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
295
		    const uint8_t *);
296
static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
297
		    const uint8_t *, size_t, const uint8_t *);
298
static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
299
		    const uint8_t *);
300
static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
301
		    const uint8_t *);
302
static void	bwn_phy_exit(struct bwn_mac *);
303
static void	bwn_core_stop(struct bwn_mac *);
304
static int	bwn_switch_band(struct bwn_softc *,
305
		    struct ieee80211_channel *);
306
static int	bwn_phy_reset(struct bwn_mac *);
307
static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
308
static void	bwn_set_pretbtt(struct bwn_mac *);
309
static int	bwn_intr(void *);
310
static void	bwn_intrtask(void *, int);
311
static void	bwn_restart(struct bwn_mac *, const char *);
312
static void	bwn_intr_ucode_debug(struct bwn_mac *);
313
static void	bwn_intr_tbtt_indication(struct bwn_mac *);
314
static void	bwn_intr_atim_end(struct bwn_mac *);
315
static void	bwn_intr_beacon(struct bwn_mac *);
316
static void	bwn_intr_pmq(struct bwn_mac *);
317
static void	bwn_intr_noise(struct bwn_mac *);
318
static void	bwn_intr_txeof(struct bwn_mac *);
319
static void	bwn_hwreset(void *, int);
320
static void	bwn_handle_fwpanic(struct bwn_mac *);
321
static void	bwn_load_beacon0(struct bwn_mac *);
322
static void	bwn_load_beacon1(struct bwn_mac *);
323
static uint32_t	bwn_jssi_read(struct bwn_mac *);
324
static void	bwn_noise_gensample(struct bwn_mac *);
325
static void	bwn_handle_txeof(struct bwn_mac *,
326
		    const struct bwn_txstatus *);
327
static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
328
static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
329
static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
330
		    struct mbuf *);
331
static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
332
static int	bwn_set_txhdr(struct bwn_mac *,
333
		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
334
		    uint16_t);
335
static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
336
		    const uint8_t);
337
static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
338
static uint8_t	bwn_get_fbrate(uint8_t);
339
static void	bwn_txpwr(void *, int);
340
static void	bwn_tasks(void *);
341
static void	bwn_task_15s(struct bwn_mac *);
342
static void	bwn_task_30s(struct bwn_mac *);
343
static void	bwn_task_60s(struct bwn_mac *);
344
static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
345
		    uint8_t);
346
static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
347
static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
348
		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
349
		    int, int);
350
static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
351
static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
352
static void	bwn_watchdog(void *);
353
static void	bwn_dma_stop(struct bwn_mac *);
354
static void	bwn_pio_stop(struct bwn_mac *);
355
static void	bwn_dma_ringstop(struct bwn_dma_ring **);
356
static int	bwn_led_attach(struct bwn_mac *);
357
static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
358
static void	bwn_led_event(struct bwn_mac *, int);
359
static void	bwn_led_blink_start(struct bwn_mac *, int, int);
360
static void	bwn_led_blink_next(void *);
361
static void	bwn_led_blink_end(void *);
362
static void	bwn_rfswitch(void *);
363
static void	bwn_rf_turnon(struct bwn_mac *);
364
static void	bwn_rf_turnoff(struct bwn_mac *);
365
static void	bwn_sysctl_node(struct bwn_softc *);
366

367
static const struct bwn_channelinfo bwn_chantable_bg = {
368
	.channels = {
369
		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370
		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371
		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372
		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373
		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374
	.nchannels = 14
375
};
376

377
static const struct bwn_channelinfo bwn_chantable_a = {
378
	.channels = {
379
		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380
		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381
		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382
		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383
		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384
		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385
		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386
		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387
		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388
		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389
		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390
		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391
		{ 6080, 216, 30 } },
392
	.nchannels = 37
393
};
394

395
#if 0
396
static const struct bwn_channelinfo bwn_chantable_n = {
397
	.channels = {
398
		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399
		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400
		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401
		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402
		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403
		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404
		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405
		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406
		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407
		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408
		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409
		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410
		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411
		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412
		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413
		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414
		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415
		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416
		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417
		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418
		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419
		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420
		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421
		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422
		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423
		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424
		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425
		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426
		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427
		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428
		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429
		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430
		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431
		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432
		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433
		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434
		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435
	.nchannels = 110
436
};
437
#endif
438

439
#define	VENDOR_LED_ACT(vendor)				\
440
{							\
441
	.vid = PCI_VENDOR_##vendor,			\
442
	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443
}
444

445
static const struct {
446
	uint16_t	vid;
447
	uint8_t		led_act[BWN_LED_MAX];
448
} bwn_vendor_led_act[] = {
449
	VENDOR_LED_ACT(HP_COMPAQ),
450
	VENDOR_LED_ACT(ASUSTEK)
451
};
452

453
static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454
	{ BWN_VENDOR_LED_ACT_DEFAULT };
455

456
#undef VENDOR_LED_ACT
457

458
static const char *bwn_led_vars[] = {
459
	BHND_NVAR_LEDBH0,
460
	BHND_NVAR_LEDBH1,
461
	BHND_NVAR_LEDBH2,
462
	BHND_NVAR_LEDBH3
463
};
464

465
static const struct {
466
	int		on_dur;
467
	int		off_dur;
468
} bwn_led_duration[109] = {
469
	[0]	= { 400, 100 },
470
	[2]	= { 150, 75 },
471
	[4]	= { 90, 45 },
472
	[11]	= { 66, 34 },
473
	[12]	= { 53, 26 },
474
	[18]	= { 42, 21 },
475
	[22]	= { 35, 17 },
476
	[24]	= { 32, 16 },
477
	[36]	= { 21, 10 },
478
	[48]	= { 16, 8 },
479
	[72]	= { 11, 5 },
480
	[96]	= { 9, 4 },
481
	[108]	= { 7, 3 }
482
};
483

484
static const uint16_t bwn_wme_shm_offsets[] = {
485
	[0] = BWN_WME_BESTEFFORT,
486
	[1] = BWN_WME_BACKGROUND,
487
	[2] = BWN_WME_VOICE,
488
	[3] = BWN_WME_VIDEO,
489
};
490

491
/* Supported D11 core revisions */
492
#define	BWN_DEV(_hwrev)	{{					\
493
	BHND_MATCH_CORE(BHND_MFGID_BCM, BHND_COREID_D11),	\
494
	BHND_MATCH_CORE_REV(_hwrev),				\
495
}}
496
static const struct bhnd_device bwn_devices[] = {
497
	BWN_DEV(HWREV_RANGE(5, 16)),
498
	BWN_DEV(HWREV_EQ(23)),
499
	BHND_DEVICE_END
500
};
501

502
/* D11 quirks when bridged via a PCI host bridge core */
503
static const struct bhnd_device_quirk pci_bridge_quirks[] = {
504
	BHND_CORE_QUIRK	(HWREV_LTE(10),	BWN_QUIRK_UCODE_SLOWCLOCK_WAR),
505
	BHND_DEVICE_QUIRK_END
506
};
507

508
/* D11 quirks when bridged via a PCMCIA host bridge core */
509
static const struct bhnd_device_quirk pcmcia_bridge_quirks[] = {
510
	BHND_CORE_QUIRK	(HWREV_ANY,	BWN_QUIRK_NODMA),
511
	BHND_DEVICE_QUIRK_END
512
};
513

514
/* Host bridge cores for which D11 quirk flags should be applied */
515
static const struct bhnd_device bridge_devices[] = {
516
	BHND_DEVICE(BCM, PCI,		NULL, pci_bridge_quirks),
517
	BHND_DEVICE(BCM, PCMCIA,	NULL, pcmcia_bridge_quirks),
518
	BHND_DEVICE_END
519
};
520

521
static int
522
bwn_probe(device_t dev)
523
{
524
	const struct bhnd_device *id;
525

526
	id = bhnd_device_lookup(dev, bwn_devices, sizeof(bwn_devices[0]));
527
	if (id == NULL)
528
		return (ENXIO);
529

530
	bhnd_set_default_core_desc(dev);
531
	return (BUS_PROBE_DEFAULT);
532
}
533

534
static int
535
bwn_attach(device_t dev)
536
{
537
	struct bwn_mac		*mac;
538
	struct bwn_softc	*sc;
539
	device_t		 parent, hostb;
540
	char			 chip_name[BHND_CHIPID_MAX_NAMELEN];
541
	int			 error;
542

543
	sc = device_get_softc(dev);
544
	sc->sc_dev = dev;
545
#ifdef BWN_DEBUG
546
	sc->sc_debug = bwn_debug;
547
#endif
548

549
	mac = NULL;
550

551
	/* Determine the driver quirks applicable to this device, including any
552
	 * quirks specific to the bus host bridge core (if any) */
553
	sc->sc_quirks = bhnd_device_quirks(dev, bwn_devices,
554
	    sizeof(bwn_devices[0]));
555

556
	parent = device_get_parent(dev);
557
	if ((hostb = bhnd_bus_find_hostb_device(parent)) != NULL) {
558
		sc->sc_quirks |= bhnd_device_quirks(hostb, bridge_devices,
559
		    sizeof(bridge_devices[0]));
560
	}
561

562
	/* DMA explicitly disabled? */
563
	if (!bwn_usedma)
564
		sc->sc_quirks |= BWN_QUIRK_NODMA;
565

566
	/* Fetch our chip identification and board info */
567
	sc->sc_cid = *bhnd_get_chipid(dev);
568
	if ((error = bhnd_read_board_info(dev, &sc->sc_board_info))) {
569
		device_printf(sc->sc_dev, "couldn't read board info\n");
570
		return (error);
571
	}
572

573
	/* Allocate our D11 register block and PMU state */
574
	sc->sc_mem_rid = 0;
575
	sc->sc_mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
576
	    &sc->sc_mem_rid, RF_ACTIVE);
577
	if (sc->sc_mem_res == NULL) {
578
		device_printf(sc->sc_dev, "couldn't allocate registers\n");
579
		return (error);
580
	}
581

582
	if ((error = bhnd_alloc_pmu(sc->sc_dev))) {
583
		bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
584
		    sc->sc_mem_rid, sc->sc_mem_res);
585
		return (error);
586
	}
587

588
	/* Retain references to all required bus service providers */
589
	if ((error = bwn_retain_bus_providers(sc)))
590
		goto fail;
591

592
	/* Fetch mask of available antennas */
593
	error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA2G,
594
	    &sc->sc_ant2g);
595
	if (error) {
596
		device_printf(sc->sc_dev, "error determining 2GHz antenna "
597
		    "availability from NVRAM: %d\n", error);
598
		goto fail;
599
	}
600

601
	error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA5G,
602
	    &sc->sc_ant5g);
603
	if (error) {
604
		device_printf(sc->sc_dev, "error determining 5GHz antenna "
605
		    "availability from NVRAM: %d\n", error);
606
		goto fail;
607
	}
608

609
	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
610
		bwn_attach_pre(sc);
611
		bwn_sprom_bugfixes(dev);
612
		sc->sc_flags |= BWN_FLAG_ATTACHED;
613
	}
614

615
	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
616
	mac->mac_sc = sc;
617
	mac->mac_status = BWN_MAC_STATUS_UNINIT;
618
	if (bwn_bfp != 0)
619
		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
620

621
	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
622
	NET_TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
623
	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
624

625
	error = bwn_attach_core(mac);
626
	if (error)
627
		goto fail;
628
	error = bwn_led_attach(mac);
629
	if (error)
630
		goto fail;
631

632
	bhnd_format_chip_id(chip_name, sizeof(chip_name), sc->sc_cid.chip_id);
633
	device_printf(sc->sc_dev, "WLAN (%s rev %u sromrev %u) "
634
	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
635
	    chip_name, bhnd_get_hwrev(sc->sc_dev),
636
	    sc->sc_board_info.board_srom_rev, mac->mac_phy.analog,
637
	    mac->mac_phy.type, mac->mac_phy.rev, mac->mac_phy.rf_manuf,
638
	    mac->mac_phy.rf_ver, mac->mac_phy.rf_rev);
639
	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
640
		device_printf(sc->sc_dev, "DMA (%d bits)\n", mac->mac_dmatype);
641
	else
642
		device_printf(sc->sc_dev, "PIO\n");
643

644
#ifdef	BWN_GPL_PHY
645
	device_printf(sc->sc_dev,
646
	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
647
#endif
648

649
	mac->mac_rid_irq = 0;
650
	mac->mac_res_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
651
	    &mac->mac_rid_irq, RF_ACTIVE | RF_SHAREABLE);
652

653
	if (mac->mac_res_irq == NULL) {
654
		device_printf(sc->sc_dev, "couldn't allocate IRQ resource\n");
655
		error = ENXIO;
656
		goto fail;
657
	}
658

659
	error = bus_setup_intr(dev, mac->mac_res_irq,
660
	    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
661
	    &mac->mac_intrhand);
662
	if (error != 0) {
663
		device_printf(sc->sc_dev, "couldn't setup interrupt (%d)\n",
664
		    error);
665
		goto fail;
666
	}
667

668
	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
669

670
	/*
671
	 * calls attach-post routine
672
	 */
673
	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
674
		bwn_attach_post(sc);
675

676
	return (0);
677
fail:
678
	if (mac != NULL && mac->mac_res_irq != NULL) {
679
		bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
680
		    mac->mac_res_irq);
681
	}
682

683
	free(mac, M_DEVBUF);
684
	bhnd_release_pmu(dev);
685
	bwn_release_bus_providers(sc);
686

687
	if (sc->sc_mem_res != NULL) {
688
		bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
689
		    sc->sc_mem_rid, sc->sc_mem_res);
690
	}
691

692
	return (error);
693
}
694

695
static int
696
bwn_retain_bus_providers(struct bwn_softc *sc)
697
{
698
	struct chipc_caps *ccaps;
699

700
	sc->sc_chipc = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_CHIPC);
701
	if (sc->sc_chipc == NULL) {
702
		device_printf(sc->sc_dev, "ChipCommon device not found\n");
703
		goto failed;
704
	}
705

706
	ccaps = BHND_CHIPC_GET_CAPS(sc->sc_chipc);
707

708
	sc->sc_gpio = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_GPIO);
709
	if (sc->sc_gpio == NULL) {
710
		device_printf(sc->sc_dev, "GPIO device not found\n");
711
		goto failed;
712
	}
713

714
	if (ccaps->pmu) {
715
		sc->sc_pmu = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_PMU);
716
		if (sc->sc_pmu == NULL) {
717
			device_printf(sc->sc_dev, "PMU device not found\n");
718
			goto failed;
719
		}
720
	}
721

722
	return (0);
723

724
failed:
725
	bwn_release_bus_providers(sc);
726
	return (ENXIO);
727
}
728

729
static void
730
bwn_release_bus_providers(struct bwn_softc *sc)
731
{
732
#define	BWN_RELEASE_PROV(_sc, _prov, _service)	do {			\
733
	if ((_sc)-> _prov != NULL) {					\
734
		bhnd_release_provider((_sc)->sc_dev, (_sc)-> _prov,	\
735
		    (_service));					\
736
		(_sc)-> _prov = NULL;					\
737
	}								\
738
} while (0)
739

740
	BWN_RELEASE_PROV(sc, sc_chipc, BHND_SERVICE_CHIPC);
741
	BWN_RELEASE_PROV(sc, sc_gpio, BHND_SERVICE_GPIO);
742
	BWN_RELEASE_PROV(sc, sc_pmu, BHND_SERVICE_PMU);
743

744
#undef	BWN_RELEASE_PROV
745
}
746

747
static int
748
bwn_attach_post(struct bwn_softc *sc)
749
{
750
	struct ieee80211com	*ic;
751
	const char		*mac_varname;
752
	u_int			 core_unit;
753
	int			 error;
754

755
	ic = &sc->sc_ic;
756

757
	ic->ic_softc = sc;
758
	ic->ic_name = device_get_nameunit(sc->sc_dev);
759
	/* XXX not right but it's not used anywhere important */
760
	ic->ic_phytype = IEEE80211_T_OFDM;
761
	ic->ic_opmode = IEEE80211_M_STA;
762
	ic->ic_caps =
763
		  IEEE80211_C_STA		/* station mode supported */
764
		| IEEE80211_C_MONITOR		/* monitor mode */
765
		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
766
		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
767
		| IEEE80211_C_SHSLOT		/* short slot time supported */
768
		| IEEE80211_C_WME		/* WME/WMM supported */
769
		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
770
#if 0
771
		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
772
#endif
773
		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
774
		;
775

776
	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
777
	ic->ic_flags_ext |= IEEE80211_FEXT_SEQNO_OFFLOAD;
778

779
	/* Determine the NVRAM variable containing our MAC address */
780
	core_unit = bhnd_get_core_unit(sc->sc_dev);
781
	mac_varname = NULL;
782
	if (sc->sc_board_info.board_srom_rev <= 2) {
783
		if (core_unit == 0) {
784
			mac_varname = BHND_NVAR_IL0MACADDR;
785
		} else if (core_unit == 1) {
786
			mac_varname = BHND_NVAR_ET1MACADDR;
787
		}
788
	} else {
789
		if (core_unit == 0) {
790
			mac_varname = BHND_NVAR_MACADDR;
791
		}
792
	}
793

794
	if (mac_varname == NULL) {
795
		device_printf(sc->sc_dev, "missing MAC address variable for "
796
		    "D11 core %u", core_unit);
797
		return (ENXIO);
798
	}
799

800
	/* Read the MAC address from NVRAM */
801
	error = bhnd_nvram_getvar_array(sc->sc_dev, mac_varname, ic->ic_macaddr,
802
	    sizeof(ic->ic_macaddr), BHND_NVRAM_TYPE_UINT8_ARRAY);
803
	if (error) {
804
		device_printf(sc->sc_dev, "error reading %s: %d\n", mac_varname,
805
		    error);
806
		return (error);
807
	}
808

809
	/* call MI attach routine. */
810
	ieee80211_ifattach(ic);
811

812
	/* override default methods */
813
	ic->ic_raw_xmit = bwn_raw_xmit;
814
	ic->ic_updateslot = bwn_updateslot;
815
	ic->ic_update_promisc = bwn_update_promisc;
816
	ic->ic_wme.wme_update = bwn_wme_update;
817
	ic->ic_scan_start = bwn_scan_start;
818
	ic->ic_scan_end = bwn_scan_end;
819
	ic->ic_set_channel = bwn_set_channel;
820
	ic->ic_vap_create = bwn_vap_create;
821
	ic->ic_vap_delete = bwn_vap_delete;
822
	ic->ic_transmit = bwn_transmit;
823
	ic->ic_parent = bwn_parent;
824

825
	ieee80211_radiotap_attach(ic,
826
	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
827
	    BWN_TX_RADIOTAP_PRESENT,
828
	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
829
	    BWN_RX_RADIOTAP_PRESENT);
830

831
	bwn_sysctl_node(sc);
832

833
	if (bootverbose)
834
		ieee80211_announce(ic);
835
	return (0);
836
}
837

838
static void
839
bwn_phy_detach(struct bwn_mac *mac)
840
{
841

842
	if (mac->mac_phy.detach != NULL)
843
		mac->mac_phy.detach(mac);
844
}
845

846
static int
847
bwn_detach(device_t dev)
848
{
849
	struct bwn_softc *sc = device_get_softc(dev);
850
	struct bwn_mac *mac = sc->sc_curmac;
851
	struct ieee80211com *ic = &sc->sc_ic;
852

853
	sc->sc_flags |= BWN_FLAG_INVALID;
854

855
	if (device_is_attached(sc->sc_dev)) {
856
		BWN_LOCK(sc);
857
		bwn_stop(sc);
858
		BWN_UNLOCK(sc);
859
		bwn_dma_free(mac);
860
		callout_drain(&sc->sc_led_blink_ch);
861
		callout_drain(&sc->sc_rfswitch_ch);
862
		callout_drain(&sc->sc_task_ch);
863
		callout_drain(&sc->sc_watchdog_ch);
864
		bwn_phy_detach(mac);
865
		ieee80211_draintask(ic, &mac->mac_hwreset);
866
		ieee80211_draintask(ic, &mac->mac_txpower);
867
		ieee80211_ifdetach(ic);
868
	}
869
	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
870
	taskqueue_free(sc->sc_tq);
871

872
	if (mac->mac_intrhand != NULL) {
873
		bus_teardown_intr(dev, mac->mac_res_irq, mac->mac_intrhand);
874
		mac->mac_intrhand = NULL;
875
	}
876

877
	bhnd_release_pmu(dev);
878
	bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_mem_rid,
879
	    sc->sc_mem_res);
880
	bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
881
	    mac->mac_res_irq);
882
	mbufq_drain(&sc->sc_snd);
883
	bwn_release_firmware(mac);
884
	BWN_LOCK_DESTROY(sc);
885

886
	bwn_release_bus_providers(sc);
887

888
	return (0);
889
}
890

891
static void
892
bwn_attach_pre(struct bwn_softc *sc)
893
{
894

895
	BWN_LOCK_INIT(sc);
896
	TAILQ_INIT(&sc->sc_maclist);
897
	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
898
	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
899
	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
900
	mbufq_init(&sc->sc_snd, ifqmaxlen);
901
	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
902
		taskqueue_thread_enqueue, &sc->sc_tq);
903
	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
904
		"%s taskq", device_get_nameunit(sc->sc_dev));
905
}
906

907
static void
908
bwn_sprom_bugfixes(device_t dev)
909
{
910
	struct bwn_softc *sc = device_get_softc(dev);
911

912
#define	BWN_ISDEV(_device, _subvendor, _subdevice)		\
913
	((sc->sc_board_info.board_devid == PCI_DEVID_##_device) &&	\
914
	 (sc->sc_board_info.board_vendor == PCI_VENDOR_##_subvendor) &&	\
915
	 (sc->sc_board_info.board_type == _subdevice))
916

917
	 /* A subset of Apple Airport Extreme (BCM4306 rev 2) devices
918
	  * were programmed with a missing PACTRL boardflag */
919
	 if (sc->sc_board_info.board_vendor == PCI_VENDOR_APPLE &&
920
	     sc->sc_board_info.board_type == 0x4e &&
921
	     sc->sc_board_info.board_rev > 0x40)
922
		 sc->sc_board_info.board_flags |= BHND_BFL_PACTRL;
923

924
	if (BWN_ISDEV(BCM4318_D11G, ASUSTEK, 0x100f) ||
925
	    BWN_ISDEV(BCM4306_D11G, DELL, 0x0003) ||
926
	    BWN_ISDEV(BCM4306_D11G, HP, 0x12f8) ||
927
	    BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0013) ||
928
	    BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0014) ||
929
	    BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0015) ||
930
	    BWN_ISDEV(BCM4306_D11G, MOTOROLA, 0x7010))
931
		sc->sc_board_info.board_flags &= ~BHND_BFL_BTCOEX;
932
#undef	BWN_ISDEV
933
}
934

935
static void
936
bwn_parent(struct ieee80211com *ic)
937
{
938
	struct bwn_softc *sc = ic->ic_softc;
939
	int startall = 0;
940

941
	BWN_LOCK(sc);
942
	if (ic->ic_nrunning > 0) {
943
		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
944
			bwn_init(sc);
945
			startall = 1;
946
		} else
947
			bwn_update_promisc(ic);
948
	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
949
		bwn_stop(sc);
950
	BWN_UNLOCK(sc);
951

952
	if (startall)
953
		ieee80211_start_all(ic);
954
}
955

956
static int
957
bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
958
{
959
	struct bwn_softc *sc = ic->ic_softc;
960
	int error;
961

962
	BWN_LOCK(sc);
963
	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
964
		BWN_UNLOCK(sc);
965
		return (ENXIO);
966
	}
967
	error = mbufq_enqueue(&sc->sc_snd, m);
968
	if (error) {
969
		BWN_UNLOCK(sc);
970
		return (error);
971
	}
972
	bwn_start(sc);
973
	BWN_UNLOCK(sc);
974
	return (0);
975
}
976

977
static void
978
bwn_start(struct bwn_softc *sc)
979
{
980
	struct bwn_mac *mac = sc->sc_curmac;
981
	struct ieee80211_frame *wh;
982
	struct ieee80211_node *ni;
983
	struct ieee80211_key *k;
984
	struct mbuf *m;
985

986
	BWN_ASSERT_LOCKED(sc);
987

988
	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
989
	    mac->mac_status < BWN_MAC_STATUS_STARTED)
990
		return;
991

992
	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
993
		if (bwn_tx_isfull(sc, m))
994
			break;
995
		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
996
		if (ni == NULL) {
997
			device_printf(sc->sc_dev, "unexpected NULL ni\n");
998
			m_freem(m);
999
			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1000
			continue;
1001
		}
1002
		wh = mtod(m, struct ieee80211_frame *);
1003
		ieee80211_output_seqno_assign(ni, -1, m);
1004
		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1005
			k = ieee80211_crypto_encap(ni, m);
1006
			if (k == NULL) {
1007
				if_inc_counter(ni->ni_vap->iv_ifp,
1008
				    IFCOUNTER_OERRORS, 1);
1009
				ieee80211_free_node(ni);
1010
				m_freem(m);
1011
				continue;
1012
			}
1013
		}
1014
		wh = NULL;	/* Catch any invalid use */
1015
		if (bwn_tx_start(sc, ni, m) != 0) {
1016
			if (ni != NULL) {
1017
				if_inc_counter(ni->ni_vap->iv_ifp,
1018
				    IFCOUNTER_OERRORS, 1);
1019
				ieee80211_free_node(ni);
1020
			}
1021
			continue;
1022
		}
1023
		sc->sc_watchdog_timer = 5;
1024
	}
1025
}
1026

1027
static int
1028
bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
1029
{
1030
	struct bwn_dma_ring *dr;
1031
	struct bwn_mac *mac = sc->sc_curmac;
1032
	struct bwn_pio_txqueue *tq;
1033
	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1034

1035
	BWN_ASSERT_LOCKED(sc);
1036

1037
	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1038
		dr = bwn_dma_select(mac, M_WME_GETAC(m));
1039
		if (dr->dr_stop == 1 ||
1040
		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1041
			dr->dr_stop = 1;
1042
			goto full;
1043
		}
1044
	} else {
1045
		tq = bwn_pio_select(mac, M_WME_GETAC(m));
1046
		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1047
		    pktlen > (tq->tq_size - tq->tq_used))
1048
			goto full;
1049
	}
1050
	return (0);
1051
full:
1052
	mbufq_prepend(&sc->sc_snd, m);
1053
	return (1);
1054
}
1055

1056
static int
1057
bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1058
{
1059
	struct bwn_mac *mac = sc->sc_curmac;
1060
	int error;
1061

1062
	BWN_ASSERT_LOCKED(sc);
1063

1064
	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1065
		m_freem(m);
1066
		return (ENXIO);
1067
	}
1068

1069
	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1070
	    bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
1071
	if (error) {
1072
		m_freem(m);
1073
		return (error);
1074
	}
1075
	return (0);
1076
}
1077

1078
static int
1079
bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1080
    struct mbuf **mp)
1081
{
1082
	struct bwn_pio_txpkt *tp;
1083
	struct bwn_pio_txqueue *tq;
1084
	struct bwn_softc *sc = mac->mac_sc;
1085
	struct bwn_txhdr txhdr;
1086
	struct mbuf *m, *m_new;
1087
	uint32_t ctl32;
1088
	int error;
1089
	uint16_t ctl16;
1090

1091
	BWN_ASSERT_LOCKED(sc);
1092

1093
	/* XXX TODO send packets after DTIM */
1094

1095
	m = *mp;
1096
	tq = bwn_pio_select(mac, M_WME_GETAC(m));
1097
	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1098
	tp = TAILQ_FIRST(&tq->tq_pktlist);
1099
	tp->tp_ni = ni;
1100
	tp->tp_m = m;
1101

1102
	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1103
	if (error) {
1104
		device_printf(sc->sc_dev, "tx fail\n");
1105
		return (error);
1106
	}
1107

1108
	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1109
	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1110
	tq->tq_free--;
1111

1112
	if (bhnd_get_hwrev(sc->sc_dev) >= 8) {
1113
		/*
1114
		 * XXX please removes m_defrag(9)
1115
		 */
1116
		m_new = m_defrag(*mp, M_NOWAIT);
1117
		if (m_new == NULL) {
1118
			device_printf(sc->sc_dev,
1119
			    "%s: can't defrag TX buffer\n",
1120
			    __func__);
1121
			return (ENOBUFS);
1122
		}
1123
		*mp = m_new;
1124
		if (m_new->m_next != NULL)
1125
			device_printf(sc->sc_dev,
1126
			    "TODO: fragmented packets for PIO\n");
1127
		tp->tp_m = m_new;
1128

1129
		/* send HEADER */
1130
		ctl32 = bwn_pio_write_multi_4(mac, tq,
1131
		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1132
			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1133
		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1134
		/* send BODY */
1135
		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1136
		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1137
		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1138
		    ctl32 | BWN_PIO8_TXCTL_EOF);
1139
	} else {
1140
		ctl16 = bwn_pio_write_multi_2(mac, tq,
1141
		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1142
			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1143
		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1144
		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1145
		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1146
		    ctl16 | BWN_PIO_TXCTL_EOF);
1147
	}
1148

