if_bwn.c revision 298944
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 298944 2016-05-02 21:06:02Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include <sys/param.h>
38#include <sys/systm.h>
39#include <sys/kernel.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/endian.h>
43#include <sys/errno.h>
44#include <sys/firmware.h>
45#include <sys/lock.h>
46#include <sys/mutex.h>
47#include <machine/bus.h>
48#include <machine/resource.h>
49#include <sys/bus.h>
50#include <sys/rman.h>
51#include <sys/socket.h>
52#include <sys/sockio.h>
53
54#include <net/ethernet.h>
55#include <net/if.h>
56#include <net/if_var.h>
57#include <net/if_arp.h>
58#include <net/if_dl.h>
59#include <net/if_llc.h>
60#include <net/if_media.h>
61#include <net/if_types.h>
62
63#include <dev/pci/pcivar.h>
64#include <dev/pci/pcireg.h>
65#include <dev/siba/siba_ids.h>
66#include <dev/siba/sibareg.h>
67#include <dev/siba/sibavar.h>
68
69#include <net80211/ieee80211_var.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_regdomain.h>
72#include <net80211/ieee80211_phy.h>
73#include <net80211/ieee80211_ratectl.h>
74
75#include <dev/bwn/if_bwnreg.h>
76#include <dev/bwn/if_bwnvar.h>
77
78#include <dev/bwn/if_bwn_misc.h>
79#include <dev/bwn/if_bwn_phy_lp.h>
80
81static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
82    "Broadcom driver parameters");
83
84/*
85 * Tunable & sysctl variables.
86 */
87
88#ifdef BWN_DEBUG
89static	int bwn_debug = 0;
90SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
91    "Broadcom debugging printfs");
92enum {
93	BWN_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
94	BWN_DEBUG_RECV		= 0x00000002,	/* basic recv operation */
95	BWN_DEBUG_STATE		= 0x00000004,	/* 802.11 state transitions */
96	BWN_DEBUG_TXPOW		= 0x00000008,	/* tx power processing */
97	BWN_DEBUG_RESET		= 0x00000010,	/* reset processing */
98	BWN_DEBUG_OPS		= 0x00000020,	/* bwn_ops processing */
99	BWN_DEBUG_BEACON	= 0x00000040,	/* beacon handling */
100	BWN_DEBUG_WATCHDOG	= 0x00000080,	/* watchdog timeout */
101	BWN_DEBUG_INTR		= 0x00000100,	/* ISR */
102	BWN_DEBUG_CALIBRATE	= 0x00000200,	/* periodic calibration */
103	BWN_DEBUG_NODE		= 0x00000400,	/* node management */
104	BWN_DEBUG_LED		= 0x00000800,	/* led management */
105	BWN_DEBUG_CMD		= 0x00001000,	/* cmd submission */
106	BWN_DEBUG_LO		= 0x00002000,	/* LO */
107	BWN_DEBUG_FW		= 0x00004000,	/* firmware */
108	BWN_DEBUG_WME		= 0x00008000,	/* WME */
109	BWN_DEBUG_RF		= 0x00010000,	/* RF */
110	BWN_DEBUG_FATAL		= 0x80000000,	/* fatal errors */
111	BWN_DEBUG_ANY		= 0xffffffff
112};
113#define	DPRINTF(sc, m, fmt, ...) do {			\
114	if (sc->sc_debug & (m))				\
115		printf(fmt, __VA_ARGS__);		\
116} while (0)
117#else
118#define	DPRINTF(sc, m, fmt, ...) do { (void) sc; } while (0)
119#endif
120
121static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
122SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
123    "uses Bad Frames Preemption");
124static int	bwn_bluetooth = 1;
125SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
126    "turns on Bluetooth Coexistence");
127static int	bwn_hwpctl = 0;
128SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
129    "uses H/W power control");
130static int	bwn_msi_disable = 0;		/* MSI disabled  */
131TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
132static int	bwn_usedma = 1;
133SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
134    "uses DMA");
135TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
136static int	bwn_wme = 1;
137SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
138    "uses WME support");
139
140static void	bwn_attach_pre(struct bwn_softc *);
141static int	bwn_attach_post(struct bwn_softc *);
142static void	bwn_sprom_bugfixes(device_t);
143static int	bwn_init(struct bwn_softc *);
144static void	bwn_parent(struct ieee80211com *);
145static void	bwn_start(struct bwn_softc *);
146static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
147static int	bwn_attach_core(struct bwn_mac *);
148static void	bwn_reset_core(struct bwn_mac *, uint32_t);
149static int	bwn_phy_getinfo(struct bwn_mac *, int);
150static int	bwn_chiptest(struct bwn_mac *);
151static int	bwn_setup_channels(struct bwn_mac *, int, int);
152static int	bwn_phy_g_attach(struct bwn_mac *);
153static void	bwn_phy_g_detach(struct bwn_mac *);
154static void	bwn_phy_g_init_pre(struct bwn_mac *);
155static int	bwn_phy_g_prepare_hw(struct bwn_mac *);
156static int	bwn_phy_g_init(struct bwn_mac *);
157static void	bwn_phy_g_exit(struct bwn_mac *);
158static uint16_t	bwn_phy_g_read(struct bwn_mac *, uint16_t);
159static void	bwn_phy_g_write(struct bwn_mac *, uint16_t,
160		    uint16_t);
161static uint16_t	bwn_phy_g_rf_read(struct bwn_mac *, uint16_t);
162static void	bwn_phy_g_rf_write(struct bwn_mac *, uint16_t,
163		    uint16_t);
164static int	bwn_phy_g_hwpctl(struct bwn_mac *);
165static void	bwn_phy_g_rf_onoff(struct bwn_mac *, int);
166static int	bwn_phy_g_switch_channel(struct bwn_mac *, uint32_t);
167static uint32_t	bwn_phy_g_get_default_chan(struct bwn_mac *);
168static void	bwn_phy_g_set_antenna(struct bwn_mac *, int);
169static int	bwn_phy_g_im(struct bwn_mac *, int);
170static int	bwn_phy_g_recalc_txpwr(struct bwn_mac *, int);
171static void	bwn_phy_g_set_txpwr(struct bwn_mac *);
172static void	bwn_phy_g_task_15s(struct bwn_mac *);
173static void	bwn_phy_g_task_60s(struct bwn_mac *);
174static uint16_t	bwn_phy_g_txctl(struct bwn_mac *);
175static void	bwn_phy_switch_analog(struct bwn_mac *, int);
176static uint16_t	bwn_shm_read_2(struct bwn_mac *, uint16_t, uint16_t);
177static void	bwn_shm_write_2(struct bwn_mac *, uint16_t, uint16_t,
178		    uint16_t);
179static uint32_t	bwn_shm_read_4(struct bwn_mac *, uint16_t, uint16_t);
180static void	bwn_shm_write_4(struct bwn_mac *, uint16_t, uint16_t,
181		    uint32_t);
182static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
183		    uint16_t);
184static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
185		    const struct bwn_channelinfo *, int);
186static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
187		    const struct ieee80211_bpf_params *);
188static void	bwn_updateslot(struct ieee80211com *);
189static void	bwn_update_promisc(struct ieee80211com *);
190static void	bwn_wme_init(struct bwn_mac *);
191static int	bwn_wme_update(struct ieee80211com *);
192static void	bwn_wme_clear(struct bwn_softc *);
193static void	bwn_wme_load(struct bwn_mac *);
194static void	bwn_wme_loadparams(struct bwn_mac *,
195		    const struct wmeParams *, uint16_t);
196static void	bwn_scan_start(struct ieee80211com *);
197static void	bwn_scan_end(struct ieee80211com *);
198static void	bwn_set_channel(struct ieee80211com *);
199static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
200		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
201		    const uint8_t [IEEE80211_ADDR_LEN],
202		    const uint8_t [IEEE80211_ADDR_LEN]);
203static void	bwn_vap_delete(struct ieee80211vap *);
204static void	bwn_stop(struct bwn_softc *);
205static int	bwn_core_init(struct bwn_mac *);
206static void	bwn_core_start(struct bwn_mac *);
207static void	bwn_core_exit(struct bwn_mac *);
208static void	bwn_bt_disable(struct bwn_mac *);
209static int	bwn_chip_init(struct bwn_mac *);
210static void	bwn_set_txretry(struct bwn_mac *, int, int);
211static void	bwn_rate_init(struct bwn_mac *);
212static void	bwn_set_phytxctl(struct bwn_mac *);
213static void	bwn_spu_setdelay(struct bwn_mac *, int);
214static void	bwn_bt_enable(struct bwn_mac *);
215static void	bwn_set_macaddr(struct bwn_mac *);
216static void	bwn_crypt_init(struct bwn_mac *);
217static void	bwn_chip_exit(struct bwn_mac *);
218static int	bwn_fw_fillinfo(struct bwn_mac *);
219static int	bwn_fw_loaducode(struct bwn_mac *);
220static int	bwn_gpio_init(struct bwn_mac *);
221static int	bwn_fw_loadinitvals(struct bwn_mac *);
222static int	bwn_phy_init(struct bwn_mac *);
223static void	bwn_set_txantenna(struct bwn_mac *, int);
224static void	bwn_set_opmode(struct bwn_mac *);
225static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
226static uint8_t	bwn_plcp_getcck(const uint8_t);
227static uint8_t	bwn_plcp_getofdm(const uint8_t);
228static void	bwn_pio_init(struct bwn_mac *);
229static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
230static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
231		    int);
232static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
233		    struct bwn_pio_rxqueue *, int);
234static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
235static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
236		    uint16_t);
237static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
238static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
239static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
240static void	bwn_pio_handle_txeof(struct bwn_mac *,
241		    const struct bwn_txstatus *);
242static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
243static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
244static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
245		    uint16_t);
246static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
247		    uint32_t);
248static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
249		    struct mbuf *);
250static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
251static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
252		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
253static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
254		    uint16_t, uint32_t);
255static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
256		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
257static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
258		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
259static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
260		    uint16_t, struct bwn_pio_txpkt **);
261static void	bwn_dma_init(struct bwn_mac *);
262static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
263static int	bwn_dma_mask2type(uint64_t);
264static uint64_t	bwn_dma_mask(struct bwn_mac *);
265static uint16_t	bwn_dma_base(int, int);
266static void	bwn_dma_ringfree(struct bwn_dma_ring **);
267static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
268		    int, struct bwn_dmadesc_generic **,
269		    struct bwn_dmadesc_meta **);
270static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
271		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
272		    int, int);
273static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
274static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
275static void	bwn_dma_32_resume(struct bwn_dma_ring *);
276static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
277static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
278static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
279		    int, struct bwn_dmadesc_generic **,
280		    struct bwn_dmadesc_meta **);
281static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
282		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
283		    int, int);
284static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
285static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
286static void	bwn_dma_64_resume(struct bwn_dma_ring *);
287static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
288static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
289static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
290static void	bwn_dma_setup(struct bwn_dma_ring *);
291static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
292static void	bwn_dma_cleanup(struct bwn_dma_ring *);
293static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
294static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
295static void	bwn_dma_rx(struct bwn_dma_ring *);
296static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
297static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
298		    struct bwn_dmadesc_meta *);
299static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
300static int	bwn_dma_gettype(struct bwn_mac *);
301static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
302static int	bwn_dma_freeslot(struct bwn_dma_ring *);
303static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
304static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
305static int	bwn_dma_newbuf(struct bwn_dma_ring *,
306		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
307		    int);
308static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
309		    bus_size_t, int);
310static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
311static void	bwn_dma_handle_txeof(struct bwn_mac *,
312		    const struct bwn_txstatus *);
313static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
314		    struct mbuf *);
315static int	bwn_dma_getslot(struct bwn_dma_ring *);
316static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
317		    uint8_t);
318static int	bwn_dma_attach(struct bwn_mac *);
319static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
320		    int, int, int);
321static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
322		    const struct bwn_txstatus *, uint16_t, int *);
323static void	bwn_dma_free(struct bwn_mac *);
324static void	bwn_phy_g_init_sub(struct bwn_mac *);
325static uint8_t	bwn_has_hwpctl(struct bwn_mac *);
326static void	bwn_phy_init_b5(struct bwn_mac *);
327static void	bwn_phy_init_b6(struct bwn_mac *);
328static void	bwn_phy_init_a(struct bwn_mac *);
329static void	bwn_loopback_calcgain(struct bwn_mac *);
330static uint16_t	bwn_rf_init_bcm2050(struct bwn_mac *);
331static void	bwn_lo_g_init(struct bwn_mac *);
332static void	bwn_lo_g_adjust(struct bwn_mac *);
333static void	bwn_lo_get_powervector(struct bwn_mac *);
334static struct bwn_lo_calib *bwn_lo_calibset(struct bwn_mac *,
335		    const struct bwn_bbatt *, const struct bwn_rfatt *);
336static void	bwn_lo_write(struct bwn_mac *, struct bwn_loctl *);
337static void	bwn_phy_hwpctl_init(struct bwn_mac *);
338static void	bwn_phy_g_switch_chan(struct bwn_mac *, int, uint8_t);
339static void	bwn_phy_g_set_txpwr_sub(struct bwn_mac *,
340		    const struct bwn_bbatt *, const struct bwn_rfatt *,
341		    uint8_t);
342static void	bwn_phy_g_set_bbatt(struct bwn_mac *, uint16_t);
343static uint16_t	bwn_rf_2050_rfoverval(struct bwn_mac *, uint16_t, uint32_t);
344static void	bwn_spu_workaround(struct bwn_mac *, uint8_t);
345static void	bwn_wa_init(struct bwn_mac *);
346static void	bwn_ofdmtab_write_2(struct bwn_mac *, uint16_t, uint16_t,
347		    uint16_t);
348static void	bwn_dummy_transmission(struct bwn_mac *, int, int);
349static void	bwn_ofdmtab_write_4(struct bwn_mac *, uint16_t, uint16_t,
350		    uint32_t);
351static void	bwn_gtab_write(struct bwn_mac *, uint16_t, uint16_t,
352		    uint16_t);
353static void	bwn_ram_write(struct bwn_mac *, uint16_t, uint32_t);
354static void	bwn_psctl(struct bwn_mac *, uint32_t);
355static int16_t	bwn_nrssi_read(struct bwn_mac *, uint16_t);
356static void	bwn_nrssi_offset(struct bwn_mac *);
357static void	bwn_nrssi_threshold(struct bwn_mac *);
358static void	bwn_nrssi_slope_11g(struct bwn_mac *);
359static void	bwn_set_all_gains(struct bwn_mac *, int16_t, int16_t,
360		    int16_t);
361static void	bwn_set_original_gains(struct bwn_mac *);
362static void	bwn_hwpctl_early_init(struct bwn_mac *);
363static void	bwn_hwpctl_init_gphy(struct bwn_mac *);
364static uint16_t	bwn_phy_g_chan2freq(uint8_t);
365static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
366static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
367		    const char *, struct bwn_fwfile *);
368static void	bwn_release_firmware(struct bwn_mac *);
369static void	bwn_do_release_fw(struct bwn_fwfile *);
370static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
371static int	bwn_fwinitvals_write(struct bwn_mac *,
372		    const struct bwn_fwinitvals *, size_t, size_t);
373static int	bwn_switch_channel(struct bwn_mac *, int);
374static uint16_t	bwn_ant2phy(int);
375static void	bwn_mac_write_bssid(struct bwn_mac *);
376static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
377		    const uint8_t *);
378static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
379		    const uint8_t *, size_t, const uint8_t *);
380static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
381		    const uint8_t *);
382static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
383		    const uint8_t *);
384static void	bwn_phy_exit(struct bwn_mac *);
385static void	bwn_core_stop(struct bwn_mac *);
386static int	bwn_switch_band(struct bwn_softc *,
387		    struct ieee80211_channel *);
388static void	bwn_phy_reset(struct bwn_mac *);
389static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
390static void	bwn_set_pretbtt(struct bwn_mac *);
391static int	bwn_intr(void *);
392static void	bwn_intrtask(void *, int);
393static void	bwn_restart(struct bwn_mac *, const char *);
394static void	bwn_intr_ucode_debug(struct bwn_mac *);
395static void	bwn_intr_tbtt_indication(struct bwn_mac *);
396static void	bwn_intr_atim_end(struct bwn_mac *);
397static void	bwn_intr_beacon(struct bwn_mac *);
398static void	bwn_intr_pmq(struct bwn_mac *);
399static void	bwn_intr_noise(struct bwn_mac *);
400static void	bwn_intr_txeof(struct bwn_mac *);
401static void	bwn_hwreset(void *, int);
402static void	bwn_handle_fwpanic(struct bwn_mac *);
403static void	bwn_load_beacon0(struct bwn_mac *);
404static void	bwn_load_beacon1(struct bwn_mac *);
405static uint32_t	bwn_jssi_read(struct bwn_mac *);
406static void	bwn_noise_gensample(struct bwn_mac *);
407static void	bwn_handle_txeof(struct bwn_mac *,
408		    const struct bwn_txstatus *);
409static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
410static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
411static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
412		    struct mbuf *);
413static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
414static int	bwn_set_txhdr(struct bwn_mac *,
415		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
416		    uint16_t);
417static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
418		    const uint8_t);
419static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
420static uint8_t	bwn_get_fbrate(uint8_t);
421static int	bwn_phy_shm_tssi_read(struct bwn_mac *, uint16_t);
422static void	bwn_phy_g_setatt(struct bwn_mac *, int *, int *);
423static void	bwn_phy_lock(struct bwn_mac *);
424static void	bwn_phy_unlock(struct bwn_mac *);
425static void	bwn_rf_lock(struct bwn_mac *);
426static void	bwn_rf_unlock(struct bwn_mac *);
427static void	bwn_txpwr(void *, int);
428static void	bwn_tasks(void *);
429static void	bwn_task_15s(struct bwn_mac *);
430static void	bwn_task_30s(struct bwn_mac *);
431static void	bwn_task_60s(struct bwn_mac *);
432static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
433		    uint8_t);
434static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
435static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
436		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
437		    int, int);
438static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
439static void	bwn_phy_g_dc_lookup_init(struct bwn_mac *, uint8_t);
440static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
441static void	bwn_watchdog(void *);
442static void	bwn_dma_stop(struct bwn_mac *);
443static void	bwn_pio_stop(struct bwn_mac *);
444static void	bwn_dma_ringstop(struct bwn_dma_ring **);
445static void	bwn_led_attach(struct bwn_mac *);
446static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
447static void	bwn_led_event(struct bwn_mac *, int);
448static void	bwn_led_blink_start(struct bwn_mac *, int, int);
449static void	bwn_led_blink_next(void *);
450static void	bwn_led_blink_end(void *);
451static void	bwn_rfswitch(void *);
452static void	bwn_rf_turnon(struct bwn_mac *);
453static void	bwn_rf_turnoff(struct bwn_mac *);
454static void	bwn_sysctl_node(struct bwn_softc *);
455
456static struct resource_spec bwn_res_spec_legacy[] = {
457	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
458	{ -1,			0,		0 }
459};
460
461static struct resource_spec bwn_res_spec_msi[] = {
462	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
463	{ -1,			0,		0 }
464};
465
466static const struct bwn_channelinfo bwn_chantable_bg = {
467	.channels = {
468		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
469		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
470		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
471		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
472		{ 2472, 13, 30 }, { 2484, 14, 30 } },
473	.nchannels = 14
474};
475
476static const struct bwn_channelinfo bwn_chantable_a = {
477	.channels = {
478		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
479		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
480		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
481		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
482		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
483		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
484		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
485		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
486		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
487		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
488		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
489		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
490		{ 6080, 216, 30 } },
491	.nchannels = 37
492};
493
494static const struct bwn_channelinfo bwn_chantable_n = {
495	.channels = {
496		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
497		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
498		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
499		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
500		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
501		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
502		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
503		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
504		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
505		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
506		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
507		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
508		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
509		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
510		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
511		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
512		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
513		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
514		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
515		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
516		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
517		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
518		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
519		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
520		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
521		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
522		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
523		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
524		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
525		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
526		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
527		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
528		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
529		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
530		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
531		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
532		{ 6130, 226, 30 }, { 6140, 228, 30 } },
533	.nchannels = 110
534};
535
536static const uint16_t bwn_tab_noise_g1[] = BWN_TAB_NOISE_G1;
537static const uint16_t bwn_tab_noise_g2[] = BWN_TAB_NOISE_G2;
538static const uint16_t bwn_tab_noisescale_g1[] = BWN_TAB_NOISESCALE_G1;
539static const uint16_t bwn_tab_noisescale_g2[] = BWN_TAB_NOISESCALE_G2;
540static const uint16_t bwn_tab_noisescale_g3[] = BWN_TAB_NOISESCALE_G3;
541const uint8_t bwn_bitrev_table[256] = BWN_BITREV_TABLE;
542
543#define	VENDOR_LED_ACT(vendor)				\
544{							\
545	.vid = PCI_VENDOR_##vendor,			\
546	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
547}
548
549static const struct {
550	uint16_t	vid;
551	uint8_t		led_act[BWN_LED_MAX];
552} bwn_vendor_led_act[] = {
553	VENDOR_LED_ACT(COMPAQ),
554	VENDOR_LED_ACT(ASUSTEK)
555};
556
557static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
558	{ BWN_VENDOR_LED_ACT_DEFAULT };
559
560#undef VENDOR_LED_ACT
561
562static const struct {
563	int		on_dur;
564	int		off_dur;
565} bwn_led_duration[109] = {
566	[0]	= { 400, 100 },
567	[2]	= { 150, 75 },
568	[4]	= { 90, 45 },
569	[11]	= { 66, 34 },
570	[12]	= { 53, 26 },
571	[18]	= { 42, 21 },
572	[22]	= { 35, 17 },
573	[24]	= { 32, 16 },
574	[36]	= { 21, 10 },
575	[48]	= { 16, 8 },
576	[72]	= { 11, 5 },
577	[96]	= { 9, 4 },
578	[108]	= { 7, 3 }
579};
580
581static const uint16_t bwn_wme_shm_offsets[] = {
582	[0] = BWN_WME_BESTEFFORT,
583	[1] = BWN_WME_BACKGROUND,
584	[2] = BWN_WME_VOICE,
585	[3] = BWN_WME_VIDEO,
586};
587
588static const struct siba_devid bwn_devs[] = {
589	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
590	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
591	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
592	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
593	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
594	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
595	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
596	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
597	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
598};
599
600static int
601bwn_probe(device_t dev)
602{
603	int i;
604
605	for (i = 0; i < nitems(bwn_devs); i++) {
606		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
607		    siba_get_device(dev) == bwn_devs[i].sd_device &&
608		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
609			return (BUS_PROBE_DEFAULT);
610	}
611
612	return (ENXIO);
613}
614
615static int
616bwn_attach(device_t dev)
617{
618	struct bwn_mac *mac;
619	struct bwn_softc *sc = device_get_softc(dev);
620	int error, i, msic, reg;
621
622	sc->sc_dev = dev;
623#ifdef BWN_DEBUG
624	sc->sc_debug = bwn_debug;
625#endif
626
627	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
628		bwn_attach_pre(sc);
629		bwn_sprom_bugfixes(dev);
630		sc->sc_flags |= BWN_FLAG_ATTACHED;
631	}
632
633	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
634		if (siba_get_pci_device(dev) != 0x4313 &&
635		    siba_get_pci_device(dev) != 0x431a &&
636		    siba_get_pci_device(dev) != 0x4321) {
637			device_printf(sc->sc_dev,
638			    "skip 802.11 cores\n");
639			return (ENODEV);
640		}
641	}
642
643	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
644	mac->mac_sc = sc;
645	mac->mac_status = BWN_MAC_STATUS_UNINIT;
646	if (bwn_bfp != 0)
647		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
648
649	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
650	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
651	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
652
653	error = bwn_attach_core(mac);
654	if (error)
655		goto fail0;
656	bwn_led_attach(mac);
657
658	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
659	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
660	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
661	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
662	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
663	    mac->mac_phy.rf_rev);
664	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
665		device_printf(sc->sc_dev, "DMA (%d bits)\n",
666		    mac->mac_method.dma.dmatype);
667	else
668		device_printf(sc->sc_dev, "PIO\n");
669
670	/*
671	 * setup PCI resources and interrupt.
