xref: /freebsd/sys/dev/mwl/mwlhal.c (revision 95ee2897e98f5d444f26ed2334cc7c439f9c16c6)

/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting
 * Copyright (c) 2007-2009 Marvell Semiconductor, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer,
 *    without modification.
 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
 *    redistribution must be conditioned upon including a substantially
 *    similar Disclaimer requirement for further binary redistribution.
 *
 * NO WARRANTY
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGES.
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/sysctl.h>
#include <sys/malloc.h>
#include <sys/lock.h>
#include <sys/mutex.h>
#include <sys/kernel.h>
#include <sys/errno.h>
#include <sys/bus.h>
#include <sys/endian.h>

#include <sys/linker.h>
#include <sys/firmware.h>

#include <machine/bus.h>

#include <dev/mwl/mwlhal.h>
#include <dev/mwl/mwlreg.h>

#include <sys/socket.h>
#include <sys/sockio.h>
#include <net/if.h>
#include <dev/mwl/mwldiag.h>

#define	MWLHAL_DEBUG			/* debug msgs */

typedef enum {
    WL_ANTENNAMODE_RX = 0xffff,
    WL_ANTENNAMODE_TX = 2,
} wlantennamode_e;

typedef enum {
    WL_TX_POWERLEVEL_LOW = 5,
    WL_TX_POWERLEVEL_MEDIUM = 10,
    WL_TX_POWERLEVEL_HIGH = 15,
} wltxpowerlevel_e;

#define	MWL_CMDBUF_SIZE	0x4000		/* size of f/w command buffer */
#define	MWL_BASTREAMS_MAX	7	/* max BA streams (NB: fw >3.3.5.9) */
#define	MWL_BAQID_MAX		8	/* max BA Q id's (NB: fw >3.3.5.9) */
#define	MWL_MBSS_AP_MAX		8	/* max ap vap's */
#define	MWL_MBSS_STA_MAX	24	/* max station/client vap's */
#define	MWL_MBSS_MAX	(MWL_MBSS_AP_MAX+MWL_MBSS_STA_MAX)

/*
 * BA stream -> queue ID mapping
 *
 * The first 2 streams map to h/w; the remaining streams are
 * implemented in firmware.
 */
static const int ba2qid[MWL_BASTREAMS_MAX] = {
	5, 6				/* h/w supported */
#if MWL_BASTREAMS_MAX == 7
	, 7, 0, 1, 2, 3 		/* f/w supported */
#endif
};
static int qid2ba[MWL_BAQID_MAX];

#define	IEEE80211_ADDR_LEN	6	/* XXX */
#define	IEEE80211_ADDR_COPY(_dst, _src) \
	memcpy(_dst, _src, IEEE80211_ADDR_LEN)
#define	IEEE80211_ADDR_EQ(_dst, _src) \
	(memcmp(_dst, _src, IEEE80211_ADDR_LEN) == 0)

#define	_CMD_SETUP(pCmd, type, cmd) do {				\
	pCmd = (type *)&mh->mh_cmdbuf[0];				\
	memset(pCmd, 0, sizeof(type));					\
	pCmd->CmdHdr.Cmd = htole16(cmd);				\
	pCmd->CmdHdr.Length = htole16(sizeof(type));			\
} while (0)

#define	_VCMD_SETUP(vap, pCmd, type, cmd) do {				\
	_CMD_SETUP(pCmd, type, cmd);					\
	pCmd->CmdHdr.MacId = vap->macid;				\
} while (0)

#define	PWTAGETRATETABLE20M	14*4
#define	PWTAGETRATETABLE40M	9*4
#define	PWTAGETRATETABLE20M_5G	35*4
#define	PWTAGETRATETABLE40M_5G	16*4

struct mwl_hal_bastream {
	MWL_HAL_BASTREAM public;	/* public state */
	uint8_t	stream;			/* stream # */
	uint8_t	setup;			/* f/w cmd sent */
	uint8_t ba_policy;		/* direct/delayed BA policy */
	uint8_t	tid;
	uint8_t	paraminfo;
	uint8_t macaddr[IEEE80211_ADDR_LEN];
};

struct mwl_hal_priv;

struct mwl_hal_vap {
	struct mwl_hal_priv *mh;	/* back pointer */
	uint16_t bss_type;		/* f/w type */
	uint8_t vap_type;		/* MWL_HAL_BSSTYPE */
	uint8_t	macid;			/* for passing to f/w */
	uint8_t flags;
#define	MVF_RUNNING	0x01		/* BSS_START issued */
#define	MVF_STATION	0x02		/* sta db entry created */
	uint8_t mac[IEEE80211_ADDR_LEN];/* mac address */
};
#define	MWLVAP(_vap)	((_vap)->mh)

/*
 * Per-device state.  We allocate a single cmd buffer for
 * submitting operations to the firmware.  Access to this
 * buffer (and the f/w) are single-threaded.  At present
 * we spin waiting for cmds to complete which is bad.  Not
 * sure if it's possible to submit multiple requests or
 * control when we get cmd done interrupts.  There's no
 * documentation and no example code to indicate what can
 * or cannot be done so all we can do right now is follow the
 * linux driver logic.  This falls apart when the f/w fails;
 * the system comes to a crawl as we spin waiting for operations
 * to finish.
 */
struct mwl_hal_priv {
	struct mwl_hal	public;		/* public area */
	device_t	mh_dev;
	char		mh_mtxname[12];
	struct mtx	mh_mtx;
	bus_dma_tag_t	mh_dmat;	/* bus DMA tag for cmd buffer */
	bus_dma_segment_t mh_seg;	/* segment for cmd buffer */
	bus_dmamap_t	mh_dmamap;	/* DMA map for cmd buffer */
	uint16_t	*mh_cmdbuf;	/* f/w cmd buffer */
	bus_addr_t	mh_cmdaddr;	/* physaddr of cmd buffer */
	int		mh_flags;
#define	MHF_CALDATA	0x0001		/* cal data retrieved */
#define	MHF_FWHANG	0x0002		/* fw appears hung */
#define	MHF_MBSS	0x0004		/* mbss enabled */
	struct mwl_hal_vap mh_vaps[MWL_MBSS_MAX+1];
	int		mh_bastreams;	/* bit mask of available BA streams */
	int		mh_regioncode;	/* XXX last region code sent to fw */
	struct mwl_hal_bastream mh_streams[MWL_BASTREAMS_MAX];
	int		mh_debug;
	MWL_HAL_CHANNELINFO mh_20M;
	MWL_HAL_CHANNELINFO mh_40M;
	MWL_HAL_CHANNELINFO mh_20M_5G;
	MWL_HAL_CHANNELINFO mh_40M_5G;
	int		mh_SDRAMSIZE_Addr;
	uint32_t	mh_RTSSuccesses;/* cumulative stats for read-on-clear */
	uint32_t	mh_RTSFailures;
	uint32_t	mh_RxDuplicateFrames;
	uint32_t	mh_FCSErrorCount;
	MWL_DIAG_REVS	mh_revs;
};
#define	MWLPRIV(_mh)	((struct mwl_hal_priv *)(_mh))

static int mwl_hal_setmac_locked(struct mwl_hal_vap *,
	const uint8_t addr[IEEE80211_ADDR_LEN]);
static int mwlExecuteCmd(struct mwl_hal_priv *, unsigned short cmd);
static int mwlGetPwrCalTable(struct mwl_hal_priv *);
#ifdef MWLHAL_DEBUG
static const char *mwlcmdname(int cmd);
static void dumpresult(struct mwl_hal_priv *, int showresult);
#endif /* MWLHAL_DEBUG */

SYSCTL_DECL(_hw_mwl);
static SYSCTL_NODE(_hw_mwl, OID_AUTO, hal, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
    "Marvell HAL parameters");

static __inline void
MWL_HAL_LOCK(struct mwl_hal_priv *mh)
{
	mtx_lock(&mh->mh_mtx);
}

static __inline void
MWL_HAL_LOCK_ASSERT(struct mwl_hal_priv *mh)
{
	mtx_assert(&mh->mh_mtx, MA_OWNED);
}

static __inline void
MWL_HAL_UNLOCK(struct mwl_hal_priv *mh)
{
	mtx_unlock(&mh->mh_mtx);
}

static __inline uint32_t
RD4(struct mwl_hal_priv *mh, bus_size_t off)
{
	return bus_space_read_4(mh->public.mh_iot, mh->public.mh_ioh, off);
}

static __inline void
WR4(struct mwl_hal_priv *mh, bus_size_t off, uint32_t val)
{
	bus_space_write_4(mh->public.mh_iot, mh->public.mh_ioh, off, val);
}

static void
mwl_hal_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
{
	bus_addr_t *paddr = (bus_addr_t*) arg;
	KASSERT(error == 0, ("error %u on bus_dma callback", error));
	*paddr = segs->ds_addr;
}

/*
 * Setup for communication with the device.  We allocate
 * a command buffer and map it for bus dma use.  The pci
 * device id is used to identify whether the device has
 * SRAM on it (in which case f/w download must include a
 * memory controller reset).  All bus i/o operations happen
 * in BAR 1; the driver passes in the tag and handle we need.
 */
struct mwl_hal *
mwl_hal_attach(device_t dev, uint16_t devid,
    bus_space_handle_t ioh, bus_space_tag_t iot, bus_dma_tag_t tag)
{
	struct mwl_hal_priv *mh;
	struct mwl_hal_vap *hvap;
	int error, i;

	mh = malloc(sizeof(struct mwl_hal_priv), M_DEVBUF, M_NOWAIT | M_ZERO);
	if (mh == NULL)
		return NULL;
	mh->mh_dev = dev;
	mh->public.mh_ioh = ioh;
	mh->public.mh_iot = iot;
	for (i = 0; i < MWL_BASTREAMS_MAX; i++) {
		mh->mh_streams[i].public.txq = ba2qid[i];
		mh->mh_streams[i].stream = i;
		/* construct back-mapping while we're at it */
		if (mh->mh_streams[i].public.txq < MWL_BAQID_MAX)
			qid2ba[mh->mh_streams[i].public.txq] = i;
		else
			device_printf(dev, "unexpected BA tx qid %d for "
			    "stream %d\n", mh->mh_streams[i].public.txq, i);
	}
	/* setup constant portion of vap state */
	/* XXX should get max ap/client vap's from f/w */
	i = 0;
	hvap = &mh->mh_vaps[i];
	hvap->vap_type = MWL_HAL_AP;
	hvap->bss_type = htole16(WL_MAC_TYPE_PRIMARY_AP);
	hvap->macid = 0;
	for (i++; i < MWL_MBSS_AP_MAX; i++) {
		hvap = &mh->mh_vaps[i];
		hvap->vap_type = MWL_HAL_AP;
		hvap->bss_type = htole16(WL_MAC_TYPE_SECONDARY_AP);
		hvap->macid = i;
	}
	hvap = &mh->mh_vaps[i];
	hvap->vap_type = MWL_HAL_STA;
	hvap->bss_type = htole16(WL_MAC_TYPE_PRIMARY_CLIENT);
	hvap->macid = i;
	for (i++; i < MWL_MBSS_MAX; i++) {
		hvap = &mh->mh_vaps[i];
		hvap->vap_type = MWL_HAL_STA;
		hvap->bss_type = htole16(WL_MAC_TYPE_SECONDARY_CLIENT);
		hvap->macid = i;
	}
	mh->mh_revs.mh_devid = devid;
	snprintf(mh->mh_mtxname, sizeof(mh->mh_mtxname),
	    "%s_hal", device_get_nameunit(dev));
	mtx_init(&mh->mh_mtx, mh->mh_mtxname, NULL, MTX_DEF);