1149
	return (0);
1150
}
1151

1152
static struct bwn_pio_txqueue *
1153
bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1154
{
1155

1156
	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1157
		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1158

1159
	switch (prio) {
1160
	case 0:
1161
		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1162
	case 1:
1163
		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1164
	case 2:
1165
		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1166
	case 3:
1167
		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1168
	}
1169
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1170
	return (NULL);
1171
}
1172

1173
static int
1174
bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1175
    struct mbuf **mp)
1176
{
1177
#define	BWN_GET_TXHDRCACHE(slot)					\
1178
	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1179
	struct bwn_dma *dma = &mac->mac_method.dma;
1180
	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
1181
	struct bwn_dmadesc_generic *desc;
1182
	struct bwn_dmadesc_meta *mt;
1183
	struct bwn_softc *sc = mac->mac_sc;
1184
	struct mbuf *m;
1185
	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1186
	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1187

1188
	BWN_ASSERT_LOCKED(sc);
1189
	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1190

1191
	/* XXX send after DTIM */
1192

1193
	m = *mp;
1194
	slot = bwn_dma_getslot(dr);
1195
	dr->getdesc(dr, slot, &desc, &mt);
1196
	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1197
	    ("%s:%d: fail", __func__, __LINE__));
1198

1199
	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1200
	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1201
	    BWN_DMA_COOKIE(dr, slot));
1202
	if (error)
1203
		goto fail;
1204
	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1205
	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1206
	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1207
	if (error) {
1208
		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1209
		    __func__, error);
1210
		goto fail;
1211
	}
1212
	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1213
	    BUS_DMASYNC_PREWRITE);
1214
	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1215
	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1216
	    BUS_DMASYNC_PREWRITE);
1217

1218
	slot = bwn_dma_getslot(dr);
1219
	dr->getdesc(dr, slot, &desc, &mt);
1220
	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1221
	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1222
	mt->mt_m = m;
1223
	mt->mt_ni = ni;
1224

1225
	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1226
	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1227
	if (error && error != EFBIG) {
1228
		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1229
		    __func__, error);
1230
		goto fail;
1231
	}
1232
	if (error) {    /* error == EFBIG */
1233
		struct mbuf *m_new;
1234

1235
		m_new = m_defrag(m, M_NOWAIT);
1236
		if (m_new == NULL) {
1237
			device_printf(sc->sc_dev,
1238
			    "%s: can't defrag TX buffer\n",
1239
			    __func__);
1240
			error = ENOBUFS;
1241
			goto fail;
1242
		}
1243
		*mp = m = m_new;
1244

1245
		mt->mt_m = m;
1246
		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1247
		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1248
		if (error) {
1249
			device_printf(sc->sc_dev,
1250
			    "%s: can't load TX buffer (2) %d\n",
1251
			    __func__, error);
1252
			goto fail;
1253
		}
1254
	}
1255
	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1256
	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1257
	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1258
	    BUS_DMASYNC_PREWRITE);
1259

1260
	/* XXX send after DTIM */
1261

1262
	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1263
	return (0);
1264
fail:
1265
	dr->dr_curslot = backup[0];
1266
	dr->dr_usedslot = backup[1];
1267
	return (error);
1268
#undef BWN_GET_TXHDRCACHE
1269
}
1270

1271
static void
1272
bwn_watchdog(void *arg)
1273
{
1274
	struct bwn_softc *sc = arg;
1275

1276
	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1277
		device_printf(sc->sc_dev, "device timeout\n");
1278
		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1279
	}
1280
	callout_schedule(&sc->sc_watchdog_ch, hz);
1281
}
1282

1283
static int
1284
bwn_attach_core(struct bwn_mac *mac)
1285
{
1286
	struct bwn_softc *sc = mac->mac_sc;
1287
	int error, have_bg = 0, have_a = 0;
1288
	uint16_t iost;
1289

1290
	KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5,
1291
	    ("unsupported revision %d", bhnd_get_hwrev(sc->sc_dev)));
1292

1293
	if ((error = bwn_core_forceclk(mac, true)))
1294
		return (error);
1295

1296
	if ((error = bhnd_read_iost(sc->sc_dev, &iost))) {
1297
		device_printf(sc->sc_dev, "error reading I/O status flags: "
1298
		    "%d\n", error);
1299
		return (error);
1300
	}
1301

1302
	have_a = (iost & BWN_IOST_HAVE_5GHZ) ? 1 : 0;
1303
	have_bg = (iost & BWN_IOST_HAVE_2GHZ) ? 1 : 0;
1304
	if (iost & BWN_IOST_DUALPHY) {
1305
		have_bg = 1;
1306
		have_a = 1;
1307
	}
1308

1309
#if 0
1310
	device_printf(sc->sc_dev, "%s: iost=0x%04hx, have_a=%d, have_bg=%d,"
1311
	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1312
	    __func__,
1313
	    iost,
1314
	    have_a,
1315
	    have_bg,
1316
	    sc->sc_board_info.board_devid,
1317
	    sc->sc_cid.chip_id);
1318
#endif
1319

1320
	/*
1321
	 * Guess at whether it has A-PHY or G-PHY.
1322
	 * This is just used for resetting the core to probe things;
1323
	 * we will re-guess once it's all up and working.
1324
	 */
1325
	error = bwn_reset_core(mac, have_bg);
1326
	if (error)
1327
		goto fail;
1328

1329
	/*
1330
	 * Determine the DMA engine type
1331
	 */
1332
	if (iost & BHND_IOST_DMA64) {
1333
		mac->mac_dmatype = BHND_DMA_ADDR_64BIT;
1334
	} else {
1335
		uint32_t tmp;
1336
		uint16_t base;
1337

1338
		base = bwn_dma_base(0, 0);
1339
		BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL,
1340
		    BWN_DMA32_TXADDREXT_MASK);
1341
		tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
1342
		if (tmp & BWN_DMA32_TXADDREXT_MASK) {
1343
			mac->mac_dmatype = BHND_DMA_ADDR_32BIT;
1344
		} else {
1345
			mac->mac_dmatype = BHND_DMA_ADDR_30BIT;
1346
		}
1347
	}
1348

1349
	/*
1350
	 * Get the PHY version.
1351
	 */
1352
	error = bwn_phy_getinfo(mac, have_bg);
1353
	if (error)
1354
		goto fail;
1355

1356
	/*
1357
	 * This is the whitelist of devices which we "believe"
1358
	 * the SPROM PHY config from.  The rest are "guessed".
1359
	 */
1360
	if (sc->sc_board_info.board_devid != PCI_DEVID_BCM4311_D11DUAL &&
1361
	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4328_D11G &&
1362
	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4318_D11DUAL &&
1363
	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4306_D11DUAL &&
1364
	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4321_D11N &&
1365
	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4322_D11N) {
1366
		have_a = have_bg = 0;
1367
		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1368
			have_a = 1;
1369
		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1370
		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1371
		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1372
			have_bg = 1;
1373
		else
1374
			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1375
			    mac->mac_phy.type));
1376
	}
1377

1378
	/*
1379
	 * XXX The PHY-G support doesn't do 5GHz operation.
1380
	 */
1381
	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1382
	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1383
		device_printf(sc->sc_dev,
1384
		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1385
		    __func__);
1386
		have_a = 0;
1387
		have_bg = 1;
1388
	}
1389

1390
	mac->mac_phy.phy_n = NULL;
1391

1392
	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1393
		mac->mac_phy.attach = bwn_phy_g_attach;
1394
		mac->mac_phy.detach = bwn_phy_g_detach;
1395
		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1396
		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1397
		mac->mac_phy.init = bwn_phy_g_init;
1398
		mac->mac_phy.exit = bwn_phy_g_exit;
1399
		mac->mac_phy.phy_read = bwn_phy_g_read;
1400
		mac->mac_phy.phy_write = bwn_phy_g_write;
1401
		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1402
		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1403
		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1404
		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1405
		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1406
		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1407
		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1408
		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1409
		mac->mac_phy.set_im = bwn_phy_g_im;
1410
		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1411
		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1412
		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1413
		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1414
	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1415
		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1416
		mac->mac_phy.init = bwn_phy_lp_init;
1417
		mac->mac_phy.phy_read = bwn_phy_lp_read;
1418
		mac->mac_phy.phy_write = bwn_phy_lp_write;
1419
		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1420
		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1421
		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1422
		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1423
		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1424
		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1425
		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1426
		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1427
		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1428
	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1429
		mac->mac_phy.attach = bwn_phy_n_attach;
1430
		mac->mac_phy.detach = bwn_phy_n_detach;
1431
		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1432
		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1433
		mac->mac_phy.init = bwn_phy_n_init;
1434
		mac->mac_phy.exit = bwn_phy_n_exit;
1435
		mac->mac_phy.phy_read = bwn_phy_n_read;
1436
		mac->mac_phy.phy_write = bwn_phy_n_write;
1437
		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1438
		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1439
		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1440
		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1441
		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1442
		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1443
		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1444
		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1445
		mac->mac_phy.set_im = bwn_phy_n_im;
1446
		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1447
		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1448
		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1449
		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1450
	} else {
1451
		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1452
		    mac->mac_phy.type);
1453
		error = ENXIO;
1454
		goto fail;
1455
	}
1456

1457
	mac->mac_phy.gmode = have_bg;
1458
	if (mac->mac_phy.attach != NULL) {
1459
		error = mac->mac_phy.attach(mac);
1460
		if (error) {
1461
			device_printf(sc->sc_dev, "failed\n");
1462
			goto fail;
1463
		}
1464
	}
1465

1466
	error = bwn_reset_core(mac, have_bg);
1467
	if (error)
1468
		goto fail;
1469

1470
	error = bwn_chiptest(mac);
1471
	if (error)
1472
		goto fail;
1473
	error = bwn_setup_channels(mac, have_bg, have_a);
1474
	if (error) {
1475
		device_printf(sc->sc_dev, "failed to setup channels\n");
1476
		goto fail;
1477
	}
1478

1479
	if (sc->sc_curmac == NULL)
1480
		sc->sc_curmac = mac;
1481

1482
	error = bwn_dma_attach(mac);
1483
	if (error != 0) {
1484
		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1485
		goto fail;
1486
	}
1487

1488
	mac->mac_phy.switch_analog(mac, 0);
1489

1490
fail:
1491
	bhnd_suspend_hw(sc->sc_dev, 0);
1492
	bwn_release_firmware(mac);
1493
	return (error);
1494
}
1495

1496
/*
1497
 * Reset
1498
 */
1499
int
1500
bwn_reset_core(struct bwn_mac *mac, int g_mode)
1501
{
1502
	struct bwn_softc	*sc;
1503
	uint32_t		 ctl;
1504
	uint16_t		 ioctl, ioctl_mask;
1505
	int			 error;
1506

1507
	sc = mac->mac_sc;
1508

1509
	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1510

1511
	/* Reset core */
1512
	ioctl = (BWN_IOCTL_PHYCLOCK_ENABLE | BWN_IOCTL_PHYRESET);
1513
	if (g_mode)
1514
		ioctl |= BWN_IOCTL_SUPPORT_G;
1515

1516
	/* XXX N-PHY only; and hard-code to 20MHz for now */
1517
	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1518
		ioctl |= BWN_IOCTL_PHY_BANDWIDTH_20MHZ;
1519

1520
	if ((error = bhnd_reset_hw(sc->sc_dev, ioctl, ioctl))) {
1521
		device_printf(sc->sc_dev, "core reset failed: %d", error);
1522
		return (error);
1523
	}
1524

1525
	DELAY(2000);
1526

1527
	/* Take PHY out of reset */
1528
	ioctl = BHND_IOCTL_CLK_FORCE;
1529
	ioctl_mask = BHND_IOCTL_CLK_FORCE |
1530
		     BWN_IOCTL_PHYRESET |
1531
		     BWN_IOCTL_PHYCLOCK_ENABLE;
1532

1533
	if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1534
		device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1535
		    "%d\n", error);
1536
		return (error);
1537
	}
1538

1539
	DELAY(2000);
1540

1541
	ioctl = BWN_IOCTL_PHYCLOCK_ENABLE;
1542
	if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1543
		device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1544
		    "%d\n", error);
1545
		return (error);
1546
	}
1547

1548
	DELAY(2000);
1549

1550
	if (mac->mac_phy.switch_analog != NULL)
1551
		mac->mac_phy.switch_analog(mac, 1);
1552

1553
	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1554
	if (g_mode)
1555
		ctl |= BWN_MACCTL_GMODE;
1556
	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1557

1558
	return (0);
1559
}
1560

1561
static int
1562
bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1563
{
1564
	struct bwn_phy *phy = &mac->mac_phy;
1565
	struct bwn_softc *sc = mac->mac_sc;
1566
	uint32_t tmp;
1567

1568
	/* PHY */
1569
	tmp = BWN_READ_2(mac, BWN_PHYVER);
1570
	phy->gmode = gmode;
1571
	phy->rf_on = 1;
1572
	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1573
	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1574
	phy->rev = (tmp & BWN_PHYVER_VERSION);
1575
	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1576
	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1577
		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1578
	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1579
	    (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
1580
	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1581
		goto unsupphy;
1582

1583
	/* RADIO */
1584
	BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1585
	tmp = BWN_READ_2(mac, BWN_RFDATALO);
1586
	BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1587
	tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1588

1589
	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1590
	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1591
	phy->rf_manuf = (tmp & 0x00000fff);
1592

1593
	/*
1594
	 * For now, just always do full init (ie, what bwn has traditionally
1595
	 * done)
1596
	 */
1597
	phy->phy_do_full_init = 1;
1598

1599
	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1600
		goto unsupradio;
1601
	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1602
	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1603
	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1604
	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1605
	    (phy->type == BWN_PHYTYPE_N &&
1606
	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1607
	    (phy->type == BWN_PHYTYPE_LP &&
1608
	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1609
		goto unsupradio;
1610

1611
	return (0);
1612
unsupphy:
1613
	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1614
	    "analog %#x)\n",
1615
	    phy->type, phy->rev, phy->analog);
1616
	return (ENXIO);
1617
unsupradio:
1618
	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1619
	    "rev %#x)\n",
1620
	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1621
	return (ENXIO);
1622
}
1623

1624
static int
1625
bwn_chiptest(struct bwn_mac *mac)
1626
{
1627
#define	TESTVAL0	0x55aaaa55
1628
#define	TESTVAL1	0xaa5555aa
1629
	struct bwn_softc *sc = mac->mac_sc;
1630
	uint32_t v, backup;
1631

1632
	BWN_LOCK(sc);
1633

1634
	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1635

1636
	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1637
	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1638
		goto error;
1639
	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1640
	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1641
		goto error;
1642

1643
	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1644

1645
	if ((bhnd_get_hwrev(sc->sc_dev) >= 3) &&
1646
	    (bhnd_get_hwrev(sc->sc_dev) <= 10)) {
1647
		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1648
		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1649
		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1650
			goto error;
1651
		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1652
			goto error;
1653
	}
1654
	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1655

1656
	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1657
	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1658
		goto error;
1659

1660
	BWN_UNLOCK(sc);
1661
	return (0);
1662
error:
1663
	BWN_UNLOCK(sc);
1664
	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1665
	return (ENODEV);
1666
}
1667

1668
static int
1669
bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1670
{
1671
	struct bwn_softc *sc = mac->mac_sc;
1672
	struct ieee80211com *ic = &sc->sc_ic;
1673
	uint8_t bands[IEEE80211_MODE_BYTES];
1674

1675
	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1676
	ic->ic_nchans = 0;
1677

1678
	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1679
	    __func__,
1680
	    have_bg,
1681
	    have_a);
1682

1683
	if (have_bg) {
1684
		memset(bands, 0, sizeof(bands));
1685
		setbit(bands, IEEE80211_MODE_11B);
1686
		setbit(bands, IEEE80211_MODE_11G);
1687
		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1688
		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1689
	}
1690

1691
	if (have_a) {
1692
		memset(bands, 0, sizeof(bands));
1693
		setbit(bands, IEEE80211_MODE_11A);
1694
		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1695
		    &ic->ic_nchans, &bwn_chantable_a, bands);
1696
	}
1697

1698
	mac->mac_phy.supports_2ghz = have_bg;
1699
	mac->mac_phy.supports_5ghz = have_a;
1700

1701
	return (ic->ic_nchans == 0 ? ENXIO : 0);
1702
}
1703

1704
uint32_t
1705
bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1706
{
1707
	uint32_t ret;
1708

1709
	BWN_ASSERT_LOCKED(mac->mac_sc);
1710

1711
	if (way == BWN_SHARED) {
1712
		KASSERT((offset & 0x0001) == 0,
1713
		    ("%s:%d warn", __func__, __LINE__));
1714
		if (offset & 0x0003) {
1715
			bwn_shm_ctlword(mac, way, offset >> 2);
1716
			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1717
			ret <<= 16;
1718
			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1719
			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1720
			goto out;
1721
		}
1722
		offset >>= 2;
1723
	}
1724
	bwn_shm_ctlword(mac, way, offset);
1725
	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1726
out:
1727
	return (ret);
1728
}
1729

1730
uint16_t
1731
bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1732
{
1733
	uint16_t ret;
1734

1735
	BWN_ASSERT_LOCKED(mac->mac_sc);
1736

1737
	if (way == BWN_SHARED) {
1738
		KASSERT((offset & 0x0001) == 0,
1739
		    ("%s:%d warn", __func__, __LINE__));
1740
		if (offset & 0x0003) {
1741
			bwn_shm_ctlword(mac, way, offset >> 2);
1742
			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1743
			goto out;
1744
		}
1745
		offset >>= 2;
1746
	}
1747
	bwn_shm_ctlword(mac, way, offset);
1748
	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1749
out:
1750

1751
	return (ret);
1752
}
1753

1754
static void
1755
bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1756
    uint16_t offset)
1757
{
1758
	uint32_t control;
1759

1760
	control = way;
1761
	control <<= 16;
1762
	control |= offset;
1763
	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1764
}
1765

1766
void
1767
bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1768
    uint32_t value)
1769
{
1770
	BWN_ASSERT_LOCKED(mac->mac_sc);
1771

1772
	if (way == BWN_SHARED) {
1773
		KASSERT((offset & 0x0001) == 0,
1774
		    ("%s:%d warn", __func__, __LINE__));
1775
		if (offset & 0x0003) {
1776
			bwn_shm_ctlword(mac, way, offset >> 2);
1777
			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1778
				    (value >> 16) & 0xffff);
1779
			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1780
			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1781
			return;
1782
		}
1783
		offset >>= 2;
1784
	}
1785
	bwn_shm_ctlword(mac, way, offset);
1786
	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1787
}
1788

1789
void
1790
bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1791
    uint16_t value)
1792
{
1793
	BWN_ASSERT_LOCKED(mac->mac_sc);
1794

1795
	if (way == BWN_SHARED) {
1796
		KASSERT((offset & 0x0001) == 0,
1797
		    ("%s:%d warn", __func__, __LINE__));
1798
		if (offset & 0x0003) {
1799
			bwn_shm_ctlword(mac, way, offset >> 2);
1800
			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1801
			return;
1802
		}
1803
		offset >>= 2;
1804
	}
1805
	bwn_shm_ctlword(mac, way, offset);
1806
	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1807
}
1808

1809
static void
1810
bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1811
    const struct bwn_channelinfo *ci, const uint8_t bands[])
1812
{
1813
	int i, error;
1814

1815
	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1816
		const struct bwn_channel *hc = &ci->channels[i];
1817

1818
		error = ieee80211_add_channel(chans, maxchans, nchans,
1819
		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1820
	}
1821
}
1822

1823
static int
1824
bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1825
	const struct ieee80211_bpf_params *params)
1826
{
1827
	struct ieee80211com *ic = ni->ni_ic;
1828
	struct bwn_softc *sc = ic->ic_softc;
1829
	struct bwn_mac *mac = sc->sc_curmac;
1830
	int error;
1831

1832
	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1833
	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1834
		m_freem(m);
1835
		return (ENETDOWN);
1836
	}
1837

1838
	BWN_LOCK(sc);
1839
	if (bwn_tx_isfull(sc, m)) {
1840
		m_freem(m);
1841
		BWN_UNLOCK(sc);
1842
		return (ENOBUFS);
1843
	}
1844

1845
	error = bwn_tx_start(sc, ni, m);
1846
	if (error == 0)
1847
		sc->sc_watchdog_timer = 5;
1848
	BWN_UNLOCK(sc);
1849
	return (error);
1850
}
1851

1852
/*
1853
 * Callback from the 802.11 layer to update the slot time
1854
 * based on the current setting.  We use it to notify the
1855
 * firmware of ERP changes and the f/w takes care of things
1856
 * like slot time and preamble.
1857
 */
1858
static void
1859
bwn_updateslot(struct ieee80211com *ic)
1860
{
1861
	struct bwn_softc *sc = ic->ic_softc;
1862
	struct bwn_mac *mac;
1863

1864
	BWN_LOCK(sc);
1865
	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1866
		mac = (struct bwn_mac *)sc->sc_curmac;
1867
		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1868
	}
1869
	BWN_UNLOCK(sc);
1870
}
1871

1872
/*
1873
 * Callback from the 802.11 layer after a promiscuous mode change.
1874
 * Note this interface does not check the operating mode as this
1875
 * is an internal callback and we are expected to honor the current
1876
 * state (e.g. this is used for setting the interface in promiscuous
1877
 * mode when operating in hostap mode to do ACS).
1878
 */
1879
static void
1880
bwn_update_promisc(struct ieee80211com *ic)
1881
{
1882
	struct bwn_softc *sc = ic->ic_softc;
1883
	struct bwn_mac *mac = sc->sc_curmac;
1884

1885
	BWN_LOCK(sc);
1886
	mac = sc->sc_curmac;
1887
	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1888
		if (ic->ic_promisc > 0)
1889
			sc->sc_filters |= BWN_MACCTL_PROMISC;
1890
		else
1891
			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1892
		bwn_set_opmode(mac);
1893
	}
1894
	BWN_UNLOCK(sc);
1895
}
1896

1897
/*
1898
 * Callback from the 802.11 layer to update WME parameters.
1899
 */
1900
static int
1901
bwn_wme_update(struct ieee80211com *ic)
1902
{
1903
	struct bwn_softc *sc = ic->ic_softc;
1904
	struct bwn_mac *mac = sc->sc_curmac;
1905
	struct chanAccParams chp;
1906
	struct wmeParams *wmep;
1907
	int i;
1908

1909
	ieee80211_wme_ic_getparams(ic, &chp);
1910

1911
	BWN_LOCK(sc);
1912
	mac = sc->sc_curmac;
1913
	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1914
		bwn_mac_suspend(mac);
1915
		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1916
			wmep = &chp.cap_wmeParams[i];
1917
			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1918
		}
1919
		bwn_mac_enable(mac);
1920
	}
1921
	BWN_UNLOCK(sc);
1922
	return (0);
1923
}
1924

1925
static void
1926
bwn_scan_start(struct ieee80211com *ic)
1927
{
1928
	struct bwn_softc *sc = ic->ic_softc;
1929
	struct bwn_mac *mac;
1930

1931
	BWN_LOCK(sc);
1932
	mac = sc->sc_curmac;
1933
	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1934
		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1935
		bwn_set_opmode(mac);
1936
		/* disable CFP update during scan */
1937
		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1938
	}
1939
	BWN_UNLOCK(sc);
1940
}
1941

1942
static void
1943
bwn_scan_end(struct ieee80211com *ic)
1944
{
1945
	struct bwn_softc *sc = ic->ic_softc;
1946
	struct bwn_mac *mac;
1947

1948
	BWN_LOCK(sc);
1949
	mac = sc->sc_curmac;
1950
	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1951
		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1952
		bwn_set_opmode(mac);
1953
		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1954
	}
1955
	BWN_UNLOCK(sc);
1956
}
1957

1958
static void
1959
bwn_set_channel(struct ieee80211com *ic)
1960
{
1961
	struct bwn_softc *sc = ic->ic_softc;
1962
	struct bwn_mac *mac = sc->sc_curmac;
1963
	struct bwn_phy *phy = &mac->mac_phy;
1964
	int chan, error;
1965

1966
	BWN_LOCK(sc);
1967

1968
	error = bwn_switch_band(sc, ic->ic_curchan);
1969
	if (error)
1970
		goto fail;
1971
	bwn_mac_suspend(mac);
1972
	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1973
	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1974
	if (chan != phy->chan)
1975
		bwn_switch_channel(mac, chan);
1976

1977
	/* TX power level */
1978
	if (ic->ic_curchan->ic_maxpower != 0 &&
1979
	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1980
		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1981
		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1982
		    BWN_TXPWR_IGNORE_TSSI);
1983
	}
1984

1985
	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1986
	if (phy->set_antenna)
1987
		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1988

1989
	if (sc->sc_rf_enabled != phy->rf_on) {
1990
		if (sc->sc_rf_enabled) {
1991
			bwn_rf_turnon(mac);
1992
			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1993
				device_printf(sc->sc_dev,
1994
				    "please turn on the RF switch\n");
1995
		} else
1996
			bwn_rf_turnoff(mac);
1997
	}
1998

1999
	bwn_mac_enable(mac);
2000

2001
fail:
2002
	BWN_UNLOCK(sc);
2003
}
2004

2005
static struct ieee80211vap *
2006
bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2007
    enum ieee80211_opmode opmode, int flags,
2008
    const uint8_t bssid[IEEE80211_ADDR_LEN],
2009
    const uint8_t mac[IEEE80211_ADDR_LEN])
2010
{
2011
	struct ieee80211vap *vap;
2012
	struct bwn_vap *bvp;
2013

2014
	switch (opmode) {
2015
	case IEEE80211_M_HOSTAP:
2016
	case IEEE80211_M_MBSS:
2017
	case IEEE80211_M_STA:
2018
	case IEEE80211_M_WDS:
2019
	case IEEE80211_M_MONITOR:
2020
	case IEEE80211_M_IBSS:
2021
	case IEEE80211_M_AHDEMO:
2022
		break;
2023
	default:
2024
		return (NULL);
2025
	}
2026

2027
	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
2028
	vap = &bvp->bv_vap;
2029
	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
2030
	/* override with driver methods */
2031
	bvp->bv_newstate = vap->iv_newstate;
2032
	vap->iv_newstate = bwn_newstate;
2033

2034
	/* override max aid so sta's cannot assoc when we're out of sta id's */
2035
	vap->iv_max_aid = BWN_STAID_MAX;
2036

2037
	ieee80211_ratectl_init(vap);
2038

2039
	/* complete setup */
2040
	ieee80211_vap_attach(vap, ieee80211_media_change,
2041
	    ieee80211_media_status, mac);
2042
	return (vap);
2043
}
2044

2045
static void
2046
bwn_vap_delete(struct ieee80211vap *vap)
2047
{
2048
	struct bwn_vap *bvp = BWN_VAP(vap);
2049

2050
	ieee80211_ratectl_deinit(vap);
2051
	ieee80211_vap_detach(vap);
2052
	free(bvp, M_80211_VAP);
2053
}
2054

2055
static int
2056
bwn_init(struct bwn_softc *sc)
2057
{
2058
	struct bwn_mac *mac;
2059
	int error;
2060

2061
	BWN_ASSERT_LOCKED(sc);
2062

2063
	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2064

2065
	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2066
	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2067
	sc->sc_filters = 0;
2068
	bwn_wme_clear(sc);
2069
	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2070
	sc->sc_rf_enabled = 1;
2071

2072
	mac = sc->sc_curmac;
2073
	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2074
		error = bwn_core_init(mac);
2075
		if (error != 0)
2076
			return (error);
2077
	}
2078
	if (mac->mac_status == BWN_MAC_STATUS_INITED)
2079
		bwn_core_start(mac);
2080

2081
	bwn_set_opmode(mac);
2082
	bwn_set_pretbtt(mac);
2083
	bwn_spu_setdelay(mac, 0);
2084
	bwn_set_macaddr(mac);
2085

2086
	sc->sc_flags |= BWN_FLAG_RUNNING;
2087
	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2088
	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2089

2090
	return (0);
2091
}
2092

2093
static void
2094
bwn_stop(struct bwn_softc *sc)
2095
{
2096
	struct bwn_mac *mac = sc->sc_curmac;
2097

2098
	BWN_ASSERT_LOCKED(sc);
2099

2100
	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2101

2102
	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2103
		/* XXX FIXME opmode not based on VAP */
2104
		bwn_set_opmode(mac);
2105
		bwn_set_macaddr(mac);
2106
	}
2107

2108
	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2109
		bwn_core_stop(mac);
2110