672	 */
673	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
674		msic = pci_msi_count(dev);
675		if (bootverbose)
676			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
677	} else
678		msic = 0;
679
680	mac->mac_intr_spec = bwn_res_spec_legacy;
681	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
682		if (pci_alloc_msi(dev, &msic) == 0) {
683			device_printf(sc->sc_dev,
684			    "Using %d MSI messages\n", msic);
685			mac->mac_intr_spec = bwn_res_spec_msi;
686			mac->mac_msi = 1;
687		}
688	}
689
690	error = bus_alloc_resources(dev, mac->mac_intr_spec,
691	    mac->mac_res_irq);
692	if (error) {
693		device_printf(sc->sc_dev,
694		    "couldn't allocate IRQ resources (%d)\n", error);
695		goto fail1;
696	}
697
698	if (mac->mac_msi == 0)
699		error = bus_setup_intr(dev, mac->mac_res_irq[0],
700		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
701		    &mac->mac_intrhand[0]);
702	else {
703		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
704			error = bus_setup_intr(dev, mac->mac_res_irq[i],
705			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
706			    &mac->mac_intrhand[i]);
707			if (error != 0) {
708				device_printf(sc->sc_dev,
709				    "couldn't setup interrupt (%d)\n", error);
710				break;
711			}
712		}
713	}
714
715	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
716
717	/*
718	 * calls attach-post routine
719	 */
720	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
721		bwn_attach_post(sc);
722
723	return (0);
724fail1:
725	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
726		pci_release_msi(dev);
727fail0:
728	free(mac, M_DEVBUF);
729	return (error);
730}
731
732static int
733bwn_is_valid_ether_addr(uint8_t *addr)
734{
735	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
736
737	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
738		return (FALSE);
739
740	return (TRUE);
741}
742
743static int
744bwn_attach_post(struct bwn_softc *sc)
745{
746	struct ieee80211com *ic = &sc->sc_ic;
747
748	ic->ic_softc = sc;
749	ic->ic_name = device_get_nameunit(sc->sc_dev);
750	/* XXX not right but it's not used anywhere important */
751	ic->ic_phytype = IEEE80211_T_OFDM;
752	ic->ic_opmode = IEEE80211_M_STA;
753	ic->ic_caps =
754		  IEEE80211_C_STA		/* station mode supported */
755		| IEEE80211_C_MONITOR		/* monitor mode */
756		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
757		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
758		| IEEE80211_C_SHSLOT		/* short slot time supported */
759		| IEEE80211_C_WME		/* WME/WMM supported */
760		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
761		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
762		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
763		;
764
765	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
766
767	IEEE80211_ADDR_COPY(ic->ic_macaddr,
768	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
769	    siba_sprom_get_mac_80211a(sc->sc_dev) :
770	    siba_sprom_get_mac_80211bg(sc->sc_dev));
771
772	/* call MI attach routine. */
773	ieee80211_ifattach(ic);
774
775	ic->ic_headroom = sizeof(struct bwn_txhdr);
776
777	/* override default methods */
778	ic->ic_raw_xmit = bwn_raw_xmit;
779	ic->ic_updateslot = bwn_updateslot;
780	ic->ic_update_promisc = bwn_update_promisc;
781	ic->ic_wme.wme_update = bwn_wme_update;
782	ic->ic_scan_start = bwn_scan_start;
783	ic->ic_scan_end = bwn_scan_end;
784	ic->ic_set_channel = bwn_set_channel;
785	ic->ic_vap_create = bwn_vap_create;
786	ic->ic_vap_delete = bwn_vap_delete;
787	ic->ic_transmit = bwn_transmit;
788	ic->ic_parent = bwn_parent;
789
790	ieee80211_radiotap_attach(ic,
791	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
792	    BWN_TX_RADIOTAP_PRESENT,
793	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
794	    BWN_RX_RADIOTAP_PRESENT);
795
796	bwn_sysctl_node(sc);
797
798	if (bootverbose)
799		ieee80211_announce(ic);
800	return (0);
801}
802
803static void
804bwn_phy_detach(struct bwn_mac *mac)
805{
806
807	if (mac->mac_phy.detach != NULL)
808		mac->mac_phy.detach(mac);
809}
810
811static int
812bwn_detach(device_t dev)
813{
814	struct bwn_softc *sc = device_get_softc(dev);
815	struct bwn_mac *mac = sc->sc_curmac;
816	struct ieee80211com *ic = &sc->sc_ic;
817	int i;
818
819	sc->sc_flags |= BWN_FLAG_INVALID;
820
821	if (device_is_attached(sc->sc_dev)) {
822		BWN_LOCK(sc);
823		bwn_stop(sc);
824		BWN_UNLOCK(sc);
825		bwn_dma_free(mac);
826		callout_drain(&sc->sc_led_blink_ch);
827		callout_drain(&sc->sc_rfswitch_ch);
828		callout_drain(&sc->sc_task_ch);
829		callout_drain(&sc->sc_watchdog_ch);
830		bwn_phy_detach(mac);
831		ieee80211_draintask(ic, &mac->mac_hwreset);
832		ieee80211_draintask(ic, &mac->mac_txpower);
833		ieee80211_ifdetach(ic);
834	}
835	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
836	taskqueue_free(sc->sc_tq);
837
838	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
839		if (mac->mac_intrhand[i] != NULL) {
840			bus_teardown_intr(dev, mac->mac_res_irq[i],
841			    mac->mac_intrhand[i]);
842			mac->mac_intrhand[i] = NULL;
843		}
844	}
845	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
846	if (mac->mac_msi != 0)
847		pci_release_msi(dev);
848	mbufq_drain(&sc->sc_snd);
849	BWN_LOCK_DESTROY(sc);
850	return (0);
851}
852
853static void
854bwn_attach_pre(struct bwn_softc *sc)
855{
856
857	BWN_LOCK_INIT(sc);
858	TAILQ_INIT(&sc->sc_maclist);
859	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
860	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
861	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
862	mbufq_init(&sc->sc_snd, ifqmaxlen);
863	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
864		taskqueue_thread_enqueue, &sc->sc_tq);
865	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
866		"%s taskq", device_get_nameunit(sc->sc_dev));
867}
868
869static void
870bwn_sprom_bugfixes(device_t dev)
871{
872#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
873	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
874	 (siba_get_pci_device(dev) == _device) &&			\
875	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
876	 (siba_get_pci_subdevice(dev) == _subdevice))
877
878	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
879	    siba_get_pci_subdevice(dev) == 0x4e &&
880	    siba_get_pci_revid(dev) > 0x40)
881		siba_sprom_set_bf_lo(dev,
882		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
883	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
884	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
885		siba_sprom_set_bf_lo(dev,
886		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
887	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
888		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
889		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
890		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
891		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
892		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
893		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
894		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
895			siba_sprom_set_bf_lo(dev,
896			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
897	}
898#undef	BWN_ISDEV
899}
900
901static void
902bwn_parent(struct ieee80211com *ic)
903{
904	struct bwn_softc *sc = ic->ic_softc;
905	int startall = 0;
906
907	BWN_LOCK(sc);
908	if (ic->ic_nrunning > 0) {
909		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
910			bwn_init(sc);
911			startall = 1;
912		} else
913			bwn_update_promisc(ic);
914	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
915		bwn_stop(sc);
916	BWN_UNLOCK(sc);
917
918	if (startall)
919		ieee80211_start_all(ic);
920}
921
922static int
923bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
924{
925	struct bwn_softc *sc = ic->ic_softc;
926	int error;
927
928	BWN_LOCK(sc);
929	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
930		BWN_UNLOCK(sc);
931		return (ENXIO);
932	}
933	error = mbufq_enqueue(&sc->sc_snd, m);
934	if (error) {
935		BWN_UNLOCK(sc);
936		return (error);
937	}
938	bwn_start(sc);
939	BWN_UNLOCK(sc);
940	return (0);
941}
942
943static void
944bwn_start(struct bwn_softc *sc)
945{
946	struct bwn_mac *mac = sc->sc_curmac;
947	struct ieee80211_frame *wh;
948	struct ieee80211_node *ni;
949	struct ieee80211_key *k;
950	struct mbuf *m;
951
952	BWN_ASSERT_LOCKED(sc);
953
954	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
955	    mac->mac_status < BWN_MAC_STATUS_STARTED)
956		return;
957
958	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
959		if (bwn_tx_isfull(sc, m))
960			break;
961		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
962		if (ni == NULL) {
963			device_printf(sc->sc_dev, "unexpected NULL ni\n");
964			m_freem(m);
965			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
966			continue;
967		}
968		wh = mtod(m, struct ieee80211_frame *);
969		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
970			k = ieee80211_crypto_encap(ni, m);
971			if (k == NULL) {
972				if_inc_counter(ni->ni_vap->iv_ifp,
973				    IFCOUNTER_OERRORS, 1);
974				ieee80211_free_node(ni);
975				m_freem(m);
976				continue;
977			}
978		}
979		wh = NULL;	/* Catch any invalid use */
980		if (bwn_tx_start(sc, ni, m) != 0) {
981			if (ni != NULL) {
982				if_inc_counter(ni->ni_vap->iv_ifp,
983				    IFCOUNTER_OERRORS, 1);
984				ieee80211_free_node(ni);
985			}
986			continue;
987		}
988		sc->sc_watchdog_timer = 5;
989	}
990}
991
992static int
993bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
994{
995	struct bwn_dma_ring *dr;
996	struct bwn_mac *mac = sc->sc_curmac;
997	struct bwn_pio_txqueue *tq;
998	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
999
1000	BWN_ASSERT_LOCKED(sc);
1001
1002	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1003		dr = bwn_dma_select(mac, M_WME_GETAC(m));
1004		if (dr->dr_stop == 1 ||
1005		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1006			dr->dr_stop = 1;
1007			goto full;
1008		}
1009	} else {
1010		tq = bwn_pio_select(mac, M_WME_GETAC(m));
1011		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1012		    pktlen > (tq->tq_size - tq->tq_used))
1013			goto full;
1014	}
1015	return (0);
1016full:
1017	mbufq_prepend(&sc->sc_snd, m);
1018	return (1);
1019}
1020
1021static int
1022bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1023{
1024	struct bwn_mac *mac = sc->sc_curmac;
1025	int error;
1026
1027	BWN_ASSERT_LOCKED(sc);
1028
1029	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1030		m_freem(m);
1031		return (ENXIO);
1032	}
1033
1034	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1035	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
1036	if (error) {
1037		m_freem(m);
1038		return (error);
1039	}
1040	return (0);
1041}
1042
1043static int
1044bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1045{
1046	struct bwn_pio_txpkt *tp;
1047	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
1048	struct bwn_softc *sc = mac->mac_sc;
1049	struct bwn_txhdr txhdr;
1050	struct mbuf *m_new;
1051	uint32_t ctl32;
1052	int error;
1053	uint16_t ctl16;
1054
1055	BWN_ASSERT_LOCKED(sc);
1056
1057	/* XXX TODO send packets after DTIM */
1058
1059	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1060	tp = TAILQ_FIRST(&tq->tq_pktlist);
1061	tp->tp_ni = ni;
1062	tp->tp_m = m;
1063
1064	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1065	if (error) {
1066		device_printf(sc->sc_dev, "tx fail\n");
1067		return (error);
1068	}
1069
1070	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1071	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1072	tq->tq_free--;
1073
1074	if (siba_get_revid(sc->sc_dev) >= 8) {
1075		/*
1076		 * XXX please removes m_defrag(9)
1077		 */
1078		m_new = m_defrag(m, M_NOWAIT);
1079		if (m_new == NULL) {
1080			device_printf(sc->sc_dev,
1081			    "%s: can't defrag TX buffer\n",
1082			    __func__);
1083			return (ENOBUFS);
1084		}
1085		if (m_new->m_next != NULL)
1086			device_printf(sc->sc_dev,
1087			    "TODO: fragmented packets for PIO\n");
1088		tp->tp_m = m_new;
1089
1090		/* send HEADER */
1091		ctl32 = bwn_pio_write_multi_4(mac, tq,
1092		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1093			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1094		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1095		/* send BODY */
1096		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1097		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1098		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1099		    ctl32 | BWN_PIO8_TXCTL_EOF);
1100	} else {
1101		ctl16 = bwn_pio_write_multi_2(mac, tq,
1102		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1103			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1104		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1105		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1106		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1107		    ctl16 | BWN_PIO_TXCTL_EOF);
1108	}
1109
1110	return (0);
1111}
1112
1113static struct bwn_pio_txqueue *
1114bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1115{
1116
1117	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1118		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1119
1120	switch (prio) {
1121	case 0:
1122		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1123	case 1:
1124		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1125	case 2:
1126		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1127	case 3:
1128		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1129	}
1130	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1131	return (NULL);
1132}
1133
1134static int
1135bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1136{
1137#define	BWN_GET_TXHDRCACHE(slot)					\
1138	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1139	struct bwn_dma *dma = &mac->mac_method.dma;
1140	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1141	struct bwn_dmadesc_generic *desc;
1142	struct bwn_dmadesc_meta *mt;
1143	struct bwn_softc *sc = mac->mac_sc;
1144	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1145	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1146
1147	BWN_ASSERT_LOCKED(sc);
1148	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1149
1150	/* XXX send after DTIM */
1151
1152	slot = bwn_dma_getslot(dr);
1153	dr->getdesc(dr, slot, &desc, &mt);
1154	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1155	    ("%s:%d: fail", __func__, __LINE__));
1156
1157	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1158	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1159	    BWN_DMA_COOKIE(dr, slot));
1160	if (error)
1161		goto fail;
1162	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1163	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1164	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1165	if (error) {
1166		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1167		    __func__, error);
1168		goto fail;
1169	}
1170	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1171	    BUS_DMASYNC_PREWRITE);
1172	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1173	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1174	    BUS_DMASYNC_PREWRITE);
1175
1176	slot = bwn_dma_getslot(dr);
1177	dr->getdesc(dr, slot, &desc, &mt);
1178	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1179	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1180	mt->mt_m = m;
1181	mt->mt_ni = ni;
1182
1183	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1184	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1185	if (error && error != EFBIG) {
1186		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1187		    __func__, error);
1188		goto fail;
1189	}
1190	if (error) {    /* error == EFBIG */
1191		struct mbuf *m_new;
1192
1193		m_new = m_defrag(m, M_NOWAIT);
1194		if (m_new == NULL) {
1195			device_printf(sc->sc_dev,
1196			    "%s: can't defrag TX buffer\n",
1197			    __func__);
1198			error = ENOBUFS;
1199			goto fail;
1200		} else {
1201			m = m_new;
1202		}
1203
1204		mt->mt_m = m;
1205		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1206		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1207		if (error) {
1208			device_printf(sc->sc_dev,
1209			    "%s: can't load TX buffer (2) %d\n",
1210			    __func__, error);
1211			goto fail;
1212		}
1213	}
1214	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1215	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1216	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1217	    BUS_DMASYNC_PREWRITE);
1218
1219	/* XXX send after DTIM */
1220
1221	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1222	return (0);
1223fail:
1224	dr->dr_curslot = backup[0];
1225	dr->dr_usedslot = backup[1];
1226	return (error);
1227#undef BWN_GET_TXHDRCACHE
1228}
1229
1230static void
1231bwn_watchdog(void *arg)
1232{
1233	struct bwn_softc *sc = arg;
1234