	/*
	 * Allocate the command buffer and map into the address
	 * space of the h/w.  We request "coherent" memory which
	 * will be uncached on some architectures.
	 */
	error = bus_dma_tag_create(tag,		/* parent */
		       PAGE_SIZE, 0,		/* alignment, bounds */
		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
		       BUS_SPACE_MAXADDR,	/* highaddr */
		       NULL, NULL,		/* filter, filterarg */
		       MWL_CMDBUF_SIZE,		/* maxsize */
		       1,			/* nsegments */
		       MWL_CMDBUF_SIZE,		/* maxsegsize */
		       BUS_DMA_ALLOCNOW,	/* flags */
		       NULL,			/* lockfunc */
		       NULL,			/* lockarg */
		       &mh->mh_dmat);
	if (error != 0) {
		device_printf(dev, "unable to allocate memory for cmd tag, "
			"error %u\n", error);
		goto fail0;
	}

	/* allocate descriptors */
	error = bus_dmamem_alloc(mh->mh_dmat, (void**) &mh->mh_cmdbuf,
				 BUS_DMA_NOWAIT | BUS_DMA_COHERENT,
				 &mh->mh_dmamap);
	if (error != 0) {
		device_printf(dev, "unable to allocate memory for cmd buffer, "
			"error %u\n", error);
		goto fail1;
	}

	error = bus_dmamap_load(mh->mh_dmat, mh->mh_dmamap,
				mh->mh_cmdbuf, MWL_CMDBUF_SIZE,
				mwl_hal_load_cb, &mh->mh_cmdaddr,
				BUS_DMA_NOWAIT);
	if (error != 0) {
		device_printf(dev, "unable to load cmd buffer, error %u\n",
			error);
		goto fail2;
	}

	/*
	 * Some cards have SDRAM.  When loading firmware we need
	 * to reset the SDRAM controller prior to doing this.
	 * When the SDRAMSIZE is non-zero we do that work in
	 * mwl_hal_fwload.
	 */
	switch (devid) {
	case 0x2a02:		/* CB82 */
	case 0x2a03:		/* CB85 */
	case 0x2a08:		/* MC85_B1 */
	case 0x2a0b:		/* CB85AP */
	case 0x2a24:
		mh->mh_SDRAMSIZE_Addr = 0x40fe70b7;	/* 8M SDRAM */
		break;
	case 0x2a04:		/* MC85 */
		mh->mh_SDRAMSIZE_Addr = 0x40fc70b7;	/* 16M SDRAM */
		break;
	default:
		break;
	}
	return &mh->public;
fail2:
	bus_dmamem_free(mh->mh_dmat, mh->mh_cmdbuf, mh->mh_dmamap);
fail1:
	bus_dma_tag_destroy(mh->mh_dmat);
fail0:
	mtx_destroy(&mh->mh_mtx);
	free(mh, M_DEVBUF);
	return NULL;
}

void
mwl_hal_detach(struct mwl_hal *mh0)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);

	bus_dmamem_free(mh->mh_dmat, mh->mh_cmdbuf, mh->mh_dmamap);
	bus_dma_tag_destroy(mh->mh_dmat);
	mtx_destroy(&mh->mh_mtx);
	free(mh, M_DEVBUF);
}

/*
 * Reset internal state after a firmware download.
 */
static int
mwlResetHalState(struct mwl_hal_priv *mh)
{
	int i;

	/* XXX get from f/w */
	mh->mh_bastreams = (1<<MWL_BASTREAMS_MAX)-1;
	for (i = 0; i < MWL_MBSS_MAX; i++)
		mh->mh_vaps[i].mh = NULL;
	/*
	 * Clear cumulative stats.
	 */
	mh->mh_RTSSuccesses = 0;
	mh->mh_RTSFailures = 0;
	mh->mh_RxDuplicateFrames = 0;
	mh->mh_FCSErrorCount = 0;
	/*
	 * Fetch cal data for later use.
	 * XXX may want to fetch other stuff too.
	 */
	/* XXX check return */
	if ((mh->mh_flags & MHF_CALDATA) == 0)
		mwlGetPwrCalTable(mh);
	return 0;
}

struct mwl_hal_vap *
mwl_hal_newvap(struct mwl_hal *mh0, MWL_HAL_BSSTYPE type,
	const uint8_t mac[IEEE80211_ADDR_LEN])
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	struct mwl_hal_vap *vap;
	int i;

	MWL_HAL_LOCK(mh);
	/* NB: could optimize but not worth it w/ max 32 bss */
	for (i = 0; i < MWL_MBSS_MAX; i++) {
		vap = &mh->mh_vaps[i];
		if (vap->vap_type == type && vap->mh == NULL) {
			vap->mh = mh;
			mwl_hal_setmac_locked(vap, mac);
			break;
		}
	}
	MWL_HAL_UNLOCK(mh);
	return (i < MWL_MBSS_MAX) ? vap : NULL;
}

void
mwl_hal_delvap(struct mwl_hal_vap *vap)
{
	/* NB: locking not needed for single write */
	vap->mh = NULL;
}

/*
 * Manipulate the debug mask.  Note debug
 * msgs are only provided when this code is
 * compiled with MWLHAL_DEBUG defined.
 */

void
mwl_hal_setdebug(struct mwl_hal *mh, int debug)
{
	MWLPRIV(mh)->mh_debug = debug;
}

int
mwl_hal_getdebug(struct mwl_hal *mh)
{
	return MWLPRIV(mh)->mh_debug;
}

void
mwl_hal_setbastreams(struct mwl_hal *mh, int mask)
{
	MWLPRIV(mh)->mh_bastreams = mask & ((1<<MWL_BASTREAMS_MAX)-1);
}

int
mwl_hal_getbastreams(struct mwl_hal *mh)
{
	return MWLPRIV(mh)->mh_bastreams;
}

int
mwl_hal_ismbsscapable(struct mwl_hal *mh)
{
	return (MWLPRIV(mh)->mh_flags & MHF_MBSS) != 0;
}

#if 0
/* XXX inlined */
/*
 * Return the current ISR setting and clear the cause.
 * XXX maybe make inline
 */
void
mwl_hal_getisr(struct mwl_hal *mh0, uint32_t *status)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	uint32_t cause;

	cause = RD4(mh, MACREG_REG_A2H_INTERRUPT_CAUSE);
	if (cause == 0xffffffff) {	/* card removed */
device_printf(mh->mh_dev, "%s: cause 0x%x\n", __func__, cause);
		cause = 0;
	} else if (cause != 0) {
		/* clear cause bits */
		WR4(mh, MACREG_REG_A2H_INTERRUPT_CAUSE,
		    cause &~ mh->public.mh_imask);
		RD4(mh, MACREG_REG_INT_CODE);	/* XXX flush write? */
	}
	*status = cause;
}
#endif

/*
 * Set the interrupt mask.
 */
void
mwl_hal_intrset(struct mwl_hal *mh0, uint32_t mask)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);

	WR4(mh, MACREG_REG_A2H_INTERRUPT_MASK, 0);
	RD4(mh, MACREG_REG_INT_CODE);

	mh->public.mh_imask = mask;
	WR4(mh, MACREG_REG_A2H_INTERRUPT_MASK, mask);
	RD4(mh, MACREG_REG_INT_CODE);
}

#if 0
/* XXX inlined */
/*
 * Kick the firmware to tell it there are new tx descriptors
 * for processing.  The driver says what h/w q has work in
 * case the f/w ever gets smarter.
 */
void
mwl_hal_txstart(struct mwl_hal *mh0, int qnum)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	uint32_t dummy;

	WR4(mh, MACREG_REG_H2A_INTERRUPT_EVENTS, MACREG_H2ARIC_BIT_PPA_READY);
	dummy = RD4(mh, MACREG_REG_INT_CODE);
}
#endif

/*
 * Callback from the driver on a cmd done interrupt.
 * Nothing to do right now as we spin waiting for
 * cmd completion.
 */
void
mwl_hal_cmddone(struct mwl_hal *mh0)
{
#if 0
	struct mwl_hal_priv *mh = MWLPRIV(mh0);

	if (mh->mh_debug & MWL_HAL_DEBUG_CMDDONE) {
		device_printf(mh->mh_dev, "cmd done interrupt:\n");
		dumpresult(mh, 1);
	}
#endif
}

/*
 * Return "hw specs".  Note this must be the first
 * cmd MUST be done after a firmware download or the
 * f/w will lockup.
 * XXX move into the hal so driver doesn't need to be responsible
 */
int
mwl_hal_gethwspecs(struct mwl_hal *mh0, struct mwl_hal_hwspec *hw)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_GET_HW_SPEC *pCmd;
	int retval, minrev;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_GET_HW_SPEC, HostCmd_CMD_GET_HW_SPEC);
	memset(&pCmd->PermanentAddr[0], 0xff, IEEE80211_ADDR_LEN);
	pCmd->ulFwAwakeCookie = htole32((unsigned int)mh->mh_cmdaddr+2048);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_GET_HW_SPEC);
	if (retval == 0) {
		IEEE80211_ADDR_COPY(hw->macAddr, pCmd->PermanentAddr);
		hw->wcbBase[0] = le32toh(pCmd->WcbBase0) & 0x0000ffff;
		hw->wcbBase[1] = le32toh(pCmd->WcbBase1[0]) & 0x0000ffff;
		hw->wcbBase[2] = le32toh(pCmd->WcbBase1[1]) & 0x0000ffff;
		hw->wcbBase[3] = le32toh(pCmd->WcbBase1[2]) & 0x0000ffff;
		hw->rxDescRead = le32toh(pCmd->RxPdRdPtr)& 0x0000ffff;
		hw->rxDescWrite = le32toh(pCmd->RxPdWrPtr)& 0x0000ffff;
		hw->regionCode = le16toh(pCmd->RegionCode) & 0x00ff;
		hw->fwReleaseNumber = le32toh(pCmd->FWReleaseNumber);
		hw->maxNumWCB = le16toh(pCmd->NumOfWCB);
		hw->maxNumMCAddr = le16toh(pCmd->NumOfMCastAddr);
		hw->numAntennas = le16toh(pCmd->NumberOfAntenna);
		hw->hwVersion = pCmd->Version;
		hw->hostInterface = pCmd->HostIf;

		mh->mh_revs.mh_macRev = hw->hwVersion;		/* XXX */
		mh->mh_revs.mh_phyRev = hw->hostInterface;	/* XXX */

		minrev = ((hw->fwReleaseNumber) >> 16) & 0xff;
		if (minrev >= 4) {
			/* starting with 3.4.x.x s/w BA streams supported */
			mh->mh_bastreams &= (1<<MWL_BASTREAMS_MAX)-1;
		} else
			mh->mh_bastreams &= (1<<2)-1;
	}
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Inform the f/w about location of the tx/rx dma data structures
 * and related state.  This cmd must be done immediately after a
 * mwl_hal_gethwspecs call or the f/w will lockup.
 */
int
mwl_hal_sethwdma(struct mwl_hal *mh0, const struct mwl_hal_txrxdma *dma)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_SET_HW_SPEC *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_SET_HW_SPEC, HostCmd_CMD_SET_HW_SPEC);
	pCmd->WcbBase[0] = htole32(dma->wcbBase[0]);
	pCmd->WcbBase[1] = htole32(dma->wcbBase[1]);
	pCmd->WcbBase[2] = htole32(dma->wcbBase[2]);
	pCmd->WcbBase[3] = htole32(dma->wcbBase[3]);
	pCmd->TxWcbNumPerQueue = htole32(dma->maxNumTxWcb);
	pCmd->NumTxQueues = htole32(dma->maxNumWCB);
	pCmd->TotalRxWcb = htole32(1);		/* XXX */
	pCmd->RxPdWrPtr = htole32(dma->rxDescRead);
	pCmd->Flags = htole32(SET_HW_SPEC_HOSTFORM_BEACON
#ifdef MWL_HOST_PS_SUPPORT
		    | SET_HW_SPEC_HOST_POWERSAVE
#endif
		    | SET_HW_SPEC_HOSTFORM_PROBERESP);
	/* disable multi-bss operation for A1-A4 parts */
	if (mh->mh_revs.mh_macRev < 5)
		pCmd->Flags |= htole32(SET_HW_SPEC_DISABLEMBSS);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_HW_SPEC);
	if (retval == 0) {
		if (pCmd->Flags & htole32(SET_HW_SPEC_DISABLEMBSS))
			mh->mh_flags &= ~MHF_MBSS;
		else
			mh->mh_flags |= MHF_MBSS;
	}
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Retrieve statistics from the f/w.
 * XXX should be in memory shared w/ driver
 */
int
mwl_hal_gethwstats(struct mwl_hal *mh0, struct mwl_hal_hwstats *stats)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_802_11_GET_STAT *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_802_11_GET_STAT,
		HostCmd_CMD_802_11_GET_STAT);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_GET_STAT);
	if (retval == 0) {
		const uint32_t *sp = (const uint32_t *)&pCmd->TxRetrySuccesses;
		uint32_t *dp = (uint32_t *)&stats->TxRetrySuccesses;
		int i;