2111
	callout_stop(&sc->sc_led_blink_ch);
2112
	sc->sc_led_blinking = 0;
2113

2114
	bwn_core_exit(mac);
2115
	sc->sc_rf_enabled = 0;
2116

2117
	sc->sc_flags &= ~BWN_FLAG_RUNNING;
2118
}
2119

2120
static void
2121
bwn_wme_clear(struct bwn_softc *sc)
2122
{
2123
	struct wmeParams *p;
2124
	unsigned int i;
2125

2126
	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2127
	    ("%s:%d: fail", __func__, __LINE__));
2128

2129
	for (i = 0; i < N(sc->sc_wmeParams); i++) {
2130
		p = &(sc->sc_wmeParams[i]);
2131

2132
		switch (bwn_wme_shm_offsets[i]) {
2133
		case BWN_WME_VOICE:
2134
			p->wmep_txopLimit = 0;
2135
			p->wmep_aifsn = 2;
2136
			/* XXX FIXME: log2(cwmin) */
2137
			p->wmep_logcwmin =
2138
			    _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2139
			p->wmep_logcwmax =
2140
			    _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMAX);
2141
			break;
2142
		case BWN_WME_VIDEO:
2143
			p->wmep_txopLimit = 0;
2144
			p->wmep_aifsn = 2;
2145
			/* XXX FIXME: log2(cwmin) */
2146
			p->wmep_logcwmin =
2147
			    _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2148
			p->wmep_logcwmax =
2149
			    _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMAX);
2150
			break;
2151
		case BWN_WME_BESTEFFORT:
2152
			p->wmep_txopLimit = 0;
2153
			p->wmep_aifsn = 3;
2154
			/* XXX FIXME: log2(cwmin) */
2155
			p->wmep_logcwmin =
2156
			    _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2157
			p->wmep_logcwmax =
2158
			    _IEEE80211_MASKSHIFT(0x03ff, WME_PARAM_LOGCWMAX);
2159
			break;
2160
		case BWN_WME_BACKGROUND:
2161
			p->wmep_txopLimit = 0;
2162
			p->wmep_aifsn = 7;
2163
			/* XXX FIXME: log2(cwmin) */
2164
			p->wmep_logcwmin =
2165
			    _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2166
			p->wmep_logcwmax =
2167
			    _IEEE80211_MASKSHIFT(0x03ff, WME_PARAM_LOGCWMAX);
2168
			break;
2169
		default:
2170
			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2171
		}
2172
	}
2173
}
2174

2175
static int
2176
bwn_core_forceclk(struct bwn_mac *mac, bool force)
2177
{
2178
	struct bwn_softc	*sc;
2179
	bhnd_clock		 clock;
2180
	int			 error;
2181

2182
	sc = mac->mac_sc;
2183

2184
	/* On PMU equipped devices, we do not need to force the HT clock */
2185
	if (sc->sc_pmu != NULL)
2186
		return (0);
2187

2188
	/* Issue a PMU clock request */
2189
	if (force)
2190
		clock = BHND_CLOCK_HT;
2191
	else
2192
		clock = BHND_CLOCK_DYN;
2193

2194
	if ((error = bhnd_request_clock(sc->sc_dev, clock))) {
2195
		device_printf(sc->sc_dev, "%d clock request failed: %d\n",
2196
		    clock, error);
2197
		return (error);
2198
	}
2199

2200
	return (0);
2201
}
2202

2203
static int
2204
bwn_core_init(struct bwn_mac *mac)
2205
{
2206
	struct bwn_softc *sc = mac->mac_sc;
2207
	uint64_t hf;
2208
	int error;
2209

2210
	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2211
	    ("%s:%d: fail", __func__, __LINE__));
2212

2213
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2214

2215
	if ((error = bwn_core_forceclk(mac, true)))
2216
		return (error);
2217

2218
	if (bhnd_is_hw_suspended(sc->sc_dev)) {
2219
		if ((error = bwn_reset_core(mac, mac->mac_phy.gmode)))
2220
			goto fail0;
2221
	}
2222

2223
	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2224
	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2225
	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2226
	BWN_GETTIME(mac->mac_phy.nexttime);
2227
	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2228
	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2229
	mac->mac_stats.link_noise = -95;
2230
	mac->mac_reason_intr = 0;
2231
	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2232
	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2233
#ifdef BWN_DEBUG
2234
	if (sc->sc_debug & BWN_DEBUG_XMIT)
2235
		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2236
#endif
2237
	mac->mac_suspended = 1;
2238
	mac->mac_task_state = 0;
2239
	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2240

2241
	mac->mac_phy.init_pre(mac);
2242

2243
	bwn_bt_disable(mac);
2244
	if (mac->mac_phy.prepare_hw) {
2245
		error = mac->mac_phy.prepare_hw(mac);
2246
		if (error)
2247
			goto fail0;
2248
	}
2249
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2250
	error = bwn_chip_init(mac);
2251
	if (error)
2252
		goto fail0;
2253
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2254
	    bhnd_get_hwrev(sc->sc_dev));
2255
	hf = bwn_hf_read(mac);
2256
	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2257
		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2258
		if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL)
2259
			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2260
		if (mac->mac_phy.rev == 1)
2261
			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2262
	}
2263
	if (mac->mac_phy.rf_ver == 0x2050) {
2264
		if (mac->mac_phy.rf_rev < 6)
2265
			hf |= BWN_HF_FORCE_VCO_RECALC;
2266
		if (mac->mac_phy.rf_rev == 6)
2267
			hf |= BWN_HF_4318_TSSI;
2268
	}
2269
	if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2270
		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2271
	if (sc->sc_quirks & BWN_QUIRK_UCODE_SLOWCLOCK_WAR)
2272
		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2273
	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2274
	bwn_hf_write(mac, hf);
2275

2276
	/* Tell the firmware about the MAC capabilities */
2277
	if (bhnd_get_hwrev(sc->sc_dev) >= 13) {
2278
		uint32_t cap;
2279
		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2280
		DPRINTF(sc, BWN_DEBUG_RESET,
2281
		    "%s: hw capabilities: 0x%08x\n",
2282
		    __func__, cap);
2283
		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2284
		    cap & 0xffff);
2285
		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2286
		    (cap >> 16) & 0xffff);
2287
	}
2288

2289
	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2290
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2291
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2292
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2293

2294
	bwn_rate_init(mac);
2295
	bwn_set_phytxctl(mac);
2296

2297
	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2298
	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2299
	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2300

2301
	if (sc->sc_quirks & BWN_QUIRK_NODMA)
2302
		bwn_pio_init(mac);
2303
	else
2304
		bwn_dma_init(mac);
2305
	bwn_wme_init(mac);
2306
	bwn_spu_setdelay(mac, 1);
2307
	bwn_bt_enable(mac);
2308

2309
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2310
	if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2311
		bwn_core_forceclk(mac, true);
2312
	else
2313
		bwn_core_forceclk(mac, false);
2314

2315
	bwn_set_macaddr(mac);
2316
	bwn_crypt_init(mac);
2317

2318
	/* XXX LED initializatin */
2319

2320
	mac->mac_status = BWN_MAC_STATUS_INITED;
2321

2322
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2323
	return (error);
2324

2325
fail0:
2326
	bhnd_suspend_hw(sc->sc_dev, 0);
2327
	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2328
	    ("%s:%d: fail", __func__, __LINE__));
2329
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2330
	return (error);
2331
}
2332

2333
static void
2334
bwn_core_start(struct bwn_mac *mac)
2335
{
2336
	struct bwn_softc *sc = mac->mac_sc;
2337
	uint32_t tmp;
2338

2339
	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2340
	    ("%s:%d: fail", __func__, __LINE__));
2341

2342
	if (bhnd_get_hwrev(sc->sc_dev) < 5)
2343
		return;
2344

2345
	while (1) {
2346
		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2347
		if (!(tmp & 0x00000001))
2348
			break;
2349
		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2350
	}
2351

2352
	bwn_mac_enable(mac);
2353
	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2354
	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2355

2356
	mac->mac_status = BWN_MAC_STATUS_STARTED;
2357
}
2358

2359
static void
2360
bwn_core_exit(struct bwn_mac *mac)
2361
{
2362
	struct bwn_softc *sc = mac->mac_sc;
2363
	uint32_t macctl;
2364

2365
	BWN_ASSERT_LOCKED(mac->mac_sc);
2366

2367
	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2368
	    ("%s:%d: fail", __func__, __LINE__));
2369

2370
	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2371
		return;
2372
	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2373

2374
	macctl = BWN_READ_4(mac, BWN_MACCTL);
2375
	macctl &= ~BWN_MACCTL_MCODE_RUN;
2376
	macctl |= BWN_MACCTL_MCODE_JMP0;
2377
	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2378

2379
	bwn_dma_stop(mac);
2380
	bwn_pio_stop(mac);
2381
	bwn_chip_exit(mac);
2382
	mac->mac_phy.switch_analog(mac, 0);
2383
	bhnd_suspend_hw(sc->sc_dev, 0);
2384
}
2385

2386
static void
2387
bwn_bt_disable(struct bwn_mac *mac)
2388
{
2389
	struct bwn_softc *sc = mac->mac_sc;
2390

2391
	(void)sc;
2392
	/* XXX do nothing yet */
2393
}
2394

2395
static int
2396
bwn_chip_init(struct bwn_mac *mac)
2397
{
2398
	struct bwn_softc *sc = mac->mac_sc;
2399
	struct bwn_phy *phy = &mac->mac_phy;
2400
	uint32_t macctl;
2401
	u_int delay;
2402
	int error;
2403

2404
	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2405
	if (phy->gmode)
2406
		macctl |= BWN_MACCTL_GMODE;
2407
	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2408

2409
	error = bwn_fw_fillinfo(mac);
2410
	if (error)
2411
		return (error);
2412
	error = bwn_fw_loaducode(mac);
2413
	if (error)
2414
		return (error);
2415

2416
	error = bwn_gpio_init(mac);
2417
	if (error)
2418
		return (error);
2419

2420
	error = bwn_fw_loadinitvals(mac);
2421
	if (error)
2422
		return (error);
2423

2424
	phy->switch_analog(mac, 1);
2425
	error = bwn_phy_init(mac);
2426
	if (error)
2427
		return (error);
2428

2429
	if (phy->set_im)
2430
		phy->set_im(mac, BWN_IMMODE_NONE);
2431
	if (phy->set_antenna)
2432
		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2433
	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2434

2435
	if (phy->type == BWN_PHYTYPE_B)
2436
		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2437
	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2438
	if (bhnd_get_hwrev(sc->sc_dev) < 5)
2439
		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2440

2441
	BWN_WRITE_4(mac, BWN_MACCTL,
2442
	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2443
	BWN_WRITE_4(mac, BWN_MACCTL,
2444
	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2445
	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2446

2447
	bwn_set_opmode(mac);
2448
	if (bhnd_get_hwrev(sc->sc_dev) < 3) {
2449
		BWN_WRITE_2(mac, 0x060e, 0x0000);
2450
		BWN_WRITE_2(mac, 0x0610, 0x8000);
2451
		BWN_WRITE_2(mac, 0x0604, 0x0000);
2452
		BWN_WRITE_2(mac, 0x0606, 0x0200);
2453
	} else {
2454
		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2455
		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2456
	}
2457
	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2458
	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2459
	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2460
	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2461
	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2462
	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2463
	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2464

2465
	bwn_mac_phy_clock_set(mac, true);
2466

2467
	/* Provide the HT clock transition latency to the MAC core */
2468
	error = bhnd_get_clock_latency(sc->sc_dev, BHND_CLOCK_HT, &delay);
2469
	if (error) {
2470
		device_printf(sc->sc_dev, "failed to fetch HT clock latency: "
2471
		    "%d\n", error);
2472
		return (error);
2473
	}
2474

2475
	if (delay > UINT16_MAX) {
2476
		device_printf(sc->sc_dev, "invalid HT clock latency: %u\n",
2477
		    delay);
2478
		return (ENXIO);
2479
	}
2480

2481
	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, delay);
2482
	return (0);
2483
}
2484

2485
/* read hostflags */
2486
uint64_t
2487
bwn_hf_read(struct bwn_mac *mac)
2488
{
2489
	uint64_t ret;
2490

2491
	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2492
	ret <<= 16;
2493
	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2494
	ret <<= 16;
2495
	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2496
	return (ret);
2497
}
2498

2499
void
2500
bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2501
{
2502

2503
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2504
	    (value & 0x00000000ffffull));
2505
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2506
	    (value & 0x0000ffff0000ull) >> 16);
2507
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2508
	    (value & 0xffff00000000ULL) >> 32);
2509
}
2510

2511
static void
2512
bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2513
{
2514

2515
	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2516
	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2517
}
2518

2519
static void
2520
bwn_rate_init(struct bwn_mac *mac)
2521
{
2522

2523
	switch (mac->mac_phy.type) {
2524
	case BWN_PHYTYPE_A:
2525
	case BWN_PHYTYPE_G:
2526
	case BWN_PHYTYPE_LP:
2527
	case BWN_PHYTYPE_N:
2528
		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2529
		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2530
		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2531
		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2532
		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2533
		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2534
		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2535
		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2536
			break;
2537
		/* FALLTHROUGH */
2538
	case BWN_PHYTYPE_B:
2539
		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2540
		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2541
		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2542
		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2543
		break;
2544
	default:
2545
		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2546
	}
2547
}
2548

2549
static void
2550
bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2551
{
2552
	uint16_t offset;
2553

2554
	if (ofdm) {
2555
		offset = 0x480;
2556
		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2557
	} else {
2558
		offset = 0x4c0;
2559
		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2560
	}
2561
	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2562
	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2563
}
2564

2565
static uint8_t
2566
bwn_plcp_getcck(const uint8_t bitrate)
2567
{
2568

2569
	switch (bitrate) {
2570
	case BWN_CCK_RATE_1MB:
2571
		return (0x0a);
2572
	case BWN_CCK_RATE_2MB:
2573
		return (0x14);
2574
	case BWN_CCK_RATE_5MB:
2575
		return (0x37);
2576
	case BWN_CCK_RATE_11MB:
2577
		return (0x6e);
2578
	}
2579
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2580
	return (0);
2581
}
2582

2583
static uint8_t
2584
bwn_plcp_getofdm(const uint8_t bitrate)
2585
{
2586

2587
	switch (bitrate) {
2588
	case BWN_OFDM_RATE_6MB:
2589
		return (0xb);
2590
	case BWN_OFDM_RATE_9MB:
2591
		return (0xf);
2592
	case BWN_OFDM_RATE_12MB:
2593
		return (0xa);
2594
	case BWN_OFDM_RATE_18MB:
2595
		return (0xe);
2596
	case BWN_OFDM_RATE_24MB:
2597
		return (0x9);
2598
	case BWN_OFDM_RATE_36MB:
2599
		return (0xd);
2600
	case BWN_OFDM_RATE_48MB:
2601
		return (0x8);
2602
	case BWN_OFDM_RATE_54MB:
2603
		return (0xc);
2604
	}
2605
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2606
	return (0);
2607
}
2608

2609
static void
2610
bwn_set_phytxctl(struct bwn_mac *mac)
2611
{
2612
	uint16_t ctl;
2613

2614
	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2615
	    BWN_TX_PHY_TXPWR);
2616
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2617
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2618
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2619
}
2620

2621
static void
2622
bwn_pio_init(struct bwn_mac *mac)
2623
{
2624
	struct bwn_pio *pio = &mac->mac_method.pio;
2625

2626
	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2627
	    & ~BWN_MACCTL_BIGENDIAN);
2628
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2629

2630
	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2631
	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2632
	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2633
	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2634
	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2635
	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2636
}
2637

2638
static void
2639
bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2640
    int index)
2641
{
2642
	struct bwn_pio_txpkt *tp;
2643
	struct bwn_softc *sc = mac->mac_sc;
2644
	unsigned int i;
2645

2646
	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2647
	tq->tq_index = index;
2648

2649
	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2650
	if (bhnd_get_hwrev(sc->sc_dev) >= 8)
2651
		tq->tq_size = 1920;
2652
	else {
2653
		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2654
		tq->tq_size -= 80;
2655
	}
2656

2657
	TAILQ_INIT(&tq->tq_pktlist);
2658
	for (i = 0; i < N(tq->tq_pkts); i++) {
2659
		tp = &(tq->tq_pkts[i]);
2660
		tp->tp_index = i;
2661
		tp->tp_queue = tq;
2662
		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2663
	}
2664
}
2665

2666
static uint16_t
2667
bwn_pio_idx2base(struct bwn_mac *mac, int index)
2668
{
2669
	struct bwn_softc *sc = mac->mac_sc;
2670
	static const uint16_t bases[] = {
2671
		BWN_PIO_BASE0,
2672
		BWN_PIO_BASE1,
2673
		BWN_PIO_BASE2,
2674
		BWN_PIO_BASE3,
2675
		BWN_PIO_BASE4,
2676
		BWN_PIO_BASE5,
2677
		BWN_PIO_BASE6,
2678
		BWN_PIO_BASE7,
2679
	};
2680
	static const uint16_t bases_rev11[] = {
2681
		BWN_PIO11_BASE0,
2682
		BWN_PIO11_BASE1,
2683
		BWN_PIO11_BASE2,
2684
		BWN_PIO11_BASE3,
2685
		BWN_PIO11_BASE4,
2686
		BWN_PIO11_BASE5,
2687
	};
2688

2689
	if (bhnd_get_hwrev(sc->sc_dev) >= 11) {
2690
		if (index >= N(bases_rev11))
2691
			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2692
		return (bases_rev11[index]);
2693
	}
2694
	if (index >= N(bases))
2695
		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2696
	return (bases[index]);
2697
}
2698

2699
static void
2700
bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2701
    int index)
2702
{
2703
	struct bwn_softc *sc = mac->mac_sc;
2704

2705
	prq->prq_mac = mac;
2706
	prq->prq_rev = bhnd_get_hwrev(sc->sc_dev);
2707
	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2708
	bwn_dma_rxdirectfifo(mac, index, 1);
2709
}
2710

2711
static void
2712
bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2713
{
2714
	if (tq == NULL)
2715
		return;
2716
	bwn_pio_cancel_tx_packets(tq);
2717
}
2718

2719
static void
2720
bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2721
{
2722

2723
	bwn_destroy_pioqueue_tx(pio);
2724
}
2725

2726
static uint16_t
2727
bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2728
    uint16_t offset)
2729
{
2730

2731
	return (BWN_READ_2(mac, tq->tq_base + offset));
2732
}
2733

2734
static void
2735
bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2736
{
2737
	uint32_t ctl;
2738
	uint16_t base;
2739

2740
	base = bwn_dma_base(mac->mac_dmatype, idx);
2741
	if (mac->mac_dmatype == BHND_DMA_ADDR_64BIT) {
2742
		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2743
		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2744
		if (enable)
2745
			ctl |= BWN_DMA64_RXDIRECTFIFO;
2746
		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2747
	} else {
2748
		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2749
		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2750
		if (enable)
2751
			ctl |= BWN_DMA32_RXDIRECTFIFO;
2752
		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2753
	}
2754
}
2755

2756
static void
2757
bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2758
{
2759
	struct bwn_pio_txpkt *tp;
2760
	unsigned int i;
2761

2762
	for (i = 0; i < N(tq->tq_pkts); i++) {
2763
		tp = &(tq->tq_pkts[i]);
2764
		if (tp->tp_m) {
2765
			m_freem(tp->tp_m);
2766
			tp->tp_m = NULL;
2767
		}
2768
	}
2769
}
2770

2771
static uint16_t
2772
bwn_dma_base(int type, int controller_idx)
2773
{
2774
	static const uint16_t map64[] = {
2775
		BWN_DMA64_BASE0,
2776
		BWN_DMA64_BASE1,
2777
		BWN_DMA64_BASE2,
2778
		BWN_DMA64_BASE3,
2779
		BWN_DMA64_BASE4,
2780
		BWN_DMA64_BASE5,
2781
	};
2782
	static const uint16_t map32[] = {
2783
		BWN_DMA32_BASE0,
2784
		BWN_DMA32_BASE1,
2785
		BWN_DMA32_BASE2,
2786
		BWN_DMA32_BASE3,
2787
		BWN_DMA32_BASE4,
2788
		BWN_DMA32_BASE5,
2789
	};
2790

2791
	if (type == BHND_DMA_ADDR_64BIT) {
2792
		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2793
		    ("%s:%d: fail", __func__, __LINE__));
2794
		return (map64[controller_idx]);
2795
	}
2796
	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2797
	    ("%s:%d: fail", __func__, __LINE__));
2798
	return (map32[controller_idx]);
2799
}
2800

2801
static void
2802
bwn_dma_init(struct bwn_mac *mac)
2803
{
2804
	struct bwn_dma *dma = &mac->mac_method.dma;
2805

2806
	/* setup TX DMA channels. */
2807
	bwn_dma_setup(dma->wme[WME_AC_BK]);
2808
	bwn_dma_setup(dma->wme[WME_AC_BE]);
2809
	bwn_dma_setup(dma->wme[WME_AC_VI]);
2810
	bwn_dma_setup(dma->wme[WME_AC_VO]);
2811
	bwn_dma_setup(dma->mcast);
2812
	/* setup RX DMA channel. */
2813
	bwn_dma_setup(dma->rx);
2814
}
2815

2816
static struct bwn_dma_ring *
2817
bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2818
    int for_tx)
2819
{
2820
	struct bwn_dma *dma = &mac->mac_method.dma;
2821
	struct bwn_dma_ring *dr;
2822
	struct bwn_dmadesc_generic *desc;
2823
	struct bwn_dmadesc_meta *mt;
2824
	struct bwn_softc *sc = mac->mac_sc;
2825
	int error, i;
2826

2827
	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2828
	if (dr == NULL)
2829
		goto out;
2830
	dr->dr_numslots = BWN_RXRING_SLOTS;
2831
	if (for_tx)
2832
		dr->dr_numslots = BWN_TXRING_SLOTS;
2833

2834
	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2835
	    M_DEVBUF, M_NOWAIT | M_ZERO);
2836
	if (dr->dr_meta == NULL)
2837
		goto fail0;
2838

2839
	dr->dr_type = mac->mac_dmatype;
2840
	dr->dr_mac = mac;
2841
	dr->dr_base = bwn_dma_base(dr->dr_type, controller_index);
2842
	dr->dr_index = controller_index;
2843
	if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
2844
		dr->getdesc = bwn_dma_64_getdesc;
2845
		dr->setdesc = bwn_dma_64_setdesc;
2846
		dr->start_transfer = bwn_dma_64_start_transfer;
2847
		dr->suspend = bwn_dma_64_suspend;
2848
		dr->resume = bwn_dma_64_resume;
2849
		dr->get_curslot = bwn_dma_64_get_curslot;
2850
		dr->set_curslot = bwn_dma_64_set_curslot;
2851
	} else {
2852
		dr->getdesc = bwn_dma_32_getdesc;
2853
		dr->setdesc = bwn_dma_32_setdesc;
2854
		dr->start_transfer = bwn_dma_32_start_transfer;
2855
		dr->suspend = bwn_dma_32_suspend;
2856
		dr->resume = bwn_dma_32_resume;
2857
		dr->get_curslot = bwn_dma_32_get_curslot;
2858
		dr->set_curslot = bwn_dma_32_set_curslot;
2859
	}
2860
	if (for_tx) {
2861
		dr->dr_tx = 1;
2862
		dr->dr_curslot = -1;
2863
	} else {
2864
		if (dr->dr_index == 0) {
2865
			switch (mac->mac_fw.fw_hdr_format) {
2866
			case BWN_FW_HDR_351:
2867
			case BWN_FW_HDR_410:
2868
				dr->dr_rx_bufsize =
2869
				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2870
				dr->dr_frameoffset =
2871
				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2872
				break;
2873
			case BWN_FW_HDR_598:
2874
				dr->dr_rx_bufsize =
2875
				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2876
				dr->dr_frameoffset =
2877
				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2878
				break;
2879
			}
2880
		} else
2881
			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2882
	}
2883

2884
	error = bwn_dma_allocringmemory(dr);
2885
	if (error)
2886
		goto fail2;
2887

2888
	if (for_tx) {
2889
		/*
2890
		 * Assumption: BWN_TXRING_SLOTS can be divided by
2891
		 * BWN_TX_SLOTS_PER_FRAME
2892
		 */
2893
		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2894
		    ("%s:%d: fail", __func__, __LINE__));
2895

2896
		dr->dr_txhdr_cache = contigmalloc(
2897
		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2898
		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2899
		    0, BUS_SPACE_MAXADDR, 8, 0);
2900
		if (dr->dr_txhdr_cache == NULL) {
2901
			device_printf(sc->sc_dev,
2902
			    "can't allocate TX header DMA memory\n");
2903
			goto fail1;
2904
		}
2905

2906
		/*
2907
		 * Create TX ring DMA stuffs
2908
		 */
2909
		error = bus_dma_tag_create(dma->parent_dtag,
2910
				    BWN_ALIGN, 0,
2911
				    BUS_SPACE_MAXADDR,
2912
				    BUS_SPACE_MAXADDR,
2913
				    NULL, NULL,
2914
				    BWN_HDRSIZE(mac),
2915
				    1,
2916
				    BUS_SPACE_MAXSIZE_32BIT,
2917
				    0,
2918
				    NULL, NULL,
2919
				    &dr->dr_txring_dtag);
2920
		if (error) {
2921
			device_printf(sc->sc_dev,
2922
			    "can't create TX ring DMA tag: TODO frees\n");
2923
			goto fail2;
2924
		}
2925

2926
		for (i = 0; i < dr->dr_numslots; i += 2) {
2927
			dr->getdesc(dr, i, &desc, &mt);
2928

2929
			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2930
			mt->mt_m = NULL;
2931
			mt->mt_ni = NULL;
2932
			mt->mt_islast = 0;
2933
			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2934
			    &mt->mt_dmap);
2935
			if (error) {
2936
				device_printf(sc->sc_dev,
2937
				     "can't create RX buf DMA map\n");
2938
				goto fail2;
2939
			}
2940

2941
			dr->getdesc(dr, i + 1, &desc, &mt);
2942

2943
			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2944
			mt->mt_m = NULL;
2945
			mt->mt_ni = NULL;
2946
			mt->mt_islast = 1;
2947
			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2948
			    &mt->mt_dmap);
2949
			if (error) {
2950
				device_printf(sc->sc_dev,
2951
				     "can't create RX buf DMA map\n");
2952
				goto fail2;
2953
			}
2954
		}
2955
	} else {
2956
		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2957
		    &dr->dr_spare_dmap);
2958
		if (error) {
2959
			device_printf(sc->sc_dev,
2960
			    "can't create RX buf DMA map\n");
2961
			goto out;		/* XXX wrong! */
2962
		}
2963

2964
		for (i = 0; i < dr->dr_numslots; i++) {
2965
			dr->getdesc(dr, i, &desc, &mt);
2966

2967
			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2968
			    &mt->mt_dmap);
2969
			if (error) {
2970
				device_printf(sc->sc_dev,
2971
				    "can't create RX buf DMA map\n");
2972
				goto out;	/* XXX wrong! */
2973
			}
2974
			error = bwn_dma_newbuf(dr, desc, mt, 1);
2975
			if (error) {
2976
				device_printf(sc->sc_dev,
2977
				    "failed to allocate RX buf\n");
2978
				goto out;	/* XXX wrong! */
2979
			}
2980
		}
2981

2982
		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2983
		    BUS_DMASYNC_PREWRITE);
2984

2985
		dr->dr_usedslot = dr->dr_numslots;
2986
	}
2987

2988
      out:
2989
	return (dr);
2990

2991
fail2:
2992
	free(dr->dr_txhdr_cache, M_DEVBUF);
2993
fail1:
2994
	free(dr->dr_meta, M_DEVBUF);
2995
fail0:
2996
	free(dr, M_DEVBUF);
2997
	return (NULL);
2998
}
2999

3000
static void
3001
bwn_dma_ringfree(struct bwn_dma_ring **dr)
3002
{
3003

3004
	if (dr == NULL)
3005
		return;
3006

3007
	bwn_dma_free_descbufs(*dr);
3008
	bwn_dma_free_ringmemory(*dr);
3009

3010
	free((*dr)->dr_txhdr_cache, M_DEVBUF);
3011
	free((*dr)->dr_meta, M_DEVBUF);
3012
	free(*dr, M_DEVBUF);
3013

3014
	*dr = NULL;
3015
}
3016

3017
static void
3018
bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
3019
    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3020
{
3021
	struct bwn_dmadesc32 *desc;
3022

3023
	*meta = &(dr->dr_meta[slot]);
3024
	desc = dr->dr_ring_descbase;
3025
	desc = &(desc[slot]);
3026

3027
	*gdesc = (struct bwn_dmadesc_generic *)desc;
3028
}
3029

3030
static void
3031
bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
3032
    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3033
    int start, int end, int irq)
3034
{
3035
	struct bwn_dmadesc32		*descbase;
3036
	struct bwn_dma			*dma;
3037
	struct bhnd_dma_translation	*dt;
3038
	uint32_t			 addr, addrext, ctl;
3039
	int				 slot;
3040