1235	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1236		device_printf(sc->sc_dev, "device timeout\n");
1237		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1238	}
1239	callout_schedule(&sc->sc_watchdog_ch, hz);
1240}
1241
1242static int
1243bwn_attach_core(struct bwn_mac *mac)
1244{
1245	struct bwn_softc *sc = mac->mac_sc;
1246	int error, have_bg = 0, have_a = 0;
1247	uint32_t high;
1248
1249	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1250	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1251
1252	siba_powerup(sc->sc_dev, 0);
1253
1254	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1255	bwn_reset_core(mac,
1256	    (high & BWN_TGSHIGH_HAVE_2GHZ) ? BWN_TGSLOW_SUPPORT_G : 0);
1257	error = bwn_phy_getinfo(mac, high);
1258	if (error)
1259		goto fail;
1260
1261	have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1262	have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1263	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1264	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1265	    siba_get_pci_device(sc->sc_dev) != 0x4324) {
1266		have_a = have_bg = 0;
1267		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1268			have_a = 1;
1269		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1270		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1271		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1272			have_bg = 1;
1273		else
1274			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1275			    mac->mac_phy.type));
1276	}
1277	/* XXX turns off PHY A because it's not supported */
1278	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1279	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1280		have_a = 0;
1281		have_bg = 1;
1282	}
1283
1284	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1285		mac->mac_phy.attach = bwn_phy_g_attach;
1286		mac->mac_phy.detach = bwn_phy_g_detach;
1287		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1288		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1289		mac->mac_phy.init = bwn_phy_g_init;
1290		mac->mac_phy.exit = bwn_phy_g_exit;
1291		mac->mac_phy.phy_read = bwn_phy_g_read;
1292		mac->mac_phy.phy_write = bwn_phy_g_write;
1293		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1294		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1295		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1296		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1297		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1298		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1299		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1300		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1301		mac->mac_phy.set_im = bwn_phy_g_im;
1302		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1303		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1304		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1305		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1306	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1307		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1308		mac->mac_phy.init = bwn_phy_lp_init;
1309		mac->mac_phy.phy_read = bwn_phy_lp_read;
1310		mac->mac_phy.phy_write = bwn_phy_lp_write;
1311		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1312		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1313		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1314		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1315		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1316		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1317		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1318		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1319		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1320	} else {
1321		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1322		    mac->mac_phy.type);
1323		error = ENXIO;
1324		goto fail;
1325	}
1326
1327	mac->mac_phy.gmode = have_bg;
1328	if (mac->mac_phy.attach != NULL) {
1329		error = mac->mac_phy.attach(mac);
1330		if (error) {
1331			device_printf(sc->sc_dev, "failed\n");
1332			goto fail;
1333		}
1334	}
1335
1336	bwn_reset_core(mac, have_bg ? BWN_TGSLOW_SUPPORT_G : 0);
1337
1338	error = bwn_chiptest(mac);
1339	if (error)
1340		goto fail;
1341	error = bwn_setup_channels(mac, have_bg, have_a);
1342	if (error) {
1343		device_printf(sc->sc_dev, "failed to setup channels\n");
1344		goto fail;
1345	}
1346
1347	if (sc->sc_curmac == NULL)
1348		sc->sc_curmac = mac;
1349
1350	error = bwn_dma_attach(mac);
1351	if (error != 0) {
1352		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1353		goto fail;
1354	}
1355
1356	mac->mac_phy.switch_analog(mac, 0);
1357
1358	siba_dev_down(sc->sc_dev, 0);
1359fail:
1360	siba_powerdown(sc->sc_dev);
1361	return (error);
1362}
1363
1364static void
1365bwn_reset_core(struct bwn_mac *mac, uint32_t flags)
1366{
1367	struct bwn_softc *sc = mac->mac_sc;
1368	uint32_t low, ctl;
1369
1370	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1371
1372	siba_dev_up(sc->sc_dev, flags);
1373	DELAY(2000);
1374
1375	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1376	    ~BWN_TGSLOW_PHYRESET;
1377	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1378	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1379	DELAY(1000);
1380	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1381	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1382	DELAY(1000);
1383
1384	if (mac->mac_phy.switch_analog != NULL)
1385		mac->mac_phy.switch_analog(mac, 1);
1386
1387	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1388	if (flags & BWN_TGSLOW_SUPPORT_G)
1389		ctl |= BWN_MACCTL_GMODE;
1390	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1391}
1392
1393static int
1394bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1395{
1396	struct bwn_phy *phy = &mac->mac_phy;
1397	struct bwn_softc *sc = mac->mac_sc;
1398	uint32_t tmp;
1399
1400	/* PHY */
1401	tmp = BWN_READ_2(mac, BWN_PHYVER);
1402	phy->gmode = (tgshigh & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1403	phy->rf_on = 1;
1404	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1405	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1406	phy->rev = (tmp & BWN_PHYVER_VERSION);
1407	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1408	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1409		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1410	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1411	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1412	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1413		goto unsupphy;
1414
1415	/* RADIO */
1416	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1417		if (siba_get_chiprev(sc->sc_dev) == 0)
1418			tmp = 0x3205017f;
1419		else if (siba_get_chiprev(sc->sc_dev) == 1)
1420			tmp = 0x4205017f;
1421		else
1422			tmp = 0x5205017f;
1423	} else {
1424		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1425		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1426		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1427		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1428	}
1429	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1430	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1431	phy->rf_manuf = (tmp & 0x00000fff);
1432	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1433		goto unsupradio;
1434	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1435	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1436	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1437	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1438	    (phy->type == BWN_PHYTYPE_N &&
1439	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1440	    (phy->type == BWN_PHYTYPE_LP &&
1441	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1442		goto unsupradio;
1443
1444	return (0);
1445unsupphy:
1446	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1447	    "analog %#x)\n",
1448	    phy->type, phy->rev, phy->analog);
1449	return (ENXIO);
1450unsupradio:
1451	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1452	    "rev %#x)\n",
1453	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1454	return (ENXIO);
1455}
1456
1457static int
1458bwn_chiptest(struct bwn_mac *mac)
1459{
1460#define	TESTVAL0	0x55aaaa55
1461#define	TESTVAL1	0xaa5555aa
1462	struct bwn_softc *sc = mac->mac_sc;
1463	uint32_t v, backup;
1464
1465	BWN_LOCK(sc);
1466
1467	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1468
1469	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1470	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1471		goto error;
1472	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1473	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1474		goto error;
1475
1476	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1477
1478	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1479	    (siba_get_revid(sc->sc_dev) <= 10)) {
1480		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1481		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1482		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1483			goto error;
1484		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1485			goto error;
1486	}
1487	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1488
1489	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1490	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1491		goto error;
1492
1493	BWN_UNLOCK(sc);
1494	return (0);
1495error:
1496	BWN_UNLOCK(sc);
1497	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1498	return (ENODEV);
1499}
1500
1501#define	IEEE80211_CHAN_HTG	(IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1502#define	IEEE80211_CHAN_HTA	(IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1503
1504static int
1505bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1506{
1507	struct bwn_softc *sc = mac->mac_sc;
1508	struct ieee80211com *ic = &sc->sc_ic;
1509
1510	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1511	ic->ic_nchans = 0;
1512
1513	if (have_bg)
1514		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1515		    &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1516	if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1517		if (have_a)
1518			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1519			    &ic->ic_nchans, &bwn_chantable_n,
1520			    IEEE80211_CHAN_HTA);
1521	} else {
1522		if (have_a)
1523			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1524			    &ic->ic_nchans, &bwn_chantable_a,
1525			    IEEE80211_CHAN_A);
1526	}
1527
1528	mac->mac_phy.supports_2ghz = have_bg;
1529	mac->mac_phy.supports_5ghz = have_a;
1530
1531	return (ic->ic_nchans == 0 ? ENXIO : 0);
1532}
1533
1534static uint32_t
1535bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1536{
1537	uint32_t ret;
1538
1539	BWN_ASSERT_LOCKED(mac->mac_sc);
1540
1541	if (way == BWN_SHARED) {
1542		KASSERT((offset & 0x0001) == 0,
1543		    ("%s:%d warn", __func__, __LINE__));
1544		if (offset & 0x0003) {
1545			bwn_shm_ctlword(mac, way, offset >> 2);
1546			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1547			ret <<= 16;
1548			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1549			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1550			goto out;
1551		}
1552		offset >>= 2;
1553	}
1554	bwn_shm_ctlword(mac, way, offset);
1555	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1556out:
1557	return (ret);
1558}
1559
1560static uint16_t
1561bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1562{
1563	uint16_t ret;
1564
1565	BWN_ASSERT_LOCKED(mac->mac_sc);
1566
1567	if (way == BWN_SHARED) {
1568		KASSERT((offset & 0x0001) == 0,
1569		    ("%s:%d warn", __func__, __LINE__));
1570		if (offset & 0x0003) {
1571			bwn_shm_ctlword(mac, way, offset >> 2);
1572			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1573			goto out;
1574		}
1575		offset >>= 2;
1576	}
1577	bwn_shm_ctlword(mac, way, offset);
1578	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1579out:
1580
1581	return (ret);
1582}
1583
1584static void
1585bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1586    uint16_t offset)
1587{
1588	uint32_t control;
1589
1590	control = way;
1591	control <<= 16;
1592	control |= offset;
1593	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1594}
1595
1596static void
1597bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1598    uint32_t value)
1599{
1600	BWN_ASSERT_LOCKED(mac->mac_sc);
1601
1602	if (way == BWN_SHARED) {
1603		KASSERT((offset & 0x0001) == 0,
1604		    ("%s:%d warn", __func__, __LINE__));
1605		if (offset & 0x0003) {
1606			bwn_shm_ctlword(mac, way, offset >> 2);
1607			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1608				    (value >> 16) & 0xffff);
1609			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1610			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1611			return;
1612		}
1613		offset >>= 2;
1614	}
1615	bwn_shm_ctlword(mac, way, offset);
1616	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1617}
1618
1619static void
1620bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1621    uint16_t value)
1622{
1623	BWN_ASSERT_LOCKED(mac->mac_sc);
1624
1625	if (way == BWN_SHARED) {
1626		KASSERT((offset & 0x0001) == 0,
1627		    ("%s:%d warn", __func__, __LINE__));
1628		if (offset & 0x0003) {
1629			bwn_shm_ctlword(mac, way, offset >> 2);
1630			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1631			return;
1632		}
1633		offset >>= 2;
1634	}
1635	bwn_shm_ctlword(mac, way, offset);
1636	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1637}
1638
1639static void
1640bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1641    int txpow)
1642{
1643
1644	c->ic_freq = freq;
1645	c->ic_flags = flags;
1646	c->ic_ieee = ieee;
1647	c->ic_minpower = 0;
1648	c->ic_maxpower = 2 * txpow;
1649	c->ic_maxregpower = txpow;
1650}
1651
1652static void
1653bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1654    const struct bwn_channelinfo *ci, int flags)
1655{
1656	struct ieee80211_channel *c;
1657	int i;
1658
1659	c = &chans[*nchans];
1660
1661	for (i = 0; i < ci->nchannels; i++) {
1662		const struct bwn_channel *hc;
1663
1664		hc = &ci->channels[i];
1665		if (*nchans >= maxchans)
1666			break;
1667		bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1668		c++, (*nchans)++;
1669		if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1670			/* g channel have a separate b-only entry */
1671			if (*nchans >= maxchans)
1672				break;
1673			c[0] = c[-1];
1674			c[-1].ic_flags = IEEE80211_CHAN_B;
1675			c++, (*nchans)++;
1676		}
1677		if (flags == IEEE80211_CHAN_HTG) {
1678			/* HT g channel have a separate g-only entry */
1679			if (*nchans >= maxchans)
1680				break;
1681			c[-1].ic_flags = IEEE80211_CHAN_G;
1682			c[0] = c[-1];
1683			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1684			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1685			c++, (*nchans)++;
1686		}
1687		if (flags == IEEE80211_CHAN_HTA) {
1688			/* HT a channel have a separate a-only entry */
1689			if (*nchans >= maxchans)
1690				break;
1691			c[-1].ic_flags = IEEE80211_CHAN_A;
1692			c[0] = c[-1];
1693			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1694			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1695			c++, (*nchans)++;
1696		}
1697	}
1698}
1699
1700static int
1701bwn_phy_g_attach(struct bwn_mac *mac)
1702{
1703	struct bwn_softc *sc = mac->mac_sc;
1704	struct bwn_phy *phy = &mac->mac_phy;
1705	struct bwn_phy_g *pg = &phy->phy_g;
1706	unsigned int i;
1707	int16_t pab0, pab1, pab2;
1708	static int8_t bwn_phy_g_tssi2dbm_table[] = BWN_PHY_G_TSSI2DBM_TABLE;
1709	int8_t bg;
1710
1711	bg = (int8_t)siba_sprom_get_tssi_bg(sc->sc_dev);
1712	pab0 = (int16_t)siba_sprom_get_pa0b0(sc->sc_dev);
1713	pab1 = (int16_t)siba_sprom_get_pa0b1(sc->sc_dev);
1714	pab2 = (int16_t)siba_sprom_get_pa0b2(sc->sc_dev);
1715
1716	if ((siba_get_chipid(sc->sc_dev) == 0x4301) && (phy->rf_ver != 0x2050))
1717		device_printf(sc->sc_dev, "not supported anymore\n");
1718
1719	pg->pg_flags = 0;
1720	if (pab0 == 0 || pab1 == 0 || pab2 == 0 || pab0 == -1 || pab1 == -1 ||
1721	    pab2 == -1) {
1722		pg->pg_idletssi = 52;
1723		pg->pg_tssi2dbm = bwn_phy_g_tssi2dbm_table;
1724		return (0);
1725	}
1726
1727	pg->pg_idletssi = (bg == 0 || bg == -1) ? 62 : bg;
1728	pg->pg_tssi2dbm = (uint8_t *)malloc(64, M_DEVBUF, M_NOWAIT | M_ZERO);
1729	if (pg->pg_tssi2dbm == NULL) {
1730		device_printf(sc->sc_dev, "failed to allocate buffer\n");
1731		return (ENOMEM);
1732	}
1733	for (i = 0; i < 64; i++) {
1734		int32_t m1, m2, f, q, delta;
1735		int8_t j = 0;
1736
1737		m1 = BWN_TSSI2DBM(16 * pab0 + i * pab1, 32);
1738		m2 = MAX(BWN_TSSI2DBM(32768 + i * pab2, 256), 1);
1739		f = 256;
1740
1741		do {
1742			if (j > 15) {
1743				device_printf(sc->sc_dev,
1744				    "failed to generate tssi2dBm\n");
1745				free(pg->pg_tssi2dbm, M_DEVBUF);
1746				return (ENOMEM);
1747			}
1748			q = BWN_TSSI2DBM(f * 4096 - BWN_TSSI2DBM(m2 * f, 16) *