		for (i = 0; i < sizeof(*stats)/sizeof(uint32_t); i++)
			dp[i] = le32toh(sp[i]);
		/*
		 * Update stats not returned by f/w but available
		 * through public registers.  Note these registers
		 * are "clear on read" so we maintain cumulative data.
		 * XXX register defines
		 */
		mh->mh_RTSSuccesses += RD4(mh, 0xa834);
		mh->mh_RTSFailures += RD4(mh, 0xa830);
		mh->mh_RxDuplicateFrames += RD4(mh, 0xa84c);
		mh->mh_FCSErrorCount += RD4(mh, 0xa840);
	}
	MWL_HAL_UNLOCK(mh);

	stats->RTSSuccesses = mh->mh_RTSSuccesses;
	stats->RTSFailures = mh->mh_RTSFailures;
	stats->RxDuplicateFrames = mh->mh_RxDuplicateFrames;
	stats->FCSErrorCount = mh->mh_FCSErrorCount;
	return retval;
}

/*
 * Set HT guard interval handling.
 * Takes effect immediately.
 */
int
mwl_hal_sethtgi(struct mwl_hal_vap *vap, int GIType)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_HT_GUARD_INTERVAL *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_HT_GUARD_INTERVAL,
		HostCmd_CMD_HT_GUARD_INTERVAL);
	pCmd->Action = htole32(HostCmd_ACT_GEN_SET);

	if (GIType == 0) {
		pCmd->GIType = htole32(GI_TYPE_LONG);
	} else if (GIType == 1) {
		pCmd->GIType = htole32(GI_TYPE_LONG | GI_TYPE_SHORT);
	} else {
		pCmd->GIType = htole32(GI_TYPE_LONG);
	}

	retval = mwlExecuteCmd(mh, HostCmd_CMD_HT_GUARD_INTERVAL);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Configure radio.
 * Takes effect immediately.
 * XXX preamble installed after set fixed rate cmd
 */
int
mwl_hal_setradio(struct mwl_hal *mh0, int onoff, MWL_HAL_PREAMBLE preamble)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_802_11_RADIO_CONTROL *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_802_11_RADIO_CONTROL,
		HostCmd_CMD_802_11_RADIO_CONTROL);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET);
	if (onoff == 0)
		pCmd->Control = 0;
	else
		pCmd->Control = htole16(preamble);
	pCmd->RadioOn = htole16(onoff);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_RADIO_CONTROL);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Configure antenna use.
 * Takes effect immediately.
 * XXX tx antenna setting ignored
 * XXX rx antenna setting should always be 3 (for now)
 */
int
mwl_hal_setantenna(struct mwl_hal *mh0, MWL_HAL_ANTENNA dirSet, int ant)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_802_11_RF_ANTENNA *pCmd;
	int retval;

	if (!(dirSet == WL_ANTENNATYPE_RX || dirSet == WL_ANTENNATYPE_TX))
		return EINVAL;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_802_11_RF_ANTENNA,
		HostCmd_CMD_802_11_RF_ANTENNA);
	pCmd->Action = htole16(dirSet);
	if (ant == 0)			/* default to all/both antennae */
		ant = 3;
	pCmd->AntennaMode = htole16(ant);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_RF_ANTENNA);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Set packet size threshold for implicit use of RTS.
 * Takes effect immediately.
 * XXX packet length > threshold =>'s RTS
 */
int
mwl_hal_setrtsthreshold(struct mwl_hal_vap *vap, int threshold)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_DS_802_11_RTS_THSD *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_DS_802_11_RTS_THSD,
		HostCmd_CMD_802_11_RTS_THSD);
	pCmd->Action  = htole16(HostCmd_ACT_GEN_SET);
	pCmd->Threshold = htole16(threshold);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_RTS_THSD);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Enable sta-mode operation (disables beacon frame xmit).
 */
int
mwl_hal_setinframode(struct mwl_hal_vap *vap)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_INFRA_MODE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_INFRA_MODE,
		HostCmd_CMD_SET_INFRA_MODE);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_INFRA_MODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Configure radar detection in support of 802.11h.
 */
int
mwl_hal_setradardetection(struct mwl_hal *mh0, MWL_HAL_RADAR action)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_802_11h_Detect_Radar *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_802_11h_Detect_Radar,
		HostCmd_CMD_802_11H_DETECT_RADAR);
	pCmd->CmdHdr.Length = htole16(sizeof(HostCmd_802_11h_Detect_Radar));
	pCmd->Action = htole16(action);
	if (mh->mh_regioncode == DOMAIN_CODE_ETSI_131)
		pCmd->RadarTypeCode = htole16(131);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11H_DETECT_RADAR);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Convert public channel flags definition to a
 * value suitable for feeding to the firmware.
 * Note this includes byte swapping.
 */
static uint32_t
cvtChannelFlags(const MWL_HAL_CHANNEL *chan)
{
	uint32_t w;

	/*
	 * NB: f/w only understands FREQ_BAND_5GHZ, supplying the more
	 *     precise band info causes it to lockup (sometimes).
	 */
	w = (chan->channelFlags.FreqBand == MWL_FREQ_BAND_2DOT4GHZ) ?
		FREQ_BAND_2DOT4GHZ : FREQ_BAND_5GHZ;
	switch (chan->channelFlags.ChnlWidth) {
	case MWL_CH_10_MHz_WIDTH:
		w |= CH_10_MHz_WIDTH;
		break;
	case MWL_CH_20_MHz_WIDTH:
		w |= CH_20_MHz_WIDTH;
		break;
	case MWL_CH_40_MHz_WIDTH:
	default:
		w |= CH_40_MHz_WIDTH;
		break;
	}
	switch (chan->channelFlags.ExtChnlOffset) {
	case MWL_EXT_CH_NONE:
		w |= EXT_CH_NONE;
		break;
	case MWL_EXT_CH_ABOVE_CTRL_CH:
		w |= EXT_CH_ABOVE_CTRL_CH;
		break;
	case MWL_EXT_CH_BELOW_CTRL_CH:
		w |= EXT_CH_BELOW_CTRL_CH;
		break;
	}
	return htole32(w);
}

/*
 * Start a channel switch announcement countdown.  The IE
 * in the beacon frame is allowed to go out and the firmware
 * counts down and notifies the host when it's time to switch
 * channels.
 */
int
mwl_hal_setchannelswitchie(struct mwl_hal *mh0,
	const MWL_HAL_CHANNEL *nextchan, uint32_t mode, uint32_t count)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_SET_SWITCH_CHANNEL *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_SET_SWITCH_CHANNEL,
		HostCmd_CMD_SET_SWITCH_CHANNEL);
	pCmd->Next11hChannel = htole32(nextchan->channel);
	pCmd->Mode = htole32(mode);
	pCmd->InitialCount = htole32(count+1);
	pCmd->ChannelFlags = cvtChannelFlags(nextchan);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_SWITCH_CHANNEL);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Set the region code that selects the radar bin'ing agorithm.
 */
int
mwl_hal_setregioncode(struct mwl_hal *mh0, int regionCode)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_SET_REGIONCODE_INFO *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_SET_REGIONCODE_INFO,
		HostCmd_CMD_SET_REGION_CODE);
	/* XXX map pseudo-codes to fw codes */
	switch (regionCode) {
	case DOMAIN_CODE_ETSI_131:
		pCmd->regionCode = htole16(DOMAIN_CODE_ETSI);
		break;
	default:
		pCmd->regionCode = htole16(regionCode);
		break;
	}

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_REGION_CODE);
	if (retval == 0)
		mh->mh_regioncode = regionCode;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

#define	RATEVAL(r)	((r) &~ RATE_MCS)
#define	RATETYPE(r)	(((r) & RATE_MCS) ? HT_RATE_TYPE : LEGACY_RATE_TYPE)

int
mwl_hal_settxrate(struct mwl_hal_vap *vap, MWL_HAL_TXRATE_HANDLING handling,
	const MWL_HAL_TXRATE *rate)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_USE_FIXED_RATE *pCmd;
	FIXED_RATE_ENTRY *fp;
	int retval, i, n;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_USE_FIXED_RATE,
		HostCmd_CMD_SET_FIXED_RATE);

	pCmd->MulticastRate = RATEVAL(rate->McastRate);
	pCmd->MultiRateTxType = RATETYPE(rate->McastRate);
	/* NB: no rate type field */
	pCmd->ManagementRate = RATEVAL(rate->MgtRate);
	memset(pCmd->FixedRateTable, 0, sizeof(pCmd->FixedRateTable));
	if (handling == RATE_FIXED) {
		pCmd->Action = htole32(HostCmd_ACT_GEN_SET);
		pCmd->AllowRateDrop = htole32(FIXED_RATE_WITHOUT_AUTORATE_DROP);
		fp = pCmd->FixedRateTable;
		fp->FixedRate =
		    htole32(RATEVAL(rate->RateSeries[0].Rate));
		fp->FixRateTypeFlags.FixRateType =
		    htole32(RATETYPE(rate->RateSeries[0].Rate));
		pCmd->EntryCount = htole32(1);
	} else if (handling == RATE_FIXED_DROP) {
		pCmd->Action = htole32(HostCmd_ACT_GEN_SET);
		pCmd->AllowRateDrop = htole32(FIXED_RATE_WITH_AUTO_RATE_DROP);
		n = 0;
		fp = pCmd->FixedRateTable;
		for (i = 0; i < 4; i++) {
			if (rate->RateSeries[0].TryCount == 0)
				break;
			fp->FixRateTypeFlags.FixRateType =
			    htole32(RATETYPE(rate->RateSeries[i].Rate));
			fp->FixedRate =
			    htole32(RATEVAL(rate->RateSeries[i].Rate));
			fp->FixRateTypeFlags.RetryCountValid =
			    htole32(RETRY_COUNT_VALID);
			fp->RetryCount =
			    htole32(rate->RateSeries[i].TryCount-1);
			n++;
		}
		pCmd->EntryCount = htole32(n);
	} else
		pCmd->Action = htole32(HostCmd_ACT_NOT_USE_FIXED_RATE);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_FIXED_RATE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_settxrate_auto(struct mwl_hal *mh0, const MWL_HAL_TXRATE *rate)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_USE_FIXED_RATE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_USE_FIXED_RATE,
		HostCmd_CMD_SET_FIXED_RATE);

	pCmd->MulticastRate = RATEVAL(rate->McastRate);
	pCmd->MultiRateTxType = RATETYPE(rate->McastRate);
	/* NB: no rate type field */
	pCmd->ManagementRate = RATEVAL(rate->MgtRate);
	memset(pCmd->FixedRateTable, 0, sizeof(pCmd->FixedRateTable));
	pCmd->Action = htole32(HostCmd_ACT_NOT_USE_FIXED_RATE);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_FIXED_RATE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