3041
	descbase = dr->dr_ring_descbase;
3042
	dma = &dr->dr_mac->mac_method.dma;
3043
	dt = &dma->translation;
3044

3045
	slot = (int)(&(desc->dma.dma32) - descbase);
3046
	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3047
	    ("%s:%d: fail", __func__, __LINE__));
3048

3049
	addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3050
	addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3051
	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
3052
	if (slot == dr->dr_numslots - 1)
3053
		ctl |= BWN_DMA32_DCTL_DTABLEEND;
3054
	if (start)
3055
		ctl |= BWN_DMA32_DCTL_FRAMESTART;
3056
	if (end)
3057
		ctl |= BWN_DMA32_DCTL_FRAMEEND;
3058
	if (irq)
3059
		ctl |= BWN_DMA32_DCTL_IRQ;
3060
	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
3061
	    & BWN_DMA32_DCTL_ADDREXT_MASK;
3062

3063
	desc->dma.dma32.control = htole32(ctl);
3064
	desc->dma.dma32.address = htole32(addr);
3065
}
3066

3067
static void
3068
bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
3069
{
3070

3071
	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
3072
	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
3073
}
3074

3075
static void
3076
bwn_dma_32_suspend(struct bwn_dma_ring *dr)
3077
{
3078

3079
	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3080
	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
3081
}
3082

3083
static void
3084
bwn_dma_32_resume(struct bwn_dma_ring *dr)
3085
{
3086

3087
	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3088
	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
3089
}
3090

3091
static int
3092
bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3093
{
3094
	uint32_t val;
3095

3096
	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3097
	val &= BWN_DMA32_RXDPTR;
3098

3099
	return (val / sizeof(struct bwn_dmadesc32));
3100
}
3101

3102
static void
3103
bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3104
{
3105

3106
	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3107
	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3108
}
3109

3110
static void
3111
bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3112
    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3113
{
3114
	struct bwn_dmadesc64 *desc;
3115

3116
	*meta = &(dr->dr_meta[slot]);
3117
	desc = dr->dr_ring_descbase;
3118
	desc = &(desc[slot]);
3119

3120
	*gdesc = (struct bwn_dmadesc_generic *)desc;
3121
}
3122

3123
static void
3124
bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3125
    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3126
    int start, int end, int irq)
3127
{
3128
	struct bwn_dmadesc64		*descbase;
3129
	struct bwn_dma			*dma;
3130
	struct bhnd_dma_translation	*dt;
3131
	bhnd_addr_t			 addr;
3132
	uint32_t			 addrhi, addrlo;
3133
	uint32_t			 addrext;
3134
	uint32_t			 ctl0, ctl1;
3135
	int				 slot;
3136

3137
	descbase = dr->dr_ring_descbase;
3138
	dma = &dr->dr_mac->mac_method.dma;
3139
	dt = &dma->translation;
3140

3141
	slot = (int)(&(desc->dma.dma64) - descbase);
3142
	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3143
	    ("%s:%d: fail", __func__, __LINE__));
3144

3145
	addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3146
	addrhi = (addr >> 32);
3147
	addrlo = (addr & UINT32_MAX);
3148
	addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3149

3150
	ctl0 = 0;
3151
	if (slot == dr->dr_numslots - 1)
3152
		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3153
	if (start)
3154
		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3155
	if (end)
3156
		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3157
	if (irq)
3158
		ctl0 |= BWN_DMA64_DCTL0_IRQ;
3159

3160
	ctl1 = 0;
3161
	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3162
	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3163
	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
3164

3165
	desc->dma.dma64.control0 = htole32(ctl0);
3166
	desc->dma.dma64.control1 = htole32(ctl1);
3167
	desc->dma.dma64.address_low = htole32(addrlo);
3168
	desc->dma.dma64.address_high = htole32(addrhi);
3169
}
3170

3171
static void
3172
bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3173
{
3174

3175
	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3176
	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3177
}
3178

3179
static void
3180
bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3181
{
3182

3183
	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3184
	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3185
}
3186

3187
static void
3188
bwn_dma_64_resume(struct bwn_dma_ring *dr)
3189
{
3190

3191
	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3192
	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3193
}
3194

3195
static int
3196
bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3197
{
3198
	uint32_t val;
3199

3200
	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3201
	val &= BWN_DMA64_RXSTATDPTR;
3202

3203
	return (val / sizeof(struct bwn_dmadesc64));
3204
}
3205

3206
static void
3207
bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3208
{
3209

3210
	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3211
	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3212
}
3213

3214
static int
3215
bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3216
{
3217
	struct bwn_mac *mac = dr->dr_mac;
3218
	struct bwn_dma *dma = &mac->mac_method.dma;
3219
	struct bwn_softc *sc = mac->mac_sc;
3220
	int error;
3221

3222
	error = bus_dma_tag_create(dma->parent_dtag,
3223
			    BWN_ALIGN, 0,
3224
			    BUS_SPACE_MAXADDR,
3225
			    BUS_SPACE_MAXADDR,
3226
			    NULL, NULL,
3227
			    BWN_DMA_RINGMEMSIZE,
3228
			    1,
3229
			    BUS_SPACE_MAXSIZE_32BIT,
3230
			    0,
3231
			    NULL, NULL,
3232
			    &dr->dr_ring_dtag);
3233
	if (error) {
3234
		device_printf(sc->sc_dev,
3235
		    "can't create TX ring DMA tag: TODO frees\n");
3236
		return (-1);
3237
	}
3238

3239
	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3240
	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3241
	    &dr->dr_ring_dmap);
3242
	if (error) {
3243
		device_printf(sc->sc_dev,
3244
		    "can't allocate DMA mem: TODO frees\n");
3245
		return (-1);
3246
	}
3247
	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3248
	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3249
	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3250
	if (error) {
3251
		device_printf(sc->sc_dev,
3252
		    "can't load DMA mem: TODO free\n");
3253
		return (-1);
3254
	}
3255

3256
	return (0);
3257
}
3258

3259
static void
3260
bwn_dma_setup(struct bwn_dma_ring *dr)
3261
{
3262
	struct bwn_mac			*mac;
3263
	struct bwn_dma			*dma;
3264
	struct bhnd_dma_translation	*dt;
3265
	bhnd_addr_t			 addr, paddr;
3266
	uint32_t			 addrhi, addrlo, addrext, value;
3267

3268
	mac = dr->dr_mac;
3269
	dma = &mac->mac_method.dma;
3270
	dt = &dma->translation;
3271

3272
	paddr = dr->dr_ring_dmabase;
3273
	addr = (paddr & dt->addr_mask) | dt->base_addr;
3274
	addrhi = (addr >> 32);
3275
	addrlo = (addr & UINT32_MAX);
3276
	addrext = ((paddr & dt->addrext_mask) >> dma->addrext_shift);
3277

3278
	if (dr->dr_tx) {
3279
		dr->dr_curslot = -1;
3280

3281
		if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3282
			value = BWN_DMA64_TXENABLE;
3283
			value |= BWN_DMA64_TXPARITY_DISABLE;
3284
			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3285
			    & BWN_DMA64_TXADDREXT_MASK;
3286
			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3287
			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, addrlo);
3288
			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, addrhi);
3289
		} else {
3290
			value = BWN_DMA32_TXENABLE;
3291
			value |= BWN_DMA32_TXPARITY_DISABLE;
3292
			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3293
			    & BWN_DMA32_TXADDREXT_MASK;
3294
			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3295
			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, addrlo);
3296
		}
3297
		return;
3298
	}
3299

3300
	/*
3301
	 * set for RX
3302
	 */
3303
	dr->dr_usedslot = dr->dr_numslots;
3304

3305
	if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3306
		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3307
		value |= BWN_DMA64_RXENABLE;
3308
		value |= BWN_DMA64_RXPARITY_DISABLE;
3309
		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3310
		    & BWN_DMA64_RXADDREXT_MASK;
3311
		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3312
		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, addrlo);
3313
		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, addrhi);
3314
		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3315
		    sizeof(struct bwn_dmadesc64));
3316
	} else {
3317
		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3318
		value |= BWN_DMA32_RXENABLE;
3319
		value |= BWN_DMA32_RXPARITY_DISABLE;
3320
		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3321
		    & BWN_DMA32_RXADDREXT_MASK;
3322
		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3323
		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, addrlo);
3324
		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3325
		    sizeof(struct bwn_dmadesc32));
3326
	}
3327
}
3328

3329
static void
3330
bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3331
{
3332

3333
	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3334
	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3335
	    dr->dr_ring_dmap);
3336
}
3337

3338
static void
3339
bwn_dma_cleanup(struct bwn_dma_ring *dr)
3340
{
3341

3342
	if (dr->dr_tx) {
3343
		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3344
		if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3345
			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3346
			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3347
		} else
3348
			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3349
	} else {
3350
		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3351
		if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3352
			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3353
			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3354
		} else
3355
			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3356
	}
3357
}
3358

3359
static void
3360
bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3361
{
3362
	struct bwn_dmadesc_generic *desc;
3363
	struct bwn_dmadesc_meta *meta;
3364
	struct bwn_mac *mac = dr->dr_mac;
3365
	struct bwn_dma *dma = &mac->mac_method.dma;
3366
	struct bwn_softc *sc = mac->mac_sc;
3367
	int i;
3368

3369
	if (!dr->dr_usedslot)
3370
		return;
3371
	for (i = 0; i < dr->dr_numslots; i++) {
3372
		dr->getdesc(dr, i, &desc, &meta);
3373

3374
		if (meta->mt_m == NULL) {
3375
			if (!dr->dr_tx)
3376
				device_printf(sc->sc_dev, "%s: not TX?\n",
3377
				    __func__);
3378
			continue;
3379
		}
3380
		if (dr->dr_tx) {
3381
			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3382
				bus_dmamap_unload(dr->dr_txring_dtag,
3383
				    meta->mt_dmap);
3384
			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3385
				bus_dmamap_unload(dma->txbuf_dtag,
3386
				    meta->mt_dmap);
3387
		} else
3388
			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3389
		bwn_dma_free_descbuf(dr, meta);
3390
	}
3391
}
3392

3393
static int
3394
bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3395
    int type)
3396
{
3397
	struct bwn_softc *sc = mac->mac_sc;
3398
	uint32_t value;
3399
	int i;
3400
	uint16_t offset;
3401

3402
	for (i = 0; i < 10; i++) {
3403
		offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3404
		    BWN_DMA32_TXSTATUS;
3405
		value = BWN_READ_4(mac, base + offset);
3406
		if (type == BHND_DMA_ADDR_64BIT) {
3407
			value &= BWN_DMA64_TXSTAT;
3408
			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3409
			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3410
			    value == BWN_DMA64_TXSTAT_STOPPED)
3411
				break;
3412
		} else {
3413
			value &= BWN_DMA32_TXSTATE;
3414
			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3415
			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3416
			    value == BWN_DMA32_TXSTAT_STOPPED)
3417
				break;
3418
		}
3419
		DELAY(1000);
3420
	}
3421
	offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXCTL :
3422
	    BWN_DMA32_TXCTL;
3423
	BWN_WRITE_4(mac, base + offset, 0);
3424
	for (i = 0; i < 10; i++) {
3425
		offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3426
		    BWN_DMA32_TXSTATUS;
3427
		value = BWN_READ_4(mac, base + offset);
3428
		if (type == BHND_DMA_ADDR_64BIT) {
3429
			value &= BWN_DMA64_TXSTAT;
3430
			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3431
				i = -1;
3432
				break;
3433
			}
3434
		} else {
3435
			value &= BWN_DMA32_TXSTATE;
3436
			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3437
				i = -1;
3438
				break;
3439
			}
3440
		}
3441
		DELAY(1000);
3442
	}
3443
	if (i != -1) {
3444
		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3445
		return (ENODEV);
3446
	}
3447
	DELAY(1000);
3448

3449
	return (0);
3450
}
3451

3452
static int
3453
bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3454
    int type)
3455
{
3456
	struct bwn_softc *sc = mac->mac_sc;
3457
	uint32_t value;
3458
	int i;
3459
	uint16_t offset;
3460

3461
	offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXCTL :
3462
	    BWN_DMA32_RXCTL;
3463
	BWN_WRITE_4(mac, base + offset, 0);
3464
	for (i = 0; i < 10; i++) {
3465
		offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXSTATUS :
3466
		    BWN_DMA32_RXSTATUS;
3467
		value = BWN_READ_4(mac, base + offset);
3468
		if (type == BHND_DMA_ADDR_64BIT) {
3469
			value &= BWN_DMA64_RXSTAT;
3470
			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3471
				i = -1;
3472
				break;
3473
			}
3474
		} else {
3475
			value &= BWN_DMA32_RXSTATE;
3476
			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3477
				i = -1;
3478
				break;
3479
			}
3480
		}
3481
		DELAY(1000);
3482
	}
3483
	if (i != -1) {
3484
		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3485
		return (ENODEV);
3486
	}
3487

3488
	return (0);
3489
}
3490

3491
static void
3492
bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3493
    struct bwn_dmadesc_meta *meta)
3494
{
3495

3496
	if (meta->mt_m != NULL) {
3497
		m_freem(meta->mt_m);
3498
		meta->mt_m = NULL;
3499
	}
3500
	if (meta->mt_ni != NULL) {
3501
		ieee80211_free_node(meta->mt_ni);
3502
		meta->mt_ni = NULL;
3503
	}
3504
}
3505

3506
static void
3507
bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3508
{
3509
	struct bwn_rxhdr4 *rxhdr;
3510
	unsigned char *frame;
3511

3512
	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3513
	rxhdr->frame_len = 0;
3514

3515
	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3516
	    sizeof(struct bwn_plcp6) + 2,
3517
	    ("%s:%d: fail", __func__, __LINE__));
3518
	frame = mtod(m, char *) + dr->dr_frameoffset;
3519
	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3520
}
3521

3522
static uint8_t
3523
bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3524
{
3525
	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3526

3527
	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3528
	    == 0xff);
3529
}
3530

3531
static void
3532
bwn_wme_init(struct bwn_mac *mac)
3533
{
3534

3535
	bwn_wme_load(mac);
3536

3537
	/* enable WME support. */
3538
	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3539
	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3540
	    BWN_IFSCTL_USE_EDCF);
3541
}
3542

3543
static void
3544
bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3545
{
3546
	struct bwn_softc *sc = mac->mac_sc;
3547
	struct ieee80211com *ic = &sc->sc_ic;
3548
	uint16_t delay;	/* microsec */
3549

3550
	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3551
	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3552
		delay = 500;
3553
	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3554
		delay = max(delay, (uint16_t)2400);
3555

3556
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3557
}
3558

3559
static void
3560
bwn_bt_enable(struct bwn_mac *mac)
3561
{
3562
	struct bwn_softc *sc = mac->mac_sc;
3563
	uint64_t hf;
3564

3565
	if (bwn_bluetooth == 0)
3566
		return;
3567
	if ((sc->sc_board_info.board_flags & BHND_BFL_BTCOEX) == 0)
3568
		return;
3569
	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3570
		return;
3571

3572
	hf = bwn_hf_read(mac);
3573
	if (sc->sc_board_info.board_flags & BHND_BFL_BTC2WIRE_ALTGPIO)
3574
		hf |= BWN_HF_BT_COEXISTALT;
3575
	else
3576
		hf |= BWN_HF_BT_COEXIST;
3577
	bwn_hf_write(mac, hf);
3578
}
3579

3580
static void
3581
bwn_set_macaddr(struct bwn_mac *mac)
3582
{
3583

3584
	bwn_mac_write_bssid(mac);
3585
	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3586
	    mac->mac_sc->sc_ic.ic_macaddr);
3587
}
3588

3589
static void
3590
bwn_clear_keys(struct bwn_mac *mac)
3591
{
3592
	int i;
3593

3594
	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3595
		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3596
		    ("%s:%d: fail", __func__, __LINE__));
3597

3598
		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3599
		    NULL, BWN_SEC_KEYSIZE, NULL);
3600
		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3601
			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3602
			    NULL, BWN_SEC_KEYSIZE, NULL);
3603
		}
3604
		mac->mac_key[i].keyconf = NULL;
3605
	}
3606
}
3607

3608
static void
3609
bwn_crypt_init(struct bwn_mac *mac)
3610
{
3611
	struct bwn_softc *sc = mac->mac_sc;
3612

3613
	mac->mac_max_nr_keys = (bhnd_get_hwrev(sc->sc_dev) >= 5) ? 58 : 20;
3614
	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3615
	    ("%s:%d: fail", __func__, __LINE__));
3616
	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3617
	mac->mac_ktp *= 2;
3618
	if (bhnd_get_hwrev(sc->sc_dev) >= 5)
3619
		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3620
	bwn_clear_keys(mac);
3621
}
3622

3623
static void
3624
bwn_chip_exit(struct bwn_mac *mac)
3625
{
3626
	bwn_phy_exit(mac);
3627
}
3628

3629
static int
3630
bwn_fw_fillinfo(struct bwn_mac *mac)
3631
{
3632
	int error;
3633

3634
	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3635
	if (error == 0)
3636
		return (0);
3637
	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3638
	if (error == 0)
3639
		return (0);
3640
	return (error);
3641
}
3642

3643
/**
3644
 * Request that the GPIO controller tristate all pins set in @p mask, granting
3645
 * the MAC core control over the pins.
3646
 * 
3647
 * @param mac	bwn MAC state.
3648
 * @param pins	If the bit position for a pin number is set to one, tristate the
3649
 *		pin.
3650
 */
3651
int
3652
bwn_gpio_control(struct bwn_mac *mac, uint32_t pins)
3653
{
3654
	struct bwn_softc	*sc;
3655
	uint32_t		 flags[32];
3656
	int			 error;
3657

3658
	sc = mac->mac_sc;
3659

3660
	/* Determine desired pin flags */
3661
	for (size_t pin = 0; pin < nitems(flags); pin++) {
3662
		uint32_t pinbit = (1 << pin);
3663

3664
		if (pins & pinbit) {
3665
			/* Tristate output */
3666
			flags[pin] = GPIO_PIN_OUTPUT|GPIO_PIN_TRISTATE;
3667
		} else {
3668
			/* Leave unmodified */
3669
			flags[pin] = 0;
3670
		}
3671
	}
3672

3673
	/* Configure all pins */
3674
	error = GPIO_PIN_CONFIG_32(sc->sc_gpio, 0, nitems(flags), flags);
3675
	if (error) {
3676
		device_printf(sc->sc_dev, "error configuring %s pin flags: "
3677
		    "%d\n", device_get_nameunit(sc->sc_gpio), error);
3678
		return (error);
3679
	}
3680

3681
	return (0);
3682
}
3683

3684
static int
3685
bwn_gpio_init(struct bwn_mac *mac)
3686
{
3687
	struct bwn_softc	*sc;
3688
	uint32_t		 pins;
3689

3690
	sc = mac->mac_sc;
3691

3692
	pins = 0xF;
3693

3694
	BWN_WRITE_4(mac, BWN_MACCTL,
3695
	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3696
	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3697
	    BWN_READ_2(mac, BWN_GPIO_MASK) | pins);
3698

3699
	if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL) {
3700
		/* MAC core is responsible for toggling PAREF via gpio9 */
3701
		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3702
		    BWN_READ_2(mac, BWN_GPIO_MASK) | BHND_GPIO_BOARD_PACTRL);
3703

3704
		pins |= BHND_GPIO_BOARD_PACTRL;
3705
	}
3706

3707
	return (bwn_gpio_control(mac, pins));
3708
}
3709

3710
static int
3711
bwn_fw_loadinitvals(struct bwn_mac *mac)
3712
{
3713
#define	GETFWOFFSET(fwp, offset)				\
3714
	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3715
	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3716
	const struct bwn_fwhdr *hdr;
3717
	struct bwn_fw *fw = &mac->mac_fw;
3718
	int error;
3719

3720
	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3721
	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3722
	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3723
	if (error)
3724
		return (error);
3725
	if (fw->initvals_band.fw) {
3726
		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3727
		error = bwn_fwinitvals_write(mac,
3728
		    GETFWOFFSET(fw->initvals_band, hdr_len),
3729
		    be32toh(hdr->size),
3730
		    fw->initvals_band.fw->datasize - hdr_len);
3731
	}
3732
	return (error);
3733
#undef GETFWOFFSET
3734
}
3735

3736
static int
3737
bwn_phy_init(struct bwn_mac *mac)
3738
{
3739
	struct bwn_softc *sc = mac->mac_sc;
3740
	int error;
3741

3742
	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3743
	mac->mac_phy.rf_onoff(mac, 1);
3744
	error = mac->mac_phy.init(mac);
3745
	if (error) {
3746
		device_printf(sc->sc_dev, "PHY init failed\n");
3747
		goto fail0;
3748
	}
3749
	error = bwn_switch_channel(mac,
3750
	    mac->mac_phy.get_default_chan(mac));
3751
	if (error) {
3752
		device_printf(sc->sc_dev,
3753
		    "failed to switch default channel\n");
3754
		goto fail1;
3755
	}
3756
	return (0);
3757
fail1:
3758
	if (mac->mac_phy.exit)
3759
		mac->mac_phy.exit(mac);
3760
fail0:
3761
	mac->mac_phy.rf_onoff(mac, 0);
3762

3763
	return (error);
3764
}
3765

3766
static void
3767
bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3768
{
3769
	uint16_t ant;
3770
	uint16_t tmp;
3771

3772
	ant = bwn_ant2phy(antenna);
3773

3774
	/* For ACK/CTS */
3775
	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3776
	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3777
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3778
	/* For Probe Resposes */
3779
	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3780
	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3781
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3782
}
3783

3784
static void
3785
bwn_set_opmode(struct bwn_mac *mac)
3786
{
3787
	struct bwn_softc *sc = mac->mac_sc;
3788
	struct ieee80211com *ic = &sc->sc_ic;
3789
	uint32_t ctl;
3790
	uint16_t cfp_pretbtt;
3791

3792
	ctl = BWN_READ_4(mac, BWN_MACCTL);
3793
	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3794
	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3795
	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3796
	ctl |= BWN_MACCTL_STA;
3797

3798
	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3799
	    ic->ic_opmode == IEEE80211_M_MBSS)
3800
		ctl |= BWN_MACCTL_HOSTAP;
3801
	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3802
		ctl &= ~BWN_MACCTL_STA;
3803
	ctl |= sc->sc_filters;
3804

3805
	if (bhnd_get_hwrev(sc->sc_dev) <= 4)
3806
		ctl |= BWN_MACCTL_PROMISC;
3807

3808
	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3809

3810
	cfp_pretbtt = 2;
3811
	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3812
		if (sc->sc_cid.chip_id == BHND_CHIPID_BCM4306 &&
3813
		    sc->sc_cid.chip_rev == 3)
3814
			cfp_pretbtt = 100;
3815
		else
3816
			cfp_pretbtt = 50;
3817
	}
3818
	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3819
}
3820

3821
static void
3822
bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3823
{
3824
	if (!error) {
3825
		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3826
		*((bus_addr_t *)arg) = seg->ds_addr;
3827
	}
3828
}
3829

3830
void
3831
bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3832
{
3833
	struct bwn_phy *phy = &mac->mac_phy;
3834
	struct bwn_softc *sc = mac->mac_sc;
3835
	unsigned int i, max_loop;
3836
	uint16_t value;
3837
	uint32_t buffer[5] = {
3838
		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3839
	};
3840

3841
	if (ofdm) {
3842
		max_loop = 0x1e;
3843
		buffer[0] = 0x000201cc;
3844
	} else {
3845
		max_loop = 0xfa;
3846
		buffer[0] = 0x000b846e;
3847
	}
3848

3849
	BWN_ASSERT_LOCKED(mac->mac_sc);
3850

3851
	for (i = 0; i < 5; i++)
3852
		bwn_ram_write(mac, i * 4, buffer[i]);
3853

3854
	BWN_WRITE_2(mac, 0x0568, 0x0000);
3855
	BWN_WRITE_2(mac, 0x07c0,
3856
	    (bhnd_get_hwrev(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3857

3858
	value = (ofdm ? 0x41 : 0x40);
3859
	BWN_WRITE_2(mac, 0x050c, value);
3860

3861
	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3862
	    phy->type == BWN_PHYTYPE_LCN)
3863
		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3864
	BWN_WRITE_2(mac, 0x0508, 0x0000);
3865
	BWN_WRITE_2(mac, 0x050a, 0x0000);
3866
	BWN_WRITE_2(mac, 0x054c, 0x0000);
3867
	BWN_WRITE_2(mac, 0x056a, 0x0014);
3868
	BWN_WRITE_2(mac, 0x0568, 0x0826);
3869
	BWN_WRITE_2(mac, 0x0500, 0x0000);
3870

3871
	/* XXX TODO: n phy pa override? */
3872

3873
	switch (phy->type) {
3874
	case BWN_PHYTYPE_N:
3875
	case BWN_PHYTYPE_LCN:
3876
		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3877
		break;
3878
	case BWN_PHYTYPE_LP:
3879
		BWN_WRITE_2(mac, 0x0502, 0x0050);
3880
		break;
3881
	default:
3882
		BWN_WRITE_2(mac, 0x0502, 0x0030);
3883
		break;
3884
	}
3885

3886
	/* flush */
3887
	BWN_READ_2(mac, 0x0502);
3888

3889
	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3890
		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3891
	for (i = 0x00; i < max_loop; i++) {
3892
		value = BWN_READ_2(mac, 0x050e);
3893
		if (value & 0x0080)
3894
			break;
3895
		DELAY(10);
3896
	}
3897
	for (i = 0x00; i < 0x0a; i++) {
3898
		value = BWN_READ_2(mac, 0x050e);
3899
		if (value & 0x0400)
3900
			break;
3901
		DELAY(10);
3902
	}
3903
	for (i = 0x00; i < 0x19; i++) {
3904
		value = BWN_READ_2(mac, 0x0690);
3905
		if (!(value & 0x0100))
3906
			break;
3907
		DELAY(10);
3908
	}
3909
	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3910
		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3911
}
3912

3913
void
3914
bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3915
{
3916
	uint32_t macctl;
3917

3918
	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3919

3920
	macctl = BWN_READ_4(mac, BWN_MACCTL);
3921
	if (macctl & BWN_MACCTL_BIGENDIAN)
3922
		printf("TODO: need swap\n");
3923

3924
	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3925
	BWN_BARRIER(mac, BWN_RAM_CONTROL, 4, BUS_SPACE_BARRIER_WRITE);
3926
	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3927
}
3928

3929
void
3930
bwn_mac_suspend(struct bwn_mac *mac)
3931
{
3932
	struct bwn_softc *sc = mac->mac_sc;
3933
	int i;
3934
	uint32_t tmp;
3935

3936
	KASSERT(mac->mac_suspended >= 0,
3937
	    ("%s:%d: fail", __func__, __LINE__));
3938

3939
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3940
	    __func__, mac->mac_suspended);
3941

3942
	if (mac->mac_suspended == 0) {
3943
		bwn_psctl(mac, BWN_PS_AWAKE);
3944
		BWN_WRITE_4(mac, BWN_MACCTL,
3945
			    BWN_READ_4(mac, BWN_MACCTL)
3946
			    & ~BWN_MACCTL_ON);
3947
		BWN_READ_4(mac, BWN_MACCTL);
3948
		for (i = 35; i; i--) {
3949
			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3950
			if (tmp & BWN_INTR_MAC_SUSPENDED)
3951
				goto out;
3952
			DELAY(10);
3953
		}
3954
		for (i = 40; i; i--) {
3955
			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3956
			if (tmp & BWN_INTR_MAC_SUSPENDED)
3957
				goto out;
3958
			DELAY(1000);
3959
		}
3960
		device_printf(sc->sc_dev, "MAC suspend failed\n");
3961
	}
3962
out:
3963
	mac->mac_suspended++;
3964
}
3965

3966
void
3967
bwn_mac_enable(struct bwn_mac *mac)
3968
{
3969
	struct bwn_softc *sc = mac->mac_sc;
3970
	uint16_t state;
3971

3972
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3973
	    __func__, mac->mac_suspended);
3974

3975
	state = bwn_shm_read_2(mac, BWN_SHARED,
3976
	    BWN_SHARED_UCODESTAT);
3977
	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3978
	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3979
		DPRINTF(sc, BWN_DEBUG_FW,
3980
		    "%s: warn: firmware state (%d)\n",
3981
		    __func__, state);
3982
	}
3983

3984
	mac->mac_suspended--;
3985
	KASSERT(mac->mac_suspended >= 0,
3986
	    ("%s:%d: fail", __func__, __LINE__));
3987
	if (mac->mac_suspended == 0) {
3988
		BWN_WRITE_4(mac, BWN_MACCTL,
3989
		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3990
		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3991
		BWN_READ_4(mac, BWN_MACCTL);
3992
		BWN_READ_4(mac, BWN_INTR_REASON);
3993
		bwn_psctl(mac, 0);
3994
	}
3995
}
3996