1749			    f, 2048);
1750			delta = abs(q - f);
1751			f = q;
1752			j++;
1753		} while (delta >= 2);
1754
1755		pg->pg_tssi2dbm[i] = MIN(MAX(BWN_TSSI2DBM(m1 * f, 8192), -127),
1756		    128);
1757	}
1758
1759	pg->pg_flags |= BWN_PHY_G_FLAG_TSSITABLE_ALLOC;
1760	return (0);
1761}
1762
1763static void
1764bwn_phy_g_detach(struct bwn_mac *mac)
1765{
1766	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
1767
1768	if (pg->pg_flags & BWN_PHY_G_FLAG_TSSITABLE_ALLOC) {
1769		free(pg->pg_tssi2dbm, M_DEVBUF);
1770		pg->pg_tssi2dbm = NULL;
1771	}
1772	pg->pg_flags = 0;
1773}
1774
1775static void
1776bwn_phy_g_init_pre(struct bwn_mac *mac)
1777{
1778	struct bwn_phy *phy = &mac->mac_phy;
1779	struct bwn_phy_g *pg = &phy->phy_g;
1780	void *tssi2dbm;
1781	int idletssi;
1782	unsigned int i;
1783
1784	tssi2dbm = pg->pg_tssi2dbm;
1785	idletssi = pg->pg_idletssi;
1786
1787	memset(pg, 0, sizeof(*pg));
1788
1789	pg->pg_tssi2dbm = tssi2dbm;
1790	pg->pg_idletssi = idletssi;
1791
1792	memset(pg->pg_minlowsig, 0xff, sizeof(pg->pg_minlowsig));
1793
1794	for (i = 0; i < N(pg->pg_nrssi); i++)
1795		pg->pg_nrssi[i] = -1000;
1796	for (i = 0; i < N(pg->pg_nrssi_lt); i++)
1797		pg->pg_nrssi_lt[i] = i;
1798	pg->pg_lofcal = 0xffff;
1799	pg->pg_initval = 0xffff;
1800	pg->pg_immode = BWN_IMMODE_NONE;
1801	pg->pg_ofdmtab_dir = BWN_OFDMTAB_DIR_UNKNOWN;
1802	pg->pg_avgtssi = 0xff;
1803
1804	pg->pg_loctl.tx_bias = 0xff;
1805	TAILQ_INIT(&pg->pg_loctl.calib_list);
1806}
1807
1808static int
1809bwn_phy_g_prepare_hw(struct bwn_mac *mac)
1810{
1811	struct bwn_phy *phy = &mac->mac_phy;
1812	struct bwn_phy_g *pg = &phy->phy_g;
1813	struct bwn_softc *sc = mac->mac_sc;
1814	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
1815	static const struct bwn_rfatt rfatt0[] = {
1816		{ 3, 0 }, { 1, 0 }, { 5, 0 }, { 7, 0 },	{ 9, 0 }, { 2, 0 },
1817		{ 0, 0 }, { 4, 0 }, { 6, 0 }, { 8, 0 }, { 1, 1 }, { 2, 1 },
1818		{ 3, 1 }, { 4, 1 }
1819	};
1820	static const struct bwn_rfatt rfatt1[] = {
1821		{ 2, 1 }, { 4, 1 }, { 6, 1 }, { 8, 1 }, { 10, 1 }, { 12, 1 },
1822		{ 14, 1 }
1823	};
1824	static const struct bwn_rfatt rfatt2[] = {
1825		{ 0, 1 }, { 2, 1 }, { 4, 1 }, { 6, 1 }, { 8, 1 }, { 9, 1 },
1826		{ 9, 1 }
1827	};
1828	static const struct bwn_bbatt bbatt_0[] = {
1829		{ 0 }, { 1 }, { 2 }, { 3 }, { 4 }, { 5 }, { 6 }, { 7 }, { 8 }
1830	};
1831
1832	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s fail", __func__));
1833
1834	if (phy->rf_ver == 0x2050 && phy->rf_rev < 6)
1835		pg->pg_bbatt.att = 0;
1836	else
1837		pg->pg_bbatt.att = 2;
1838
1839	/* prepare Radio Attenuation */
1840	pg->pg_rfatt.padmix = 0;
1841
1842	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
1843	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BCM4309G) {
1844		if (siba_get_pci_revid(sc->sc_dev) < 0x43) {
1845			pg->pg_rfatt.att = 2;
1846			goto done;
1847		} else if (siba_get_pci_revid(sc->sc_dev) < 0x51) {
1848			pg->pg_rfatt.att = 3;
1849			goto done;
1850		}
1851	}
1852
1853	if (phy->type == BWN_PHYTYPE_A) {
1854		pg->pg_rfatt.att = 0x60;
1855		goto done;
1856	}
1857
1858	switch (phy->rf_ver) {
1859	case 0x2050:
1860		switch (phy->rf_rev) {
1861		case 0:
1862			pg->pg_rfatt.att = 5;
1863			goto done;
1864		case 1:
1865			if (phy->type == BWN_PHYTYPE_G) {
1866				if (siba_get_pci_subvendor(sc->sc_dev) ==
1867				    SIBA_BOARDVENDOR_BCM &&
1868				    siba_get_pci_subdevice(sc->sc_dev) ==
1869				    SIBA_BOARD_BCM4309G &&
1870				    siba_get_pci_revid(sc->sc_dev) >= 30)
1871					pg->pg_rfatt.att = 3;
1872				else if (siba_get_pci_subvendor(sc->sc_dev) ==
1873				    SIBA_BOARDVENDOR_BCM &&
1874				    siba_get_pci_subdevice(sc->sc_dev) ==
1875				    SIBA_BOARD_BU4306)
1876					pg->pg_rfatt.att = 3;
1877				else
1878					pg->pg_rfatt.att = 1;
1879			} else {
1880				if (siba_get_pci_subvendor(sc->sc_dev) ==
1881				    SIBA_BOARDVENDOR_BCM &&
1882				    siba_get_pci_subdevice(sc->sc_dev) ==
1883				    SIBA_BOARD_BCM4309G &&
1884				    siba_get_pci_revid(sc->sc_dev) >= 30)
1885					pg->pg_rfatt.att = 7;
1886				else
1887					pg->pg_rfatt.att = 6;
1888			}
1889			goto done;
1890		case 2:
1891			if (phy->type == BWN_PHYTYPE_G) {
1892				if (siba_get_pci_subvendor(sc->sc_dev) ==
1893				    SIBA_BOARDVENDOR_BCM &&
1894				    siba_get_pci_subdevice(sc->sc_dev) ==
1895				    SIBA_BOARD_BCM4309G &&
1896				    siba_get_pci_revid(sc->sc_dev) >= 30)
1897					pg->pg_rfatt.att = 3;
1898				else if (siba_get_pci_subvendor(sc->sc_dev) ==
1899				    SIBA_BOARDVENDOR_BCM &&
1900				    siba_get_pci_subdevice(sc->sc_dev) ==
1901				    SIBA_BOARD_BU4306)
1902					pg->pg_rfatt.att = 5;
1903				else if (siba_get_chipid(sc->sc_dev) == 0x4320)
1904					pg->pg_rfatt.att = 4;
1905				else
1906					pg->pg_rfatt.att = 3;
1907			} else
1908				pg->pg_rfatt.att = 6;
1909			goto done;
1910		case 3:
1911			pg->pg_rfatt.att = 5;
1912			goto done;
1913		case 4:
1914		case 5:
1915			pg->pg_rfatt.att = 1;
1916			goto done;
1917		case 6:
1918		case 7:
1919			pg->pg_rfatt.att = 5;
1920			goto done;
1921		case 8:
1922			pg->pg_rfatt.att = 0xa;
1923			pg->pg_rfatt.padmix = 1;
1924			goto done;
1925		case 9:
1926		default:
1927			pg->pg_rfatt.att = 5;
1928			goto done;
1929		}
1930		break;
1931	case 0x2053:
1932		switch (phy->rf_rev) {
1933		case 1:
1934			pg->pg_rfatt.att = 6;
1935			goto done;
1936		}
1937		break;
1938	}
1939	pg->pg_rfatt.att = 5;
1940done:
1941	pg->pg_txctl = (bwn_phy_g_txctl(mac) << 4);
1942
1943	if (!bwn_has_hwpctl(mac)) {
1944		lo->rfatt.array = rfatt0;
1945		lo->rfatt.len = N(rfatt0);
1946		lo->rfatt.min = 0;
1947		lo->rfatt.max = 9;
1948		goto genbbatt;
1949	}
1950	if (phy->rf_ver == 0x2050 && phy->rf_rev == 8) {
1951		lo->rfatt.array = rfatt1;
1952		lo->rfatt.len = N(rfatt1);
1953		lo->rfatt.min = 0;
1954		lo->rfatt.max = 14;
1955		goto genbbatt;
1956	}
1957	lo->rfatt.array = rfatt2;
1958	lo->rfatt.len = N(rfatt2);
1959	lo->rfatt.min = 0;
1960	lo->rfatt.max = 9;
1961genbbatt:
1962	lo->bbatt.array = bbatt_0;
1963	lo->bbatt.len = N(bbatt_0);
1964	lo->bbatt.min = 0;
1965	lo->bbatt.max = 8;
1966
1967	BWN_READ_4(mac, BWN_MACCTL);
1968	if (phy->rev == 1) {
1969		phy->gmode = 0;
1970		bwn_reset_core(mac, 0);
1971		bwn_phy_g_init_sub(mac);
1972		phy->gmode = 1;
1973		bwn_reset_core(mac, BWN_TGSLOW_SUPPORT_G);
1974	}
1975	return (0);
1976}
1977
1978static uint16_t
1979bwn_phy_g_txctl(struct bwn_mac *mac)
1980{
1981	struct bwn_phy *phy = &mac->mac_phy;
1982
1983	if (phy->rf_ver != 0x2050)
1984		return (0);
1985	if (phy->rf_rev == 1)
1986		return (BWN_TXCTL_PA2DB | BWN_TXCTL_TXMIX);
1987	if (phy->rf_rev < 6)
1988		return (BWN_TXCTL_PA2DB);
1989	if (phy->rf_rev == 8)
1990		return (BWN_TXCTL_TXMIX);
1991	return (0);
1992}
1993
1994static int
1995bwn_phy_g_init(struct bwn_mac *mac)
1996{
1997
1998	bwn_phy_g_init_sub(mac);
1999	return (0);
2000}
2001
2002static void
2003bwn_phy_g_exit(struct bwn_mac *mac)
2004{
2005	struct bwn_txpwr_loctl *lo = &mac->mac_phy.phy_g.pg_loctl;
2006	struct bwn_lo_calib *cal, *tmp;
2007
2008	if (lo == NULL)
2009		return;
2010	TAILQ_FOREACH_SAFE(cal, &lo->calib_list, list, tmp) {
2011		TAILQ_REMOVE(&lo->calib_list, cal, list);
2012		free(cal, M_DEVBUF);
2013	}
2014}
2015
2016static uint16_t
2017bwn_phy_g_read(struct bwn_mac *mac, uint16_t reg)
2018{
2019
2020	BWN_WRITE_2(mac, BWN_PHYCTL, reg);
2021	return (BWN_READ_2(mac, BWN_PHYDATA));
2022}
2023
2024static void
2025bwn_phy_g_write(struct bwn_mac *mac, uint16_t reg, uint16_t value)
2026{
2027
2028	BWN_WRITE_2(mac, BWN_PHYCTL, reg);
2029	BWN_WRITE_2(mac, BWN_PHYDATA, value);
2030}
2031
2032static uint16_t
2033bwn_phy_g_rf_read(struct bwn_mac *mac, uint16_t reg)
2034{
2035
2036	KASSERT(reg != 1, ("%s:%d: fail", __func__, __LINE__));
2037	BWN_WRITE_2(mac, BWN_RFCTL, reg | 0x80);
2038	return (BWN_READ_2(mac, BWN_RFDATALO));
2039}
2040
2041static void
2042bwn_phy_g_rf_write(struct bwn_mac *mac, uint16_t reg, uint16_t value)
2043{
2044
2045	KASSERT(reg != 1, ("%s:%d: fail", __func__, __LINE__));
2046	BWN_WRITE_2(mac, BWN_RFCTL, reg);
2047	BWN_WRITE_2(mac, BWN_RFDATALO, value);
2048}
2049
2050static int
2051bwn_phy_g_hwpctl(struct bwn_mac *mac)
2052{
2053
2054	return (mac->mac_phy.rev >= 6);
2055}
2056
2057static void
2058bwn_phy_g_rf_onoff(struct bwn_mac *mac, int on)
2059{
2060	struct bwn_phy *phy = &mac->mac_phy;
2061	struct bwn_phy_g *pg = &phy->phy_g;
2062	unsigned int channel;
2063	uint16_t rfover, rfoverval;
2064
2065	if (on) {
2066		if (phy->rf_on)
2067			return;
2068
2069		BWN_PHY_WRITE(mac, 0x15, 0x8000);
2070		BWN_PHY_WRITE(mac, 0x15, 0xcc00);
2071		BWN_PHY_WRITE(mac, 0x15, (phy->gmode ? 0xc0 : 0x0));
2072		if (pg->pg_flags & BWN_PHY_G_FLAG_RADIOCTX_VALID) {
2073			BWN_PHY_WRITE(mac, BWN_PHY_RFOVER,
2074			    pg->pg_radioctx_over);
2075			BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
2076			    pg->pg_radioctx_overval);
2077			pg->pg_flags &= ~BWN_PHY_G_FLAG_RADIOCTX_VALID;
2078		}
2079		channel = phy->chan;
2080		bwn_phy_g_switch_chan(mac, 6, 1);
2081		bwn_phy_g_switch_chan(mac, channel, 0);
2082		return;
2083	}
2084
2085	rfover = BWN_PHY_READ(mac, BWN_PHY_RFOVER);
2086	rfoverval = BWN_PHY_READ(mac, BWN_PHY_RFOVERVAL);
2087	pg->pg_radioctx_over = rfover;
2088	pg->pg_radioctx_overval = rfoverval;
2089	pg->pg_flags |= BWN_PHY_G_FLAG_RADIOCTX_VALID;
2090	BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, rfover | 0x008c);
2091	BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, rfoverval & 0xff73);
2092}
2093
2094static int
2095bwn_phy_g_switch_channel(struct bwn_mac *mac, uint32_t newchan)
2096{
2097
2098	if ((newchan < 1) || (newchan > 14))
2099		return (EINVAL);
2100	bwn_phy_g_switch_chan(mac, newchan, 0);
2101
2102	return (0);
2103}
2104
2105static uint32_t
2106bwn_phy_g_get_default_chan(struct bwn_mac *mac)
2107{
2108
2109	return (1);
2110}
2111
2112static void
2113bwn_phy_g_set_antenna(struct bwn_mac *mac, int antenna)
2114{
2115	struct bwn_phy *phy = &mac->mac_phy;
2116	uint64_t hf;
2117	int autodiv = 0;
2118	uint16_t tmp;
2119
2120	if (antenna == BWN_ANTAUTO0 || antenna == BWN_ANTAUTO1)
2121		autodiv = 1;
2122
2123	hf = bwn_hf_read(mac) & ~BWN_HF_UCODE_ANTDIV_HELPER;
2124	bwn_hf_write(mac, hf);
2125
2126	BWN_PHY_WRITE(mac, BWN_PHY_BBANDCFG,
2127	    (BWN_PHY_READ(mac, BWN_PHY_BBANDCFG) & ~BWN_PHY_BBANDCFG_RXANT) |
2128	    ((autodiv ? BWN_ANTAUTO1 : antenna)
2129		<< BWN_PHY_BBANDCFG_RXANT_SHIFT));
2130
2131	if (autodiv) {
2132		tmp = BWN_PHY_READ(mac, BWN_PHY_ANTDWELL);
2133		if (antenna == BWN_ANTAUTO1)
2134			tmp &= ~BWN_PHY_ANTDWELL_AUTODIV1;
2135		else
2136			tmp |= BWN_PHY_ANTDWELL_AUTODIV1;
2137		BWN_PHY_WRITE(mac, BWN_PHY_ANTDWELL, tmp);
2138	}
2139	tmp = BWN_PHY_READ(mac, BWN_PHY_ANTWRSETT);
2140	if (autodiv)
2141		tmp |= BWN_PHY_ANTWRSETT_ARXDIV;
2142	else
2143		tmp &= ~BWN_PHY_ANTWRSETT_ARXDIV;
2144	BWN_PHY_WRITE(mac, BWN_PHY_ANTWRSETT, tmp);
2145	if (phy->rev >= 2) {
2146		BWN_PHY_WRITE(mac, BWN_PHY_OFDM61,
2147		    BWN_PHY_READ(mac, BWN_PHY_OFDM61) | BWN_PHY_OFDM61_10);
2148		BWN_PHY_WRITE(mac, BWN_PHY_DIVSRCHGAINBACK,
2149		    (BWN_PHY_READ(mac, BWN_PHY_DIVSRCHGAINBACK) & 0xff00) |
2150		    0x15);
2151		if (phy->rev == 2)
2152			BWN_PHY_WRITE(mac, BWN_PHY_ADIVRELATED, 8);
2153		else
2154			BWN_PHY_WRITE(mac, BWN_PHY_ADIVRELATED,
2155			    (BWN_PHY_READ(mac, BWN_PHY_ADIVRELATED) & 0xff00) |
2156			    8);
2157	}
2158	if (phy->rev >= 6)
2159		BWN_PHY_WRITE(mac, BWN_PHY_OFDM9B, 0xdc);
2160
2161	hf |= BWN_HF_UCODE_ANTDIV_HELPER;
2162	bwn_hf_write(mac, hf);
2163}
2164
2165static int
2166bwn_phy_g_im(struct bwn_mac *mac, int mode)
2167{
2168	struct bwn_phy *phy = &mac->mac_phy;
2169	struct bwn_phy_g *pg = &phy->phy_g;
2170
2171	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s: fail", __func__));
2172	KASSERT(mode == BWN_IMMODE_NONE, ("%s: fail", __func__));
2173
2174	if (phy->rev == 0 || !phy->gmode)
2175		return (ENODEV);
2176
2177	pg->pg_aci_wlan_automatic = 0;
2178	return (0);
2179}
2180
2181static int
2182bwn_phy_g_recalc_txpwr(struct bwn_mac *mac, int ignore_tssi)
2183{
2184	struct bwn_phy *phy = &mac->mac_phy;
2185	struct bwn_phy_g *pg = &phy->phy_g;
2186	struct bwn_softc *sc = mac->mac_sc;
2187	unsigned int tssi;
2188	int cck, ofdm;
2189	int power;
2190	int rfatt, bbatt;
2191	unsigned int max;
2192
2193	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s: fail", __func__));
2194
2195	cck = bwn_phy_shm_tssi_read(mac, BWN_SHARED_TSSI_CCK);
2196	ofdm = bwn_phy_shm_tssi_read(mac, BWN_SHARED_TSSI_OFDM_G);
2197	if (cck < 0 && ofdm < 0) {
2198		if (ignore_tssi == 0)
2199			return (BWN_TXPWR_RES_DONE);
2200		cck = 0;
2201		ofdm = 0;
2202	}
2203	tssi = (cck < 0) ? ofdm : ((ofdm < 0) ? cck : (cck + ofdm) / 2);
2204	if (pg->pg_avgtssi != 0xff)
2205		tssi = (tssi + pg->pg_avgtssi) / 2;
2206	pg->pg_avgtssi = tssi;
2207	KASSERT(tssi < BWN_TSSI_MAX, ("%s:%d: fail", __func__, __LINE__));
2208
2209	max = siba_sprom_get_maxpwr_bg(sc->sc_dev);
2210	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2211		max -= 3;
2212	if (max >= 120) {
2213		device_printf(sc->sc_dev, "invalid max TX-power value\n");
2214		max = 80;
2215		siba_sprom_set_maxpwr_bg(sc->sc_dev, max);
2216	}
2217
2218	power = MIN(MAX((phy->txpower < 0) ? 0 : (phy->txpower << 2), 0), max) -
2219	    (pg->pg_tssi2dbm[MIN(MAX(pg->pg_idletssi - pg->pg_curtssi +
2220	     tssi, 0x00), 0x3f)]);
2221	if (power == 0)
2222		return (BWN_TXPWR_RES_DONE);
2223
2224	rfatt = -((power + 7) / 8);
2225	bbatt = (-(power / 2)) - (4 * rfatt);
2226	if ((rfatt == 0) && (bbatt == 0))
2227		return (BWN_TXPWR_RES_DONE);
2228	pg->pg_bbatt_delta = bbatt;
2229	pg->pg_rfatt_delta = rfatt;
2230	return (BWN_TXPWR_RES_NEED_ADJUST);
2231}
2232
2233static void
2234bwn_phy_g_set_txpwr(struct bwn_mac *mac)
2235{
2236	struct bwn_phy *phy = &mac->mac_phy;
2237	struct bwn_phy_g *pg = &phy->phy_g;
2238	struct bwn_softc *sc = mac->mac_sc;
2239	int rfatt, bbatt;
2240	uint8_t txctl;
2241
2242	bwn_mac_suspend(mac);
2243
2244	BWN_ASSERT_LOCKED(sc);
2245
2246	bbatt = pg->pg_bbatt.att;
2247	bbatt += pg->pg_bbatt_delta;
2248	rfatt = pg->pg_rfatt.att;
2249	rfatt += pg->pg_rfatt_delta;
2250
2251	bwn_phy_g_setatt(mac, &bbatt, &rfatt);
2252	txctl = pg->pg_txctl;
2253	if ((phy->rf_ver == 0x2050) && (phy->rf_rev == 2)) {
2254		if (rfatt <= 1) {
2255			if (txctl == 0) {
2256				txctl = BWN_TXCTL_PA2DB | BWN_TXCTL_TXMIX;
2257				rfatt += 2;
2258				bbatt += 2;
2259			} else if (siba_sprom_get_bf_lo(sc->sc_dev) &
2260			    BWN_BFL_PACTRL) {
2261				bbatt += 4 * (rfatt - 2);
2262				rfatt = 2;
2263			}
2264		} else if (rfatt > 4 && txctl) {
2265			txctl = 0;
2266			if (bbatt < 3) {
2267				rfatt -= 3;
2268				bbatt += 2;
2269			} else {
2270				rfatt -= 2;
2271				bbatt -= 2;
2272			}
2273		}
2274	}
2275	pg->pg_txctl = txctl;
2276	bwn_phy_g_setatt(mac, &bbatt, &rfatt);
2277	pg->pg_rfatt.att = rfatt;
2278	pg->pg_bbatt.att = bbatt;
2279
2280	DPRINTF(sc, BWN_DEBUG_TXPOW, "%s: adjust TX power\n", __func__);
2281
2282	bwn_phy_lock(mac);
2283	bwn_rf_lock(mac);
2284	bwn_phy_g_set_txpwr_sub(mac, &pg->pg_bbatt, &pg->pg_rfatt,
2285	    pg->pg_txctl);
2286	bwn_rf_unlock(mac);
2287	bwn_phy_unlock(mac);
2288
2289	bwn_mac_enable(mac);
2290}
2291
2292static void
2293bwn_phy_g_task_15s(struct bwn_mac *mac)
2294{
2295	struct bwn_phy *phy = &mac->mac_phy;
2296	struct bwn_phy_g *pg = &phy->phy_g;
2297	struct bwn_softc *sc = mac->mac_sc;
2298	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
2299	unsigned long expire, now;
2300	struct bwn_lo_calib *cal, *tmp;
2301	uint8_t expired = 0;
2302
2303	bwn_mac_suspend(mac);
2304
2305	if (lo == NULL)
2306		goto fail;
2307
2308	BWN_GETTIME(now);
2309	if (bwn_has_hwpctl(mac)) {
2310		expire = now - BWN_LO_PWRVEC_EXPIRE;
2311		if (ieee80211_time_before(lo->pwr_vec_read_time, expire)) {
2312			bwn_lo_get_powervector(mac);
2313			bwn_phy_g_dc_lookup_init(mac, 0);
2314		}
2315		goto fail;
2316	}
2317
2318	expire = now - BWN_LO_CALIB_EXPIRE;
2319	TAILQ_FOREACH_SAFE(cal, &lo->calib_list, list, tmp) {
2320		if (!ieee80211_time_before(cal->calib_time, expire))
2321			continue;
2322		if (BWN_BBATTCMP(&cal->bbatt, &pg->pg_bbatt) &&
2323		    BWN_RFATTCMP(&cal->rfatt, &pg->pg_rfatt)) {
2324			KASSERT(!expired, ("%s:%d: fail", __func__, __LINE__));
2325			expired = 1;
2326		}
2327
2328		DPRINTF(sc, BWN_DEBUG_LO, "expired BB %u RF %u %u I %d Q %d\n",
2329		    cal->bbatt.att, cal->rfatt.att, cal->rfatt.padmix,
2330		    cal->ctl.i, cal->ctl.q);
2331
2332		TAILQ_REMOVE(&lo->calib_list, cal, list);
2333		free(cal, M_DEVBUF);
2334	}
2335	if (expired || TAILQ_EMPTY(&lo->calib_list)) {
2336		cal = bwn_lo_calibset(mac, &pg->pg_bbatt,
2337		    &pg->pg_rfatt);
2338		if (cal == NULL) {
2339			device_printf(sc->sc_dev,
2340			    "failed to recalibrate LO\n");
2341			goto fail;
2342		}
2343		TAILQ_INSERT_TAIL(&lo->calib_list, cal, list);
2344		bwn_lo_write(mac, &cal->ctl);
2345	}
2346
2347fail:
2348	bwn_mac_enable(mac);
2349}
2350
2351static void