#undef RATEVAL
#undef RATETYPE

int
mwl_hal_setslottime(struct mwl_hal *mh0, int usecs)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_SLOT *pCmd;
	int retval;

	if (usecs != 9 && usecs != 20)
		return EINVAL;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_SLOT,
	    HostCmd_CMD_802_11_SET_SLOT);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET);
	pCmd->Slot = (usecs == 9 ? 1 : 0);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_SET_SLOT);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_adjusttxpower(struct mwl_hal *mh0, uint32_t level)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_802_11_RF_TX_POWER *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_802_11_RF_TX_POWER,
	    HostCmd_CMD_802_11_RF_TX_POWER);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET);

	if (level < 30) {
		pCmd->SupportTxPowerLevel = htole16(WL_TX_POWERLEVEL_LOW);
	} else if (level >= 30 && level < 60) {
		pCmd->SupportTxPowerLevel = htole16(WL_TX_POWERLEVEL_MEDIUM);
	} else {
		pCmd->SupportTxPowerLevel = htole16(WL_TX_POWERLEVEL_HIGH);
	}

	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_RF_TX_POWER);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

static const struct mwl_hal_channel *
findchannel(const struct mwl_hal_priv *mh, const MWL_HAL_CHANNEL *c)
{
	const struct mwl_hal_channel *hc;
	const MWL_HAL_CHANNELINFO *ci;
	int chan = c->channel, i;

	if (c->channelFlags.FreqBand == MWL_FREQ_BAND_2DOT4GHZ) {
		i = chan - 1;
		if (c->channelFlags.ChnlWidth == MWL_CH_40_MHz_WIDTH) {
			ci = &mh->mh_40M;
			if (c->channelFlags.ExtChnlOffset == MWL_EXT_CH_BELOW_CTRL_CH)
				i -= 4;
		} else
			ci = &mh->mh_20M;
		/* 2.4G channel table is directly indexed */
		hc = ((unsigned)i < ci->nchannels) ? &ci->channels[i] : NULL;
	} else if (c->channelFlags.FreqBand == MWL_FREQ_BAND_5GHZ) {
		if (c->channelFlags.ChnlWidth == MWL_CH_40_MHz_WIDTH) {
			ci = &mh->mh_40M_5G;
			if (c->channelFlags.ExtChnlOffset == MWL_EXT_CH_BELOW_CTRL_CH)
				chan -= 4;
		} else
			ci = &mh->mh_20M_5G;
		/* 5GHz channel table is sparse and must be searched */
		for (i = 0; i < ci->nchannels; i++)
			if (ci->channels[i].ieee == chan)
				break;
		hc = (i < ci->nchannels) ? &ci->channels[i] : NULL;
	} else
		hc = NULL;
	return hc;
}

int
mwl_hal_settxpower(struct mwl_hal *mh0, const MWL_HAL_CHANNEL *c, uint8_t maxtxpow)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_802_11_RF_TX_POWER *pCmd;
	const struct mwl_hal_channel *hc;
	int i, retval;

	hc = findchannel(mh, c);
	if (hc == NULL) {
		/* XXX temp while testing */
		device_printf(mh->mh_dev,
		    "%s: no cal data for channel %u band %u width %u ext %u\n",
		    __func__, c->channel, c->channelFlags.FreqBand,
		    c->channelFlags.ChnlWidth, c->channelFlags.ExtChnlOffset);
		return EINVAL;
	}

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_802_11_RF_TX_POWER,
	    HostCmd_CMD_802_11_RF_TX_POWER);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET_LIST);
	i = 0;
	/* NB: 5Ghz cal data have the channel # in [0]; don't truncate */
	if (c->channelFlags.FreqBand == MWL_FREQ_BAND_5GHZ)
		pCmd->PowerLevelList[i++] = htole16(hc->targetPowers[0]);
	for (; i < 4; i++) {
		uint16_t pow = hc->targetPowers[i];
		if (pow > maxtxpow)
			pow = maxtxpow;
		pCmd->PowerLevelList[i] = htole16(pow);
	}
	retval = mwlExecuteCmd(mh, HostCmd_CMD_802_11_RF_TX_POWER);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_getchannelinfo(struct mwl_hal *mh0, int band, int chw,
	const MWL_HAL_CHANNELINFO **ci)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);

	switch (band) {
	case MWL_FREQ_BAND_2DOT4GHZ:
		*ci = (chw == MWL_CH_20_MHz_WIDTH) ? &mh->mh_20M : &mh->mh_40M;
		break;
	case MWL_FREQ_BAND_5GHZ:
		*ci = (chw == MWL_CH_20_MHz_WIDTH) ?
		     &mh->mh_20M_5G : &mh->mh_40M_5G;
		break;
	default:
		return EINVAL;
	}
	return ((*ci)->freqLow == (*ci)->freqHigh) ? EINVAL : 0;
}

int
mwl_hal_setmcast(struct mwl_hal *mh0, int nmc, const uint8_t macs[])
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_MAC_MULTICAST_ADR *pCmd;
	int retval;

	if (nmc > MWL_HAL_MCAST_MAX)
		return EINVAL;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_MAC_MULTICAST_ADR,
		HostCmd_CMD_MAC_MULTICAST_ADR);
	memcpy(pCmd->MACList, macs, nmc*IEEE80211_ADDR_LEN);
	pCmd->NumOfAdrs = htole16(nmc);
	pCmd->Action = htole16(0xffff);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_MAC_MULTICAST_ADR);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_keyset(struct mwl_hal_vap *vap, const MWL_HAL_KEYVAL *kv,
	const uint8_t mac[IEEE80211_ADDR_LEN])
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_UPDATE_ENCRYPTION_SET_KEY *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_UPDATE_ENCRYPTION_SET_KEY,
		HostCmd_CMD_UPDATE_ENCRYPTION);
	if (kv->keyFlags & (KEY_FLAG_TXGROUPKEY|KEY_FLAG_RXGROUPKEY))
		pCmd->ActionType = htole32(EncrActionTypeSetGroupKey);
	else
		pCmd->ActionType = htole32(EncrActionTypeSetKey);
	pCmd->KeyParam.Length = htole16(sizeof(pCmd->KeyParam));
	pCmd->KeyParam.KeyTypeId = htole16(kv->keyTypeId);
	pCmd->KeyParam.KeyInfo = htole32(kv->keyFlags);
	pCmd->KeyParam.KeyIndex = htole32(kv->keyIndex);
	/* NB: includes TKIP MIC keys */
	memcpy(&pCmd->KeyParam.Key, &kv->key, kv->keyLen);
	switch (kv->keyTypeId) {
	case KEY_TYPE_ID_WEP:
		pCmd->KeyParam.KeyLen = htole16(kv->keyLen);
		break;
	case KEY_TYPE_ID_TKIP:
		pCmd->KeyParam.KeyLen = htole16(sizeof(TKIP_TYPE_KEY));
		pCmd->KeyParam.Key.TkipKey.TkipRsc.low =
			htole16(kv->key.tkip.rsc.low);
		pCmd->KeyParam.Key.TkipKey.TkipRsc.high =
			htole32(kv->key.tkip.rsc.high);
		pCmd->KeyParam.Key.TkipKey.TkipTsc.low =
			htole16(kv->key.tkip.tsc.low);
		pCmd->KeyParam.Key.TkipKey.TkipTsc.high =
			htole32(kv->key.tkip.tsc.high);
		break;
	case KEY_TYPE_ID_AES:
		pCmd->KeyParam.KeyLen = htole16(sizeof(AES_TYPE_KEY));
		break;
	}
#ifdef MWL_MBSS_SUPPORT
	IEEE80211_ADDR_COPY(pCmd->KeyParam.Macaddr, mac);
#else
	IEEE80211_ADDR_COPY(pCmd->Macaddr, mac);
#endif
	retval = mwlExecuteCmd(mh, HostCmd_CMD_UPDATE_ENCRYPTION);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_keyreset(struct mwl_hal_vap *vap, const MWL_HAL_KEYVAL *kv, const uint8_t mac[IEEE80211_ADDR_LEN])
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_UPDATE_ENCRYPTION_SET_KEY *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_UPDATE_ENCRYPTION_SET_KEY,
		HostCmd_CMD_UPDATE_ENCRYPTION);
	pCmd->ActionType = htole16(EncrActionTypeRemoveKey);
	pCmd->KeyParam.Length = htole16(sizeof(pCmd->KeyParam));
	pCmd->KeyParam.KeyTypeId = htole16(kv->keyTypeId);
	pCmd->KeyParam.KeyInfo = htole32(kv->keyFlags);
	pCmd->KeyParam.KeyIndex = htole32(kv->keyIndex);
#ifdef MWL_MBSS_SUPPORT
	IEEE80211_ADDR_COPY(pCmd->KeyParam.Macaddr, mac);
#else
	IEEE80211_ADDR_COPY(pCmd->Macaddr, mac);
#endif
	retval = mwlExecuteCmd(mh, HostCmd_CMD_UPDATE_ENCRYPTION);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

static int
mwl_hal_setmac_locked(struct mwl_hal_vap *vap,
	const uint8_t addr[IEEE80211_ADDR_LEN])
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_DS_SET_MAC *pCmd;

	_VCMD_SETUP(vap, pCmd, HostCmd_DS_SET_MAC, HostCmd_CMD_SET_MAC_ADDR);
	IEEE80211_ADDR_COPY(&pCmd->MacAddr[0], addr);
#ifdef MWL_MBSS_SUPPORT
	pCmd->MacType = vap->bss_type;		/* NB: already byte swapped */
	IEEE80211_ADDR_COPY(vap->mac, addr);	/* XXX do only if success */
#endif
	return mwlExecuteCmd(mh, HostCmd_CMD_SET_MAC_ADDR);
}

int
mwl_hal_setmac(struct mwl_hal_vap *vap, const uint8_t addr[IEEE80211_ADDR_LEN])
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	int retval;

	MWL_HAL_LOCK(mh);
	retval = mwl_hal_setmac_locked(vap, addr);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setbeacon(struct mwl_hal_vap *vap, const void *frame, size_t frameLen)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_DS_SET_BEACON *pCmd;
	int retval;

	/* XXX verify frameLen fits */
	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_DS_SET_BEACON, HostCmd_CMD_SET_BEACON);
	/* XXX override _VCMD_SETUP */
	pCmd->CmdHdr.Length = htole16(sizeof(HostCmd_DS_SET_BEACON)-1+frameLen);
	pCmd->FrmBodyLen = htole16(frameLen);
	memcpy(pCmd->FrmBody, frame, frameLen);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_BEACON);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setpowersave_bss(struct mwl_hal_vap *vap, uint8_t nsta)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_SET_POWERSAVESTATION *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_SET_POWERSAVESTATION,
		HostCmd_CMD_SET_POWERSAVESTATION);
	pCmd->NumberOfPowersave = nsta;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_POWERSAVESTATION);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setpowersave_sta(struct mwl_hal_vap *vap, uint16_t aid, int ena)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_SET_TIM *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_SET_TIM, HostCmd_CMD_SET_TIM);
	pCmd->Aid = htole16(aid);
	pCmd->Set = htole32(ena);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_TIM);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setassocid(struct mwl_hal_vap *vap,
	const uint8_t bssId[IEEE80211_ADDR_LEN], uint16_t assocId)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_AID *pCmd = (HostCmd_FW_SET_AID *) &mh->mh_cmdbuf[0];
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_AID, HostCmd_CMD_SET_AID);
	pCmd->AssocID = htole16(assocId);
	IEEE80211_ADDR_COPY(&pCmd->MacAddr[0], bssId);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_AID);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setchannel(struct mwl_hal *mh0, const MWL_HAL_CHANNEL *chan)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_RF_CHANNEL *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_RF_CHANNEL, HostCmd_CMD_SET_RF_CHANNEL);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET);
	pCmd->CurrentChannel = chan->channel;
	pCmd->ChannelFlags = cvtChannelFlags(chan);	/* NB: byte-swapped */