3997
void
3998
bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3999
{
4000
	struct bwn_softc *sc = mac->mac_sc;
4001
	int i;
4002
	uint16_t ucstat;
4003

4004
	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
4005
	    ("%s:%d: fail", __func__, __LINE__));
4006
	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
4007
	    ("%s:%d: fail", __func__, __LINE__));
4008

4009
	/* XXX forcibly awake and hwps-off */
4010

4011
	BWN_WRITE_4(mac, BWN_MACCTL,
4012
	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
4013
	    ~BWN_MACCTL_HWPS);
4014
	BWN_READ_4(mac, BWN_MACCTL);
4015
	if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4016
		for (i = 0; i < 100; i++) {
4017
			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
4018
			    BWN_SHARED_UCODESTAT);
4019
			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
4020
				break;
4021
			DELAY(10);
4022
		}
4023
	}
4024
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
4025
	    ucstat);
4026
}
4027

4028
static int
4029
bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
4030
{
4031
	struct bwn_softc *sc = mac->mac_sc;
4032
	struct bwn_fw *fw = &mac->mac_fw;
4033
	const uint8_t rev = bhnd_get_hwrev(sc->sc_dev);
4034
	const char *filename;
4035
	uint16_t iost;
4036
	int error;
4037

4038
	/* microcode */
4039
	filename = NULL;
4040
	switch (rev) {
4041
	case 42:
4042
		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4043
			filename = "ucode42";
4044
		break;
4045
	case 40:
4046
		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4047
			filename = "ucode40";
4048
		break;
4049
	case 33:
4050
		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
4051
			filename = "ucode33_lcn40";
4052
		break;
4053
	case 30:
4054
		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4055
			filename = "ucode30_mimo";
4056
		break;
4057
	case 29:
4058
		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4059
			filename = "ucode29_mimo";
4060
		break;
4061
	case 26:
4062
		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4063
			filename = "ucode26_mimo";
4064
		break;
4065
	case 28:
4066
	case 25:
4067
		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4068
			filename = "ucode25_mimo";
4069
		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4070
			filename = "ucode25_lcn";
4071
		break;
4072
	case 24:
4073
		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4074
			filename = "ucode24_lcn";
4075
		break;
4076
	case 23:
4077
		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4078
			filename = "ucode16_mimo";
4079
		break;
4080
	case 16:
4081
	case 17:
4082
	case 18:
4083
	case 19:
4084
		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4085
			filename = "ucode16_mimo";
4086
		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
4087
			filename = "ucode16_lp";
4088
		break;
4089
	case 15:
4090
		filename = "ucode15";
4091
		break;
4092
	case 14:
4093
		filename = "ucode14";
4094
		break;
4095
	case 13:
4096
		filename = "ucode13";
4097
		break;
4098
	case 12:
4099
	case 11:
4100
		filename = "ucode11";
4101
		break;
4102
	case 10:
4103
	case 9:
4104
	case 8:
4105
	case 7:
4106
	case 6:
4107
	case 5:
4108
		filename = "ucode5";
4109
		break;
4110
	default:
4111
		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
4112
		bwn_release_firmware(mac);
4113
		return (EOPNOTSUPP);
4114
	}
4115

4116
	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
4117
	error = bwn_fw_get(mac, type, filename, &fw->ucode);
4118
	if (error) {
4119
		bwn_release_firmware(mac);
4120
		return (error);
4121
	}
4122

4123
	/* PCM */
4124
	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
4125
	if (rev >= 5 && rev <= 10) {
4126
		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
4127
		if (error == ENOENT)
4128
			fw->no_pcmfile = 1;
4129
		else if (error) {
4130
			bwn_release_firmware(mac);
4131
			return (error);
4132
		}
4133
	} else if (rev < 11) {
4134
		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
4135
		bwn_release_firmware(mac);
4136
		return (EOPNOTSUPP);
4137
	}
4138

4139
	/* initvals */
4140
	error = bhnd_read_iost(sc->sc_dev, &iost);
4141
	if (error)
4142
		goto fail1;
4143

4144
	switch (mac->mac_phy.type) {
4145
	case BWN_PHYTYPE_A:
4146
		if (rev < 5 || rev > 10)
4147
			goto fail1;
4148
		if (iost & BWN_IOST_HAVE_2GHZ)
4149
			filename = "a0g1initvals5";
4150
		else
4151
			filename = "a0g0initvals5";
4152
		break;
4153
	case BWN_PHYTYPE_G:
4154
		if (rev >= 5 && rev <= 10)
4155
			filename = "b0g0initvals5";
4156
		else if (rev >= 13)
4157
			filename = "b0g0initvals13";
4158
		else
4159
			goto fail1;
4160
		break;
4161
	case BWN_PHYTYPE_LP:
4162
		if (rev == 13)
4163
			filename = "lp0initvals13";
4164
		else if (rev == 14)
4165
			filename = "lp0initvals14";
4166
		else if (rev >= 15)
4167
			filename = "lp0initvals15";
4168
		else
4169
			goto fail1;
4170
		break;
4171
	case BWN_PHYTYPE_N:
4172
		if (rev == 30)
4173
			filename = "n16initvals30";
4174
		else if (rev == 28 || rev == 25)
4175
			filename = "n0initvals25";
4176
		else if (rev == 24)
4177
			filename = "n0initvals24";
4178
		else if (rev == 23)
4179
			filename = "n0initvals16";
4180
		else if (rev >= 16 && rev <= 18)
4181
			filename = "n0initvals16";
4182
		else if (rev >= 11 && rev <= 12)
4183
			filename = "n0initvals11";
4184
		else
4185
			goto fail1;
4186
		break;
4187
	default:
4188
		goto fail1;
4189
	}
4190
	error = bwn_fw_get(mac, type, filename, &fw->initvals);
4191
	if (error) {
4192
		bwn_release_firmware(mac);
4193
		return (error);
4194
	}
4195

4196
	/* bandswitch initvals */
4197
	switch (mac->mac_phy.type) {
4198
	case BWN_PHYTYPE_A:
4199
		if (rev >= 5 && rev <= 10) {
4200
			if (iost & BWN_IOST_HAVE_2GHZ)
4201
				filename = "a0g1bsinitvals5";
4202
			else
4203
				filename = "a0g0bsinitvals5";
4204
		} else if (rev >= 11)
4205
			filename = NULL;
4206
		else
4207
			goto fail1;
4208
		break;
4209
	case BWN_PHYTYPE_G:
4210
		if (rev >= 5 && rev <= 10)
4211
			filename = "b0g0bsinitvals5";
4212
		else if (rev >= 11)
4213
			filename = NULL;
4214
		else
4215
			goto fail1;
4216
		break;
4217
	case BWN_PHYTYPE_LP:
4218
		if (rev == 13)
4219
			filename = "lp0bsinitvals13";
4220
		else if (rev == 14)
4221
			filename = "lp0bsinitvals14";
4222
		else if (rev >= 15)
4223
			filename = "lp0bsinitvals15";
4224
		else
4225
			goto fail1;
4226
		break;
4227
	case BWN_PHYTYPE_N:
4228
		if (rev == 30)
4229
			filename = "n16bsinitvals30";
4230
		else if (rev == 28 || rev == 25)
4231
			filename = "n0bsinitvals25";
4232
		else if (rev == 24)
4233
			filename = "n0bsinitvals24";
4234
		else if (rev == 23)
4235
			filename = "n0bsinitvals16";
4236
		else if (rev >= 16 && rev <= 18)
4237
			filename = "n0bsinitvals16";
4238
		else if (rev >= 11 && rev <= 12)
4239
			filename = "n0bsinitvals11";
4240
		else
4241
			goto fail1;
4242
		break;
4243
	default:
4244
		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4245
		    mac->mac_phy.type);
4246
		goto fail1;
4247
	}
4248
	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4249
	if (error) {
4250
		bwn_release_firmware(mac);
4251
		return (error);
4252
	}
4253
	return (0);
4254
fail1:
4255
	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4256
	    rev, mac->mac_phy.type);
4257
	bwn_release_firmware(mac);
4258
	return (EOPNOTSUPP);
4259
}
4260

4261
static int
4262
bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4263
    const char *name, struct bwn_fwfile *bfw)
4264
{
4265
	const struct bwn_fwhdr *hdr;
4266
	struct bwn_softc *sc = mac->mac_sc;
4267
	const struct firmware *fw;
4268
	char namebuf[64];
4269

4270
	if (name == NULL) {
4271
		bwn_do_release_fw(bfw);
4272
		return (0);
4273
	}
4274
	if (bfw->filename != NULL) {
4275
		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4276
			return (0);
4277
		bwn_do_release_fw(bfw);
4278
	}
4279

4280
	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4281
	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4282
	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4283
	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4284
	fw = firmware_get(namebuf);
4285
	if (fw == NULL) {
4286
		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4287
		    namebuf);
4288
		return (ENOENT);
4289
	}
4290
	if (fw->datasize < sizeof(struct bwn_fwhdr))
4291
		goto fail;
4292
	hdr = (const struct bwn_fwhdr *)(fw->data);
4293
	switch (hdr->type) {
4294
	case BWN_FWTYPE_UCODE:
4295
	case BWN_FWTYPE_PCM:
4296
		if (be32toh(hdr->size) !=
4297
		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4298
			goto fail;
4299
		/* FALLTHROUGH */
4300
	case BWN_FWTYPE_IV:
4301
		if (hdr->ver != 1)
4302
			goto fail;
4303
		break;
4304
	default:
4305
		goto fail;
4306
	}
4307
	bfw->filename = name;
4308
	bfw->fw = fw;
4309
	bfw->type = type;
4310
	return (0);
4311
fail:
4312
	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4313
	if (fw != NULL)
4314
		firmware_put(fw, FIRMWARE_UNLOAD);
4315
	return (EPROTO);
4316
}
4317

4318
static void
4319
bwn_release_firmware(struct bwn_mac *mac)
4320
{
4321

4322
	bwn_do_release_fw(&mac->mac_fw.ucode);
4323
	bwn_do_release_fw(&mac->mac_fw.pcm);
4324
	bwn_do_release_fw(&mac->mac_fw.initvals);
4325
	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4326
}
4327

4328
static void
4329
bwn_do_release_fw(struct bwn_fwfile *bfw)
4330
{
4331

4332
	if (bfw->fw != NULL)
4333
		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4334
	bfw->fw = NULL;
4335
	bfw->filename = NULL;
4336
}
4337

4338
static int
4339
bwn_fw_loaducode(struct bwn_mac *mac)
4340
{
4341
#define	GETFWOFFSET(fwp, offset)	\
4342
	((const uint32_t *)((const char *)fwp.fw->data + offset))
4343
#define	GETFWSIZE(fwp, offset)	\
4344
	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4345
	struct bwn_softc *sc = mac->mac_sc;
4346
	const uint32_t *data;
4347
	unsigned int i;
4348
	uint32_t ctl;
4349
	uint16_t date, fwcaps, time;
4350
	int error = 0;
4351

4352
	ctl = BWN_READ_4(mac, BWN_MACCTL);
4353
	ctl |= BWN_MACCTL_MCODE_JMP0;
4354
	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4355
	    __LINE__));
4356
	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4357
	for (i = 0; i < 64; i++)
4358
		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4359
	for (i = 0; i < 4096; i += 2)
4360
		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4361

4362
	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4363
	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4364
	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4365
	     i++) {
4366
		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4367
		DELAY(10);
4368
	}
4369

4370
	if (mac->mac_fw.pcm.fw) {
4371
		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4372
		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4373
		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4374
		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4375
		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4376
		    sizeof(struct bwn_fwhdr)); i++) {
4377
			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4378
			DELAY(10);
4379
		}
4380
	}
4381

4382
	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4383
	BWN_WRITE_4(mac, BWN_MACCTL,
4384
	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4385
	    BWN_MACCTL_MCODE_RUN);
4386

4387
	for (i = 0; i < 21; i++) {
4388
		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4389
			break;
4390
		if (i >= 20) {
4391
			device_printf(sc->sc_dev, "ucode timeout\n");
4392
			error = ENXIO;
4393
			goto error;
4394
		}
4395
		DELAY(50000);
4396
	}
4397
	BWN_READ_4(mac, BWN_INTR_REASON);
4398

4399
	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4400
	if (mac->mac_fw.rev <= 0x128) {
4401
		device_printf(sc->sc_dev, "the firmware is too old\n");
4402
		error = EOPNOTSUPP;
4403
		goto error;
4404
	}
4405

4406
	/*
4407
	 * Determine firmware header version; needed for TX/RX packet
4408
	 * handling.
4409
	 */
4410
	if (mac->mac_fw.rev >= 598)
4411
		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4412
	else if (mac->mac_fw.rev >= 410)
4413
		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4414
	else
4415
		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4416

4417
	/*
4418
	 * We don't support rev 598 or later; that requires
4419
	 * another round of changes to the TX/RX descriptor
4420
	 * and status layout.
4421
	 *
4422
	 * So, complain this is the case and exit out, rather
4423
	 * than attaching and then failing.
4424
	 */
4425
#if 0
4426
	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4427
		device_printf(sc->sc_dev,
4428
		    "firmware is too new (>=598); not supported\n");
4429
		error = EOPNOTSUPP;
4430
		goto error;
4431
	}
4432
#endif
4433

4434
	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4435
	    BWN_SHARED_UCODE_PATCH);
4436
	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4437
	mac->mac_fw.opensource = (date == 0xffff);
4438
	if (bwn_wme != 0)
4439
		mac->mac_flags |= BWN_MAC_FLAG_WME;
4440
	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4441

4442
	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4443
	if (mac->mac_fw.opensource == 0) {
4444
		device_printf(sc->sc_dev,
4445
		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4446
		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4447
		if (mac->mac_fw.no_pcmfile)
4448
			device_printf(sc->sc_dev,
4449
			    "no HW crypto acceleration due to pcm5\n");
4450
	} else {
4451
		mac->mac_fw.patch = time;
4452
		fwcaps = bwn_fwcaps_read(mac);
4453
		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4454
			device_printf(sc->sc_dev,
4455
			    "disabling HW crypto acceleration\n");
4456
			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4457
		}
4458
		if (!(fwcaps & BWN_FWCAPS_WME)) {
4459
			device_printf(sc->sc_dev, "disabling WME support\n");
4460
			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4461
		}
4462
	}
4463

4464
	if (BWN_ISOLDFMT(mac))
4465
		device_printf(sc->sc_dev, "using old firmware image\n");
4466

4467
	return (0);
4468

4469
error:
4470
	BWN_WRITE_4(mac, BWN_MACCTL,
4471
	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4472
	    BWN_MACCTL_MCODE_JMP0);
4473

4474
	return (error);
4475
#undef GETFWSIZE
4476
#undef GETFWOFFSET
4477
}
4478

4479
/* OpenFirmware only */
4480
static uint16_t
4481
bwn_fwcaps_read(struct bwn_mac *mac)
4482
{
4483

4484
	KASSERT(mac->mac_fw.opensource == 1,
4485
	    ("%s:%d: fail", __func__, __LINE__));
4486
	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4487
}
4488

4489
static int
4490
bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4491
    size_t count, size_t array_size)
4492
{
4493
#define	GET_NEXTIV16(iv)						\
4494
	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4495
	    sizeof(uint16_t) + sizeof(uint16_t)))
4496
#define	GET_NEXTIV32(iv)						\
4497
	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4498
	    sizeof(uint16_t) + sizeof(uint32_t)))
4499
	struct bwn_softc *sc = mac->mac_sc;
4500
	const struct bwn_fwinitvals *iv;
4501
	uint16_t offset;
4502
	size_t i;
4503
	uint8_t bit32;
4504

4505
	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4506
	    ("%s:%d: fail", __func__, __LINE__));
4507
	iv = ivals;
4508
	for (i = 0; i < count; i++) {
4509
		if (array_size < sizeof(iv->offset_size))
4510
			goto fail;
4511
		array_size -= sizeof(iv->offset_size);
4512
		offset = be16toh(iv->offset_size);
4513
		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4514
		offset &= BWN_FWINITVALS_OFFSET_MASK;
4515
		if (offset >= 0x1000)
4516
			goto fail;
4517
		if (bit32) {
4518
			if (array_size < sizeof(iv->data.d32))
4519
				goto fail;
4520
			array_size -= sizeof(iv->data.d32);
4521
			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4522
			iv = GET_NEXTIV32(iv);
4523
		} else {
4524
			if (array_size < sizeof(iv->data.d16))
4525
				goto fail;
4526
			array_size -= sizeof(iv->data.d16);
4527
			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4528

4529
			iv = GET_NEXTIV16(iv);
4530
		}
4531
	}
4532
	if (array_size != 0)
4533
		goto fail;
4534
	return (0);
4535
fail:
4536
	device_printf(sc->sc_dev, "initvals: invalid format\n");
4537
	return (EPROTO);
4538
#undef GET_NEXTIV16
4539
#undef GET_NEXTIV32
4540
}
4541

4542
int
4543
bwn_switch_channel(struct bwn_mac *mac, int chan)
4544
{
4545
	struct bwn_phy *phy = &(mac->mac_phy);
4546
	struct bwn_softc *sc = mac->mac_sc;
4547
	struct ieee80211com *ic = &sc->sc_ic;
4548
	uint16_t channelcookie, savedcookie;
4549
	int error;
4550

4551
	if (chan == 0xffff)
4552
		chan = phy->get_default_chan(mac);
4553

4554
	channelcookie = chan;
4555
	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4556
		channelcookie |= 0x100;
4557
	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4558
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4559
	error = phy->switch_channel(mac, chan);
4560
	if (error)
4561
		goto fail;
4562

4563
	mac->mac_phy.chan = chan;
4564
	DELAY(8000);
4565
	return (0);
4566
fail:
4567
	device_printf(sc->sc_dev, "failed to switch channel\n");
4568
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4569
	return (error);
4570
}
4571

4572
static uint16_t
4573
bwn_ant2phy(int antenna)
4574
{
4575

4576
	switch (antenna) {
4577
	case BWN_ANT0:
4578
		return (BWN_TX_PHY_ANT0);
4579
	case BWN_ANT1:
4580
		return (BWN_TX_PHY_ANT1);
4581
	case BWN_ANT2:
4582
		return (BWN_TX_PHY_ANT2);
4583
	case BWN_ANT3:
4584
		return (BWN_TX_PHY_ANT3);
4585
	case BWN_ANTAUTO:
4586
		return (BWN_TX_PHY_ANT01AUTO);
4587
	}
4588
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4589
	return (0);
4590
}
4591

4592
static void
4593
bwn_wme_load(struct bwn_mac *mac)
4594
{
4595
	struct bwn_softc *sc = mac->mac_sc;
4596
	int i;
4597

4598
	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4599
	    ("%s:%d: fail", __func__, __LINE__));
4600

4601
	bwn_mac_suspend(mac);
4602
	for (i = 0; i < N(sc->sc_wmeParams); i++)
4603
		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4604
		    bwn_wme_shm_offsets[i]);
4605
	bwn_mac_enable(mac);
4606
}
4607

4608
static void
4609
bwn_wme_loadparams(struct bwn_mac *mac,
4610
    const struct wmeParams *p, uint16_t shm_offset)
4611
{
4612
	struct bwn_softc *sc = mac->mac_sc;
4613
	uint16_t params[BWN_NR_WMEPARAMS];
4614
	int slot, tmp;
4615
	unsigned int i;
4616

4617
	slot = BWN_READ_2(mac, BWN_RNG) &
4618
	    _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4619

4620
	memset(&params, 0, sizeof(params));
4621

4622
	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4623
	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4624
	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4625

4626
	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4627
	params[BWN_WMEPARAM_CWMIN] =
4628
	    _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4629
	params[BWN_WMEPARAM_CWMAX] =
4630
	     _IEEE80211_SHIFTMASK(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4631
	params[BWN_WMEPARAM_CWCUR] =
4632
	     _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4633
	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4634
	params[BWN_WMEPARAM_BSLOTS] = slot;
4635
	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4636

4637
	for (i = 0; i < N(params); i++) {
4638
		if (i == BWN_WMEPARAM_STATUS) {
4639
			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4640
			    shm_offset + (i * 2));
4641
			tmp |= 0x100;
4642
			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4643
			    tmp);
4644
		} else {
4645
			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4646
			    params[i]);
4647
		}
4648
	}
4649
}
4650

4651
static void
4652
bwn_mac_write_bssid(struct bwn_mac *mac)
4653
{
4654
	struct bwn_softc *sc = mac->mac_sc;
4655
	uint32_t tmp;
4656
	int i;
4657
	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4658

4659
	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4660
	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4661
	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4662
	    IEEE80211_ADDR_LEN);
4663

4664
	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4665
		tmp = (uint32_t) (mac_bssid[i + 0]);
4666
		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4667
		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4668
		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4669
		bwn_ram_write(mac, 0x20 + i, tmp);
4670
	}
4671
}
4672

4673
static void
4674
bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4675
    const uint8_t *macaddr)
4676
{
4677
	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4678
	uint16_t data;
4679

4680
	if (!mac)
4681
		macaddr = zero;
4682

4683
	offset |= 0x0020;
4684
	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4685

4686
	data = macaddr[0];
4687
	data |= macaddr[1] << 8;
4688
	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4689
	data = macaddr[2];
4690
	data |= macaddr[3] << 8;
4691
	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4692
	data = macaddr[4];
4693
	data |= macaddr[5] << 8;
4694
	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4695
}
4696

4697
static void
4698
bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4699
    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4700
{
4701
	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4702
	uint8_t per_sta_keys_start = 8;
4703

4704
	if (BWN_SEC_NEWAPI(mac))
4705
		per_sta_keys_start = 4;
4706

4707
	KASSERT(index < mac->mac_max_nr_keys,
4708
	    ("%s:%d: fail", __func__, __LINE__));
4709
	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4710
	    ("%s:%d: fail", __func__, __LINE__));
4711

4712
	if (index >= per_sta_keys_start)
4713
		bwn_key_macwrite(mac, index, NULL);
4714
	if (key)
4715
		memcpy(buf, key, key_len);
4716
	bwn_key_write(mac, index, algorithm, buf);
4717
	if (index >= per_sta_keys_start)
4718
		bwn_key_macwrite(mac, index, mac_addr);
4719

4720
	mac->mac_key[index].algorithm = algorithm;
4721
}
4722

4723
static void
4724
bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4725
{
4726
	struct bwn_softc *sc = mac->mac_sc;
4727
	uint32_t addrtmp[2] = { 0, 0 };
4728
	uint8_t start = 8;
4729

4730
	if (BWN_SEC_NEWAPI(mac))
4731
		start = 4;
4732

4733
	KASSERT(index >= start,
4734
	    ("%s:%d: fail", __func__, __LINE__));
4735
	index -= start;
4736

4737
	if (addr) {
4738
		addrtmp[0] = addr[0];
4739
		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4740
		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4741
		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4742
		addrtmp[1] = addr[4];
4743
		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4744
	}
4745

4746
	if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4747
		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4748
		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4749
	} else {
4750
		if (index >= 8) {
4751
			bwn_shm_write_4(mac, BWN_SHARED,
4752
			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4753
			bwn_shm_write_2(mac, BWN_SHARED,
4754
			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4755
		}
4756
	}
4757
}
4758

4759
static void
4760
bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4761
    const uint8_t *key)
4762
{
4763
	unsigned int i;
4764
	uint32_t offset;
4765
	uint16_t kidx, value;
4766

4767
	kidx = BWN_SEC_KEY2FW(mac, index);
4768
	bwn_shm_write_2(mac, BWN_SHARED,
4769
	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4770

4771
	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4772
	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4773
		value = key[i];
4774
		value |= (uint16_t)(key[i + 1]) << 8;
4775
		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4776
	}
4777
}
4778

4779
static void
4780
bwn_phy_exit(struct bwn_mac *mac)
4781
{
4782

4783
	mac->mac_phy.rf_onoff(mac, 0);
4784
	if (mac->mac_phy.exit != NULL)
4785
		mac->mac_phy.exit(mac);
4786
}
4787

4788
static void
4789
bwn_dma_free(struct bwn_mac *mac)
4790
{
4791
	struct bwn_dma *dma;
4792

4793
	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4794
		return;
4795
	dma = &mac->mac_method.dma;
4796

4797
	bwn_dma_ringfree(&dma->rx);
4798
	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4799
	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4800
	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4801
	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4802
	bwn_dma_ringfree(&dma->mcast);
4803
}
4804

4805
static void
4806
bwn_core_stop(struct bwn_mac *mac)
4807
{
4808
	struct bwn_softc *sc = mac->mac_sc;
4809

4810
	BWN_ASSERT_LOCKED(sc);
4811

4812
	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4813
		return;
4814

4815
	callout_stop(&sc->sc_rfswitch_ch);
4816
	callout_stop(&sc->sc_task_ch);
4817
	callout_stop(&sc->sc_watchdog_ch);
4818
	sc->sc_watchdog_timer = 0;
4819
	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4820
	BWN_READ_4(mac, BWN_INTR_MASK);
4821
	bwn_mac_suspend(mac);
4822

4823
	mac->mac_status = BWN_MAC_STATUS_INITED;
4824
}
4825

4826
static int
4827
bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4828
{
4829
	struct bwn_mac *up_dev = NULL;
4830
	struct bwn_mac *down_dev;
4831
	struct bwn_mac *mac;
4832
	int err, status;
4833
	uint8_t gmode;
4834

4835
	BWN_ASSERT_LOCKED(sc);
4836

4837
	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4838
		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4839
		    mac->mac_phy.supports_2ghz) {
4840
			up_dev = mac;
4841
			gmode = 1;
4842
		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4843
		    mac->mac_phy.supports_5ghz) {
4844
			up_dev = mac;
4845
			gmode = 0;
4846
		} else {
4847
			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4848
			return (EINVAL);
4849
		}
4850
		if (up_dev != NULL)
4851
			break;
4852
	}
4853
	if (up_dev == NULL) {
4854
		device_printf(sc->sc_dev, "Could not find a device\n");
4855
		return (ENODEV);
4856
	}
4857
	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4858
		return (0);
4859

4860
	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4861
	    "switching to %s-GHz band\n",
4862
	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4863

4864
	down_dev = sc->sc_curmac;
4865
	status = down_dev->mac_status;
4866
	if (status >= BWN_MAC_STATUS_STARTED)
4867
		bwn_core_stop(down_dev);
4868
	if (status >= BWN_MAC_STATUS_INITED)
4869
		bwn_core_exit(down_dev);
4870

4871
	if (down_dev != up_dev) {
4872
		err = bwn_phy_reset(down_dev);
4873
		if (err)
4874
			goto fail;
4875
	}
4876

4877
	up_dev->mac_phy.gmode = gmode;
4878
	if (status >= BWN_MAC_STATUS_INITED) {
4879
		err = bwn_core_init(up_dev);
4880
		if (err) {
4881
			device_printf(sc->sc_dev,
4882
			    "fatal: failed to initialize for %s-GHz\n",
4883
			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4884
			goto fail;
4885
		}
4886
	}
4887
	if (status >= BWN_MAC_STATUS_STARTED)
4888
		bwn_core_start(up_dev);
4889
	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4890
	sc->sc_curmac = up_dev;
4891

4892
	return (0);
4893
fail:
4894
	sc->sc_curmac = NULL;
4895
	return (err);
4896
}
4897

4898
static void
4899
bwn_rf_turnon(struct bwn_mac *mac)
4900
{
4901

4902
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4903

4904
	bwn_mac_suspend(mac);
4905
	mac->mac_phy.rf_onoff(mac, 1);
4906
	mac->mac_phy.rf_on = 1;
4907
	bwn_mac_enable(mac);
4908
}
4909

4910
static void
4911
bwn_rf_turnoff(struct bwn_mac *mac)
4912
{
4913

4914
	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4915

4916
	bwn_mac_suspend(mac);
4917
	mac->mac_phy.rf_onoff(mac, 0);
4918
	mac->mac_phy.rf_on = 0;
4919
	bwn_mac_enable(mac);
4920
}
4921

4922
/*
4923
 * PHY reset.
4924
 */
4925
static int
4926
bwn_phy_reset(struct bwn_mac *mac)
4927
{
4928
	struct bwn_softc	*sc;
4929
	uint16_t		 iost, mask;
4930
	int			 error;
4931

4932
	sc = mac->mac_sc;
4933

4934
	iost = BWN_IOCTL_PHYRESET | BHND_IOCTL_CLK_FORCE;
4935
	mask = iost | BWN_IOCTL_SUPPORT_G;
4936

4937
	if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4938
		return (error);
4939

4940
	DELAY(1000);
4941

4942
	iost &= ~BHND_IOCTL_CLK_FORCE;
4943

4944
	if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4945
		return (error);
4946