2352bwn_phy_g_task_60s(struct bwn_mac *mac)
2353{
2354	struct bwn_phy *phy = &mac->mac_phy;
2355	struct bwn_softc *sc = mac->mac_sc;
2356	uint8_t old = phy->chan;
2357
2358	if (!(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_RSSI))
2359		return;
2360
2361	bwn_mac_suspend(mac);
2362	bwn_nrssi_slope_11g(mac);
2363	if ((phy->rf_ver == 0x2050) && (phy->rf_rev == 8)) {
2364		bwn_switch_channel(mac, (old >= 8) ? 1 : 13);
2365		bwn_switch_channel(mac, old);
2366	}
2367	bwn_mac_enable(mac);
2368}
2369
2370static void
2371bwn_phy_switch_analog(struct bwn_mac *mac, int on)
2372{
2373
2374	BWN_WRITE_2(mac, BWN_PHY0, on ? 0 : 0xf4);
2375}
2376
2377static int
2378bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2379	const struct ieee80211_bpf_params *params)
2380{
2381	struct ieee80211com *ic = ni->ni_ic;
2382	struct bwn_softc *sc = ic->ic_softc;
2383	struct bwn_mac *mac = sc->sc_curmac;
2384	int error;
2385
2386	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
2387	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
2388		m_freem(m);
2389		return (ENETDOWN);
2390	}
2391
2392	BWN_LOCK(sc);
2393	if (bwn_tx_isfull(sc, m)) {
2394		m_freem(m);
2395		BWN_UNLOCK(sc);
2396		return (ENOBUFS);
2397	}
2398
2399	error = bwn_tx_start(sc, ni, m);
2400	if (error == 0)
2401		sc->sc_watchdog_timer = 5;
2402	BWN_UNLOCK(sc);
2403	return (error);
2404}
2405
2406/*
2407 * Callback from the 802.11 layer to update the slot time
2408 * based on the current setting.  We use it to notify the
2409 * firmware of ERP changes and the f/w takes care of things
2410 * like slot time and preamble.
2411 */
2412static void
2413bwn_updateslot(struct ieee80211com *ic)
2414{
2415	struct bwn_softc *sc = ic->ic_softc;
2416	struct bwn_mac *mac;
2417
2418	BWN_LOCK(sc);
2419	if (sc->sc_flags & BWN_FLAG_RUNNING) {
2420		mac = (struct bwn_mac *)sc->sc_curmac;
2421		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
2422	}
2423	BWN_UNLOCK(sc);
2424}
2425
2426/*
2427 * Callback from the 802.11 layer after a promiscuous mode change.
2428 * Note this interface does not check the operating mode as this
2429 * is an internal callback and we are expected to honor the current
2430 * state (e.g. this is used for setting the interface in promiscuous
2431 * mode when operating in hostap mode to do ACS).
2432 */
2433static void
2434bwn_update_promisc(struct ieee80211com *ic)
2435{
2436	struct bwn_softc *sc = ic->ic_softc;
2437	struct bwn_mac *mac = sc->sc_curmac;
2438
2439	BWN_LOCK(sc);
2440	mac = sc->sc_curmac;
2441	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
2442		if (ic->ic_promisc > 0)
2443			sc->sc_filters |= BWN_MACCTL_PROMISC;
2444		else
2445			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
2446		bwn_set_opmode(mac);
2447	}
2448	BWN_UNLOCK(sc);
2449}
2450
2451/*
2452 * Callback from the 802.11 layer to update WME parameters.
2453 */
2454static int
2455bwn_wme_update(struct ieee80211com *ic)
2456{
2457	struct bwn_softc *sc = ic->ic_softc;
2458	struct bwn_mac *mac = sc->sc_curmac;
2459	struct wmeParams *wmep;
2460	int i;
2461
2462	BWN_LOCK(sc);
2463	mac = sc->sc_curmac;
2464	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
2465		bwn_mac_suspend(mac);
2466		for (i = 0; i < N(sc->sc_wmeParams); i++) {
2467			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
2468			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
2469		}
2470		bwn_mac_enable(mac);
2471	}
2472	BWN_UNLOCK(sc);
2473	return (0);
2474}
2475
2476static void
2477bwn_scan_start(struct ieee80211com *ic)
2478{
2479	struct bwn_softc *sc = ic->ic_softc;
2480	struct bwn_mac *mac;
2481
2482	BWN_LOCK(sc);
2483	mac = sc->sc_curmac;
2484	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
2485		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
2486		bwn_set_opmode(mac);
2487		/* disable CFP update during scan */
2488		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
2489	}
2490	BWN_UNLOCK(sc);
2491}
2492
2493static void
2494bwn_scan_end(struct ieee80211com *ic)
2495{
2496	struct bwn_softc *sc = ic->ic_softc;
2497	struct bwn_mac *mac;
2498
2499	BWN_LOCK(sc);
2500	mac = sc->sc_curmac;
2501	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
2502		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
2503		bwn_set_opmode(mac);
2504		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
2505	}
2506	BWN_UNLOCK(sc);
2507}
2508
2509static void
2510bwn_set_channel(struct ieee80211com *ic)
2511{
2512	struct bwn_softc *sc = ic->ic_softc;
2513	struct bwn_mac *mac = sc->sc_curmac;
2514	struct bwn_phy *phy = &mac->mac_phy;
2515	int chan, error;
2516
2517	BWN_LOCK(sc);
2518
2519	error = bwn_switch_band(sc, ic->ic_curchan);
2520	if (error)
2521		goto fail;
2522	bwn_mac_suspend(mac);
2523	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2524	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2525	if (chan != phy->chan)
2526		bwn_switch_channel(mac, chan);
2527
2528	/* TX power level */
2529	if (ic->ic_curchan->ic_maxpower != 0 &&
2530	    ic->ic_curchan->ic_maxpower != phy->txpower) {
2531		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
2532		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
2533		    BWN_TXPWR_IGNORE_TSSI);
2534	}
2535
2536	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2537	if (phy->set_antenna)
2538		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2539
2540	if (sc->sc_rf_enabled != phy->rf_on) {
2541		if (sc->sc_rf_enabled) {
2542			bwn_rf_turnon(mac);
2543			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
2544				device_printf(sc->sc_dev,
2545				    "please turn on the RF switch\n");
2546		} else
2547			bwn_rf_turnoff(mac);
2548	}
2549
2550	bwn_mac_enable(mac);
2551
2552fail:
2553	/*
2554	 * Setup radio tap channel freq and flags
2555	 */
2556	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2557		htole16(ic->ic_curchan->ic_freq);
2558	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2559		htole16(ic->ic_curchan->ic_flags & 0xffff);
2560
2561	BWN_UNLOCK(sc);
2562}
2563
2564static struct ieee80211vap *
2565bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2566    enum ieee80211_opmode opmode, int flags,
2567    const uint8_t bssid[IEEE80211_ADDR_LEN],
2568    const uint8_t mac[IEEE80211_ADDR_LEN])
2569{
2570	struct ieee80211vap *vap;
2571	struct bwn_vap *bvp;
2572
2573	switch (opmode) {
2574	case IEEE80211_M_HOSTAP:
2575	case IEEE80211_M_MBSS:
2576	case IEEE80211_M_STA:
2577	case IEEE80211_M_WDS:
2578	case IEEE80211_M_MONITOR:
2579	case IEEE80211_M_IBSS:
2580	case IEEE80211_M_AHDEMO:
2581		break;
2582	default:
2583		return (NULL);
2584	}
2585
2586	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
2587	vap = &bvp->bv_vap;
2588	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
2589	/* override with driver methods */
2590	bvp->bv_newstate = vap->iv_newstate;
2591	vap->iv_newstate = bwn_newstate;
2592
2593	/* override max aid so sta's cannot assoc when we're out of sta id's */
2594	vap->iv_max_aid = BWN_STAID_MAX;
2595
2596	ieee80211_ratectl_init(vap);
2597
2598	/* complete setup */
2599	ieee80211_vap_attach(vap, ieee80211_media_change,
2600	    ieee80211_media_status, mac);
2601	return (vap);
2602}
2603
2604static void
2605bwn_vap_delete(struct ieee80211vap *vap)
2606{
2607	struct bwn_vap *bvp = BWN_VAP(vap);
2608
2609	ieee80211_ratectl_deinit(vap);
2610	ieee80211_vap_detach(vap);
2611	free(bvp, M_80211_VAP);
2612}
2613
2614static int
2615bwn_init(struct bwn_softc *sc)
2616{
2617	struct bwn_mac *mac;
2618	int error;
2619
2620	BWN_ASSERT_LOCKED(sc);
2621
2622	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2623	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2624	sc->sc_filters = 0;
2625	bwn_wme_clear(sc);
2626	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2627	sc->sc_rf_enabled = 1;
2628
2629	mac = sc->sc_curmac;
2630	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2631		error = bwn_core_init(mac);
2632		if (error != 0)
2633			return (error);
2634	}
2635	if (mac->mac_status == BWN_MAC_STATUS_INITED)
2636		bwn_core_start(mac);
2637
2638	bwn_set_opmode(mac);
2639	bwn_set_pretbtt(mac);
2640	bwn_spu_setdelay(mac, 0);
2641	bwn_set_macaddr(mac);
2642
2643	sc->sc_flags |= BWN_FLAG_RUNNING;
2644	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2645	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2646
2647	return (0);
2648}
2649
2650static void
2651bwn_stop(struct bwn_softc *sc)
2652{
2653	struct bwn_mac *mac = sc->sc_curmac;
2654
2655	BWN_ASSERT_LOCKED(sc);
2656
2657	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2658		/* XXX FIXME opmode not based on VAP */
2659		bwn_set_opmode(mac);
2660		bwn_set_macaddr(mac);
2661	}
2662
2663	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2664		bwn_core_stop(mac);
2665
2666	callout_stop(&sc->sc_led_blink_ch);
2667	sc->sc_led_blinking = 0;
2668
2669	bwn_core_exit(mac);
2670	sc->sc_rf_enabled = 0;
2671
2672	sc->sc_flags &= ~BWN_FLAG_RUNNING;
2673}
2674
2675static void
2676bwn_wme_clear(struct bwn_softc *sc)
2677{
2678#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
2679	struct wmeParams *p;
2680	unsigned int i;
2681
2682	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2683	    ("%s:%d: fail", __func__, __LINE__));
2684
2685	for (i = 0; i < N(sc->sc_wmeParams); i++) {
2686		p = &(sc->sc_wmeParams[i]);
2687
2688		switch (bwn_wme_shm_offsets[i]) {
2689		case BWN_WME_VOICE:
2690			p->wmep_txopLimit = 0;
2691			p->wmep_aifsn = 2;
2692			/* XXX FIXME: log2(cwmin) */
2693			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2694			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2695			break;
2696		case BWN_WME_VIDEO:
2697			p->wmep_txopLimit = 0;
2698			p->wmep_aifsn = 2;
2699			/* XXX FIXME: log2(cwmin) */
2700			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2701			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2702			break;
2703		case BWN_WME_BESTEFFORT:
2704			p->wmep_txopLimit = 0;
2705			p->wmep_aifsn = 3;
2706			/* XXX FIXME: log2(cwmin) */
2707			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2708			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2709			break;
2710		case BWN_WME_BACKGROUND:
2711			p->wmep_txopLimit = 0;
2712			p->wmep_aifsn = 7;
2713			/* XXX FIXME: log2(cwmin) */
2714			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2715			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2716			break;
2717		default:
2718			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2719		}
2720	}
2721}
2722
2723static int
2724bwn_core_init(struct bwn_mac *mac)
2725{
2726	struct bwn_softc *sc = mac->mac_sc;
2727	uint64_t hf;
2728	int error;
2729
2730	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2731	    ("%s:%d: fail", __func__, __LINE__));
2732
2733	siba_powerup(sc->sc_dev, 0);
2734	if (!siba_dev_isup(sc->sc_dev))
2735		bwn_reset_core(mac,
2736		    mac->mac_phy.gmode ? BWN_TGSLOW_SUPPORT_G : 0);
2737
2738	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2739	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2740	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2741	BWN_GETTIME(mac->mac_phy.nexttime);
2742	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2743	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2744	mac->mac_stats.link_noise = -95;
2745	mac->mac_reason_intr = 0;
2746	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2747	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2748#ifdef BWN_DEBUG
2749	if (sc->sc_debug & BWN_DEBUG_XMIT)
2750		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2751#endif
2752	mac->mac_suspended = 1;
2753	mac->mac_task_state = 0;
2754	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2755
2756	mac->mac_phy.init_pre(mac);
2757
2758	siba_pcicore_intr(sc->sc_dev);
2759
2760	siba_fix_imcfglobug(sc->sc_dev);
2761	bwn_bt_disable(mac);
2762	if (mac->mac_phy.prepare_hw) {
2763		error = mac->mac_phy.prepare_hw(mac);
2764		if (error)
2765			goto fail0;
2766	}
2767	error = bwn_chip_init(mac);
2768	if (error)
2769		goto fail0;
2770	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2771	    siba_get_revid(sc->sc_dev));
2772	hf = bwn_hf_read(mac);
2773	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2774		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2775		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2776			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2777		if (mac->mac_phy.rev == 1)
2778			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2779	}
2780	if (mac->mac_phy.rf_ver == 0x2050) {
2781		if (mac->mac_phy.rf_rev < 6)
2782			hf |= BWN_HF_FORCE_VCO_RECALC;
2783		if (mac->mac_phy.rf_rev == 6)
2784			hf |= BWN_HF_4318_TSSI;
2785	}
2786	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2787		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2788	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2789	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2790		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2791	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2792	bwn_hf_write(mac, hf);
2793
2794	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2795	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2796	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2797	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2798
2799	bwn_rate_init(mac);
2800	bwn_set_phytxctl(mac);
2801
2802	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2803	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2804	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2805
2806	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2807		bwn_pio_init(mac);
2808	else
2809		bwn_dma_init(mac);
2810	bwn_wme_init(mac);
2811	bwn_spu_setdelay(mac, 1);
2812	bwn_bt_enable(mac);
2813
2814	siba_powerup(sc->sc_dev,
2815	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2816	bwn_set_macaddr(mac);
2817	bwn_crypt_init(mac);
2818
2819	/* XXX LED initializatin */
2820
2821	mac->mac_status = BWN_MAC_STATUS_INITED;
2822
2823	return (error);
2824
2825fail0:
2826	siba_powerdown(sc->sc_dev);
2827	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2828	    ("%s:%d: fail", __func__, __LINE__));
2829	return (error);
2830}
2831
2832static void
2833bwn_core_start(struct bwn_mac *mac)
2834{
2835	struct bwn_softc *sc = mac->mac_sc;
2836	uint32_t tmp;
2837
2838	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2839	    ("%s:%d: fail", __func__, __LINE__));
2840
2841	if (siba_get_revid(sc->sc_dev) < 5)
2842		return;
2843
2844	while (1) {
2845		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2846		if (!(tmp & 0x00000001))
2847			break;
2848		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2849	}
2850
2851	bwn_mac_enable(mac);
2852	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2853	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2854
2855	mac->mac_status = BWN_MAC_STATUS_STARTED;
2856}
2857
2858static void
2859bwn_core_exit(struct bwn_mac *mac)
2860{
2861	struct bwn_softc *sc = mac->mac_sc;
2862	uint32_t macctl;
2863
2864	BWN_ASSERT_LOCKED(mac->mac_sc);
2865
2866	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2867	    ("%s:%d: fail", __func__, __LINE__));
2868
2869	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2870		return;
2871	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2872
2873	macctl = BWN_READ_4(mac, BWN_MACCTL);
2874	macctl &= ~BWN_MACCTL_MCODE_RUN;
2875	macctl |= BWN_MACCTL_MCODE_JMP0;
2876	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2877
2878	bwn_dma_stop(mac);
2879	bwn_pio_stop(mac);
2880	bwn_chip_exit(mac);
2881	mac->mac_phy.switch_analog(mac, 0);
2882	siba_dev_down(sc->sc_dev, 0);
2883	siba_powerdown(sc->sc_dev);
2884}
2885
2886static void
2887bwn_bt_disable(struct bwn_mac *mac)
2888{
2889	struct bwn_softc *sc = mac->mac_sc;
2890
2891	(void)sc;
2892	/* XXX do nothing yet */
2893}
2894
2895static int
2896bwn_chip_init(struct bwn_mac *mac)
2897{
2898	struct bwn_softc *sc = mac->mac_sc;
2899	struct bwn_phy *phy = &mac->mac_phy;
2900	uint32_t macctl;
2901	int error;
2902
2903	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2904	if (phy->gmode)
2905		macctl |= BWN_MACCTL_GMODE;
2906	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2907
2908	error = bwn_fw_fillinfo(mac);
2909	if (error)
2910		return (error);
2911	error = bwn_fw_loaducode(mac);
2912	if (error)
2913		return (error);
2914
2915	error = bwn_gpio_init(mac);
2916	if (error)
2917		return (error);
2918
2919	error = bwn_fw_loadinitvals(mac);
2920	if (error) {
2921		siba_gpio_set(sc->sc_dev, 0);
2922		return (error);
2923	}
2924	phy->switch_analog(mac, 1);
2925	error = bwn_phy_init(mac);
2926	if (error) {
2927		siba_gpio_set(sc->sc_dev, 0);
2928		return (error);
2929	}
2930	if (phy->set_im)
2931		phy->set_im(mac, BWN_IMMODE_NONE);
2932	if (phy->set_antenna)
2933		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2934	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2935
2936	if (phy->type == BWN_PHYTYPE_B)