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_RF_CHANNEL);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

static int
bastream_check_available(struct mwl_hal_vap *vap, int qid,
	const uint8_t Macaddr[IEEE80211_ADDR_LEN],
	uint8_t Tid, uint8_t ParamInfo)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_BASTREAM *pCmd;
	int retval;

	MWL_HAL_LOCK_ASSERT(mh);

	_VCMD_SETUP(vap, pCmd, HostCmd_FW_BASTREAM, HostCmd_CMD_BASTREAM);
	pCmd->ActionType = htole32(BaCheckCreateStream);
	pCmd->BaInfo.CreateParams.BarThrs = htole32(63);
	pCmd->BaInfo.CreateParams.WindowSize = htole32(64);
	pCmd->BaInfo.CreateParams.IdleThrs = htole32(0x22000);
	IEEE80211_ADDR_COPY(&pCmd->BaInfo.CreateParams.PeerMacAddr[0], Macaddr);
	pCmd->BaInfo.CreateParams.DialogToken = 10;
	pCmd->BaInfo.CreateParams.Tid = Tid;
	pCmd->BaInfo.CreateParams.QueueId = qid;
	pCmd->BaInfo.CreateParams.ParamInfo = (uint8_t) ParamInfo;
#if 0
	cvtBAFlags(&pCmd->BaInfo.CreateParams.Flags, sp->ba_policy, 0);
#else
	pCmd->BaInfo.CreateParams.Flags =
			  htole32(BASTREAM_FLAG_IMMEDIATE_TYPE)
			| htole32(BASTREAM_FLAG_DIRECTION_UPSTREAM)
			;
#endif

	retval = mwlExecuteCmd(mh, HostCmd_CMD_BASTREAM);
	if (retval == 0) {
		/*
		 * NB: BA stream create may fail when the stream is
		 * h/w backed under some (as yet not understood) conditions.
		 * Check the result code to catch this.
		 */
		if (le16toh(pCmd->CmdHdr.Result) != HostCmd_RESULT_OK)
			retval = EIO;
	}
	return retval;
}

const MWL_HAL_BASTREAM *
mwl_hal_bastream_alloc(struct mwl_hal_vap *vap, int ba_policy,
	const uint8_t Macaddr[IEEE80211_ADDR_LEN],
	uint8_t Tid, uint8_t ParamInfo, void *a1, void *a2)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	struct mwl_hal_bastream *sp;
	int s;

	MWL_HAL_LOCK(mh);
	if (mh->mh_bastreams == 0) {
		/* no streams available */
		MWL_HAL_UNLOCK(mh);
		return NULL;
	}
	for (s = 0; (mh->mh_bastreams & (1<<s)) == 0; s++)
		;
	if (bastream_check_available(vap, s, Macaddr, Tid, ParamInfo)) {
		MWL_HAL_UNLOCK(mh);
		return NULL;
	}
	sp = &mh->mh_streams[s];
	mh->mh_bastreams &= ~(1<<s);
	sp->public.data[0] = a1;
	sp->public.data[1] = a2;
	IEEE80211_ADDR_COPY(sp->macaddr, Macaddr);
	sp->tid = Tid;
	sp->paraminfo = ParamInfo;
	sp->setup = 0;
	sp->ba_policy = ba_policy;
	MWL_HAL_UNLOCK(mh);
	return &sp->public;
}

const MWL_HAL_BASTREAM *
mwl_hal_bastream_lookup(struct mwl_hal *mh0, int s)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);

	if (!(0 <= s && s < MWL_BASTREAMS_MAX))
		return NULL;
	if (mh->mh_bastreams & (1<<s))
		return NULL;
	return &mh->mh_streams[s].public;
}

#ifndef	__DECONST
#define	__DECONST(type, var)	((type)(uintptr_t)(const void *)(var))
#endif

int
mwl_hal_bastream_create(struct mwl_hal_vap *vap,
	const MWL_HAL_BASTREAM *s, int BarThrs, int WindowSize, uint16_t seqno)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	struct mwl_hal_bastream *sp = __DECONST(struct mwl_hal_bastream *, s);
	HostCmd_FW_BASTREAM *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_BASTREAM, HostCmd_CMD_BASTREAM);
	pCmd->ActionType = htole32(BaCreateStream);
	pCmd->BaInfo.CreateParams.BarThrs = htole32(BarThrs);
	pCmd->BaInfo.CreateParams.WindowSize = htole32(WindowSize);
	pCmd->BaInfo.CreateParams.IdleThrs = htole32(0x22000);
	IEEE80211_ADDR_COPY(&pCmd->BaInfo.CreateParams.PeerMacAddr[0],
	    sp->macaddr);
	/* XXX proxy STA */
	memset(&pCmd->BaInfo.CreateParams.StaSrcMacAddr, 0, IEEE80211_ADDR_LEN);
#if 0
	pCmd->BaInfo.CreateParams.DialogToken = DialogToken;
#else
	pCmd->BaInfo.CreateParams.DialogToken = 10;
#endif
	pCmd->BaInfo.CreateParams.Tid = sp->tid;
	pCmd->BaInfo.CreateParams.QueueId = sp->stream;
	pCmd->BaInfo.CreateParams.ParamInfo = sp->paraminfo;
	/* NB: ResetSeqNo known to be zero */
	pCmd->BaInfo.CreateParams.StartSeqNo = htole16(seqno);
#if 0
	cvtBAFlags(&pCmd->BaInfo.CreateParams.Flags, sp->ba_policy, 0);
#else
	pCmd->BaInfo.CreateParams.Flags =
			  htole32(BASTREAM_FLAG_IMMEDIATE_TYPE)
			| htole32(BASTREAM_FLAG_DIRECTION_UPSTREAM)
			;
#endif

	retval = mwlExecuteCmd(mh, HostCmd_CMD_BASTREAM);
	if (retval == 0) {
		/*
		 * NB: BA stream create may fail when the stream is
		 * h/w backed under some (as yet not understood) conditions.
		 * Check the result code to catch this.
		 */
		if (le16toh(pCmd->CmdHdr.Result) != HostCmd_RESULT_OK)
			retval = EIO;
		else
			sp->setup = 1;
	}
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_bastream_destroy(struct mwl_hal *mh0, const MWL_HAL_BASTREAM *s)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	struct mwl_hal_bastream *sp = __DECONST(struct mwl_hal_bastream *, s);
	HostCmd_FW_BASTREAM *pCmd;
	int retval;

	if (sp->stream >= MWL_BASTREAMS_MAX) {
		/* XXX */
		return EINVAL;
	}
	MWL_HAL_LOCK(mh);
	if (sp->setup) {
		_CMD_SETUP(pCmd, HostCmd_FW_BASTREAM, HostCmd_CMD_BASTREAM);
		pCmd->ActionType = htole32(BaDestroyStream);
		pCmd->BaInfo.DestroyParams.FwBaContext.Context =
		    htole32(sp->stream);

		retval = mwlExecuteCmd(mh, HostCmd_CMD_BASTREAM);
	} else
		retval = 0;
	/* NB: always reclaim stream */
	mh->mh_bastreams |= 1<<sp->stream;
	sp->public.data[0] = NULL;
	sp->public.data[1] = NULL;
	sp->setup = 0;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_bastream_get_seqno(struct mwl_hal *mh0,
	const MWL_HAL_BASTREAM *s, const uint8_t Macaddr[IEEE80211_ADDR_LEN],
	uint16_t *pseqno)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	struct mwl_hal_bastream *sp = __DECONST(struct mwl_hal_bastream *, s);
	HostCmd_GET_SEQNO *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_GET_SEQNO, HostCmd_CMD_GET_SEQNO);
	IEEE80211_ADDR_COPY(pCmd->MacAddr, Macaddr);
	pCmd->TID = sp->tid;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_GET_SEQNO);
	if (retval == 0)
		*pseqno = le16toh(pCmd->SeqNo);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_getwatchdogbitmap(struct mwl_hal *mh0, uint8_t bitmap[1])
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_GET_WATCHDOG_BITMAP *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_GET_WATCHDOG_BITMAP,
		HostCmd_CMD_GET_WATCHDOG_BITMAP);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_GET_WATCHDOG_BITMAP);
	if (retval == 0) {
		bitmap[0] = pCmd->Watchdogbitmap;
		/* fw returns qid, map it to BA stream */
		if (bitmap[0] < MWL_BAQID_MAX)
			bitmap[0] = qid2ba[bitmap[0]];
	}
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Configure aggressive Ampdu rate mode.
 */
int
mwl_hal_setaggampduratemode(struct mwl_hal *mh0, int mode, int threshold)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_AMPDU_RETRY_RATEDROP_MODE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_AMPDU_RETRY_RATEDROP_MODE,
		HostCmd_CMD_AMPDU_RETRY_RATEDROP_MODE);
	pCmd->Action = htole16(1);
	pCmd->Option = htole32(mode);
	pCmd->Threshold = htole32(threshold);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_AMPDU_RETRY_RATEDROP_MODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_getaggampduratemode(struct mwl_hal *mh0, int *mode, int *threshold)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_AMPDU_RETRY_RATEDROP_MODE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_AMPDU_RETRY_RATEDROP_MODE,
		HostCmd_CMD_AMPDU_RETRY_RATEDROP_MODE);
	pCmd->Action = htole16(0);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_AMPDU_RETRY_RATEDROP_MODE);
	MWL_HAL_UNLOCK(mh);
	*mode =  le32toh(pCmd->Option);
	*threshold = le32toh(pCmd->Threshold);
	return retval;
}

/*
 * Set CFEND status Enable/Disable
 */
int
mwl_hal_setcfend(struct mwl_hal *mh0, int ena)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_CFEND_ENABLE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_CFEND_ENABLE,
		HostCmd_CMD_CFEND_ENABLE);
	pCmd->Enable = htole32(ena);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_CFEND_ENABLE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setdwds(struct mwl_hal *mh0, int ena)
{
	HostCmd_DWDS_ENABLE *pCmd;
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
   	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DWDS_ENABLE, HostCmd_CMD_DWDS_ENABLE);
	pCmd->Enable = htole32(ena);
	retval = mwlExecuteCmd(mh, HostCmd_CMD_DWDS_ENABLE);
  	MWL_HAL_UNLOCK(mh);
	return retval;
}

static void
cvtPeerInfo(PeerInfo_t *to, const MWL_HAL_PEERINFO *from)
{
	to->LegacyRateBitMap = htole32(from->LegacyRateBitMap);
	to->HTRateBitMap = htole32(from->HTRateBitMap);
	to->CapInfo = htole16(from->CapInfo);
	to->HTCapabilitiesInfo = htole16(from->HTCapabilitiesInfo);
	to->MacHTParamInfo = from->MacHTParamInfo;
	to->AddHtInfo.ControlChan = from->AddHtInfo.ControlChan;
	to->AddHtInfo.AddChan = from->AddHtInfo.AddChan;
	to->AddHtInfo.OpMode = htole16(from->AddHtInfo.OpMode);
	to->AddHtInfo.stbc = htole16(from->AddHtInfo.stbc);
}