4947
	DELAY(1000);
4948

4949
	return (0);
4950
}
4951

4952
static int
4953
bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4954
{
4955
	struct bwn_vap *bvp = BWN_VAP(vap);
4956
	struct ieee80211com *ic= vap->iv_ic;
4957
	enum ieee80211_state ostate = vap->iv_state;
4958
	struct bwn_softc *sc = ic->ic_softc;
4959
	struct bwn_mac *mac = sc->sc_curmac;
4960
	int error;
4961

4962
	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4963
	    ieee80211_state_name[vap->iv_state],
4964
	    ieee80211_state_name[nstate]);
4965

4966
	error = bvp->bv_newstate(vap, nstate, arg);
4967
	if (error != 0)
4968
		return (error);
4969

4970
	BWN_LOCK(sc);
4971

4972
	bwn_led_newstate(mac, nstate);
4973

4974
	/*
4975
	 * Clear the BSSID when we stop a STA
4976
	 */
4977
	if (vap->iv_opmode == IEEE80211_M_STA) {
4978
		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4979
			/*
4980
			 * Clear out the BSSID.  If we reassociate to
4981
			 * the same AP, this will reinialize things
4982
			 * correctly...
4983
			 */
4984
			if (ic->ic_opmode == IEEE80211_M_STA &&
4985
			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4986
				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4987
				bwn_set_macaddr(mac);
4988
			}
4989
		}
4990
	}
4991

4992
	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4993
	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4994
		/* XXX nothing to do? */
4995
	} else if (nstate == IEEE80211_S_RUN) {
4996
		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4997
		bwn_set_opmode(mac);
4998
		bwn_set_pretbtt(mac);
4999
		bwn_spu_setdelay(mac, 0);
5000
		bwn_set_macaddr(mac);
5001
	}
5002

5003
	BWN_UNLOCK(sc);
5004

5005
	return (error);
5006
}
5007

5008
static void
5009
bwn_set_pretbtt(struct bwn_mac *mac)
5010
{
5011
	struct bwn_softc *sc = mac->mac_sc;
5012
	struct ieee80211com *ic = &sc->sc_ic;
5013
	uint16_t pretbtt;
5014

5015
	if (ic->ic_opmode == IEEE80211_M_IBSS)
5016
		pretbtt = 2;
5017
	else
5018
		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
5019
	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
5020
	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
5021
}
5022

5023
static int
5024
bwn_intr(void *arg)
5025
{
5026
	struct bwn_mac *mac = arg;
5027
	struct bwn_softc *sc = mac->mac_sc;
5028
	uint32_t reason;
5029

5030
	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5031
	    (sc->sc_flags & BWN_FLAG_INVALID))
5032
		return (FILTER_STRAY);
5033

5034
	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
5035

5036
	reason = BWN_READ_4(mac, BWN_INTR_REASON);
5037
	if (reason == 0xffffffff)	/* shared IRQ */
5038
		return (FILTER_STRAY);
5039
	reason &= mac->mac_intr_mask;
5040
	if (reason == 0)
5041
		return (FILTER_HANDLED);
5042
	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
5043

5044
	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
5045
	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
5046
	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
5047
	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
5048
	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
5049
	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
5050
	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
5051
	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
5052
	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
5053
	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
5054
	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
5055

5056
	/* Disable interrupts. */
5057
	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
5058

5059
	mac->mac_reason_intr = reason;
5060

5061
	BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5062

5063
	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
5064
	return (FILTER_HANDLED);
5065
}
5066

5067
static void
5068
bwn_intrtask(void *arg, int npending)
5069
{
5070
	struct bwn_mac *mac = arg;
5071
	struct bwn_softc *sc = mac->mac_sc;
5072
	uint32_t merged = 0;
5073
	int i, tx = 0, rx = 0;
5074

5075
	BWN_LOCK(sc);
5076
	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5077
	    (sc->sc_flags & BWN_FLAG_INVALID)) {
5078
		BWN_UNLOCK(sc);
5079
		return;
5080
	}
5081

5082
	for (i = 0; i < N(mac->mac_reason); i++)
5083
		merged |= mac->mac_reason[i];
5084

5085
	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
5086
		device_printf(sc->sc_dev, "MAC trans error\n");
5087

5088
	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
5089
		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
5090
		mac->mac_phy.txerrors--;
5091
		if (mac->mac_phy.txerrors == 0) {
5092
			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
5093
			bwn_restart(mac, "PHY TX errors");
5094
		}
5095
	}
5096

5097
	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
5098
		if (merged & BWN_DMAINTR_FATALMASK) {
5099
			device_printf(sc->sc_dev,
5100
			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
5101
			    mac->mac_reason[0], mac->mac_reason[1],
5102
			    mac->mac_reason[2], mac->mac_reason[3],
5103
			    mac->mac_reason[4], mac->mac_reason[5]);
5104
			bwn_restart(mac, "DMA error");
5105
			BWN_UNLOCK(sc);
5106
			return;
5107
		}
5108
		if (merged & BWN_DMAINTR_NONFATALMASK) {
5109
			device_printf(sc->sc_dev,
5110
			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
5111
			    mac->mac_reason[0], mac->mac_reason[1],
5112
			    mac->mac_reason[2], mac->mac_reason[3],
5113
			    mac->mac_reason[4], mac->mac_reason[5]);
5114
		}
5115
	}
5116

5117
	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
5118
		bwn_intr_ucode_debug(mac);
5119
	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
5120
		bwn_intr_tbtt_indication(mac);
5121
	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
5122
		bwn_intr_atim_end(mac);
5123
	if (mac->mac_reason_intr & BWN_INTR_BEACON)
5124
		bwn_intr_beacon(mac);
5125
	if (mac->mac_reason_intr & BWN_INTR_PMQ)
5126
		bwn_intr_pmq(mac);
5127
	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
5128
		bwn_intr_noise(mac);
5129

5130
	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5131
		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
5132
			bwn_dma_rx(mac->mac_method.dma.rx);
5133
			rx = 1;
5134
		}
5135
	} else
5136
		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
5137

5138
	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5139
	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5140
	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5141
	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5142
	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5143

5144
	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
5145
		bwn_intr_txeof(mac);
5146
		tx = 1;
5147
	}
5148

5149
	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
5150

5151
	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
5152
		int evt = BWN_LED_EVENT_NONE;
5153

5154
		if (tx && rx) {
5155
			if (sc->sc_rx_rate > sc->sc_tx_rate)
5156
				evt = BWN_LED_EVENT_RX;
5157
			else
5158
				evt = BWN_LED_EVENT_TX;
5159
		} else if (tx) {
5160
			evt = BWN_LED_EVENT_TX;
5161
		} else if (rx) {
5162
			evt = BWN_LED_EVENT_RX;
5163
		} else if (rx == 0) {
5164
			evt = BWN_LED_EVENT_POLL;
5165
		}
5166

5167
		if (evt != BWN_LED_EVENT_NONE)
5168
			bwn_led_event(mac, evt);
5169
       }
5170

5171
	if (mbufq_first(&sc->sc_snd) != NULL)
5172
		bwn_start(sc);
5173

5174
	BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5175

5176
	BWN_UNLOCK(sc);
5177
}
5178

5179
static void
5180
bwn_restart(struct bwn_mac *mac, const char *msg)
5181
{
5182
	struct bwn_softc *sc = mac->mac_sc;
5183
	struct ieee80211com *ic = &sc->sc_ic;
5184

5185
	if (mac->mac_status < BWN_MAC_STATUS_INITED)
5186
		return;
5187

5188
	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5189
	ieee80211_runtask(ic, &mac->mac_hwreset);
5190
}
5191

5192
static void
5193
bwn_intr_ucode_debug(struct bwn_mac *mac)
5194
{
5195
	struct bwn_softc *sc = mac->mac_sc;
5196
	uint16_t reason;
5197

5198
	if (mac->mac_fw.opensource == 0)
5199
		return;
5200

5201
	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5202
	switch (reason) {
5203
	case BWN_DEBUGINTR_PANIC:
5204
		bwn_handle_fwpanic(mac);
5205
		break;
5206
	case BWN_DEBUGINTR_DUMP_SHM:
5207
		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5208
		break;
5209
	case BWN_DEBUGINTR_DUMP_REGS:
5210
		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5211
		break;
5212
	case BWN_DEBUGINTR_MARKER:
5213
		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5214
		break;
5215
	default:
5216
		device_printf(sc->sc_dev,
5217
		    "ucode debug unknown reason: %#x\n", reason);
5218
	}
5219

5220
	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5221
	    BWN_DEBUGINTR_ACK);
5222
}
5223

5224
static void
5225
bwn_intr_tbtt_indication(struct bwn_mac *mac)
5226
{
5227
	struct bwn_softc *sc = mac->mac_sc;
5228
	struct ieee80211com *ic = &sc->sc_ic;
5229

5230
	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5231
		bwn_psctl(mac, 0);
5232
	if (ic->ic_opmode == IEEE80211_M_IBSS)
5233
		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5234
}
5235

5236
static void
5237
bwn_intr_atim_end(struct bwn_mac *mac)
5238
{
5239

5240
	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5241
		BWN_WRITE_4(mac, BWN_MACCMD,
5242
		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5243
		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5244
	}
5245
}
5246

5247
static void
5248
bwn_intr_beacon(struct bwn_mac *mac)
5249
{
5250
	struct bwn_softc *sc = mac->mac_sc;
5251
	struct ieee80211com *ic = &sc->sc_ic;
5252
	uint32_t cmd, beacon0, beacon1;
5253

5254
	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5255
	    ic->ic_opmode == IEEE80211_M_MBSS)
5256
		return;
5257

5258
	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5259

5260
	cmd = BWN_READ_4(mac, BWN_MACCMD);
5261
	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5262
	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5263

5264
	if (beacon0 && beacon1) {
5265
		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5266
		mac->mac_intr_mask |= BWN_INTR_BEACON;
5267
		return;
5268
	}
5269

5270
	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5271
		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5272
		bwn_load_beacon0(mac);
5273
		bwn_load_beacon1(mac);
5274
		cmd = BWN_READ_4(mac, BWN_MACCMD);
5275
		cmd |= BWN_MACCMD_BEACON0_VALID;
5276
		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5277
	} else {
5278
		if (!beacon0) {
5279
			bwn_load_beacon0(mac);
5280
			cmd = BWN_READ_4(mac, BWN_MACCMD);
5281
			cmd |= BWN_MACCMD_BEACON0_VALID;
5282
			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5283
		} else if (!beacon1) {
5284
			bwn_load_beacon1(mac);
5285
			cmd = BWN_READ_4(mac, BWN_MACCMD);
5286
			cmd |= BWN_MACCMD_BEACON1_VALID;
5287
			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5288
		}
5289
	}
5290
}
5291

5292
static void
5293
bwn_intr_pmq(struct bwn_mac *mac)
5294
{
5295
	uint32_t tmp;
5296

5297
	while (1) {
5298
		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5299
		if (!(tmp & 0x00000008))
5300
			break;
5301
	}
5302
	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5303
}
5304

5305
static void
5306
bwn_intr_noise(struct bwn_mac *mac)
5307
{
5308
	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5309
	uint16_t tmp;
5310
	uint8_t noise[4];
5311
	uint8_t i, j;
5312
	int32_t average;
5313

5314
	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5315
		return;
5316

5317
	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5318
	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5319
	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5320
	    noise[3] == 0x7f)
5321
		goto new;
5322

5323
	KASSERT(mac->mac_noise.noi_nsamples < 8,
5324
	    ("%s:%d: fail", __func__, __LINE__));
5325
	i = mac->mac_noise.noi_nsamples;
5326
	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5327
	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5328
	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5329
	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5330
	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5331
	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5332
	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5333
	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5334
	mac->mac_noise.noi_nsamples++;
5335
	if (mac->mac_noise.noi_nsamples == 8) {
5336
		average = 0;
5337
		for (i = 0; i < 8; i++) {
5338
			for (j = 0; j < 4; j++)
5339
				average += mac->mac_noise.noi_samples[i][j];
5340
		}
5341
		average = (((average / 32) * 125) + 64) / 128;
5342
		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5343
		if (tmp >= 8)
5344
			average += 2;
5345
		else
5346
			average -= 25;
5347
		average -= (tmp == 8) ? 72 : 48;
5348

5349
		mac->mac_stats.link_noise = average;
5350
		mac->mac_noise.noi_running = 0;
5351
		return;
5352
	}
5353
new:
5354
	bwn_noise_gensample(mac);
5355
}
5356

5357
static int
5358
bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5359
{
5360
	struct bwn_mac *mac = prq->prq_mac;
5361
	struct bwn_softc *sc = mac->mac_sc;
5362
	unsigned int i;
5363

5364
	BWN_ASSERT_LOCKED(sc);
5365

5366
	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5367
		return (0);
5368

5369
	for (i = 0; i < 5000; i++) {
5370
		if (bwn_pio_rxeof(prq) == 0)
5371
			break;
5372
	}
5373
	if (i >= 5000)
5374
		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5375
	return ((i > 0) ? 1 : 0);
5376
}
5377

5378
static void
5379
bwn_dma_rx(struct bwn_dma_ring *dr)
5380
{
5381
	int slot, curslot;
5382

5383
	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5384
	curslot = dr->get_curslot(dr);
5385
	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5386
	    ("%s:%d: fail", __func__, __LINE__));
5387

5388
	slot = dr->dr_curslot;
5389
	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5390
		bwn_dma_rxeof(dr, &slot);
5391

5392
	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5393
	    BUS_DMASYNC_PREWRITE);
5394

5395
	dr->set_curslot(dr, slot);
5396
	dr->dr_curslot = slot;
5397
}
5398

5399
static void
5400
bwn_intr_txeof(struct bwn_mac *mac)
5401
{
5402
	struct bwn_txstatus stat;
5403
	uint32_t stat0, stat1;
5404
	uint16_t tmp;
5405

5406
	BWN_ASSERT_LOCKED(mac->mac_sc);
5407

5408
	while (1) {
5409
		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5410
		if (!(stat0 & 0x00000001))
5411
			break;
5412
		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5413

5414
		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5415
		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5416
		    __func__,
5417
		    stat0,
5418
		    stat1);
5419

5420
		stat.cookie = (stat0 >> 16);
5421
		stat.seq = (stat1 & 0x0000ffff);
5422
		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5423
		tmp = (stat0 & 0x0000ffff);
5424
		stat.framecnt = ((tmp & 0xf000) >> 12);
5425
		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5426
		stat.sreason = ((tmp & 0x001c) >> 2);
5427
		stat.pm = (tmp & 0x0080) ? 1 : 0;
5428
		stat.im = (tmp & 0x0040) ? 1 : 0;
5429
		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5430
		stat.ack = (tmp & 0x0002) ? 1 : 0;
5431

5432
		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5433
		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5434
		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5435
		    __func__,
5436
		    stat.cookie,
5437
		    stat.seq,
5438
		    stat.phy_stat,
5439
		    stat.framecnt,
5440
		    stat.rtscnt,
5441
		    stat.sreason,
5442
		    stat.pm,
5443
		    stat.im,
5444
		    stat.ampdu,
5445
		    stat.ack);
5446

5447
		bwn_handle_txeof(mac, &stat);
5448
	}
5449
}
5450

5451
static void
5452
bwn_hwreset(void *arg, int npending)
5453
{
5454
	struct bwn_mac *mac = arg;
5455
	struct bwn_softc *sc = mac->mac_sc;
5456
	int error = 0;
5457
	int prev_status;
5458

5459
	BWN_LOCK(sc);
5460

5461
	prev_status = mac->mac_status;
5462
	if (prev_status >= BWN_MAC_STATUS_STARTED)
5463
		bwn_core_stop(mac);
5464
	if (prev_status >= BWN_MAC_STATUS_INITED)
5465
		bwn_core_exit(mac);
5466

5467
	if (prev_status >= BWN_MAC_STATUS_INITED) {
5468
		error = bwn_core_init(mac);
5469
		if (error)
5470
			goto out;
5471
	}
5472
	if (prev_status >= BWN_MAC_STATUS_STARTED)
5473
		bwn_core_start(mac);
5474
out:
5475
	if (error) {
5476
		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5477
		sc->sc_curmac = NULL;
5478
	}
5479
	BWN_UNLOCK(sc);
5480
}
5481

5482
static void
5483
bwn_handle_fwpanic(struct bwn_mac *mac)
5484
{
5485
	struct bwn_softc *sc = mac->mac_sc;
5486
	uint16_t reason;
5487

5488
	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5489
	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5490

5491
	if (reason == BWN_FWPANIC_RESTART)
5492
		bwn_restart(mac, "ucode panic");
5493
}
5494

5495
static void
5496
bwn_load_beacon0(struct bwn_mac *mac)
5497
{
5498

5499
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5500
}
5501

5502
static void
5503
bwn_load_beacon1(struct bwn_mac *mac)
5504
{
5505

5506
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5507
}
5508

5509
static uint32_t
5510
bwn_jssi_read(struct bwn_mac *mac)
5511
{
5512
	uint32_t val = 0;
5513

5514
	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5515
	val <<= 16;
5516
	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5517

5518
	return (val);
5519
}
5520

5521
static void
5522
bwn_noise_gensample(struct bwn_mac *mac)
5523
{
5524
	uint32_t jssi = 0x7f7f7f7f;
5525

5526
	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5527
	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5528
	BWN_WRITE_4(mac, BWN_MACCMD,
5529
	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5530
}
5531

5532
static int
5533
bwn_dma_freeslot(struct bwn_dma_ring *dr)
5534
{
5535
	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5536

5537
	return (dr->dr_numslots - dr->dr_usedslot);
5538
}
5539

5540
static int
5541
bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5542
{
5543
	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5544

5545
	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5546
	    ("%s:%d: fail", __func__, __LINE__));
5547
	if (slot == dr->dr_numslots - 1)
5548
		return (0);
5549
	return (slot + 1);
5550
}
5551

5552
static void
5553
bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5554
{
5555
	struct bwn_mac *mac = dr->dr_mac;
5556
	struct bwn_softc *sc = mac->mac_sc;
5557
	struct bwn_dma *dma = &mac->mac_method.dma;
5558
	struct bwn_dmadesc_generic *desc;
5559
	struct bwn_dmadesc_meta *meta;
5560
	struct bwn_rxhdr4 *rxhdr;
5561
	struct mbuf *m;
5562
	uint32_t macstat;
5563
	int32_t tmp;
5564
	int cnt = 0;
5565
	uint16_t len;
5566

5567
	dr->getdesc(dr, *slot, &desc, &meta);
5568

5569
	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5570
	m = meta->mt_m;
5571

5572
	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5573
		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5574
		return;
5575
	}
5576

5577
	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5578
	len = le16toh(rxhdr->frame_len);
5579
	if (len <= 0) {
5580
		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5581
		return;
5582
	}
5583
	if (bwn_dma_check_redzone(dr, m)) {
5584
		device_printf(sc->sc_dev, "redzone error.\n");
5585
		bwn_dma_set_redzone(dr, m);
5586
		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5587
		    BUS_DMASYNC_PREWRITE);
5588
		return;
5589
	}
5590
	if (len > dr->dr_rx_bufsize) {
5591
		tmp = len;
5592
		while (1) {
5593
			dr->getdesc(dr, *slot, &desc, &meta);
5594
			bwn_dma_set_redzone(dr, meta->mt_m);
5595
			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5596
			    BUS_DMASYNC_PREWRITE);
5597
			*slot = bwn_dma_nextslot(dr, *slot);
5598
			cnt++;
5599
			tmp -= dr->dr_rx_bufsize;
5600
			if (tmp <= 0)
5601
				break;
5602
		}
5603
		device_printf(sc->sc_dev, "too small buffer "
5604
		       "(len %u buffer %u dropped %d)\n",
5605
		       len, dr->dr_rx_bufsize, cnt);
5606
		return;
5607
	}
5608

5609
	switch (mac->mac_fw.fw_hdr_format) {
5610
	case BWN_FW_HDR_351:
5611
	case BWN_FW_HDR_410:
5612
		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5613
		break;
5614
	case BWN_FW_HDR_598:
5615
		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5616
		break;
5617
	}
5618

5619
	if (macstat & BWN_RX_MAC_FCSERR) {
5620
		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5621
			device_printf(sc->sc_dev, "RX drop\n");
5622
			return;
5623
		}
5624
	}
5625

5626
	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5627
	m_adj(m, dr->dr_frameoffset);
5628

5629
	bwn_rxeof(dr->dr_mac, m, rxhdr);
5630
}
5631

5632
static void
5633
bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5634
{
5635
	struct bwn_softc *sc = mac->mac_sc;
5636
	struct bwn_stats *stats = &mac->mac_stats;
5637

5638
	BWN_ASSERT_LOCKED(mac->mac_sc);
5639

5640
	if (status->im)
5641
		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5642
	if (status->ampdu)
5643
		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5644
	if (status->rtscnt) {
5645
		if (status->rtscnt == 0xf)
5646
			stats->rtsfail++;
5647
		else
5648
			stats->rts++;
5649
	}
5650

5651
	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5652
		bwn_dma_handle_txeof(mac, status);
5653
	} else {
5654
		bwn_pio_handle_txeof(mac, status);
5655
	}
5656

5657
	bwn_phy_txpower_check(mac, 0);
5658
}
5659

5660
static uint8_t
5661
bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5662
{
5663
	struct bwn_mac *mac = prq->prq_mac;
5664
	struct bwn_softc *sc = mac->mac_sc;
5665
	struct bwn_rxhdr4 rxhdr;
5666
	struct mbuf *m;
5667
	uint32_t ctl32, macstat, v32;
5668
	unsigned int i, padding;
5669
	uint16_t ctl16, len, totlen, v16;
5670
	unsigned char *mp;
5671
	char *data;
5672

5673
	memset(&rxhdr, 0, sizeof(rxhdr));
5674

5675
	if (prq->prq_rev >= 8) {
5676
		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5677
		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5678
			return (0);
5679
		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5680
		    BWN_PIO8_RXCTL_FRAMEREADY);
5681
		for (i = 0; i < 10; i++) {
5682
			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5683
			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5684
				goto ready;
5685
			DELAY(10);
5686
		}
5687
	} else {
5688
		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5689
		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5690
			return (0);
5691
		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5692
		    BWN_PIO_RXCTL_FRAMEREADY);
5693
		for (i = 0; i < 10; i++) {
5694
			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5695
			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5696
				goto ready;
5697
			DELAY(10);
5698
		}
5699
	}
5700
	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5701
	return (1);
5702
ready:
5703
	if (prq->prq_rev >= 8) {
5704
		bus_read_multi_4(sc->sc_mem_res,
5705
		    prq->prq_base + BWN_PIO8_RXDATA, (void *)&rxhdr,
5706
		    sizeof(rxhdr));
5707
	} else {
5708
		bus_read_multi_2(sc->sc_mem_res,
5709
		    prq->prq_base + BWN_PIO_RXDATA, (void *)&rxhdr,
5710
		    sizeof(rxhdr));
5711
	}
5712
	len = le16toh(rxhdr.frame_len);
5713
	if (len > 0x700) {
5714
		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5715
		goto error;
5716
	}
5717
	if (len == 0) {
5718
		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5719
		goto error;
5720
	}
5721

5722
	switch (mac->mac_fw.fw_hdr_format) {
5723
	case BWN_FW_HDR_351:
5724
	case BWN_FW_HDR_410:
5725
		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5726
		break;
5727
	case BWN_FW_HDR_598:
5728
		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5729
		break;
5730
	}
5731

5732
	if (macstat & BWN_RX_MAC_FCSERR) {
5733
		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5734
			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5735
			goto error;
5736
		}
5737
	}
5738

5739
	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5740
	totlen = len + padding;
5741
	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5742
	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5743
	if (m == NULL) {
5744
		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5745
		goto error;
5746
	}
5747
	mp = mtod(m, unsigned char *);
5748
	if (prq->prq_rev >= 8) {
5749
		bus_read_multi_4(sc->sc_mem_res,
5750
		    prq->prq_base + BWN_PIO8_RXDATA, (void *)mp, (totlen & ~3));
5751
		if (totlen & 3) {
5752
			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5753
			data = &(mp[totlen - 1]);
5754
			switch (totlen & 3) {
5755
			case 3:
5756
				*data = (v32 >> 16);
5757
				data--;
5758
			case 2:
5759
				*data = (v32 >> 8);
5760
				data--;
5761
			case 1:
5762
				*data = v32;
5763
			}
5764
		}
5765
	} else {
5766
		bus_read_multi_2(sc->sc_mem_res,
5767
		    prq->prq_base + BWN_PIO_RXDATA, (void *)mp, (totlen & ~1));
5768
		if (totlen & 1) {
5769
			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5770
			mp[totlen - 1] = v16;
5771
		}
5772
	}
5773

5774
	m->m_len = m->m_pkthdr.len = totlen;
5775

5776
	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5777

5778
	return (1);
5779
error:
5780
	if (prq->prq_rev >= 8)
5781
		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5782
		    BWN_PIO8_RXCTL_DATAREADY);
5783
	else
5784
		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5785
	return (1);
5786
}
5787

5788
static int
5789
bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5790
    struct bwn_dmadesc_meta *meta, int init)
5791
{
5792
	struct bwn_mac *mac = dr->dr_mac;
5793
	struct bwn_dma *dma = &mac->mac_method.dma;
5794
	struct bwn_rxhdr4 *hdr;
5795
	bus_dmamap_t map;
5796
	bus_addr_t paddr;
5797
	struct mbuf *m;
5798
	int error;
5799

5800
	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5801
	if (m == NULL) {
5802
		error = ENOBUFS;
5803

5804
		/*
5805
		 * If the NIC is up and running, we need to:
5806
		 * - Clear RX buffer's header.
5807
		 * - Restore RX descriptor settings.
5808
		 */
5809
		if (init)
5810
			return (error);
5811
		else
5812
			goto back;
5813
	}
5814
	m->m_len = m->m_pkthdr.len = MCLBYTES;
5815

5816
	bwn_dma_set_redzone(dr, m);
5817

5818
	/*
5819
	 * Try to load RX buf into temporary DMA map
5820
	 */
5821
	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5822
	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5823
	if (error) {
5824
		m_freem(m);
5825

5826
		/*
5827
		 * See the comment above
5828
		 */
5829
		if (init)
5830
			return (error);
5831
		else
5832
			goto back;
5833
	}
5834

5835
	if (!init)
5836
		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5837
	meta->mt_m = m;
5838
	meta->mt_paddr = paddr;
5839

5840
	/*
5841
	 * Swap RX buf's DMA map with the loaded temporary one
5842
	 */
5843
	map = meta->mt_dmap;
5844
	meta->mt_dmap = dr->dr_spare_dmap;
5845
	dr->dr_spare_dmap = map;
5846

5847
back:
5848
	/*
5849
	 * Clear RX buf header
5850
	 */
5851
	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5852
	bzero(hdr, sizeof(*hdr));
5853
	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5854
	    BUS_DMASYNC_PREWRITE);
5855

5856
	/*
5857
	 * Setup RX buf descriptor
5858
	 */
5859
	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5860
	    sizeof(*hdr), 0, 0, 0);
5861
	return (error);
5862
}
5863

5864
static void
5865
bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5866
		 bus_size_t mapsz __unused, int error)
5867
{
5868

5869
	if (!error) {
5870
		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5871
		*((bus_addr_t *)arg) = seg->ds_addr;
5872
	}
5873
}
5874

5875
static int
5876
bwn_hwrate2ieeerate(int rate)
5877
{
5878

5879
	switch (rate) {
5880
	case BWN_CCK_RATE_1MB:
5881
		return (2);
5882
	case BWN_CCK_RATE_2MB:
5883
		return (4);
5884
	case BWN_CCK_RATE_5MB:
5885
		return (11);
5886
	case BWN_CCK_RATE_11MB:
5887
		return (22);
5888
	case BWN_OFDM_RATE_6MB:
5889
		return (12);
5890
	case BWN_OFDM_RATE_9MB:
5891
		return (18);
5892
	case BWN_OFDM_RATE_12MB:
5893
		return (24);
5894
	case BWN_OFDM_RATE_18MB:
5895
		return (36);
5896
	case BWN_OFDM_RATE_24MB:
5897
		return (48);
5898
	case BWN_OFDM_RATE_36MB:
5899
		return (72);
5900
	case BWN_OFDM_RATE_48MB:
5901
		return (96);
5902
	case BWN_OFDM_RATE_54MB:
5903
		return (108);
5904
	default:
5905
		printf("Ooops\n");
5906
		return (0);
5907
	}
5908
}
5909

5910
/*
5911
 * Post process the RX provided RSSI.
5912
 *
5913
 * Valid for A, B, G, LP PHYs.
5914
 */
5915
static int8_t
5916
bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5917
    int ofdm, int adjust_2053, int adjust_2050)
5918
{
5919
	struct bwn_phy *phy = &mac->mac_phy;
5920
	struct bwn_phy_g *gphy = &phy->phy_g;
5921
	int tmp;
5922