2937		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2938	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2939	if (siba_get_revid(sc->sc_dev) < 5)
2940		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2941
2942	BWN_WRITE_4(mac, BWN_MACCTL,
2943	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2944	BWN_WRITE_4(mac, BWN_MACCTL,
2945	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2946	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2947
2948	bwn_set_opmode(mac);
2949	if (siba_get_revid(sc->sc_dev) < 3) {
2950		BWN_WRITE_2(mac, 0x060e, 0x0000);
2951		BWN_WRITE_2(mac, 0x0610, 0x8000);
2952		BWN_WRITE_2(mac, 0x0604, 0x0000);
2953		BWN_WRITE_2(mac, 0x0606, 0x0200);
2954	} else {
2955		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2956		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2957	}
2958	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2959	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2960	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2961	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2962	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2963	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2964	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2965	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
2966	    siba_read_4(sc->sc_dev, SIBA_TGSLOW) | 0x00100000);
2967	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2968	return (error);
2969}
2970
2971/* read hostflags */
2972uint64_t
2973bwn_hf_read(struct bwn_mac *mac)
2974{
2975	uint64_t ret;
2976
2977	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2978	ret <<= 16;
2979	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2980	ret <<= 16;
2981	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2982	return (ret);
2983}
2984
2985void
2986bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2987{
2988
2989	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2990	    (value & 0x00000000ffffull));
2991	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2992	    (value & 0x0000ffff0000ull) >> 16);
2993	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2994	    (value & 0xffff00000000ULL) >> 32);
2995}
2996
2997static void
2998bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2999{
3000
3001	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
3002	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
3003}
3004
3005static void
3006bwn_rate_init(struct bwn_mac *mac)
3007{
3008
3009	switch (mac->mac_phy.type) {
3010	case BWN_PHYTYPE_A:
3011	case BWN_PHYTYPE_G:
3012	case BWN_PHYTYPE_LP:
3013	case BWN_PHYTYPE_N:
3014		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
3015		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
3016		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
3017		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
3018		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
3019		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
3020		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
3021		if (mac->mac_phy.type == BWN_PHYTYPE_A)
3022			break;
3023		/* FALLTHROUGH */
3024	case BWN_PHYTYPE_B:
3025		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
3026		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
3027		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
3028		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
3029		break;
3030	default:
3031		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
3032	}
3033}
3034
3035static void
3036bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
3037{
3038	uint16_t offset;
3039
3040	if (ofdm) {
3041		offset = 0x480;
3042		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
3043	} else {
3044		offset = 0x4c0;
3045		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
3046	}
3047	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
3048	    bwn_shm_read_2(mac, BWN_SHARED, offset));
3049}
3050
3051static uint8_t
3052bwn_plcp_getcck(const uint8_t bitrate)
3053{
3054
3055	switch (bitrate) {
3056	case BWN_CCK_RATE_1MB:
3057		return (0x0a);
3058	case BWN_CCK_RATE_2MB:
3059		return (0x14);
3060	case BWN_CCK_RATE_5MB:
3061		return (0x37);
3062	case BWN_CCK_RATE_11MB:
3063		return (0x6e);
3064	}
3065	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
3066	return (0);
3067}
3068
3069static uint8_t
3070bwn_plcp_getofdm(const uint8_t bitrate)
3071{
3072
3073	switch (bitrate) {
3074	case BWN_OFDM_RATE_6MB:
3075		return (0xb);
3076	case BWN_OFDM_RATE_9MB:
3077		return (0xf);
3078	case BWN_OFDM_RATE_12MB:
3079		return (0xa);
3080	case BWN_OFDM_RATE_18MB:
3081		return (0xe);
3082	case BWN_OFDM_RATE_24MB:
3083		return (0x9);
3084	case BWN_OFDM_RATE_36MB:
3085		return (0xd);
3086	case BWN_OFDM_RATE_48MB:
3087		return (0x8);
3088	case BWN_OFDM_RATE_54MB:
3089		return (0xc);
3090	}
3091	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
3092	return (0);
3093}
3094
3095static void
3096bwn_set_phytxctl(struct bwn_mac *mac)
3097{
3098	uint16_t ctl;
3099
3100	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
3101	    BWN_TX_PHY_TXPWR);
3102	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
3103	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
3104	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
3105}
3106
3107static void
3108bwn_pio_init(struct bwn_mac *mac)
3109{
3110	struct bwn_pio *pio = &mac->mac_method.pio;
3111
3112	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
3113	    & ~BWN_MACCTL_BIGENDIAN);
3114	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
3115
3116	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
3117	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
3118	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
3119	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
3120	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
3121	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
3122}
3123
3124static void
3125bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
3126    int index)
3127{
3128	struct bwn_pio_txpkt *tp;
3129	struct bwn_softc *sc = mac->mac_sc;
3130	unsigned int i;
3131
3132	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
3133	tq->tq_index = index;
3134
3135	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
3136	if (siba_get_revid(sc->sc_dev) >= 8)
3137		tq->tq_size = 1920;
3138	else {
3139		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
3140		tq->tq_size -= 80;
3141	}
3142
3143	TAILQ_INIT(&tq->tq_pktlist);
3144	for (i = 0; i < N(tq->tq_pkts); i++) {
3145		tp = &(tq->tq_pkts[i]);
3146		tp->tp_index = i;
3147		tp->tp_queue = tq;
3148		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
3149	}
3150}
3151
3152static uint16_t
3153bwn_pio_idx2base(struct bwn_mac *mac, int index)
3154{
3155	struct bwn_softc *sc = mac->mac_sc;
3156	static const uint16_t bases[] = {
3157		BWN_PIO_BASE0,
3158		BWN_PIO_BASE1,
3159		BWN_PIO_BASE2,
3160		BWN_PIO_BASE3,
3161		BWN_PIO_BASE4,
3162		BWN_PIO_BASE5,
3163		BWN_PIO_BASE6,
3164		BWN_PIO_BASE7,
3165	};
3166	static const uint16_t bases_rev11[] = {
3167		BWN_PIO11_BASE0,
3168		BWN_PIO11_BASE1,
3169		BWN_PIO11_BASE2,
3170		BWN_PIO11_BASE3,
3171		BWN_PIO11_BASE4,
3172		BWN_PIO11_BASE5,
3173	};
3174
3175	if (siba_get_revid(sc->sc_dev) >= 11) {
3176		if (index >= N(bases_rev11))
3177			device_printf(sc->sc_dev, "%s: warning\n", __func__);
3178		return (bases_rev11[index]);
3179	}
3180	if (index >= N(bases))
3181		device_printf(sc->sc_dev, "%s: warning\n", __func__);
3182	return (bases[index]);
3183}
3184
3185static void
3186bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
3187    int index)
3188{
3189	struct bwn_softc *sc = mac->mac_sc;
3190
3191	prq->prq_mac = mac;
3192	prq->prq_rev = siba_get_revid(sc->sc_dev);
3193	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
3194	bwn_dma_rxdirectfifo(mac, index, 1);
3195}
3196
3197static void
3198bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
3199{
3200	if (tq == NULL)
3201		return;
3202	bwn_pio_cancel_tx_packets(tq);
3203}
3204
3205static void
3206bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
3207{
3208
3209	bwn_destroy_pioqueue_tx(pio);
3210}
3211
3212static uint16_t
3213bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
3214    uint16_t offset)
3215{
3216
3217	return (BWN_READ_2(mac, tq->tq_base + offset));
3218}
3219
3220static void
3221bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
3222{
3223	uint32_t ctl;
3224	int type;
3225	uint16_t base;
3226
3227	type = bwn_dma_mask2type(bwn_dma_mask(mac));
3228	base = bwn_dma_base(type, idx);
3229	if (type == BWN_DMA_64BIT) {
3230		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
3231		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
3232		if (enable)
3233			ctl |= BWN_DMA64_RXDIRECTFIFO;
3234		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
3235	} else {
3236		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
3237		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
3238		if (enable)
3239			ctl |= BWN_DMA32_RXDIRECTFIFO;
3240		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
3241	}
3242}
3243
3244static uint64_t
3245bwn_dma_mask(struct bwn_mac *mac)
3246{
3247	uint32_t tmp;
3248	uint16_t base;
3249
3250	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3251	if (tmp & SIBA_TGSHIGH_DMA64)
3252		return (BWN_DMA_BIT_MASK(64));
3253	base = bwn_dma_base(0, 0);
3254	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3255	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3256	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3257		return (BWN_DMA_BIT_MASK(32));
3258
3259	return (BWN_DMA_BIT_MASK(30));
3260}
3261
3262static int
3263bwn_dma_mask2type(uint64_t dmamask)
3264{
3265
3266	if (dmamask == BWN_DMA_BIT_MASK(30))
3267		return (BWN_DMA_30BIT);
3268	if (dmamask == BWN_DMA_BIT_MASK(32))
3269		return (BWN_DMA_32BIT);
3270	if (dmamask == BWN_DMA_BIT_MASK(64))
3271		return (BWN_DMA_64BIT);
3272	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
3273	return (BWN_DMA_30BIT);
3274}
3275
3276static void
3277bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
3278{
3279	struct bwn_pio_txpkt *tp;
3280	unsigned int i;
3281
3282	for (i = 0; i < N(tq->tq_pkts); i++) {
3283		tp = &(tq->tq_pkts[i]);
3284		if (tp->tp_m) {
3285			m_freem(tp->tp_m);
3286			tp->tp_m = NULL;
3287		}
3288	}
3289}
3290
3291static uint16_t
3292bwn_dma_base(int type, int controller_idx)
3293{
3294	static const uint16_t map64[] = {
3295		BWN_DMA64_BASE0,
3296		BWN_DMA64_BASE1,
3297		BWN_DMA64_BASE2,
3298		BWN_DMA64_BASE3,
3299		BWN_DMA64_BASE4,
3300		BWN_DMA64_BASE5,
3301	};
3302	static const uint16_t map32[] = {
3303		BWN_DMA32_BASE0,
3304		BWN_DMA32_BASE1,
3305		BWN_DMA32_BASE2,
3306		BWN_DMA32_BASE3,
3307		BWN_DMA32_BASE4,
3308		BWN_DMA32_BASE5,
3309	};
3310
3311	if (type == BWN_DMA_64BIT) {
3312		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
3313		    ("%s:%d: fail", __func__, __LINE__));
3314		return (map64[controller_idx]);
3315	}
3316	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
3317	    ("%s:%d: fail", __func__, __LINE__));
3318	return (map32[controller_idx]);
3319}
3320
3321static void
3322bwn_dma_init(struct bwn_mac *mac)
3323{
3324	struct bwn_dma *dma = &mac->mac_method.dma;
3325
3326	/* setup TX DMA channels. */
3327	bwn_dma_setup(dma->wme[WME_AC_BK]);
3328	bwn_dma_setup(dma->wme[WME_AC_BE]);
3329	bwn_dma_setup(dma->wme[WME_AC_VI]);
3330	bwn_dma_setup(dma->wme[WME_AC_VO]);
3331	bwn_dma_setup(dma->mcast);
3332	/* setup RX DMA channel. */
3333	bwn_dma_setup(dma->rx);
3334}
3335
3336static struct bwn_dma_ring *
3337bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
3338    int for_tx, int type)
3339{
3340	struct bwn_dma *dma = &mac->mac_method.dma;
3341	struct bwn_dma_ring *dr;
3342	struct bwn_dmadesc_generic *desc;
3343	struct bwn_dmadesc_meta *mt;
3344	struct bwn_softc *sc = mac->mac_sc;
3345	int error, i;
3346
3347	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
3348	if (dr == NULL)
3349		goto out;
3350	dr->dr_numslots = BWN_RXRING_SLOTS;
3351	if (for_tx)
3352		dr->dr_numslots = BWN_TXRING_SLOTS;
3353
3354	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
3355	    M_DEVBUF, M_NOWAIT | M_ZERO);
3356	if (dr->dr_meta == NULL)
3357		goto fail0;
3358
3359	dr->dr_type = type;
3360	dr->dr_mac = mac;
3361	dr->dr_base = bwn_dma_base(type, controller_index);
3362	dr->dr_index = controller_index;
3363	if (type == BWN_DMA_64BIT) {
3364		dr->getdesc = bwn_dma_64_getdesc;
3365		dr->setdesc = bwn_dma_64_setdesc;
3366		dr->start_transfer = bwn_dma_64_start_transfer;
3367		dr->suspend = bwn_dma_64_suspend;
3368		dr->resume = bwn_dma_64_resume;
3369		dr->get_curslot = bwn_dma_64_get_curslot;
3370		dr->set_curslot = bwn_dma_64_set_curslot;
3371	} else {
3372		dr->getdesc = bwn_dma_32_getdesc;
3373		dr->setdesc = bwn_dma_32_setdesc;
3374		dr->start_transfer = bwn_dma_32_start_transfer;
3375		dr->suspend = bwn_dma_32_suspend;
3376		dr->resume = bwn_dma_32_resume;
3377		dr->get_curslot = bwn_dma_32_get_curslot;
3378		dr->set_curslot = bwn_dma_32_set_curslot;
3379	}
3380	if (for_tx) {
3381		dr->dr_tx = 1;
3382		dr->dr_curslot = -1;
3383	} else {
3384		if (dr->dr_index == 0) {
3385			dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
3386			dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
3387		} else
3388			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
3389	}
3390
3391	error = bwn_dma_allocringmemory(dr);
3392	if (error)
3393		goto fail2;
3394
3395	if (for_tx) {
3396		/*
3397		 * Assumption: BWN_TXRING_SLOTS can be divided by
3398		 * BWN_TX_SLOTS_PER_FRAME
3399		 */
3400		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
3401		    ("%s:%d: fail", __func__, __LINE__));
3402
3403		dr->dr_txhdr_cache =
3404		    malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
3405			BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
3406		KASSERT(dr->dr_txhdr_cache != NULL,
3407		    ("%s:%d: fail", __func__, __LINE__));
3408
3409		/*
3410		 * Create TX ring DMA stuffs
3411		 */
3412		error = bus_dma_tag_create(dma->parent_dtag,
3413				    BWN_ALIGN, 0,
3414				    BUS_SPACE_MAXADDR,
3415				    BUS_SPACE_MAXADDR,
3416				    NULL, NULL,
3417				    BWN_HDRSIZE(mac),
3418				    1,
3419				    BUS_SPACE_MAXSIZE_32BIT,
3420				    0,
3421				    NULL, NULL,
3422				    &dr->dr_txring_dtag);
3423		if (error) {
3424			device_printf(sc->sc_dev,
3425			    "can't create TX ring DMA tag: TODO frees\n");
3426			goto fail1;
3427		}
3428
3429		for (i = 0; i < dr->dr_numslots; i += 2) {
3430			dr->getdesc(dr, i, &desc, &mt);
3431
3432			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
3433			mt->mt_m = NULL;
3434			mt->mt_ni = NULL;
3435			mt->mt_islast = 0;
3436			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
3437			    &mt->mt_dmap);
3438			if (error) {
3439				device_printf(sc->sc_dev,
3440				     "can't create RX buf DMA map\n");
3441				goto fail1;
3442			}
3443
3444			dr->getdesc(dr, i + 1, &desc, &mt);
3445
3446			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
3447			mt->mt_m = NULL;
3448			mt->mt_ni = NULL;
3449			mt->mt_islast = 1;
3450			error = bus_dmamap_create(dma->txbuf_dtag, 0,
3451			    &mt->mt_dmap);
3452			if (error) {
3453				device_printf(sc->sc_dev,
3454				     "can't create RX buf DMA map\n");
3455				goto fail1;
3456			}
3457		}
3458	} else {
3459		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
3460		    &dr->dr_spare_dmap);
3461		if (error) {
3462			device_printf(sc->sc_dev,
3463			    "can't create RX buf DMA map\n");
3464			goto out;		/* XXX wrong! */
3465		}
3466
3467		for (i = 0; i < dr->dr_numslots; i++) {
3468			dr->getdesc(dr, i, &desc, &mt);
3469
3470			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
3471			    &mt->mt_dmap);
3472			if (error) {
3473				device_printf(sc->sc_dev,
3474				    "can't create RX buf DMA map\n");
3475				goto out;	/* XXX wrong! */
3476			}
3477			error = bwn_dma_newbuf(dr, desc, mt, 1);
3478			if (error) {
3479				device_printf(sc->sc_dev,
3480				    "failed to allocate RX buf\n");
3481				goto out;	/* XXX wrong! */
3482			}
3483		}
3484
3485		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
3486		    BUS_DMASYNC_PREWRITE);
3487
3488		dr->dr_usedslot = dr->dr_numslots;
3489	}
3490
3491      out:
3492	return (dr);
3493
3494fail2:
3495	free(dr->dr_txhdr_cache, M_DEVBUF);
3496fail1:
3497	free(dr->dr_meta, M_DEVBUF);
3498fail0:
3499	free(dr, M_DEVBUF);
3500	return (NULL);
3501}
3502
3503static void
3504bwn_dma_ringfree(struct bwn_dma_ring **dr)
3505{
3506
3507	if (dr == NULL)
3508		return;
3509
3510	bwn_dma_free_descbufs(*dr);
3511	bwn_dma_free_ringmemory(*dr);
3512
3513	free((*dr)->dr_txhdr_cache, M_DEVBUF);
3514	free((*dr)->dr_meta, M_DEVBUF);
3515	free(*dr, M_DEVBUF);
3516
3517	*dr = NULL;
3518}
3519
3520static void
3521bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