/* XXX station id must be in [0..63] */
int
mwl_hal_newstation(struct mwl_hal_vap *vap,
	const uint8_t addr[IEEE80211_ADDR_LEN], uint16_t aid, uint16_t sid,
	const MWL_HAL_PEERINFO *peer, int isQosSta, int wmeInfo)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_NEW_STN *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_NEW_STN, HostCmd_CMD_SET_NEW_STN);
	pCmd->AID = htole16(aid);
	pCmd->StnId = htole16(sid);
	pCmd->Action = htole16(0);	/* SET */
	if (peer != NULL) {
		/* NB: must fix up byte order */
		cvtPeerInfo(&pCmd->PeerInfo, peer);
	}
	IEEE80211_ADDR_COPY(&pCmd->MacAddr[0], addr);
	pCmd->Qosinfo = wmeInfo;
	pCmd->isQosSta = (isQosSta != 0);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_NEW_STN);
	if (retval == 0 && IEEE80211_ADDR_EQ(vap->mac, addr))
		vap->flags |= MVF_STATION;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_delstation(struct mwl_hal_vap *vap,
	const uint8_t addr[IEEE80211_ADDR_LEN])
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_NEW_STN *pCmd;
	int retval, islocal;

	MWL_HAL_LOCK(mh);
	islocal = IEEE80211_ADDR_EQ(vap->mac, addr);
	if (!islocal || (vap->flags & MVF_STATION)) {
		_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_NEW_STN,
		    HostCmd_CMD_SET_NEW_STN);
		pCmd->Action = htole16(2);	/* REMOVE */
		IEEE80211_ADDR_COPY(&pCmd->MacAddr[0], addr);
		retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_NEW_STN);
		if (islocal)
			vap->flags &= ~MVF_STATION;
	} else
		retval = 0;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Prod the firmware to age packets on station power
 * save queues and reap frames on the tx aggregation q's.
 */
int
mwl_hal_setkeepalive(struct mwl_hal *mh0)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_KEEP_ALIVE_TICK *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_KEEP_ALIVE_TICK,
		HostCmd_CMD_SET_KEEP_ALIVE);
	/*
	 * NB: tick must be 0 to prod the f/w;
	 *     a non-zero value is a noop.
	 */
	pCmd->tick = 0;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_KEEP_ALIVE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setapmode(struct mwl_hal_vap *vap, MWL_HAL_APMODE ApMode)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_APMODE *pCmd;
	int retval;

	/* XXX validate ApMode? */

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_APMODE, HostCmd_CMD_SET_APMODE);
	pCmd->ApMode = ApMode;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_APMODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_stop(struct mwl_hal_vap *vap)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_DS_BSS_START *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	if (vap->flags & MVF_RUNNING) {
		_VCMD_SETUP(vap, pCmd, HostCmd_DS_BSS_START,
		    HostCmd_CMD_BSS_START);
		pCmd->Enable = htole32(HostCmd_ACT_GEN_OFF);
		retval = mwlExecuteCmd(mh, HostCmd_CMD_BSS_START);
	} else
		retval = 0;
	/* NB: mark !running regardless */
	vap->flags &= ~MVF_RUNNING;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_start(struct mwl_hal_vap *vap)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_DS_BSS_START *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_DS_BSS_START, HostCmd_CMD_BSS_START);
	pCmd->Enable = htole32(HostCmd_ACT_GEN_ON);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_BSS_START);
	if (retval == 0)
		vap->flags |= MVF_RUNNING;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setgprot(struct mwl_hal *mh0, int prot)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_G_PROTECT_FLAG *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_G_PROTECT_FLAG,
		HostCmd_CMD_SET_G_PROTECT_FLAG);
	pCmd->GProtectFlag  = htole32(prot);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_G_PROTECT_FLAG);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setwmm(struct mwl_hal *mh0, int onoff)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SetWMMMode *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SetWMMMode,
		HostCmd_CMD_SET_WMM_MODE);
	pCmd->Action = htole16(onoff);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_WMM_MODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setedcaparams(struct mwl_hal *mh0, uint8_t qnum,
	uint32_t CWmin, uint32_t CWmax, uint8_t AIFSN,  uint16_t TXOPLimit)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_EDCA_PARAMS *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_EDCA_PARAMS,
		HostCmd_CMD_SET_EDCA_PARAMS);
	/*
	 * NB: CWmin and CWmax are always set.
	 *     TxOpLimit is set if bit 0x2 is marked in Action
	 *     AIFSN is set if bit 0x4 is marked in Action
	 */
	pCmd->Action = htole16(0xffff);	/* NB: set everything */
	pCmd->TxOP = htole16(TXOPLimit);
	pCmd->CWMax = htole32(CWmax);
	pCmd->CWMin = htole32(CWmin);
	pCmd->AIFSN = AIFSN;
	pCmd->TxQNum = qnum;		/* XXX check */

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_EDCA_PARAMS);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/* XXX 0 = indoor, 1 = outdoor */
int
mwl_hal_setrateadaptmode(struct mwl_hal *mh0, uint16_t mode)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_SET_RATE_ADAPT_MODE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_SET_RATE_ADAPT_MODE,
		HostCmd_CMD_SET_RATE_ADAPT_MODE);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET);
	pCmd->RateAdaptMode = htole16(mode);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_RATE_ADAPT_MODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setcsmode(struct mwl_hal *mh0, MWL_HAL_CSMODE csmode)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_DS_SET_LINKADAPT_CS_MODE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_SET_LINKADAPT_CS_MODE,
		HostCmd_CMD_SET_LINKADAPT_CS_MODE);
	pCmd->Action = htole16(HostCmd_ACT_GEN_SET);
	pCmd->CSMode = htole16(csmode);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_LINKADAPT_CS_MODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setnprot(struct mwl_hal_vap *vap, MWL_HAL_HTPROTECT mode)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_N_PROTECT_FLAG *pCmd;
	int retval;

	/* XXX validate mode */
	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_N_PROTECT_FLAG,
		HostCmd_CMD_SET_N_PROTECT_FLAG);
	pCmd->NProtectFlag  = htole32(mode);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_N_PROTECT_FLAG);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setnprotmode(struct mwl_hal_vap *vap, uint8_t mode)
{
	struct mwl_hal_priv *mh = MWLVAP(vap);
	HostCmd_FW_SET_N_PROTECT_OPMODE *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_VCMD_SETUP(vap, pCmd, HostCmd_FW_SET_N_PROTECT_OPMODE,
		HostCmd_CMD_SET_N_PROTECT_OPMODE);
	pCmd->NProtectOpMode = mode;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_N_PROTECT_OPMODE);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setoptimizationlevel(struct mwl_hal *mh0, int level)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_OPTIMIZATION_LEVEL *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_OPTIMIZATION_LEVEL,
		HostCmd_CMD_SET_OPTIMIZATION_LEVEL);
	pCmd->OptLevel = level;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_OPTIMIZATION_LEVEL);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setmimops(struct mwl_hal *mh0, const uint8_t addr[IEEE80211_ADDR_LEN],
	uint8_t enable, uint8_t mode)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_MIMOPSHT *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_MIMOPSHT, HostCmd_CMD_SET_MIMOPSHT);
	IEEE80211_ADDR_COPY(pCmd->Addr, addr);
	pCmd->Enable = enable;
	pCmd->Mode = mode;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_MIMOPSHT);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

static int
mwlGetCalTable(struct mwl_hal_priv *mh, uint8_t annex, uint8_t index)
{
	HostCmd_FW_GET_CALTABLE *pCmd;
	int retval;

	MWL_HAL_LOCK_ASSERT(mh);

	_CMD_SETUP(pCmd, HostCmd_FW_GET_CALTABLE, HostCmd_CMD_GET_CALTABLE);
	pCmd->annex = annex;
	pCmd->index = index;
	memset(pCmd->calTbl, 0, sizeof(pCmd->calTbl));

	retval = mwlExecuteCmd(mh, HostCmd_CMD_GET_CALTABLE);
	if (retval == 0 &&
	    pCmd->calTbl[0] != annex && annex != 0 && annex != 255)
		retval = EIO;
	return retval;
}

/*
 * Calculate the max tx power from the channel's cal data.
 */
static void
setmaxtxpow(struct mwl_hal_channel *hc, int i, int maxix)
{
	hc->maxTxPow = hc->targetPowers[i];
	for (i++; i < maxix; i++)
		if (hc->targetPowers[i] > hc->maxTxPow)
			hc->maxTxPow = hc->targetPowers[i];
}

/*
 * Construct channel info for 5GHz channels from cal data.
 */
static void
get5Ghz(MWL_HAL_CHANNELINFO *ci, const uint8_t table[], int len)
{
	int i, j, f, l, h;

	l = 32000;
	h = 0;
	j = 0;
	for (i = 0; i < len; i += 4) {
		struct mwl_hal_channel *hc;

		if (table[i] == 0)
			continue;
		f = 5000 + 5*table[i];
		if (f < l)
			l = f;
		if (f > h)
			h = f;
		hc = &ci->channels[j];
		hc->freq = f;
		hc->ieee = table[i];
		memcpy(hc->targetPowers, &table[i], 4);
		setmaxtxpow(hc, 1, 4);		/* NB: col 1 is the freq, skip*/
		j++;
	}
	ci->nchannels = j;
	ci->freqLow = (l == 32000) ? 0 : l;
	ci->freqHigh = h;
}

static uint16_t
ieee2mhz(int chan)
{
	if (chan == 14)
		return 2484;
	if (chan < 14)
		return 2407 + chan*5;
	return 2512 + (chan-15)*20;
}

/*
 * Construct channel info for 2.4GHz channels from cal data.
 */
static void
get2Ghz(MWL_HAL_CHANNELINFO *ci, const uint8_t table[], int len)
{
	int i, j;

	j = 0;
	for (i = 0; i < len; i += 4) {
		struct mwl_hal_channel *hc = &ci->channels[j];
		hc->ieee = 1+j;
		hc->freq = ieee2mhz(1+j);
		memcpy(hc->targetPowers, &table[i], 4);
		setmaxtxpow(hc, 0, 4);
		j++;
	}
	ci->nchannels = j;
	ci->freqLow = ieee2mhz(1);
	ci->freqHigh = ieee2mhz(j);
}

#undef DUMPCALDATA
#ifdef DUMPCALDATA
static void
dumpcaldata(const char *name, const uint8_t *table, int n)
{
	int i;
	printf("\n%s:\n", name);
	for (i = 0; i < n; i += 4)
		printf("[%2d] %3d %3d %3d %3d\n", i/4, table[i+0], table[i+1], table[i+2], table[i+3]);
}
#endif

static int
mwlGetPwrCalTable(struct mwl_hal_priv *mh)
{
	const uint8_t *data;
	MWL_HAL_CHANNELINFO *ci;
	int len;

	MWL_HAL_LOCK(mh);
	/* NB: we hold the lock so it's ok to use cmdbuf */
	data = ((const HostCmd_FW_GET_CALTABLE *) mh->mh_cmdbuf)->calTbl;
	if (mwlGetCalTable(mh, 33, 0) == 0) {
		len = (data[2] | (data[3] << 8)) - 12;
		if (len > PWTAGETRATETABLE20M)
			len = PWTAGETRATETABLE20M;
#ifdef DUMPCALDATA
dumpcaldata("2.4G 20M", &data[12], len);/*XXX*/
#endif
		get2Ghz(&mh->mh_20M, &data[12], len);
	}
	if (mwlGetCalTable(mh, 34, 0) == 0) {
		len = (data[2] | (data[3] << 8)) - 12;
		if (len > PWTAGETRATETABLE40M)
			len = PWTAGETRATETABLE40M;
#ifdef DUMPCALDATA
dumpcaldata("2.4G 40M", &data[12], len);/*XXX*/
#endif
		ci = &mh->mh_40M;
		get2Ghz(ci, &data[12], len);
	}
	if (mwlGetCalTable(mh, 35, 0) == 0) {
		len = (data[2] | (data[3] << 8)) - 20;
		if (len > PWTAGETRATETABLE20M_5G)
			len = PWTAGETRATETABLE20M_5G;
#ifdef DUMPCALDATA
dumpcaldata("5G 20M", &data[20], len);/*XXX*/
#endif
		get5Ghz(&mh->mh_20M_5G, &data[20], len);
	}
	if (mwlGetCalTable(mh, 36, 0) == 0) {
		len = (data[2] | (data[3] << 8)) - 20;
		if (len > PWTAGETRATETABLE40M_5G)
			len = PWTAGETRATETABLE40M_5G;
#ifdef DUMPCALDATA
dumpcaldata("5G 40M", &data[20], len);/*XXX*/
#endif
		ci = &mh->mh_40M_5G;
		get5Ghz(ci, &data[20], len);
	}
	mh->mh_flags |= MHF_CALDATA;
	MWL_HAL_UNLOCK(mh);
	return 0;
}

int
mwl_hal_getregioncode(struct mwl_hal *mh0, uint8_t *countryCode)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	int retval;