5923
	switch (phy->rf_ver) {
5924
	case 0x2050:
5925
		if (ofdm) {
5926
			tmp = in_rssi;
5927
			if (tmp > 127)
5928
				tmp -= 256;
5929
			tmp = tmp * 73 / 64;
5930
			if (adjust_2050)
5931
				tmp += 25;
5932
			else
5933
				tmp -= 3;
5934
		} else {
5935
			if (mac->mac_sc->sc_board_info.board_flags
5936
			    & BHND_BFL_ADCDIV) {
5937
				if (in_rssi > 63)
5938
					in_rssi = 63;
5939
				tmp = gphy->pg_nrssi_lt[in_rssi];
5940
				tmp = (31 - tmp) * -131 / 128 - 57;
5941
			} else {
5942
				tmp = in_rssi;
5943
				tmp = (31 - tmp) * -149 / 128 - 68;
5944
			}
5945
			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5946
				tmp += 25;
5947
		}
5948
		break;
5949
	case 0x2060:
5950
		if (in_rssi > 127)
5951
			tmp = in_rssi - 256;
5952
		else
5953
			tmp = in_rssi;
5954
		break;
5955
	default:
5956
		tmp = in_rssi;
5957
		tmp = (tmp - 11) * 103 / 64;
5958
		if (adjust_2053)
5959
			tmp -= 109;
5960
		else
5961
			tmp -= 83;
5962
	}
5963

5964
	return (tmp);
5965
}
5966

5967
static void
5968
bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5969
{
5970
	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5971
	struct bwn_plcp6 *plcp;
5972
	struct bwn_softc *sc = mac->mac_sc;
5973
	struct ieee80211_frame_min *wh;
5974
	struct ieee80211_node *ni;
5975
	struct ieee80211com *ic = &sc->sc_ic;
5976
	uint32_t macstat;
5977
	int padding, rate, rssi = 0, noise = 0;
5978
	uint16_t phytype, phystat0, phystat3, chanstat;
5979
	unsigned char *mp = mtod(m, unsigned char *);
5980

5981
	BWN_ASSERT_LOCKED(sc);
5982

5983
	phystat0 = le16toh(rxhdr->phy_status0);
5984

5985
	/*
5986
	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5987
	 * used for LP-PHY.
5988
	 */
5989
	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5990

5991
	switch (mac->mac_fw.fw_hdr_format) {
5992
	case BWN_FW_HDR_351:
5993
	case BWN_FW_HDR_410:
5994
		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5995
		chanstat = le16toh(rxhdr->ps4.r351.channel);
5996
		break;
5997
	case BWN_FW_HDR_598:
5998
		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5999
		chanstat = le16toh(rxhdr->ps4.r598.channel);
6000
		break;
6001
	}
6002

6003
	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
6004

6005
	if (macstat & BWN_RX_MAC_FCSERR)
6006
		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
6007
	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
6008
		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
6009
	if (macstat & BWN_RX_MAC_DECERR)
6010
		goto drop;
6011

6012
	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
6013
	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
6014
		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6015
		    m->m_pkthdr.len);
6016
		goto drop;
6017
	}
6018
	plcp = (struct bwn_plcp6 *)(mp + padding);
6019
	m_adj(m, sizeof(struct bwn_plcp6) + padding);
6020
	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
6021
		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6022
		    m->m_pkthdr.len);
6023
		goto drop;
6024
	}
6025
	wh = mtod(m, struct ieee80211_frame_min *);
6026

6027
	if (macstat & BWN_RX_MAC_DEC) {
6028
		DPRINTF(sc, BWN_DEBUG_HWCRYPTO,
6029
		    "RX decryption attempted (old %d keyidx %#x)\n",
6030
		    BWN_ISOLDFMT(mac),
6031
		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
6032
	}
6033

6034
	if (phystat0 & BWN_RX_PHYST0_OFDM)
6035
		rate = bwn_plcp_get_ofdmrate(mac, plcp,
6036
		    phytype == BWN_PHYTYPE_A);
6037
	else
6038
		rate = bwn_plcp_get_cckrate(mac, plcp);
6039
	if (rate == -1) {
6040
		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
6041
			goto drop;
6042
	}
6043
	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
6044

6045
	/* rssi/noise */
6046
	switch (phytype) {
6047
	case BWN_PHYTYPE_A:
6048
	case BWN_PHYTYPE_B:
6049
	case BWN_PHYTYPE_G:
6050
	case BWN_PHYTYPE_LP:
6051
		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
6052
		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
6053
		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
6054
		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
6055
		break;
6056
	case BWN_PHYTYPE_N:
6057
		/* Broadcom has code for min/avg, but always used max */
6058
		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
6059
			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
6060
		else
6061
			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
6062
#if 0
6063
		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
6064
		    "%s: power0=%d, power1=%d, power2=%d\n",
6065
		    __func__,
6066
		    rxhdr->phy.n.power0,
6067
		    rxhdr->phy.n.power1,
6068
		    rxhdr->ps2.n.power2);
6069
#endif
6070
		break;
6071
	default:
6072
		/* XXX TODO: implement rssi for other PHYs */
6073
		break;
6074
	}
6075

6076
	/*
6077
	 * RSSI here is absolute, not relative to the noise floor.
6078
	 */
6079
	noise = mac->mac_stats.link_noise;
6080
	rssi = rssi - noise;
6081

6082
	/* RX radio tap */
6083
	if (ieee80211_radiotap_active(ic))
6084
		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
6085
	m_adj(m, -IEEE80211_CRC_LEN);
6086

6087
	BWN_UNLOCK(sc);
6088

6089
	ni = ieee80211_find_rxnode(ic, wh);
6090
	if (ni != NULL) {
6091
		ieee80211_input(ni, m, rssi, noise);
6092
		ieee80211_free_node(ni);
6093
	} else
6094
		ieee80211_input_all(ic, m, rssi, noise);
6095

6096
	BWN_LOCK(sc);
6097
	return;
6098
drop:
6099
	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
6100
}
6101

6102
static void
6103
bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
6104
    const struct bwn_txstatus *status)
6105
{
6106
	struct ieee80211_ratectl_tx_status txs;
6107
	int retrycnt = 0;
6108

6109
	/*
6110
	 * If we don't get an ACK, then we should log the
6111
	 * full framecnt.  That may be 0 if it's a PHY
6112
	 * failure, so ensure that gets logged as some
6113
	 * retry attempt.
6114
	 */
6115
	txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
6116
	if (status->ack) {
6117
		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
6118
		retrycnt = status->framecnt - 1;
6119
	} else {
6120
		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
6121
		retrycnt = status->framecnt;
6122
		if (retrycnt == 0)
6123
			retrycnt = 1;
6124
	}
6125
	txs.long_retries = retrycnt;
6126
	ieee80211_ratectl_tx_complete(ni, &txs);
6127
}
6128

6129
static void
6130
bwn_dma_handle_txeof(struct bwn_mac *mac,
6131
    const struct bwn_txstatus *status)
6132
{
6133
	struct bwn_dma *dma = &mac->mac_method.dma;
6134
	struct bwn_dma_ring *dr;
6135
	struct bwn_dmadesc_generic *desc;
6136
	struct bwn_dmadesc_meta *meta;
6137
	struct bwn_softc *sc = mac->mac_sc;
6138
	int slot;
6139

6140
	BWN_ASSERT_LOCKED(sc);
6141

6142
	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
6143
	if (dr == NULL) {
6144
		device_printf(sc->sc_dev, "failed to parse cookie\n");
6145
		return;
6146
	}
6147
	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6148

6149
	while (1) {
6150
		KASSERT(slot >= 0 && slot < dr->dr_numslots,
6151
		    ("%s:%d: fail", __func__, __LINE__));
6152
		dr->getdesc(dr, slot, &desc, &meta);
6153

6154
		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
6155
			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
6156
		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
6157
			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
6158

6159
		if (meta->mt_islast) {
6160
			KASSERT(meta->mt_m != NULL,
6161
			    ("%s:%d: fail", __func__, __LINE__));
6162

6163
			bwn_ratectl_tx_complete(meta->mt_ni, status);
6164
			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
6165
			meta->mt_ni = NULL;
6166
			meta->mt_m = NULL;
6167
		} else
6168
			KASSERT(meta->mt_m == NULL,
6169
			    ("%s:%d: fail", __func__, __LINE__));
6170

6171
		dr->dr_usedslot--;
6172
		if (meta->mt_islast)
6173
			break;
6174
		slot = bwn_dma_nextslot(dr, slot);
6175
	}
6176
	sc->sc_watchdog_timer = 0;
6177
	if (dr->dr_stop) {
6178
		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
6179
		    ("%s:%d: fail", __func__, __LINE__));
6180
		dr->dr_stop = 0;
6181
	}
6182
}
6183

6184
static void
6185
bwn_pio_handle_txeof(struct bwn_mac *mac,
6186
    const struct bwn_txstatus *status)
6187
{
6188
	struct bwn_pio_txqueue *tq;
6189
	struct bwn_pio_txpkt *tp = NULL;
6190
	struct bwn_softc *sc = mac->mac_sc;
6191

6192
	BWN_ASSERT_LOCKED(sc);
6193

6194
	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6195
	if (tq == NULL)
6196
		return;
6197

6198
	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6199
	tq->tq_free++;
6200

6201
	if (tp->tp_ni != NULL) {
6202
		/*
6203
		 * Do any tx complete callback.  Note this must
6204
		 * be done before releasing the node reference.
6205
		 */
6206
		bwn_ratectl_tx_complete(tp->tp_ni, status);
6207
	}
6208
	ieee80211_tx_complete(tp->tp_ni, tp->tp_m, 0);
6209
	tp->tp_ni = NULL;
6210
	tp->tp_m = NULL;
6211
	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6212

6213
	sc->sc_watchdog_timer = 0;
6214
}
6215

6216
static void
6217
bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6218
{
6219
	struct bwn_softc *sc = mac->mac_sc;
6220
	struct bwn_phy *phy = &mac->mac_phy;
6221
	struct ieee80211com *ic = &sc->sc_ic;
6222
	unsigned long now;
6223
	bwn_txpwr_result_t result;
6224

6225
	BWN_GETTIME(now);
6226

6227
	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6228
		return;
6229
	phy->nexttime = now + 2 * 1000;
6230

6231
	if (sc->sc_board_info.board_vendor == PCI_VENDOR_BROADCOM &&
6232
	    sc->sc_board_info.board_type == BHND_BOARD_BU4306)
6233
		return;
6234

6235
	if (phy->recalc_txpwr != NULL) {
6236
		result = phy->recalc_txpwr(mac,
6237
		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6238
		if (result == BWN_TXPWR_RES_DONE)
6239
			return;
6240
		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6241
		    ("%s: fail", __func__));
6242
		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6243

6244
		ieee80211_runtask(ic, &mac->mac_txpower);
6245
	}
6246
}
6247

6248
static uint16_t
6249
bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6250
{
6251

6252
	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6253
}
6254

6255
static uint32_t
6256
bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6257
{
6258

6259
	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6260
}
6261

6262
static void
6263
bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6264
{
6265

6266
	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6267
}
6268

6269
static void
6270
bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6271
{
6272

6273
	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6274
}
6275

6276
static int
6277
bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6278
{
6279

6280
	switch (rate) {
6281
	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6282
	case 12:
6283
		return (BWN_OFDM_RATE_6MB);
6284
	case 18:
6285
		return (BWN_OFDM_RATE_9MB);
6286
	case 24:
6287
		return (BWN_OFDM_RATE_12MB);
6288
	case 36:
6289
		return (BWN_OFDM_RATE_18MB);
6290
	case 48:
6291
		return (BWN_OFDM_RATE_24MB);
6292
	case 72:
6293
		return (BWN_OFDM_RATE_36MB);
6294
	case 96:
6295
		return (BWN_OFDM_RATE_48MB);
6296
	case 108:
6297
		return (BWN_OFDM_RATE_54MB);
6298
	/* CCK rates (NB: not IEEE std, device-specific) */
6299
	case 2:
6300
		return (BWN_CCK_RATE_1MB);
6301
	case 4:
6302
		return (BWN_CCK_RATE_2MB);
6303
	case 11:
6304
		return (BWN_CCK_RATE_5MB);
6305
	case 22:
6306
		return (BWN_CCK_RATE_11MB);
6307
	}
6308

6309
	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6310
	return (BWN_CCK_RATE_1MB);
6311
}
6312

6313
static uint16_t
6314
bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6315
{
6316
	struct bwn_phy *phy = &mac->mac_phy;
6317
	uint16_t control = 0;
6318
	uint16_t bw;
6319

6320
	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6321
	bw = BWN_TXH_PHY1_BW_20;
6322

6323
	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6324
		control = bw;
6325
	} else {
6326
		control = bw;
6327
		/* Figure out coding rate and modulation */
6328
		/* XXX TODO: table-ize, for MCS transmit */
6329
		/* Note: this is BWN_*_RATE values */
6330
		switch (bitrate) {
6331
		case BWN_CCK_RATE_1MB:
6332
			control |= 0;
6333
			break;
6334
		case BWN_CCK_RATE_2MB:
6335
			control |= 1;
6336
			break;
6337
		case BWN_CCK_RATE_5MB:
6338
			control |= 2;
6339
			break;
6340
		case BWN_CCK_RATE_11MB:
6341
			control |= 3;
6342
			break;
6343
		case BWN_OFDM_RATE_6MB:
6344
			control |= BWN_TXH_PHY1_CRATE_1_2;
6345
			control |= BWN_TXH_PHY1_MODUL_BPSK;
6346
			break;
6347
		case BWN_OFDM_RATE_9MB:
6348
			control |= BWN_TXH_PHY1_CRATE_3_4;
6349
			control |= BWN_TXH_PHY1_MODUL_BPSK;
6350
			break;
6351
		case BWN_OFDM_RATE_12MB:
6352
			control |= BWN_TXH_PHY1_CRATE_1_2;
6353
			control |= BWN_TXH_PHY1_MODUL_QPSK;
6354
			break;
6355
		case BWN_OFDM_RATE_18MB:
6356
			control |= BWN_TXH_PHY1_CRATE_3_4;
6357
			control |= BWN_TXH_PHY1_MODUL_QPSK;
6358
			break;
6359
		case BWN_OFDM_RATE_24MB:
6360
			control |= BWN_TXH_PHY1_CRATE_1_2;
6361
			control |= BWN_TXH_PHY1_MODUL_QAM16;
6362
			break;
6363
		case BWN_OFDM_RATE_36MB:
6364
			control |= BWN_TXH_PHY1_CRATE_3_4;
6365
			control |= BWN_TXH_PHY1_MODUL_QAM16;
6366
			break;
6367
		case BWN_OFDM_RATE_48MB:
6368
			control |= BWN_TXH_PHY1_CRATE_1_2;
6369
			control |= BWN_TXH_PHY1_MODUL_QAM64;
6370
			break;
6371
		case BWN_OFDM_RATE_54MB:
6372
			control |= BWN_TXH_PHY1_CRATE_3_4;
6373
			control |= BWN_TXH_PHY1_MODUL_QAM64;
6374
			break;
6375
		default:
6376
			break;
6377
		}
6378
		control |= BWN_TXH_PHY1_MODE_SISO;
6379
	}
6380

6381
	return control;
6382
}
6383

6384
static int
6385
bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6386
    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6387
{
6388
	const struct bwn_phy *phy = &mac->mac_phy;
6389
	struct bwn_softc *sc = mac->mac_sc;
6390
	struct ieee80211_frame *wh;
6391
	struct ieee80211_frame *protwh;
6392
	const struct ieee80211_txparam *tp = ni->ni_txparms;
6393
	struct ieee80211vap *vap = ni->ni_vap;
6394
	struct ieee80211com *ic = &sc->sc_ic;
6395
	struct mbuf *mprot;
6396
	uint8_t *prot_ptr;
6397
	unsigned int len;
6398
	uint32_t macctl = 0;
6399
	int rts_rate, rts_rate_fb, ismcast, isshort, type;
6400
	uint16_t phyctl = 0;
6401
	uint8_t rate, rate_fb;
6402
	int fill_phy_ctl1 = 0;
6403

6404
	wh = mtod(m, struct ieee80211_frame *);
6405
	memset(txhdr, 0, sizeof(*txhdr));
6406

6407
	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6408
	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6409
	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6410

6411
	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6412
	    || (phy->type == BWN_PHYTYPE_HT))
6413
		fill_phy_ctl1 = 1;
6414

6415
	/*
6416
	 * Find TX rate
6417
	 */
6418
	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6419
		rate = rate_fb = tp->mgmtrate;
6420
	else if (ismcast)
6421
		rate = rate_fb = tp->mcastrate;
6422
	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6423
		rate = rate_fb = tp->ucastrate;
6424
	else {
6425
		ieee80211_ratectl_rate(ni, NULL, 0);
6426
		rate = ieee80211_node_get_txrate_dot11rate(ni);
6427
		/* TODO: assign rate_fb the previous rate, if available */
6428
		rate_fb = rate;
6429
	}
6430

6431
	sc->sc_tx_rate = rate;
6432

6433
	/* Note: this maps the select ieee80211 rate to hardware rate */
6434
	rate = bwn_ieeerate2hwrate(sc, rate);
6435
	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6436

6437
	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6438
	    bwn_plcp_getcck(rate);
6439
	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6440
	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6441

6442
	/* XXX rate/rate_fb is the hardware rate */
6443
	if ((rate_fb == rate) ||
6444
	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6445
	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6446
		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6447
	else
6448
		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6449
		    m->m_pkthdr.len, rate, isshort);
6450

6451
	/* XXX TX encryption */
6452

6453
	switch (mac->mac_fw.fw_hdr_format) {
6454
	case BWN_FW_HDR_351:
6455
		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6456
		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6457
		break;
6458
	case BWN_FW_HDR_410:
6459
		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6460
		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6461
		break;
6462
	case BWN_FW_HDR_598:
6463
		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6464
		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6465
		break;
6466
	}
6467

6468
	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6469
	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6470

6471
	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6472
	    BWN_TX_EFT_FB_CCK;
6473
	txhdr->chan = phy->chan;
6474
	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6475
	    BWN_TX_PHY_ENC_CCK;
6476
	/* XXX preamble? obey net80211 */
6477
	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6478
	     rate == BWN_CCK_RATE_11MB))
6479
		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6480

6481
	if (! phy->gmode)
6482
		macctl |= BWN_TX_MAC_5GHZ;
6483

6484
	/* XXX TX antenna selection */
6485

6486
	switch (bwn_antenna_sanitize(mac, 0)) {
6487
	case 0:
6488
		phyctl |= BWN_TX_PHY_ANT01AUTO;
6489
		break;
6490
	case 1:
6491
		phyctl |= BWN_TX_PHY_ANT0;
6492
		break;
6493
	case 2:
6494
		phyctl |= BWN_TX_PHY_ANT1;
6495
		break;
6496
	case 3:
6497
		phyctl |= BWN_TX_PHY_ANT2;
6498
		break;
6499
	case 4:
6500
		phyctl |= BWN_TX_PHY_ANT3;
6501
		break;
6502
	default:
6503
		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6504
	}
6505

6506
	if (!ismcast)
6507
		macctl |= BWN_TX_MAC_ACK;
6508

6509
	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6510
	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6511
	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6512
		macctl |= BWN_TX_MAC_LONGFRAME;
6513

6514
	if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
6515
	    ic->ic_protmode != IEEE80211_PROT_NONE) {
6516
		/* Note: don't fall back to CCK rates for 5G */
6517
		if (phy->gmode)
6518
			rts_rate = BWN_CCK_RATE_1MB;
6519
		else
6520
			rts_rate = BWN_OFDM_RATE_6MB;
6521
		rts_rate_fb = bwn_get_fbrate(rts_rate);
6522

6523
		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6524
		mprot = ieee80211_alloc_prot(ni, m, rate, ic->ic_protmode);
6525
		if (mprot == NULL) {
6526
			if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
6527
			device_printf(sc->sc_dev,
6528
			    "could not allocate mbuf for protection mode %d\n",
6529
			    ic->ic_protmode);
6530
			return (ENOBUFS);
6531
		}
6532

6533
		switch (mac->mac_fw.fw_hdr_format) {
6534
		case BWN_FW_HDR_351:
6535
			prot_ptr = txhdr->body.r351.rts_frame;
6536
			break;
6537
		case BWN_FW_HDR_410:
6538
			prot_ptr = txhdr->body.r410.rts_frame;
6539
			break;
6540
		case BWN_FW_HDR_598:
6541
			prot_ptr = txhdr->body.r598.rts_frame;
6542
			break;
6543
		}
6544

6545
		bcopy(mtod(mprot, uint8_t *), prot_ptr, mprot->m_pkthdr.len);
6546
		m_freem(mprot);
6547

6548
		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6549
			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6550
			len = sizeof(struct ieee80211_frame_cts);
6551
		} else {
6552
			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6553
			len = sizeof(struct ieee80211_frame_rts);
6554
		}
6555
		len += IEEE80211_CRC_LEN;
6556

6557
		switch (mac->mac_fw.fw_hdr_format) {
6558
		case BWN_FW_HDR_351:
6559
			bwn_plcp_genhdr((struct bwn_plcp4 *)
6560
			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6561
			break;
6562
		case BWN_FW_HDR_410:
6563
			bwn_plcp_genhdr((struct bwn_plcp4 *)
6564
			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6565
			break;
6566
		case BWN_FW_HDR_598:
6567
			bwn_plcp_genhdr((struct bwn_plcp4 *)
6568
			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6569
			break;
6570
		}
6571

6572
		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6573
		    rts_rate_fb);
6574

6575
		switch (mac->mac_fw.fw_hdr_format) {
6576
		case BWN_FW_HDR_351:
6577
			protwh = (struct ieee80211_frame *)
6578
			    &txhdr->body.r351.rts_frame;
6579
			break;
6580
		case BWN_FW_HDR_410:
6581
			protwh = (struct ieee80211_frame *)
6582
			    &txhdr->body.r410.rts_frame;
6583
			break;
6584
		case BWN_FW_HDR_598:
6585
			protwh = (struct ieee80211_frame *)
6586
			    &txhdr->body.r598.rts_frame;
6587
			break;
6588
		}
6589

6590
		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6591

6592
		if (BWN_ISOFDMRATE(rts_rate)) {
6593
			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6594
			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6595
		} else {
6596
			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6597
			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6598
		}
6599
		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6600
		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6601

6602
		if (fill_phy_ctl1) {
6603
			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6604
			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6605
		}
6606
	}
6607

6608
	if (fill_phy_ctl1) {
6609
		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6610
		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6611
	}
6612

6613
	switch (mac->mac_fw.fw_hdr_format) {
6614
	case BWN_FW_HDR_351:
6615
		txhdr->body.r351.cookie = htole16(cookie);
6616
		break;
6617
	case BWN_FW_HDR_410:
6618
		txhdr->body.r410.cookie = htole16(cookie);
6619
		break;
6620
	case BWN_FW_HDR_598:
6621
		txhdr->body.r598.cookie = htole16(cookie);
6622
		break;
6623
	}
6624

6625
	txhdr->macctl = htole32(macctl);
6626
	txhdr->phyctl = htole16(phyctl);
6627

6628
	/*
6629
	 * TX radio tap
6630
	 */
6631
	if (ieee80211_radiotap_active_vap(vap)) {
6632
		sc->sc_tx_th.wt_flags = 0;
6633
		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6634
			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6635
		if (isshort &&
6636
		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6637
		     rate == BWN_CCK_RATE_11MB))
6638
			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6639
		sc->sc_tx_th.wt_rate = rate;
6640

6641
		ieee80211_radiotap_tx(vap, m);
6642
	}
6643

6644
	return (0);
6645
}
6646

6647
static void
6648
bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6649
    const uint8_t rate)
6650
{
6651
	uint32_t d, plen;
6652
	uint8_t *raw = plcp->o.raw;
6653

6654
	if (BWN_ISOFDMRATE(rate)) {
6655
		d = bwn_plcp_getofdm(rate);
6656
		KASSERT(!(octets & 0xf000),
6657
		    ("%s:%d: fail", __func__, __LINE__));
6658
		d |= (octets << 5);
6659
		plcp->o.data = htole32(d);
6660
	} else {
6661
		plen = octets * 16 / rate;
6662
		if ((octets * 16 % rate) > 0) {
6663
			plen++;
6664
			if ((rate == BWN_CCK_RATE_11MB)
6665
			    && ((octets * 8 % 11) < 4)) {
6666
				raw[1] = 0x84;
6667
			} else
6668
				raw[1] = 0x04;
6669
		} else
6670
			raw[1] = 0x04;
6671
		plcp->o.data |= htole32(plen << 16);
6672
		raw[0] = bwn_plcp_getcck(rate);
6673
	}
6674
}
6675

6676
static uint8_t
6677
bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6678
{
6679
	struct bwn_softc *sc = mac->mac_sc;
6680
	uint8_t mask;
6681

6682
	if (n == 0)
6683
		return (0);
6684
	if (mac->mac_phy.gmode)
6685
		mask = sc->sc_ant2g;
6686
	else
6687
		mask = sc->sc_ant5g;
6688
	if (!(mask & (1 << (n - 1))))
6689
		return (0);
6690
	return (n);
6691
}
6692

6693
/*
6694
 * Return a fallback rate for the given rate.
6695
 *
6696
 * Note: Don't fall back from OFDM to CCK.
6697
 */
6698
static uint8_t
6699
bwn_get_fbrate(uint8_t bitrate)
6700
{
6701
	switch (bitrate) {
6702
	/* CCK */
6703
	case BWN_CCK_RATE_1MB:
6704
		return (BWN_CCK_RATE_1MB);
6705
	case BWN_CCK_RATE_2MB:
6706
		return (BWN_CCK_RATE_1MB);
6707
	case BWN_CCK_RATE_5MB:
6708
		return (BWN_CCK_RATE_2MB);
6709
	case BWN_CCK_RATE_11MB:
6710
		return (BWN_CCK_RATE_5MB);
6711

6712
	/* OFDM */
6713
	case BWN_OFDM_RATE_6MB:
6714
		return (BWN_OFDM_RATE_6MB);
6715
	case BWN_OFDM_RATE_9MB:
6716
		return (BWN_OFDM_RATE_6MB);
6717
	case BWN_OFDM_RATE_12MB:
6718
		return (BWN_OFDM_RATE_9MB);
6719
	case BWN_OFDM_RATE_18MB:
6720
		return (BWN_OFDM_RATE_12MB);
6721
	case BWN_OFDM_RATE_24MB:
6722
		return (BWN_OFDM_RATE_18MB);
6723
	case BWN_OFDM_RATE_36MB:
6724
		return (BWN_OFDM_RATE_24MB);
6725
	case BWN_OFDM_RATE_48MB:
6726
		return (BWN_OFDM_RATE_36MB);
6727
	case BWN_OFDM_RATE_54MB:
6728
		return (BWN_OFDM_RATE_48MB);
6729
	}
6730
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6731
	return (0);
6732
}
6733

6734
static uint32_t
6735
bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6736
    uint32_t ctl, const void *_data, int len)
6737
{
6738
	struct bwn_softc *sc = mac->mac_sc;
6739
	uint32_t value = 0;
6740
	const uint8_t *data = _data;
6741

6742
	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6743
	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6744
	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6745

6746
	bus_write_multi_4(sc->sc_mem_res, tq->tq_base + BWN_PIO8_TXDATA,
6747
	    __DECONST(void *, data), (len & ~3));
6748
	if (len & 3) {
6749
		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6750
		    BWN_PIO8_TXCTL_24_31);
6751
		data = &(data[len - 1]);
6752
		switch (len & 3) {
6753
		case 3:
6754
			ctl |= BWN_PIO8_TXCTL_16_23;
6755
			value |= (uint32_t)(*data) << 16;
6756
			data--;
6757
		case 2:
6758
			ctl |= BWN_PIO8_TXCTL_8_15;
6759
			value |= (uint32_t)(*data) << 8;
6760
			data--;
6761
		case 1:
6762
			value |= (uint32_t)(*data);
6763
		}
6764
		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6765
		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6766
	}
6767

6768
	return (ctl);
6769
}
6770

6771
static void
6772
bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6773
    uint16_t offset, uint32_t value)
6774
{
6775

6776
	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6777
}
6778

6779
static uint16_t
6780
bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6781
    uint16_t ctl, const void *_data, int len)
6782
{
6783
	struct bwn_softc *sc = mac->mac_sc;
6784
	const uint8_t *data = _data;
6785

6786
	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6787
	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6788

6789
	bus_write_multi_2(sc->sc_mem_res, tq->tq_base + BWN_PIO_TXDATA,
6790
	    __DECONST(void *, data), (len & ~1));
6791
	if (len & 1) {
6792
		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6793
		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6794
		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6795
	}
6796

6797
	return (ctl);
6798
}
6799

6800
static uint16_t
6801
bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6802
    uint16_t ctl, struct mbuf *m0)
6803
{
6804
	int i, j = 0;
6805
	uint16_t data = 0;
6806
	const uint8_t *buf;
6807
	struct mbuf *m = m0;
6808