3522    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3523{
3524	struct bwn_dmadesc32 *desc;
3525
3526	*meta = &(dr->dr_meta[slot]);
3527	desc = dr->dr_ring_descbase;
3528	desc = &(desc[slot]);
3529
3530	*gdesc = (struct bwn_dmadesc_generic *)desc;
3531}
3532
3533static void
3534bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
3535    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3536    int start, int end, int irq)
3537{
3538	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
3539	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3540	uint32_t addr, addrext, ctl;
3541	int slot;
3542
3543	slot = (int)(&(desc->dma.dma32) - descbase);
3544	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3545	    ("%s:%d: fail", __func__, __LINE__));
3546
3547	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
3548	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
3549	addr |= siba_dma_translation(sc->sc_dev);
3550	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
3551	if (slot == dr->dr_numslots - 1)
3552		ctl |= BWN_DMA32_DCTL_DTABLEEND;
3553	if (start)
3554		ctl |= BWN_DMA32_DCTL_FRAMESTART;
3555	if (end)
3556		ctl |= BWN_DMA32_DCTL_FRAMEEND;
3557	if (irq)
3558		ctl |= BWN_DMA32_DCTL_IRQ;
3559	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
3560	    & BWN_DMA32_DCTL_ADDREXT_MASK;
3561
3562	desc->dma.dma32.control = htole32(ctl);
3563	desc->dma.dma32.address = htole32(addr);
3564}
3565
3566static void
3567bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
3568{
3569
3570	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
3571	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
3572}
3573
3574static void
3575bwn_dma_32_suspend(struct bwn_dma_ring *dr)
3576{
3577
3578	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3579	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
3580}
3581
3582static void
3583bwn_dma_32_resume(struct bwn_dma_ring *dr)
3584{
3585
3586	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3587	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
3588}
3589
3590static int
3591bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3592{
3593	uint32_t val;
3594
3595	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3596	val &= BWN_DMA32_RXDPTR;
3597
3598	return (val / sizeof(struct bwn_dmadesc32));
3599}
3600
3601static void
3602bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3603{
3604
3605	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3606	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3607}
3608
3609static void
3610bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3611    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3612{
3613	struct bwn_dmadesc64 *desc;
3614
3615	*meta = &(dr->dr_meta[slot]);
3616	desc = dr->dr_ring_descbase;
3617	desc = &(desc[slot]);
3618
3619	*gdesc = (struct bwn_dmadesc_generic *)desc;
3620}
3621
3622static void
3623bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3624    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3625    int start, int end, int irq)
3626{
3627	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
3628	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3629	int slot;
3630	uint32_t ctl0 = 0, ctl1 = 0;
3631	uint32_t addrlo, addrhi;
3632	uint32_t addrext;
3633
3634	slot = (int)(&(desc->dma.dma64) - descbase);
3635	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3636	    ("%s:%d: fail", __func__, __LINE__));
3637
3638	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
3639	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
3640	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
3641	    30;
3642	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
3643	if (slot == dr->dr_numslots - 1)
3644		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3645	if (start)
3646		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3647	if (end)
3648		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3649	if (irq)
3650		ctl0 |= BWN_DMA64_DCTL0_IRQ;
3651	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3652	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3653	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
3654
3655	desc->dma.dma64.control0 = htole32(ctl0);
3656	desc->dma.dma64.control1 = htole32(ctl1);
3657	desc->dma.dma64.address_low = htole32(addrlo);
3658	desc->dma.dma64.address_high = htole32(addrhi);
3659}
3660
3661static void
3662bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3663{
3664
3665	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3666	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3667}
3668
3669static void
3670bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3671{
3672
3673	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3674	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3675}
3676
3677static void
3678bwn_dma_64_resume(struct bwn_dma_ring *dr)
3679{
3680
3681	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3682	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3683}
3684
3685static int
3686bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3687{
3688	uint32_t val;
3689
3690	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3691	val &= BWN_DMA64_RXSTATDPTR;
3692
3693	return (val / sizeof(struct bwn_dmadesc64));
3694}
3695
3696static void
3697bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3698{
3699
3700	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3701	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3702}
3703
3704static int
3705bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3706{
3707	struct bwn_mac *mac = dr->dr_mac;
3708	struct bwn_dma *dma = &mac->mac_method.dma;
3709	struct bwn_softc *sc = mac->mac_sc;
3710	int error;
3711
3712	error = bus_dma_tag_create(dma->parent_dtag,
3713			    BWN_ALIGN, 0,
3714			    BUS_SPACE_MAXADDR,
3715			    BUS_SPACE_MAXADDR,
3716			    NULL, NULL,
3717			    BWN_DMA_RINGMEMSIZE,
3718			    1,
3719			    BUS_SPACE_MAXSIZE_32BIT,
3720			    0,
3721			    NULL, NULL,
3722			    &dr->dr_ring_dtag);
3723	if (error) {
3724		device_printf(sc->sc_dev,
3725		    "can't create TX ring DMA tag: TODO frees\n");
3726		return (-1);
3727	}
3728
3729	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3730	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3731	    &dr->dr_ring_dmap);
3732	if (error) {
3733		device_printf(sc->sc_dev,
3734		    "can't allocate DMA mem: TODO frees\n");
3735		return (-1);
3736	}
3737	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3738	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3739	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3740	if (error) {
3741		device_printf(sc->sc_dev,
3742		    "can't load DMA mem: TODO free\n");
3743		return (-1);
3744	}
3745
3746	return (0);
3747}
3748
3749static void
3750bwn_dma_setup(struct bwn_dma_ring *dr)
3751{
3752	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3753	uint64_t ring64;
3754	uint32_t addrext, ring32, value;
3755	uint32_t trans = siba_dma_translation(sc->sc_dev);
3756
3757	if (dr->dr_tx) {
3758		dr->dr_curslot = -1;
3759
3760		if (dr->dr_type == BWN_DMA_64BIT) {
3761			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3762			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3763			    >> 30;
3764			value = BWN_DMA64_TXENABLE;
3765			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3766			    & BWN_DMA64_TXADDREXT_MASK;
3767			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3768			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3769			    (ring64 & 0xffffffff));
3770			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3771			    ((ring64 >> 32) &
3772			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3773		} else {
3774			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3775			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3776			value = BWN_DMA32_TXENABLE;
3777			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3778			    & BWN_DMA32_TXADDREXT_MASK;
3779			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3780			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3781			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3782		}
3783		return;
3784	}
3785
3786	/*
3787	 * set for RX
3788	 */
3789	dr->dr_usedslot = dr->dr_numslots;
3790
3791	if (dr->dr_type == BWN_DMA_64BIT) {
3792		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3793		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3794		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3795		value |= BWN_DMA64_RXENABLE;
3796		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3797		    & BWN_DMA64_RXADDREXT_MASK;
3798		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3799		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3800		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3801		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3802		    | (trans << 1));
3803		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3804		    sizeof(struct bwn_dmadesc64));
3805	} else {
3806		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3807		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3808		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3809		value |= BWN_DMA32_RXENABLE;
3810		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3811		    & BWN_DMA32_RXADDREXT_MASK;
3812		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3813		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3814		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3815		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3816		    sizeof(struct bwn_dmadesc32));
3817	}
3818}
3819
3820static void
3821bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3822{
3823
3824	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3825	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3826	    dr->dr_ring_dmap);
3827}
3828
3829static void
3830bwn_dma_cleanup(struct bwn_dma_ring *dr)
3831{
3832
3833	if (dr->dr_tx) {
3834		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3835		if (dr->dr_type == BWN_DMA_64BIT) {
3836			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3837			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3838		} else
3839			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3840	} else {
3841		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3842		if (dr->dr_type == BWN_DMA_64BIT) {
3843			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3844			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3845		} else
3846			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3847	}
3848}
3849
3850static void
3851bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3852{
3853	struct bwn_dmadesc_generic *desc;
3854	struct bwn_dmadesc_meta *meta;
3855	struct bwn_mac *mac = dr->dr_mac;
3856	struct bwn_dma *dma = &mac->mac_method.dma;
3857	struct bwn_softc *sc = mac->mac_sc;
3858	int i;
3859
3860	if (!dr->dr_usedslot)
3861		return;
3862	for (i = 0; i < dr->dr_numslots; i++) {
3863		dr->getdesc(dr, i, &desc, &meta);
3864
3865		if (meta->mt_m == NULL) {
3866			if (!dr->dr_tx)
3867				device_printf(sc->sc_dev, "%s: not TX?\n",
3868				    __func__);
3869			continue;
3870		}
3871		if (dr->dr_tx) {
3872			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3873				bus_dmamap_unload(dr->dr_txring_dtag,
3874				    meta->mt_dmap);
3875			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3876				bus_dmamap_unload(dma->txbuf_dtag,
3877				    meta->mt_dmap);
3878		} else
3879			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3880		bwn_dma_free_descbuf(dr, meta);
3881	}
3882}
3883
3884static int
3885bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3886    int type)
3887{
3888	struct bwn_softc *sc = mac->mac_sc;
3889	uint32_t value;
3890	int i;
3891	uint16_t offset;
3892
3893	for (i = 0; i < 10; i++) {
3894		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3895		    BWN_DMA32_TXSTATUS;
3896		value = BWN_READ_4(mac, base + offset);
3897		if (type == BWN_DMA_64BIT) {
3898			value &= BWN_DMA64_TXSTAT;
3899			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3900			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3901			    value == BWN_DMA64_TXSTAT_STOPPED)
3902				break;
3903		} else {
3904			value &= BWN_DMA32_TXSTATE;
3905			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3906			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3907			    value == BWN_DMA32_TXSTAT_STOPPED)
3908				break;
3909		}
3910		DELAY(1000);
3911	}
3912	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3913	BWN_WRITE_4(mac, base + offset, 0);
3914	for (i = 0; i < 10; i++) {
3915		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3916						   BWN_DMA32_TXSTATUS;
3917		value = BWN_READ_4(mac, base + offset);
3918		if (type == BWN_DMA_64BIT) {
3919			value &= BWN_DMA64_TXSTAT;
3920			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3921				i = -1;
3922				break;
3923			}
3924		} else {
3925			value &= BWN_DMA32_TXSTATE;
3926			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3927				i = -1;
3928				break;
3929			}
3930		}
3931		DELAY(1000);
3932	}
3933	if (i != -1) {
3934		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3935		return (ENODEV);
3936	}
3937	DELAY(1000);
3938
3939	return (0);
3940}
3941
3942static int
3943bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3944    int type)
3945{
3946	struct bwn_softc *sc = mac->mac_sc;
3947	uint32_t value;
3948	int i;
3949	uint16_t offset;
3950
3951	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3952	BWN_WRITE_4(mac, base + offset, 0);
3953	for (i = 0; i < 10; i++) {
3954		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3955		    BWN_DMA32_RXSTATUS;
3956		value = BWN_READ_4(mac, base + offset);
3957		if (type == BWN_DMA_64BIT) {
3958			value &= BWN_DMA64_RXSTAT;
3959			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3960				i = -1;
3961				break;
3962			}
3963		} else {
3964			value &= BWN_DMA32_RXSTATE;
3965			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3966				i = -1;
3967				break;
3968			}
3969		}
3970		DELAY(1000);
3971	}
3972	if (i != -1) {
3973		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3974		return (ENODEV);
3975	}
3976
3977	return (0);
3978}
3979
3980static void
3981bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3982    struct bwn_dmadesc_meta *meta)
3983{
3984
3985	if (meta->mt_m != NULL) {
3986		m_freem(meta->mt_m);
3987		meta->mt_m = NULL;
3988	}
3989	if (meta->mt_ni != NULL) {
3990		ieee80211_free_node(meta->mt_ni);
3991		meta->mt_ni = NULL;
3992	}
3993}
3994
3995static void
3996bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3997{
3998	struct bwn_rxhdr4 *rxhdr;
3999	unsigned char *frame;
4000
4001	rxhdr = mtod(m, struct bwn_rxhdr4 *);
4002	rxhdr->frame_len = 0;
4003
4004	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
4005	    sizeof(struct bwn_plcp6) + 2,
4006	    ("%s:%d: fail", __func__, __LINE__));
4007	frame = mtod(m, char *) + dr->dr_frameoffset;
4008	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
4009}
4010
4011static uint8_t
4012bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
4013{
4014	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
4015
4016	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
4017	    == 0xff);
4018}
4019
4020static void
4021bwn_wme_init(struct bwn_mac *mac)
4022{
4023
4024	bwn_wme_load(mac);
4025
4026	/* enable WME support. */
4027	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
4028	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
4029	    BWN_IFSCTL_USE_EDCF);
4030}
4031
4032static void
4033bwn_spu_setdelay(struct bwn_mac *mac, int idle)
4034{
4035	struct bwn_softc *sc = mac->mac_sc;
4036	struct ieee80211com *ic = &sc->sc_ic;
4037	uint16_t delay;	/* microsec */
4038
4039	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
4040	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
4041		delay = 500;
4042	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
4043		delay = max(delay, (uint16_t)2400);
4044
4045	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
4046}
4047
4048static void
4049bwn_bt_enable(struct bwn_mac *mac)
4050{
4051	struct bwn_softc *sc = mac->mac_sc;
4052	uint64_t hf;
4053
4054	if (bwn_bluetooth == 0)
4055		return;
4056	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
4057		return;
4058	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
4059		return;
4060
4061	hf = bwn_hf_read(mac);
4062	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
4063		hf |= BWN_HF_BT_COEXISTALT;
4064	else
4065		hf |= BWN_HF_BT_COEXIST;
4066	bwn_hf_write(mac, hf);
4067}
4068
4069static void
4070bwn_set_macaddr(struct bwn_mac *mac)
4071{
4072
4073	bwn_mac_write_bssid(mac);
4074	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
4075	    mac->mac_sc->sc_ic.ic_macaddr);
4076}
4077
4078static void
4079bwn_clear_keys(struct bwn_mac *mac)
4080{
4081	int i;
4082
4083	for (i = 0; i < mac->mac_max_nr_keys; i++) {