	MWL_HAL_LOCK(mh);
	retval = mwlGetCalTable(mh, 0, 0);
	if (retval == 0) {
		const HostCmd_FW_GET_CALTABLE *pCmd =
		    (const HostCmd_FW_GET_CALTABLE *) mh->mh_cmdbuf;
		*countryCode = pCmd->calTbl[16];
	}
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_setpromisc(struct mwl_hal *mh0, int ena)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	uint32_t v;

	MWL_HAL_LOCK(mh);
	v = RD4(mh, MACREG_REG_PROMISCUOUS);
	WR4(mh, MACREG_REG_PROMISCUOUS, ena ? v | 1 : v &~ 1);
	MWL_HAL_UNLOCK(mh);
	return 0;
}

int
mwl_hal_getpromisc(struct mwl_hal *mh0)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	uint32_t v;

	MWL_HAL_LOCK(mh);
	v = RD4(mh, MACREG_REG_PROMISCUOUS);
	MWL_HAL_UNLOCK(mh);
	return (v & 1) != 0;
}

int
mwl_hal_GetBeacon(struct mwl_hal *mh0, uint8_t *pBcn, uint16_t *pLen)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_GET_BEACON *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_GET_BEACON, HostCmd_CMD_GET_BEACON);
	pCmd->Bcnlen = htole16(0);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_GET_BEACON);
	if (retval == 0) {
		/* XXX bounds check */
		memcpy(pBcn, &pCmd->Bcn, pCmd->Bcnlen);
		*pLen = pCmd->Bcnlen;
	}
	MWL_HAL_UNLOCK(mh);
	return retval;
}

int
mwl_hal_SetRifs(struct mwl_hal *mh0, uint8_t QNum)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	HostCmd_FW_SET_RIFS  *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_FW_SET_RIFS, HostCmd_CMD_SET_RIFS);
	pCmd->QNum = QNum;

	retval = mwlExecuteCmd(mh, HostCmd_CMD_SET_RIFS);
	MWL_HAL_UNLOCK(mh);
	return retval;
}

/*
 * Diagnostic api's for set/get registers.
 */

static int
getRFReg(struct mwl_hal_priv *mh, int flag, uint32_t reg, uint32_t *val)
{
	HostCmd_DS_RF_REG_ACCESS *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_RF_REG_ACCESS, HostCmd_CMD_RF_REG_ACCESS);
	pCmd->Offset =  htole16(reg);
	pCmd->Action = htole16(flag);
	pCmd->Value = htole32(*val);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_RF_REG_ACCESS);
	if (retval == 0)
		*val = pCmd->Value;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

static int
getBBReg(struct mwl_hal_priv *mh, int flag, uint32_t reg, uint32_t *val)
{
	HostCmd_DS_BBP_REG_ACCESS *pCmd;
	int retval;

	MWL_HAL_LOCK(mh);
	_CMD_SETUP(pCmd, HostCmd_DS_BBP_REG_ACCESS, HostCmd_CMD_BBP_REG_ACCESS);
	pCmd->Offset =  htole16(reg);
	pCmd->Action = htole16(flag);
	pCmd->Value = htole32(*val);

	retval = mwlExecuteCmd(mh, HostCmd_CMD_BBP_REG_ACCESS);
	if (retval == 0)
		*val = pCmd->Value;
	MWL_HAL_UNLOCK(mh);
	return retval;
}

static u_int
mwl_hal_getregdump(struct mwl_hal_priv *mh, const MWL_DIAG_REGRANGE *regs,
	void *dstbuf, int space)
{
	uint32_t *dp = dstbuf;
	int i;

	for (i = 0; space >= 2*sizeof(uint32_t); i++) {
		u_int r = regs[i].start;
		u_int e = regs[i].end;
		*dp++ = (r<<16) | e;
		space -= sizeof(uint32_t);
		do {
			if (MWL_DIAG_ISMAC(r))
				*dp = RD4(mh, r);
			else if (MWL_DIAG_ISBB(r))
				getBBReg(mh, HostCmd_ACT_GEN_READ,
				    r - MWL_DIAG_BASE_BB, dp);
			else if (MWL_DIAG_ISRF(r))
				getRFReg(mh, HostCmd_ACT_GEN_READ,
				    r - MWL_DIAG_BASE_RF, dp);
			else if (r < 0x1000 || r == MACREG_REG_FW_PRESENT)
				*dp = RD4(mh, r);
			else
				*dp = 0xffffffff;
			dp++;
			r += sizeof(uint32_t);
			space -= sizeof(uint32_t);
		} while (r <= e && space >= sizeof(uint32_t));
	}
	return (char *) dp - (char *) dstbuf;
}

int
mwl_hal_getdiagstate(struct mwl_hal *mh0, int request,
	const void *args, uint32_t argsize,
	void **result, uint32_t *resultsize)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);

	switch (request) {
	case MWL_DIAG_CMD_REVS:
		*result = &mh->mh_revs;
		*resultsize = sizeof(mh->mh_revs);
		return 1;
	case MWL_DIAG_CMD_REGS:
		*resultsize = mwl_hal_getregdump(mh, args, *result, *resultsize);
		return 1;
	case MWL_DIAG_CMD_HOSTCMD: {
		FWCmdHdr *pCmd = (FWCmdHdr *) &mh->mh_cmdbuf[0];
		int retval;

		MWL_HAL_LOCK(mh);
		memcpy(pCmd, args, argsize);
		retval = mwlExecuteCmd(mh, le16toh(pCmd->Cmd));
		*result = (*resultsize != 0) ? pCmd : NULL;
		MWL_HAL_UNLOCK(mh);
		return (retval == 0);
	}
	case MWL_DIAG_CMD_FWLOAD:
		if (mwl_hal_fwload(mh0, __DECONST(void *, args))) {
			device_printf(mh->mh_dev, "problem loading fw image\n");
			return 0;
		}
		return 1;
	}
	return 0;
}

/*
 * Low level firmware cmd block handshake support.
 */

static void
mwlSendCmd(struct mwl_hal_priv *mh)
{

	bus_dmamap_sync(mh->mh_dmat, mh->mh_dmamap,
	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);

	WR4(mh, MACREG_REG_GEN_PTR, mh->mh_cmdaddr);
	RD4(mh, MACREG_REG_INT_CODE);

	WR4(mh, MACREG_REG_H2A_INTERRUPT_EVENTS, MACREG_H2ARIC_BIT_DOOR_BELL);
}

static int
mwlWaitForCmdComplete(struct mwl_hal_priv *mh, uint16_t cmdCode)
{
#define MAX_WAIT_FW_COMPLETE_ITERATIONS 10000
	int i;

	for (i = 0; i < MAX_WAIT_FW_COMPLETE_ITERATIONS; i++) {
		if (mh->mh_cmdbuf[0] == le16toh(cmdCode))
			return 1;
		DELAY(1*1000);
	}
	return 0;
#undef MAX_WAIT_FW_COMPLETE_ITERATIONS
}

static int
mwlExecuteCmd(struct mwl_hal_priv *mh, unsigned short cmd)
{

	MWL_HAL_LOCK_ASSERT(mh);

	if ((mh->mh_flags & MHF_FWHANG) &&
	    (mh->mh_debug & MWL_HAL_DEBUG_IGNHANG) == 0) {
#ifdef MWLHAL_DEBUG
		device_printf(mh->mh_dev, "firmware hung, skipping cmd %s\n",
			mwlcmdname(cmd));
#else
		device_printf(mh->mh_dev, "firmware hung, skipping cmd 0x%x\n",
			cmd);
#endif
		return ENXIO;
	}
	if (RD4(mh,  MACREG_REG_INT_CODE) == 0xffffffff) {
		device_printf(mh->mh_dev, "%s: device not present!\n",
		    __func__);
		return EIO;
	}
#ifdef MWLHAL_DEBUG
	if (mh->mh_debug & MWL_HAL_DEBUG_SENDCMD)
		dumpresult(mh, 0);
#endif
	mwlSendCmd(mh);
	if (!mwlWaitForCmdComplete(mh, 0x8000 | cmd)) {
#ifdef MWLHAL_DEBUG
		device_printf(mh->mh_dev,
		    "timeout waiting for f/w cmd %s\n", mwlcmdname(cmd));
#else
		device_printf(mh->mh_dev,
		    "timeout waiting for f/w cmd 0x%x\n", cmd);
#endif
		mh->mh_flags |= MHF_FWHANG;
		return ETIMEDOUT;
	}
	bus_dmamap_sync(mh->mh_dmat, mh->mh_dmamap,
	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
#ifdef MWLHAL_DEBUG
	if (mh->mh_debug & MWL_HAL_DEBUG_CMDDONE)
		dumpresult(mh, 1);
#endif
	return 0;
}

/*
 * Firmware download support.
 */
#define FW_DOWNLOAD_BLOCK_SIZE	256
#define FW_CHECK_USECS		(5*1000)	/* 5ms */
#define FW_MAX_NUM_CHECKS	200

#if 0
/* XXX read f/w from file */
#include <dev/mwl/mwlbootfw.h>
#include <dev/mwl/mwl88W8363fw.h>
#endif

static void
mwlFwReset(struct mwl_hal_priv *mh)
{
	if (RD4(mh,  MACREG_REG_INT_CODE) == 0xffffffff) {
		device_printf(mh->mh_dev, "%s: device not present!\n",
		    __func__);
		return;
	}
	WR4(mh, MACREG_REG_H2A_INTERRUPT_EVENTS, ISR_RESET);
	mh->mh_flags &= ~MHF_FWHANG;
}

static void
mwlTriggerPciCmd(struct mwl_hal_priv *mh)
{

	bus_dmamap_sync(mh->mh_dmat, mh->mh_dmamap, BUS_DMASYNC_PREWRITE);

	WR4(mh, MACREG_REG_GEN_PTR, mh->mh_cmdaddr);
	RD4(mh, MACREG_REG_INT_CODE);

	WR4(mh, MACREG_REG_INT_CODE, 0x00);
	RD4(mh, MACREG_REG_INT_CODE);

	WR4(mh, MACREG_REG_H2A_INTERRUPT_EVENTS, MACREG_H2ARIC_BIT_DOOR_BELL);
	RD4(mh, MACREG_REG_INT_CODE);
}

static int
mwlWaitFor(struct mwl_hal_priv *mh, uint32_t val)
{
	int i;

	for (i = 0; i < FW_MAX_NUM_CHECKS; i++) {
		DELAY(FW_CHECK_USECS);
		if (RD4(mh, MACREG_REG_INT_CODE) == val)
			return 1;
	}
	return 0;
}