6809
	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6810
	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6811

6812
	for (; m != NULL; m = m->m_next) {
6813
		buf = mtod(m, const uint8_t *);
6814
		for (i = 0; i < m->m_len; i++) {
6815
			if (!((j++) % 2))
6816
				data |= buf[i];
6817
			else {
6818
				data |= (buf[i] << 8);
6819
				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6820
				data = 0;
6821
			}
6822
		}
6823
	}
6824
	if (m0->m_pkthdr.len % 2) {
6825
		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6826
		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6827
		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6828
	}
6829

6830
	return (ctl);
6831
}
6832

6833
static void
6834
bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6835
{
6836

6837
	/* XXX should exit if 5GHz band .. */
6838
	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6839
		return;
6840

6841
	BWN_WRITE_2(mac, 0x684, 510 + time);
6842
	/* Disabled in Linux b43, can adversely effect performance */
6843
#if 0
6844
	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6845
#endif
6846
}
6847

6848
static struct bwn_dma_ring *
6849
bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6850
{
6851

6852
	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6853
		return (mac->mac_method.dma.wme[WME_AC_BE]);
6854

6855
	switch (prio) {
6856
	case 3:
6857
		return (mac->mac_method.dma.wme[WME_AC_VO]);
6858
	case 2:
6859
		return (mac->mac_method.dma.wme[WME_AC_VI]);
6860
	case 0:
6861
		return (mac->mac_method.dma.wme[WME_AC_BE]);
6862
	case 1:
6863
		return (mac->mac_method.dma.wme[WME_AC_BK]);
6864
	}
6865
	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6866
	return (NULL);
6867
}
6868

6869
static int
6870
bwn_dma_getslot(struct bwn_dma_ring *dr)
6871
{
6872
	int slot;
6873

6874
	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6875

6876
	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6877
	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6878
	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6879

6880
	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6881
	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6882
	dr->dr_curslot = slot;
6883
	dr->dr_usedslot++;
6884

6885
	return (slot);
6886
}
6887

6888
static struct bwn_pio_txqueue *
6889
bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6890
    struct bwn_pio_txpkt **pack)
6891
{
6892
	struct bwn_pio *pio = &mac->mac_method.pio;
6893
	struct bwn_pio_txqueue *tq = NULL;
6894
	unsigned int index;
6895

6896
	switch (cookie & 0xf000) {
6897
	case 0x1000:
6898
		tq = &pio->wme[WME_AC_BK];
6899
		break;
6900
	case 0x2000:
6901
		tq = &pio->wme[WME_AC_BE];
6902
		break;
6903
	case 0x3000:
6904
		tq = &pio->wme[WME_AC_VI];
6905
		break;
6906
	case 0x4000:
6907
		tq = &pio->wme[WME_AC_VO];
6908
		break;
6909
	case 0x5000:
6910
		tq = &pio->mcast;
6911
		break;
6912
	}
6913
	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6914
	if (tq == NULL)
6915
		return (NULL);
6916
	index = (cookie & 0x0fff);
6917
	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6918
	if (index >= N(tq->tq_pkts))
6919
		return (NULL);
6920
	*pack = &tq->tq_pkts[index];
6921
	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6922
	return (tq);
6923
}
6924

6925
static void
6926
bwn_txpwr(void *arg, int npending)
6927
{
6928
	struct bwn_mac *mac = arg;
6929
	struct bwn_softc *sc;
6930

6931
	if (mac == NULL)
6932
		return;
6933

6934
	sc = mac->mac_sc;
6935

6936
	BWN_LOCK(sc);
6937
	if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6938
	    mac->mac_phy.set_txpwr != NULL)
6939
		mac->mac_phy.set_txpwr(mac);
6940
	BWN_UNLOCK(sc);
6941
}
6942

6943
static void
6944
bwn_task_15s(struct bwn_mac *mac)
6945
{
6946
	uint16_t reg;
6947

6948
	if (mac->mac_fw.opensource) {
6949
		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6950
		if (reg) {
6951
			bwn_restart(mac, "fw watchdog");
6952
			return;
6953
		}
6954
		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6955
	}
6956
	if (mac->mac_phy.task_15s)
6957
		mac->mac_phy.task_15s(mac);
6958

6959
	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6960
}
6961

6962
static void
6963
bwn_task_30s(struct bwn_mac *mac)
6964
{
6965

6966
	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6967
		return;
6968
	mac->mac_noise.noi_running = 1;
6969
	mac->mac_noise.noi_nsamples = 0;
6970

6971
	bwn_noise_gensample(mac);
6972
}
6973

6974
static void
6975
bwn_task_60s(struct bwn_mac *mac)
6976
{
6977

6978
	if (mac->mac_phy.task_60s)
6979
		mac->mac_phy.task_60s(mac);
6980
	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6981
}
6982

6983
static void
6984
bwn_tasks(void *arg)
6985
{
6986
	struct bwn_mac *mac = arg;
6987
	struct bwn_softc *sc = mac->mac_sc;
6988

6989
	BWN_ASSERT_LOCKED(sc);
6990
	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6991
		return;
6992

6993
	if (mac->mac_task_state % 4 == 0)
6994
		bwn_task_60s(mac);
6995
	if (mac->mac_task_state % 2 == 0)
6996
		bwn_task_30s(mac);
6997
	bwn_task_15s(mac);
6998

6999
	mac->mac_task_state++;
7000
	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
7001
}
7002

7003
static int
7004
bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
7005
{
7006
	struct bwn_softc *sc = mac->mac_sc;
7007

7008
	KASSERT(a == 0, ("not support APHY\n"));
7009

7010
	switch (plcp->o.raw[0] & 0xf) {
7011
	case 0xb:
7012
		return (BWN_OFDM_RATE_6MB);
7013
	case 0xf:
7014
		return (BWN_OFDM_RATE_9MB);
7015
	case 0xa:
7016
		return (BWN_OFDM_RATE_12MB);
7017
	case 0xe:
7018
		return (BWN_OFDM_RATE_18MB);
7019
	case 0x9:
7020
		return (BWN_OFDM_RATE_24MB);
7021
	case 0xd:
7022
		return (BWN_OFDM_RATE_36MB);
7023
	case 0x8:
7024
		return (BWN_OFDM_RATE_48MB);
7025
	case 0xc:
7026
		return (BWN_OFDM_RATE_54MB);
7027
	}
7028
	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
7029
	    plcp->o.raw[0] & 0xf);
7030
	return (-1);
7031
}
7032

7033
static int
7034
bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
7035
{
7036
	struct bwn_softc *sc = mac->mac_sc;
7037

7038
	switch (plcp->o.raw[0]) {
7039
	case 0x0a:
7040
		return (BWN_CCK_RATE_1MB);
7041
	case 0x14:
7042
		return (BWN_CCK_RATE_2MB);
7043
	case 0x37:
7044
		return (BWN_CCK_RATE_5MB);
7045
	case 0x6e:
7046
		return (BWN_CCK_RATE_11MB);
7047
	}
7048
	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
7049
	return (-1);
7050
}
7051

7052
static void
7053
bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
7054
    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
7055
    int rssi, int noise)
7056
{
7057
	struct bwn_softc *sc = mac->mac_sc;
7058
	const struct ieee80211_frame_min *wh;
7059
	uint64_t tsf;
7060
	uint16_t low_mactime_now;
7061
	uint16_t mt;
7062

7063
	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
7064
		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7065

7066
	wh = mtod(m, const struct ieee80211_frame_min *);
7067
	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
7068
		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
7069

7070
	bwn_tsf_read(mac, &tsf);
7071
	low_mactime_now = tsf;
7072
	tsf = tsf & ~0xffffULL;
7073

7074
	switch (mac->mac_fw.fw_hdr_format) {
7075
	case BWN_FW_HDR_351:
7076
	case BWN_FW_HDR_410:
7077
		mt = le16toh(rxhdr->ps4.r351.mac_time);
7078
		break;
7079
	case BWN_FW_HDR_598:
7080
		mt = le16toh(rxhdr->ps4.r598.mac_time);
7081
		break;
7082
	}
7083

7084
	tsf += mt;
7085
	if (low_mactime_now < mt)
7086
		tsf -= 0x10000;
7087

7088
	sc->sc_rx_th.wr_tsf = tsf;
7089
	sc->sc_rx_th.wr_rate = rate;
7090
	sc->sc_rx_th.wr_antsignal = rssi;
7091
	sc->sc_rx_th.wr_antnoise = noise;
7092
}
7093

7094
static void
7095
bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
7096
{
7097
	uint32_t low, high;
7098

7099
	KASSERT(bhnd_get_hwrev(mac->mac_sc->sc_dev) >= 3,
7100
	    ("%s:%d: fail", __func__, __LINE__));
7101

7102
	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
7103
	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
7104
	*tsf = high;
7105
	*tsf <<= 32;
7106
	*tsf |= low;
7107
}
7108

7109
static int
7110
bwn_dma_attach(struct bwn_mac *mac)
7111
{
7112
	struct bwn_dma			*dma;
7113
	struct bwn_softc		*sc;
7114
	struct bhnd_dma_translation	*dt, dma_translation;
7115
	bhnd_addr_t			 addrext_req;
7116
	bus_dma_tag_t			 dmat;
7117
	bus_addr_t			 lowaddr;
7118
	u_int				 addrext_shift, addr_width;
7119
	int				 error;
7120

7121
	dma = &mac->mac_method.dma;
7122
	sc = mac->mac_sc;
7123
	dt = NULL;
7124

7125
	if (sc->sc_quirks & BWN_QUIRK_NODMA)
7126
		return (0);
7127

7128
	KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5, ("%s: fail", __func__));
7129

7130
	/* Use the DMA engine's maximum host address width to determine the
7131
	 * addrext constraints, and supported device address width. */
7132
	switch (mac->mac_dmatype) {
7133
	case BHND_DMA_ADDR_30BIT:
7134
		/* 32-bit engine without addrext support */
7135
		addrext_req = 0x0;
7136
		addrext_shift = 0;
7137

7138
		/* We can address the full 32-bit device address space */
7139
		addr_width = BHND_DMA_ADDR_32BIT;
7140
		break;
7141

7142
	case BHND_DMA_ADDR_32BIT:
7143
		/* 32-bit engine with addrext support */
7144
		addrext_req = BWN_DMA32_ADDREXT_MASK;
7145
		addrext_shift = BWN_DMA32_ADDREXT_SHIFT;
7146
		addr_width = BHND_DMA_ADDR_32BIT;
7147
		break;
7148

7149
	case BHND_DMA_ADDR_64BIT:
7150
		/* 64-bit engine with addrext support */
7151
		addrext_req = BWN_DMA64_ADDREXT_MASK;
7152
		addrext_shift = BWN_DMA64_ADDREXT_SHIFT;
7153
		addr_width = BHND_DMA_ADDR_64BIT;
7154
		break;
7155

7156
	default:
7157
		device_printf(sc->sc_dev, "unsupported DMA address width: %d\n",
7158
		    mac->mac_dmatype);
7159
		return (ENXIO);
7160
	}
7161

7162
	/* Fetch our device->host DMA translation and tag */
7163
	error = bhnd_get_dma_translation(sc->sc_dev, addr_width, 0, &dmat,
7164
	    &dma_translation);
7165
	if (error) {
7166
		device_printf(sc->sc_dev, "error fetching DMA translation: "
7167
		    "%d\n", error);
7168
		return (error);
7169
	}
7170

7171
	/* Verify that our DMA engine's addrext constraints are compatible with
7172
	 * our DMA translation */
7173
	if (addrext_req != 0x0 &&
7174
	    (dma_translation.addrext_mask & addrext_req) != addrext_req)
7175
	{
7176
		device_printf(sc->sc_dev, "bus addrext mask %#jx incompatible "
7177
		    "with device addrext mask %#jx, disabling extended address "
7178
		    "support\n", (uintmax_t)dma_translation.addrext_mask,
7179
		    (uintmax_t)addrext_req);
7180

7181
		addrext_req = 0x0;
7182
		addrext_shift = 0;
7183
	}
7184

7185
	/* Apply our addrext translation constraint */
7186
	dma_translation.addrext_mask = addrext_req;
7187

7188
	/* Initialize our DMA engine configuration */
7189
	mac->mac_flags |= BWN_MAC_FLAG_DMA;
7190

7191
	dma->addrext_shift = addrext_shift;
7192
	dma->translation = dma_translation;
7193

7194
	dt = &dma->translation;
7195

7196
	/* Dermine our translation's maximum supported address */
7197
	lowaddr = MIN((dt->addr_mask | dt->addrext_mask), BUS_SPACE_MAXADDR);
7198

7199
	/*
7200
	 * Create top level DMA tag
7201
	 */
7202
	error = bus_dma_tag_create(dmat,		/* parent */
7203
			       BWN_ALIGN, 0,		/* alignment, bounds */
7204
			       lowaddr,			/* lowaddr */
7205
			       BUS_SPACE_MAXADDR,	/* highaddr */
7206
			       NULL, NULL,		/* filter, filterarg */
7207
			       BUS_SPACE_MAXSIZE,	/* maxsize */
7208
			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
7209
			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
7210
			       0,			/* flags */
7211
			       NULL, NULL,		/* lockfunc, lockarg */
7212
			       &dma->parent_dtag);
7213
	if (error) {
7214
		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
7215
		return (error);
7216
	}
7217

7218
	/*
7219
	 * Create TX/RX mbuf DMA tag
7220
	 */
7221
	error = bus_dma_tag_create(dma->parent_dtag,
7222
				1,
7223
				0,
7224
				BUS_SPACE_MAXADDR,
7225
				BUS_SPACE_MAXADDR,
7226
				NULL, NULL,
7227
				MCLBYTES,
7228
				1,
7229
				BUS_SPACE_MAXSIZE_32BIT,
7230
				0,
7231
				NULL, NULL,
7232
				&dma->rxbuf_dtag);
7233
	if (error) {
7234
		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7235
		goto fail0;
7236
	}
7237
	error = bus_dma_tag_create(dma->parent_dtag,
7238
				1,
7239
				0,
7240
				BUS_SPACE_MAXADDR,
7241
				BUS_SPACE_MAXADDR,
7242
				NULL, NULL,
7243
				MCLBYTES,
7244
				1,
7245
				BUS_SPACE_MAXSIZE_32BIT,
7246
				0,
7247
				NULL, NULL,
7248
				&dma->txbuf_dtag);
7249
	if (error) {
7250
		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7251
		goto fail1;
7252
	}
7253

7254
	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1);
7255
	if (!dma->wme[WME_AC_BK])
7256
		goto fail2;
7257

7258
	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1);
7259
	if (!dma->wme[WME_AC_BE])
7260
		goto fail3;
7261

7262
	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1);
7263
	if (!dma->wme[WME_AC_VI])
7264
		goto fail4;
7265

7266
	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1);
7267
	if (!dma->wme[WME_AC_VO])
7268
		goto fail5;
7269

7270
	dma->mcast = bwn_dma_ringsetup(mac, 4, 1);
7271
	if (!dma->mcast)
7272
		goto fail6;
7273
	dma->rx = bwn_dma_ringsetup(mac, 0, 0);
7274
	if (!dma->rx)
7275
		goto fail7;
7276

7277
	return (error);
7278

7279
fail7:	bwn_dma_ringfree(&dma->mcast);
7280
fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7281
fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7282
fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7283
fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7284
fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7285
fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7286
fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7287
	return (error);
7288
}
7289

7290
static struct bwn_dma_ring *
7291
bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7292
    uint16_t cookie, int *slot)
7293
{
7294
	struct bwn_dma *dma = &mac->mac_method.dma;
7295
	struct bwn_dma_ring *dr;
7296
	struct bwn_softc *sc = mac->mac_sc;
7297

7298
	BWN_ASSERT_LOCKED(mac->mac_sc);
7299

7300
	switch (cookie & 0xf000) {
7301
	case 0x1000:
7302
		dr = dma->wme[WME_AC_BK];
7303
		break;
7304
	case 0x2000:
7305
		dr = dma->wme[WME_AC_BE];
7306
		break;
7307
	case 0x3000:
7308
		dr = dma->wme[WME_AC_VI];
7309
		break;
7310
	case 0x4000:
7311
		dr = dma->wme[WME_AC_VO];
7312
		break;
7313
	case 0x5000:
7314
		dr = dma->mcast;
7315
		break;
7316
	default:
7317
		dr = NULL;
7318
		KASSERT(0 == 1,
7319
		    ("invalid cookie value %d", cookie & 0xf000));
7320
	}
7321
	*slot = (cookie & 0x0fff);
7322
	if (*slot < 0 || *slot >= dr->dr_numslots) {
7323
		/*
7324
		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7325
		 * that it occurs events which have same H/W sequence numbers.
7326
		 * When it's occurred just prints a WARNING msgs and ignores.
7327
		 */
7328
		KASSERT(status->seq == dma->lastseq,
7329
		    ("%s:%d: fail", __func__, __LINE__));
7330
		device_printf(sc->sc_dev,
7331
		    "out of slot ranges (0 < %d < %d)\n", *slot,
7332
		    dr->dr_numslots);
7333
		return (NULL);
7334
	}
7335
	dma->lastseq = status->seq;
7336
	return (dr);
7337
}
7338

7339
static void
7340
bwn_dma_stop(struct bwn_mac *mac)
7341
{
7342
	struct bwn_dma *dma;
7343

7344
	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7345
		return;
7346
	dma = &mac->mac_method.dma;
7347

7348
	bwn_dma_ringstop(&dma->rx);
7349
	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7350
	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7351
	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7352
	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7353
	bwn_dma_ringstop(&dma->mcast);
7354
}
7355

7356
static void
7357
bwn_dma_ringstop(struct bwn_dma_ring **dr)
7358
{
7359

7360
	if (dr == NULL)
7361
		return;
7362

7363
	bwn_dma_cleanup(*dr);
7364
}
7365

7366
static void
7367
bwn_pio_stop(struct bwn_mac *mac)
7368
{
7369
	struct bwn_pio *pio;
7370

7371
	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7372
		return;
7373
	pio = &mac->mac_method.pio;
7374

7375
	bwn_destroy_queue_tx(&pio->mcast);
7376
	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7377
	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7378
	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7379
	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7380
}
7381

7382
static int
7383
bwn_led_attach(struct bwn_mac *mac)
7384
{
7385
	struct bwn_softc *sc = mac->mac_sc;
7386
	const uint8_t *led_act = NULL;
7387
	int error;
7388
	int i;
7389

7390
	sc->sc_led_idle = (2350 * hz) / 1000;
7391
	sc->sc_led_blink = 1;
7392

7393
	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7394
		if (sc->sc_board_info.board_vendor ==
7395
		    bwn_vendor_led_act[i].vid) {
7396
			led_act = bwn_vendor_led_act[i].led_act;
7397
			break;
7398
		}
7399
	}
7400
	if (led_act == NULL)
7401
		led_act = bwn_default_led_act;
7402

7403
	_Static_assert(nitems(bwn_led_vars) == BWN_LED_MAX,
7404
	    "invalid NVRAM variable name array");
7405

7406
	for (i = 0; i < BWN_LED_MAX; ++i) {
7407
		struct bwn_led	*led;
7408
		uint8_t		 val;
7409

7410
		led = &sc->sc_leds[i];
7411

7412
		KASSERT(i < nitems(bwn_led_vars), ("unknown LED index"));
7413
		error = bhnd_nvram_getvar_uint8(sc->sc_dev, bwn_led_vars[i],
7414
		    &val);
7415
		if (error) {
7416
			if (error != ENOENT) {
7417
				device_printf(sc->sc_dev, "NVRAM variable %s "
7418
				    "unreadable: %d", bwn_led_vars[i], error);
7419
				return (error);
7420
			}
7421

7422
			/* Not found; use default */
7423
			led->led_act = led_act[i];
7424
		} else {
7425
			if (val & BWN_LED_ACT_LOW)
7426
				led->led_flags |= BWN_LED_F_ACTLOW;
7427
			led->led_act = val & BWN_LED_ACT_MASK;
7428
		}
7429
		led->led_mask = (1 << i);
7430

7431
		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7432
		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7433
		    led->led_act == BWN_LED_ACT_BLINK) {
7434
			led->led_flags |= BWN_LED_F_BLINK;
7435
			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7436
				led->led_flags |= BWN_LED_F_POLLABLE;
7437
			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7438
				led->led_flags |= BWN_LED_F_SLOW;
7439

7440
			if (sc->sc_blink_led == NULL) {
7441
				sc->sc_blink_led = led;
7442
				if (led->led_flags & BWN_LED_F_SLOW)
7443
					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7444
			}
7445
		}
7446

7447
		DPRINTF(sc, BWN_DEBUG_LED,
7448
		    "%dth led, act %d, lowact %d\n", i,
7449
		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7450
	}
7451
	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7452

7453
	return (0);
7454
}
7455

7456
static __inline uint16_t
7457
bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7458
{
7459

7460
	if (led->led_flags & BWN_LED_F_ACTLOW)
7461
		on = !on;
7462
	if (on)
7463
		val |= led->led_mask;
7464
	else
7465
		val &= ~led->led_mask;
7466
	return val;
7467
}
7468

7469
static void
7470
bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7471
{
7472
	struct bwn_softc *sc = mac->mac_sc;
7473
	struct ieee80211com *ic = &sc->sc_ic;
7474
	uint16_t val;
7475
	int i;
7476

7477
	if (nstate == IEEE80211_S_INIT) {
7478
		callout_stop(&sc->sc_led_blink_ch);
7479
		sc->sc_led_blinking = 0;
7480
	}
7481

7482
	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7483
		return;
7484

7485
	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7486
	for (i = 0; i < BWN_LED_MAX; ++i) {
7487
		struct bwn_led *led = &sc->sc_leds[i];
7488
		int on;
7489

7490
		if (led->led_act == BWN_LED_ACT_UNKN ||
7491
		    led->led_act == BWN_LED_ACT_NULL)
7492
			continue;
7493

7494
		if ((led->led_flags & BWN_LED_F_BLINK) &&
7495
		    nstate != IEEE80211_S_INIT)
7496
			continue;
7497

7498
		switch (led->led_act) {
7499
		case BWN_LED_ACT_ON:    /* Always on */
7500
			on = 1;
7501
			break;
7502
		case BWN_LED_ACT_OFF:   /* Always off */
7503
		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7504
			on = 0;
7505
			break;
7506
		default:
7507
			on = 1;
7508
			switch (nstate) {
7509
			case IEEE80211_S_INIT:
7510
				on = 0;
7511
				break;
7512
			case IEEE80211_S_RUN:
7513
				if (led->led_act == BWN_LED_ACT_11G &&
7514
				    ic->ic_curmode != IEEE80211_MODE_11G)
7515
					on = 0;
7516
				break;
7517
			default:
7518
				if (led->led_act == BWN_LED_ACT_ASSOC)
7519
					on = 0;
7520
				break;
7521
			}
7522
			break;
7523
		}
7524

7525
		val = bwn_led_onoff(led, val, on);
7526
	}
7527
	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7528
}
7529

7530
static void
7531
bwn_led_event(struct bwn_mac *mac, int event)
7532
{
7533
	struct bwn_softc *sc = mac->mac_sc;
7534
	struct bwn_led *led = sc->sc_blink_led;
7535
	int rate;
7536

7537
	if (event == BWN_LED_EVENT_POLL) {
7538
		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7539
			return;
7540
		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7541
			return;
7542
	}
7543

7544
	sc->sc_led_ticks = ticks;
7545
	if (sc->sc_led_blinking)
7546
		return;
7547

7548
	switch (event) {
7549
	case BWN_LED_EVENT_RX:
7550
		rate = sc->sc_rx_rate;
7551
		break;
7552
	case BWN_LED_EVENT_TX:
7553
		rate = sc->sc_tx_rate;
7554
		break;
7555
	case BWN_LED_EVENT_POLL:
7556
		rate = 0;
7557
		break;
7558
	default:
7559
		panic("unknown LED event %d\n", event);
7560
		break;
7561
	}
7562
	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7563
	    bwn_led_duration[rate].off_dur);
7564
}
7565

7566
static void
7567
bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7568
{
7569
	struct bwn_softc *sc = mac->mac_sc;
7570
	struct bwn_led *led = sc->sc_blink_led;
7571
	uint16_t val;
7572

7573
	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7574
	val = bwn_led_onoff(led, val, 1);
7575
	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7576

7577
	if (led->led_flags & BWN_LED_F_SLOW) {
7578
		BWN_LED_SLOWDOWN(on_dur);
7579
		BWN_LED_SLOWDOWN(off_dur);
7580
	}
7581

7582
	sc->sc_led_blinking = 1;
7583
	sc->sc_led_blink_offdur = off_dur;
7584

7585
	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7586
}
7587

7588
static void
7589
bwn_led_blink_next(void *arg)
7590
{
7591
	struct bwn_mac *mac = arg;
7592
	struct bwn_softc *sc = mac->mac_sc;
7593
	uint16_t val;
7594

7595
	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7596
	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7597
	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7598

7599
	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7600
	    bwn_led_blink_end, mac);
7601
}
7602

7603
static void
7604
bwn_led_blink_end(void *arg)
7605
{
7606
	struct bwn_mac *mac = arg;
7607
	struct bwn_softc *sc = mac->mac_sc;
7608

7609
	sc->sc_led_blinking = 0;
7610
}
7611

7612
static int
7613
bwn_suspend(device_t dev)
7614
{
7615
	struct bwn_softc *sc = device_get_softc(dev);
7616

7617
	BWN_LOCK(sc);
7618
	bwn_stop(sc);
7619
	BWN_UNLOCK(sc);
7620
	return (0);
7621
}
7622

7623
static int
7624
bwn_resume(device_t dev)
7625
{
7626
	struct bwn_softc *sc = device_get_softc(dev);
7627
	int error = EDOOFUS;
7628

7629
	BWN_LOCK(sc);
7630
	if (sc->sc_ic.ic_nrunning > 0)
7631
		error = bwn_init(sc);
7632
	BWN_UNLOCK(sc);
7633
	if (error == 0)
7634
		ieee80211_start_all(&sc->sc_ic);
7635
	return (0);
7636
}
7637

7638
static void
7639
bwn_rfswitch(void *arg)
7640
{
7641
	struct bwn_softc *sc = arg;
7642
	struct bwn_mac *mac = sc->sc_curmac;
7643
	int cur = 0, prev = 0;
7644

7645
	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7646
	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7647

7648
	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7649
	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7650
		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7651
			& BWN_RF_HWENABLED_HI_MASK))
7652
			cur = 1;
7653
	} else {
7654
		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7655
		    & BWN_RF_HWENABLED_LO_MASK)
7656
			cur = 1;
7657
	}
7658

7659
	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7660
		prev = 1;
7661

7662
	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7663
	    __func__, cur, prev);
7664

7665
	if (cur != prev) {
7666
		if (cur)
7667
			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7668
		else
7669
			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7670

7671
		device_printf(sc->sc_dev,
7672
		    "status of RF switch is changed to %s\n",
7673
		    cur ? "ON" : "OFF");
7674
		if (cur != mac->mac_phy.rf_on) {
7675
			if (cur)
7676
				bwn_rf_turnon(mac);
7677
			else
7678
				bwn_rf_turnoff(mac);
7679
		}
7680
	}
7681

7682
	callout_schedule(&sc->sc_rfswitch_ch, hz);
7683
}
7684

7685
static void
7686
bwn_sysctl_node(struct bwn_softc *sc)
7687
{
7688
	device_t dev = sc->sc_dev;
7689
	struct bwn_mac *mac;
7690
	struct bwn_stats *stats;
7691

7692
	/* XXX assume that count of MAC is only 1. */
7693

7694
	if ((mac = sc->sc_curmac) == NULL)
7695
		return;
7696
	stats = &mac->mac_stats;
7697

7698
	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7699
	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7700
	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7701
	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7702
	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7703
	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7704
	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7705
	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7706
	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7707

7708
#ifdef BWN_DEBUG
7709
	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7710
	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7711
	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7712
#endif
7713
}
7714

7715
static device_method_t bwn_methods[] = {
7716
	/* Device interface */
7717
	DEVMETHOD(device_probe,		bwn_probe),
7718
	DEVMETHOD(device_attach,	bwn_attach),
7719
	DEVMETHOD(device_detach,	bwn_detach),
7720
	DEVMETHOD(device_suspend,	bwn_suspend),
7721
	DEVMETHOD(device_resume,	bwn_resume),
7722
	DEVMETHOD_END
7723
};
7724

7725
static driver_t bwn_driver = {
7726
	"bwn",
7727
	bwn_methods,
7728
	sizeof(struct bwn_softc)
7729
};
7730

7731
DRIVER_MODULE(bwn, bhnd, bwn_driver, 0, 0);
7732
MODULE_DEPEND(bwn, bhnd, 1, 1, 1);
7733
MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
7734
MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7735
MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7736
MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7737
MODULE_VERSION(bwn, 1);
7738

7739
Product

Resources

Company