/*
 * Firmware block xmit when talking to the boot-rom.
 */
static int
mwlSendBlock(struct mwl_hal_priv *mh, int bsize, const void *data, size_t dsize)
{
	mh->mh_cmdbuf[0] = htole16(HostCmd_CMD_CODE_DNLD);
	mh->mh_cmdbuf[1] = htole16(bsize);
	memcpy(&mh->mh_cmdbuf[4], data , dsize);
	mwlTriggerPciCmd(mh);
	/* XXX 2000 vs 200 */
	if (mwlWaitFor(mh, MACREG_INT_CODE_CMD_FINISHED)) {
		WR4(mh, MACREG_REG_INT_CODE, 0);
		return 1;
	}
	device_printf(mh->mh_dev,
	    "%s: timeout waiting for CMD_FINISHED, INT_CODE 0x%x\n",
	    __func__, RD4(mh, MACREG_REG_INT_CODE));
	return 0;
}

/*
 * Firmware block xmit when talking to the 1st-stage loader.
 */
static int
mwlSendBlock2(struct mwl_hal_priv *mh, const void *data, size_t dsize)
{
	memcpy(&mh->mh_cmdbuf[0], data, dsize);
	mwlTriggerPciCmd(mh);
	if (mwlWaitFor(mh, MACREG_INT_CODE_CMD_FINISHED)) {
		WR4(mh, MACREG_REG_INT_CODE, 0);
		return 1;
	}
	device_printf(mh->mh_dev,
	    "%s: timeout waiting for CMD_FINISHED, INT_CODE 0x%x\n",
	    __func__, RD4(mh, MACREG_REG_INT_CODE));
	return 0;
}

static void
mwlPokeSdramController(struct mwl_hal_priv *mh, int SDRAMSIZE_Addr)
{
	/** Set up sdram controller for superflyv2 **/
	WR4(mh, 0x00006014, 0x33);
	WR4(mh, 0x00006018, 0xa3a2632);
	WR4(mh, 0x00006010, SDRAMSIZE_Addr);
}

int
mwl_hal_fwload(struct mwl_hal *mh0, void *fwargs)
{
	struct mwl_hal_priv *mh = MWLPRIV(mh0);
	const char *fwname = "mw88W8363fw";
	const char *fwbootname = "mwlboot";
	const struct firmware *fwboot = NULL;
	const struct firmware *fw;
	/* XXX get from firmware header */
	uint32_t FwReadySignature = HostCmd_SOFTAP_FWRDY_SIGNATURE;
	uint32_t OpMode = HostCmd_SOFTAP_MODE;
	const uint8_t *fp, *ep;
	const uint8_t *fmdata;
	uint32_t blocksize, nbytes, fmsize;
	int i, error, ntries;

	fw = firmware_get(fwname);
	if (fw == NULL) {
		device_printf(mh->mh_dev,
		    "could not load firmware image %s\n", fwname);
		return ENXIO;
	}
	fmdata = fw->data;
	fmsize = fw->datasize;
	if (fmsize < 4) {
		device_printf(mh->mh_dev, "firmware image %s too small\n",
		    fwname);
		error = ENXIO;
		goto bad2;
	}
	if (fmdata[0] == 0x01 && fmdata[1] == 0x00 &&
	    fmdata[2] == 0x00 && fmdata[3] == 0x00) {
		/*
		 * 2-stage load, get the boot firmware.
		 */
		fwboot = firmware_get(fwbootname);
		if (fwboot == NULL) {
			device_printf(mh->mh_dev,
			    "could not load firmware image %s\n", fwbootname);
			error = ENXIO;
			goto bad2;
		}
	} else
		fwboot = NULL;

	mwlFwReset(mh);

	WR4(mh, MACREG_REG_A2H_INTERRUPT_CLEAR_SEL, MACREG_A2HRIC_BIT_MASK);
	WR4(mh, MACREG_REG_A2H_INTERRUPT_CAUSE, 0x00);
	WR4(mh, MACREG_REG_A2H_INTERRUPT_MASK, 0x00);
	WR4(mh, MACREG_REG_A2H_INTERRUPT_STATUS_MASK, MACREG_A2HRIC_BIT_MASK);
	if (mh->mh_SDRAMSIZE_Addr != 0) {
		/** Set up sdram controller for superflyv2 **/
		mwlPokeSdramController(mh, mh->mh_SDRAMSIZE_Addr);
	}
	device_printf(mh->mh_dev, "load %s firmware image (%u bytes)\n",
	    fwname, fmsize);
	if (fwboot != NULL) {
		/*
		 * Do 2-stage load.  The 1st stage loader is setup
		 * with the bootrom loader then we load the real
		 * image using a different handshake. With this
		 * mechanism the firmware is segmented into chunks
		 * that have a CRC.  If a chunk is incorrect we'll
		 * be told to retransmit.
		 */
		/* XXX assumes hlpimage fits in a block */
		/* NB: zero size block indicates download is finished */
		if (!mwlSendBlock(mh, fwboot->datasize, fwboot->data, fwboot->datasize) ||
		    !mwlSendBlock(mh, 0, NULL, 0)) {
			error = ETIMEDOUT;
			goto bad;
		}
		DELAY(200*FW_CHECK_USECS);
		if (mh->mh_SDRAMSIZE_Addr != 0) {
			/** Set up sdram controller for superflyv2 **/
			mwlPokeSdramController(mh, mh->mh_SDRAMSIZE_Addr);
		}
		nbytes = ntries = 0;		/* NB: silence compiler */
		for (fp = fmdata, ep = fp + fmsize; fp < ep; ) {
			WR4(mh, MACREG_REG_INT_CODE, 0);
			blocksize = RD4(mh, MACREG_REG_SCRATCH);
			if (blocksize == 0)	/* download complete */
				break;
			if (blocksize > 0x00000c00) {
				error = EINVAL;
				goto bad;
			}
			if ((blocksize & 0x1) == 0) {
				/* block successfully downloaded, advance */
				fp += nbytes;
				ntries = 0;
			} else {
				if (++ntries > 2) {
					/*
					 * Guard against f/w telling us to
					 * retry infinitely.
					 */
					error = ELOOP;
					goto bad;
				}
				/* clear NAK bit/flag */
				blocksize &= ~0x1;
			}
			if (blocksize > ep - fp) {
				/* XXX this should not happen, what to do? */
				blocksize = ep - fp;
			}
			nbytes = blocksize;
			if (!mwlSendBlock2(mh, fp, nbytes)) {
				error = ETIMEDOUT;
				goto bad;
			}
		}
	} else {
		for (fp = fmdata, ep = fp + fmsize; fp < ep;) {
			nbytes = ep - fp;
			if (nbytes > FW_DOWNLOAD_BLOCK_SIZE)
				nbytes = FW_DOWNLOAD_BLOCK_SIZE;
			if (!mwlSendBlock(mh, FW_DOWNLOAD_BLOCK_SIZE, fp, nbytes)) {
				error = EIO;
				goto bad;
			}
			fp += nbytes;
		}
	}
	/* done with firmware... */
	if (fwboot != NULL)
		firmware_put(fwboot, FIRMWARE_UNLOAD);
	firmware_put(fw, FIRMWARE_UNLOAD);
	/*
	 * Wait for firmware to startup; we monitor the
	 * INT_CODE register waiting for a signature to
	 * written back indicating it's ready to go.
	 */
	mh->mh_cmdbuf[1] = 0;
	/*
	 * XXX WAR for mfg fw download
	 */
	if (OpMode != HostCmd_STA_MODE)
		mwlTriggerPciCmd(mh);
	for (i = 0; i < FW_MAX_NUM_CHECKS; i++) {
		WR4(mh, MACREG_REG_GEN_PTR, OpMode);
		DELAY(FW_CHECK_USECS);
		if (RD4(mh, MACREG_REG_INT_CODE) == FwReadySignature) {
			WR4(mh, MACREG_REG_INT_CODE, 0x00);
			return mwlResetHalState(mh);
		}
	}
	return ETIMEDOUT;
bad:
	mwlFwReset(mh);
bad2:
	/* done with firmware... */
	if (fwboot != NULL)
		firmware_put(fwboot, FIRMWARE_UNLOAD);
	firmware_put(fw, FIRMWARE_UNLOAD);
	return error;
}

#ifdef MWLHAL_DEBUG
static const char *
mwlcmdname(int cmd)
{
	static char buf[12];
#define	CMD(x)	case HostCmd_CMD_##x: return #x
	switch (cmd) {
	CMD(CODE_DNLD);
	CMD(GET_HW_SPEC);
	CMD(SET_HW_SPEC);
	CMD(MAC_MULTICAST_ADR);
	CMD(802_11_GET_STAT);
	CMD(MAC_REG_ACCESS);
	CMD(BBP_REG_ACCESS);
	CMD(RF_REG_ACCESS);
	CMD(802_11_RADIO_CONTROL);
	CMD(802_11_RF_TX_POWER);
	CMD(802_11_RF_ANTENNA);
	CMD(SET_BEACON);
	CMD(SET_RF_CHANNEL);
	CMD(SET_AID);
	CMD(SET_INFRA_MODE);
	CMD(SET_G_PROTECT_FLAG);
	CMD(802_11_RTS_THSD);
	CMD(802_11_SET_SLOT);
	CMD(SET_EDCA_PARAMS);
	CMD(802_11H_DETECT_RADAR);
	CMD(SET_WMM_MODE);
	CMD(HT_GUARD_INTERVAL);
	CMD(SET_FIXED_RATE);
	CMD(SET_LINKADAPT_CS_MODE);
	CMD(SET_MAC_ADDR);
	CMD(SET_RATE_ADAPT_MODE);
	CMD(BSS_START);
	CMD(SET_NEW_STN);
	CMD(SET_KEEP_ALIVE);
	CMD(SET_APMODE);
	CMD(SET_SWITCH_CHANNEL);
	CMD(UPDATE_ENCRYPTION);
	CMD(BASTREAM);
	CMD(SET_RIFS);
	CMD(SET_N_PROTECT_FLAG);
	CMD(SET_N_PROTECT_OPMODE);
	CMD(SET_OPTIMIZATION_LEVEL);
	CMD(GET_CALTABLE);
	CMD(SET_MIMOPSHT);
	CMD(GET_BEACON);
	CMD(SET_REGION_CODE);
	CMD(SET_POWERSAVESTATION);
	CMD(SET_TIM);
	CMD(GET_TIM);
	CMD(GET_SEQNO);
	CMD(DWDS_ENABLE);
	CMD(AMPDU_RETRY_RATEDROP_MODE);
	CMD(CFEND_ENABLE);
	}
	snprintf(buf, sizeof(buf), "0x%x", cmd);
	return buf;
#undef CMD
}

static void
dumpresult(struct mwl_hal_priv *mh, int showresult)
{
	const FWCmdHdr *h = (const FWCmdHdr *)mh->mh_cmdbuf;
	const uint8_t *cp;
	int len, i;

	len = le16toh(h->Length);
#ifdef MWL_MBSS_SUPPORT
	device_printf(mh->mh_dev, "Cmd %s Length %d SeqNum %d MacId %d",
	    mwlcmdname(le16toh(h->Cmd) &~ 0x8000), len, h->SeqNum, h->MacId);
#else
	device_printf(mh->mh_dev, "Cmd %s Length %d SeqNum %d",
	    mwlcmdname(le16toh(h->Cmd) &~ 0x8000), len, le16toh(h->SeqNum));
#endif
	if (showresult) {
		const char *results[] =
		    { "OK", "ERROR", "NOT_SUPPORT", "PENDING", "BUSY",
		      "PARTIAL_DATA" };
		int result = le16toh(h->Result);

		if (result <= HostCmd_RESULT_PARTIAL_DATA)
			printf(" Result %s", results[result]);
		else
			printf(" Result %d", result);
	}
	cp = (const uint8_t *)h;
	for (i = 0; i < len; i++) {
		if ((i % 16) == 0)
			printf("\n%02x", cp[i]);
		else
			printf(" %02x", cp[i]);
	}
	printf("\n");
}
#endif /* MWLHAL_DEBUG */