4084		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
4085		    ("%s:%d: fail", __func__, __LINE__));
4086
4087		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
4088		    NULL, BWN_SEC_KEYSIZE, NULL);
4089		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
4090			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
4091			    NULL, BWN_SEC_KEYSIZE, NULL);
4092		}
4093		mac->mac_key[i].keyconf = NULL;
4094	}
4095}
4096
4097static void
4098bwn_crypt_init(struct bwn_mac *mac)
4099{
4100	struct bwn_softc *sc = mac->mac_sc;
4101
4102	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
4103	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
4104	    ("%s:%d: fail", __func__, __LINE__));
4105	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
4106	mac->mac_ktp *= 2;
4107	if (siba_get_revid(sc->sc_dev) >= 5)
4108		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
4109	bwn_clear_keys(mac);
4110}
4111
4112static void
4113bwn_chip_exit(struct bwn_mac *mac)
4114{
4115	struct bwn_softc *sc = mac->mac_sc;
4116
4117	bwn_phy_exit(mac);
4118	siba_gpio_set(sc->sc_dev, 0);
4119}
4120
4121static int
4122bwn_fw_fillinfo(struct bwn_mac *mac)
4123{
4124	int error;
4125
4126	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
4127	if (error == 0)
4128		return (0);
4129	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
4130	if (error == 0)
4131		return (0);
4132	return (error);
4133}
4134
4135static int
4136bwn_gpio_init(struct bwn_mac *mac)
4137{
4138	struct bwn_softc *sc = mac->mac_sc;
4139	uint32_t mask = 0x1f, set = 0xf, value;
4140
4141	BWN_WRITE_4(mac, BWN_MACCTL,
4142	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
4143	BWN_WRITE_2(mac, BWN_GPIO_MASK,
4144	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
4145
4146	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
4147		mask |= 0x0060;
4148		set |= 0x0060;
4149	}
4150	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
4151		BWN_WRITE_2(mac, BWN_GPIO_MASK,
4152		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
4153		mask |= 0x0200;
4154		set |= 0x0200;
4155	}
4156	if (siba_get_revid(sc->sc_dev) >= 2)
4157		mask |= 0x0010;
4158
4159	value = siba_gpio_get(sc->sc_dev);
4160	if (value == -1)
4161		return (0);
4162	siba_gpio_set(sc->sc_dev, (value & mask) | set);
4163
4164	return (0);
4165}
4166
4167static int
4168bwn_fw_loadinitvals(struct bwn_mac *mac)
4169{
4170#define	GETFWOFFSET(fwp, offset)				\
4171	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
4172	const size_t hdr_len = sizeof(struct bwn_fwhdr);
4173	const struct bwn_fwhdr *hdr;
4174	struct bwn_fw *fw = &mac->mac_fw;
4175	int error;
4176
4177	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
4178	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
4179	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
4180	if (error)
4181		return (error);
4182	if (fw->initvals_band.fw) {
4183		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
4184		error = bwn_fwinitvals_write(mac,
4185		    GETFWOFFSET(fw->initvals_band, hdr_len),
4186		    be32toh(hdr->size),
4187		    fw->initvals_band.fw->datasize - hdr_len);
4188	}
4189	return (error);
4190#undef GETFWOFFSET
4191}
4192
4193static int
4194bwn_phy_init(struct bwn_mac *mac)
4195{
4196	struct bwn_softc *sc = mac->mac_sc;
4197	int error;
4198
4199	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
4200	mac->mac_phy.rf_onoff(mac, 1);
4201	error = mac->mac_phy.init(mac);
4202	if (error) {
4203		device_printf(sc->sc_dev, "PHY init failed\n");
4204		goto fail0;
4205	}
4206	error = bwn_switch_channel(mac,
4207	    mac->mac_phy.get_default_chan(mac));
4208	if (error) {
4209		device_printf(sc->sc_dev,
4210		    "failed to switch default channel\n");
4211		goto fail1;
4212	}
4213	return (0);
4214fail1:
4215	if (mac->mac_phy.exit)
4216		mac->mac_phy.exit(mac);
4217fail0:
4218	mac->mac_phy.rf_onoff(mac, 0);
4219
4220	return (error);
4221}
4222
4223static void
4224bwn_set_txantenna(struct bwn_mac *mac, int antenna)
4225{
4226	uint16_t ant;
4227	uint16_t tmp;
4228
4229	ant = bwn_ant2phy(antenna);
4230
4231	/* For ACK/CTS */
4232	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
4233	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
4234	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
4235	/* For Probe Resposes */
4236	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
4237	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
4238	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
4239}
4240
4241static void
4242bwn_set_opmode(struct bwn_mac *mac)
4243{
4244	struct bwn_softc *sc = mac->mac_sc;
4245	struct ieee80211com *ic = &sc->sc_ic;
4246	uint32_t ctl;
4247	uint16_t cfp_pretbtt;
4248
4249	ctl = BWN_READ_4(mac, BWN_MACCTL);
4250	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
4251	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
4252	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
4253	ctl |= BWN_MACCTL_STA;
4254
4255	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4256	    ic->ic_opmode == IEEE80211_M_MBSS)
4257		ctl |= BWN_MACCTL_HOSTAP;
4258	else if (ic->ic_opmode == IEEE80211_M_IBSS)
4259		ctl &= ~BWN_MACCTL_STA;
4260	ctl |= sc->sc_filters;
4261
4262	if (siba_get_revid(sc->sc_dev) <= 4)
4263		ctl |= BWN_MACCTL_PROMISC;
4264
4265	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4266
4267	cfp_pretbtt = 2;
4268	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
4269		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
4270		    siba_get_chiprev(sc->sc_dev) == 3)
4271			cfp_pretbtt = 100;
4272		else
4273			cfp_pretbtt = 50;
4274	}
4275	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
4276}
4277
4278static int
4279bwn_dma_gettype(struct bwn_mac *mac)
4280{
4281	uint32_t tmp;
4282	uint16_t base;
4283
4284	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
4285	if (tmp & SIBA_TGSHIGH_DMA64)
4286		return (BWN_DMA_64BIT);
4287	base = bwn_dma_base(0, 0);
4288	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
4289	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
4290	if (tmp & BWN_DMA32_TXADDREXT_MASK)
4291		return (BWN_DMA_32BIT);
4292
4293	return (BWN_DMA_30BIT);
4294}
4295
4296static void
4297bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
4298{
4299	if (!error) {
4300		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
4301		*((bus_addr_t *)arg) = seg->ds_addr;
4302	}
4303}
4304
4305static void
4306bwn_phy_g_init_sub(struct bwn_mac *mac)
4307{
4308	struct bwn_phy *phy = &mac->mac_phy;
4309	struct bwn_phy_g *pg = &phy->phy_g;
4310	struct bwn_softc *sc = mac->mac_sc;
4311	uint16_t i, tmp;
4312
4313	if (phy->rev == 1)
4314		bwn_phy_init_b5(mac);
4315	else
4316		bwn_phy_init_b6(mac);
4317
4318	if (phy->rev >= 2 || phy->gmode)
4319		bwn_phy_init_a(mac);
4320
4321	if (phy->rev >= 2) {
4322		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVER, 0);
4323		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVERVAL, 0);
4324	}
4325	if (phy->rev == 2) {
4326		BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, 0);
4327		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xc0);
4328	}
4329	if (phy->rev > 5) {
4330		BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, 0x400);
4331		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xc0);
4332	}
4333	if (phy->gmode || phy->rev >= 2) {
4334		tmp = BWN_PHY_READ(mac, BWN_PHY_VERSION_OFDM);
4335		tmp &= BWN_PHYVER_VERSION;
4336		if (tmp == 3 || tmp == 5) {
4337			BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0xc2), 0x1816);
4338			BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0xc3), 0x8006);
4339		}
4340		if (tmp == 5) {
4341			BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0xcc), 0x00ff,
4342			    0x1f00);
4343		}
4344	}
4345	if ((phy->rev <= 2 && phy->gmode) || phy->rev >= 2)
4346		BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x7e), 0x78);
4347	if (phy->rf_rev == 8) {
4348		BWN_PHY_SET(mac, BWN_PHY_EXTG(0x01), 0x80);
4349		BWN_PHY_SET(mac, BWN_PHY_OFDM(0x3e), 0x4);
4350	}
4351	if (BWN_HAS_LOOPBACK(phy))
4352		bwn_loopback_calcgain(mac);
4353
4354	if (phy->rf_rev != 8) {
4355		if (pg->pg_initval == 0xffff)
4356			pg->pg_initval = bwn_rf_init_bcm2050(mac);
4357		else
4358			BWN_RF_WRITE(mac, 0x0078, pg->pg_initval);
4359	}
4360	bwn_lo_g_init(mac);
4361	if (BWN_HAS_TXMAG(phy)) {
4362		BWN_RF_WRITE(mac, 0x52,
4363		    (BWN_RF_READ(mac, 0x52) & 0xff00)
4364		    | pg->pg_loctl.tx_bias |
4365		    pg->pg_loctl.tx_magn);
4366	} else {
4367		BWN_RF_SETMASK(mac, 0x52, 0xfff0, pg->pg_loctl.tx_bias);
4368	}
4369	if (phy->rev >= 6) {
4370		BWN_PHY_SETMASK(mac, BWN_PHY_CCK(0x36), 0x0fff,
4371		    (pg->pg_loctl.tx_bias << 12));
4372	}
4373	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
4374		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2e), 0x8075);
4375	else
4376		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2e), 0x807f);
4377	if (phy->rev < 2)
4378		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2f), 0x101);
4379	else
4380		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2f), 0x202);
4381	if (phy->gmode || phy->rev >= 2) {
4382		bwn_lo_g_adjust(mac);
4383		BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0x8078);
4384	}
4385
4386	if (!(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_RSSI)) {
4387		for (i = 0; i < 64; i++) {
4388			BWN_PHY_WRITE(mac, BWN_PHY_NRSSI_CTRL, i);
4389			BWN_PHY_WRITE(mac, BWN_PHY_NRSSI_DATA,
4390			    (uint16_t)MIN(MAX(bwn_nrssi_read(mac, i) - 0xffff,
4391			    -32), 31));
4392		}
4393		bwn_nrssi_threshold(mac);
4394	} else if (phy->gmode || phy->rev >= 2) {
4395		if (pg->pg_nrssi[0] == -1000) {
4396			KASSERT(pg->pg_nrssi[1] == -1000,
4397			    ("%s:%d: fail", __func__, __LINE__));
4398			bwn_nrssi_slope_11g(mac);
4399		} else
4400			bwn_nrssi_threshold(mac);
4401	}
4402	if (phy->rf_rev == 8)
4403		BWN_PHY_WRITE(mac, BWN_PHY_EXTG(0x05), 0x3230);
4404	bwn_phy_hwpctl_init(mac);
4405	if ((siba_get_chipid(sc->sc_dev) == 0x4306
4406	     && siba_get_chippkg(sc->sc_dev) == 2) || 0) {
4407		BWN_PHY_MASK(mac, BWN_PHY_CRS0, 0xbfff);
4408		BWN_PHY_MASK(mac, BWN_PHY_OFDM(0xc3), 0x7fff);
4409	}
4410}
4411
4412static uint8_t
4413bwn_has_hwpctl(struct bwn_mac *mac)
4414{
4415
4416	if (mac->mac_phy.hwpctl == 0 || mac->mac_phy.use_hwpctl == NULL)
4417		return (0);
4418	return (mac->mac_phy.use_hwpctl(mac));
4419}
4420
4421static void
4422bwn_phy_init_b5(struct bwn_mac *mac)
4423{
4424	struct bwn_phy *phy = &mac->mac_phy;
4425	struct bwn_phy_g *pg = &phy->phy_g;
4426	struct bwn_softc *sc = mac->mac_sc;
4427	uint16_t offset, value;
4428	uint8_t old_channel;
4429
4430	if (phy->analog == 1)
4431		BWN_RF_SET(mac, 0x007a, 0x0050);
4432	if ((siba_get_pci_subvendor(sc->sc_dev) != SIBA_BOARDVENDOR_BCM) &&
4433	    (siba_get_pci_subdevice(sc->sc_dev) != SIBA_BOARD_BU4306)) {
4434		value = 0x2120;
4435		for (offset = 0x00a8; offset < 0x00c7; offset++) {
4436			BWN_PHY_WRITE(mac, offset, value);
4437			value += 0x202;
4438		}
4439	}
4440	BWN_PHY_SETMASK(mac, 0x0035, 0xf0ff, 0x0700);
4441	if (phy->rf_ver == 0x2050)
4442		BWN_PHY_WRITE(mac, 0x0038, 0x0667);
4443
4444	if (phy->gmode || phy->rev >= 2) {
4445		if (phy->rf_ver == 0x2050) {
4446			BWN_RF_SET(mac, 0x007a, 0x0020);
4447			BWN_RF_SET(mac, 0x0051, 0x0004);
4448		}
4449		BWN_WRITE_2(mac, BWN_PHY_RADIO, 0x0000);
4450
4451		BWN_PHY_SET(mac, 0x0802, 0x0100);
4452		BWN_PHY_SET(mac, 0x042b, 0x2000);
4453
4454		BWN_PHY_WRITE(mac, 0x001c, 0x186a);
4455
4456		BWN_PHY_SETMASK(mac, 0x0013, 0x00ff, 0x1900);
4457		BWN_PHY_SETMASK(mac, 0x0035, 0xffc0, 0x0064);
4458		BWN_PHY_SETMASK(mac, 0x005d, 0xff80, 0x000a);
4459	}
4460
4461	if (mac->mac_flags & BWN_MAC_FLAG_BADFRAME_PREEMP)
4462		BWN_PHY_SET(mac, BWN_PHY_RADIO_BITFIELD, (1 << 11));
4463
4464	if (phy->analog == 1) {
4465		BWN_PHY_WRITE(mac, 0x0026, 0xce00);
4466		BWN_PHY_WRITE(mac, 0x0021, 0x3763);
4467		BWN_PHY_WRITE(mac, 0x0022, 0x1bc3);
4468		BWN_PHY_WRITE(mac, 0x0023, 0x06f9);
4469		BWN_PHY_WRITE(mac, 0x0024, 0x037e);
4470	} else
4471		BWN_PHY_WRITE(mac, 0x0026, 0xcc00);
4472	BWN_PHY_WRITE(mac, 0x0030, 0x00c6);
4473	BWN_WRITE_2(mac, 0x03ec, 0x3f22);
4474
4475	if (phy->analog == 1)
4476		BWN_PHY_WRITE(mac, 0x0020, 0x3e1c);
4477	else
4478		BWN_PHY_WRITE(mac, 0x0020, 0x301c);
4479
4480	if (phy->analog == 0)
4481		BWN_WRITE_2(mac, 0x03e4, 0x3000);
4482
4483	old_channel = phy->chan;
4484	bwn_phy_g_switch_chan(mac, 7, 0);
4485
4486	if (phy->rf_ver != 0x2050) {
4487		BWN_RF_WRITE(mac, 0x0075, 0x0080);
4488		BWN_RF_WRITE(mac, 0x0079, 0x0081);
4489	}
4490
4491	BWN_RF_WRITE(mac, 0x0050, 0x0020);
4492	BWN_RF_WRITE(mac, 0x0050, 0x0023);
4493
4494	if (phy->rf_ver == 0x2050) {
4495		BWN_RF_WRITE(mac, 0x0050, 0x0020);
4496		BWN_RF_WRITE(mac, 0x005a, 0x0070);
4497	}
4498
4499	BWN_RF_WRITE(mac, 0x005b, 0x007b);
4500	BWN_RF_WRITE(mac, 0x005c, 0x00b0);
4501	BWN_RF_SET(mac, 0x007a, 0x0007);
4502
4503	bwn_phy_g_switch_chan(mac, old_channel, 0);
4504	BWN_PHY_WRITE(mac, 0x0014, 0x0080);
4505	BWN_PHY_WRITE(mac, 0x0032, 0x00ca);
4506	BWN_PHY_WRITE(mac, 0x002a, 0x88a3);
4507
4508	bwn_phy_g_set_txpwr_sub(mac, &pg->pg_bbatt, &pg->pg_rfatt,
4509	    pg->pg_txctl);
4510
4511	if (phy->rf_ver == 0x2050)
4512		BWN_RF_WRITE(mac, 0x005d, 0x000d);
4513
4514	BWN_WRITE_2(mac, 0x03e4, (BWN_READ_2(mac, 0x03e4) & 0xffc0) | 0x0004);
4515}
4516
4517static void
4518bwn_loopback_calcgain(struct bwn_mac *mac)
4519{
4520	struct bwn_phy *phy = &mac->mac_phy;
4521	struct bwn_phy_g *pg = &phy->phy_g;
4522	struct bwn_softc *sc = mac->mac_sc;
4523	uint16_t backup_phy[16] = { 0 };
4524	uint16_t backup_radio[3];
4525	uint16_t backup_bband;
4526	uint16_t i, j, loop_i_max;
4527	uint16_t trsw_rx;
4528	uint16_t loop1_outer_done, loop1_inner_done;
4529
4530	backup_phy[0] = BWN_PHY_READ(mac, BWN_PHY_CRS0);
4531	backup_phy[1] = BWN_PHY_READ(mac, BWN_PHY_CCKBBANDCFG);
4532	backup_phy[2] = BWN_PHY_READ(mac, BWN_PHY_RFOVER);
4533	backup_phy[3] = BWN_PHY_READ(mac, BWN_PHY_RFOVERVAL);
4534	if (phy->rev != 1) {
4535		backup_phy[4] = BWN_PHY_READ(mac, BWN_PHY_ANALOGOVER);
4536		backup_phy[5] = BWN_PHY_READ(mac, BWN_PHY_ANALOGOVERVAL);
4537	}
4538	backup_phy[6] = BWN_PHY_READ(mac, BWN_PHY_CCK(0x5a));
4539	backup_phy[7] = BWN_PHY_READ(mac, BWN_PHY_CCK(0x59));
4540	backup_phy[8] = BWN_PHY_READ(mac, BWN_PHY_CCK(0x58));
4541	backup_phy[9] = BWN_PHY_READ(mac, BWN_PHY_CCK(0x0a));
4542	backup_phy[10] = BWN_PHY_READ(mac, BWN_PHY_CCK(0x03));
4543	backup_phy[11] = BWN_PHY_READ(mac, BWN_PHY_LO_MASK);
4544	backup_phy[12] = BWN_PHY_READ(mac, BWN_PHY_LO_CTL);
4545	backup_phy[13] = BWN_PHY_READ(mac, BWN_PHY_CCK(0x2b));
4546	backup_phy[14] = BWN_PHY_READ(mac, BWN_PHY_PGACTL);
4547	backup_phy[15] = BWN_PHY_READ(mac, BWN_PHY_LO_LEAKAGE);
4548	backup_bband = pg->pg_bbatt.att;
4549	backup_radio[0] = BWN_RF_READ(mac, 0x52);
4550	backup_radio[1] = BWN_RF_READ(mac, 0x43);
4551	backup_radio[2] = BWN_RF_READ(mac, 0x7a);
4552
4553	BWN_PHY_MASK(mac, BWN_PHY_CRS0, 0x3fff);
4554	BWN_PHY_SET(mac, BWN_PHY_CCKBBANDCFG, 0x8000);
4555	BWN_PHY_SET(mac, BWN_PHY_RFOVER, 0x0002);
4556	BWN_PHY_MASK(mac, BWN_PHY_RFOVERVAL, 0xfffd);
4557	BWN_PHY_SET(mac, BWN_PHY_RFOVER, 0x0001);
4558	BWN_PHY_MASK(mac, BWN_PHY_RFOVERVAL, 0xfffe);
4559	if (phy->rev != 1) {
4560		BWN_PHY_SET(mac, BWN_PHY_ANALOGOVER, 0x0001);
4561		BWN_PHY_MASK(mac, BWN_PHY_ANALOGOVERVAL, 0xfffe);
4562		BWN_PHY_SET(mac, BWN_PHY_ANALOGOVER, 0x0002);
4563		BWN_PHY_MASK(mac, BWN_PHY_ANALOGOVERVAL, 0xfffd);
4564	}
4565	BWN_PHY_SET(mac, BWN_PHY_RFOVER, 0x000c);
4566	BWN_PHY_SET(mac, BWN_PHY_RFOVERVAL, 0x000c);
4567	BWN_PHY_SET(mac, BWN_PHY_RFOVER, 0x0030);
4568	BWN_PHY_SETMASK(mac, BWN_PHY_RFOVERVAL, 0xffcf, 0x10);
4569
4570	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x5a), 0x0780);
4571	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x59), 0xc810);
4572	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0x000d);
4573
4574	BWN_PHY_SET(mac, BWN_PHY_CCK(0x0a), 0x2000);
4575	if (phy->rev != 1) {
4576		BWN_PHY_SET(mac, BWN_PHY_ANALOGOVER, 0x0004);
4577		BWN_PHY_MASK(mac, BWN_PHY_ANALOGOVERVAL, 0xfffb);
4578	}
4579	BWN_PHY_SETMASK(mac, BWN_PHY_CCK(0x03), 0xff9f, 0x40);
4580
4581	if (phy->rf_rev == 8)
4582		BWN_RF_WRITE(mac, 0x43, 0x000f);
4583	else {
4584		BWN_RF_WRITE(mac, 0x52, 0);
4585		BWN_RF_SETMASK(mac, 0x43, 0xfff0, 0x9);
4586	}
4587	bwn_phy_g_set_bbatt(mac, 11);
4588
4589	if (phy->rev >= 3)
4590		BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0xc020);
4591	else
4592		BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0x8020);
4593	BWN_PHY_WRITE(mac, BWN_PHY_LO_CTL, 0);
4594
4595	BWN_PHY_SETMASK(mac, BWN_PHY_CCK(0x2b), 0xffc0, 0x01);
4596	BWN_PHY_SETMASK(mac, BWN_PHY_CCK(0x2b), 0xc0ff, 0x800);
4597
4598	BWN_PHY_SET(mac, BWN_PHY_RFOVER, 0x0100);
4599	BWN_PHY_MASK(mac, BWN_PHY_RFOVERVAL, 0xcfff);
4600
4601	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_EXTLNA) {
4602		if (phy->rev >= 7) {
4603			BWN_PHY_SET(mac, BWN_PHY_RFOVER, 0x0800);
4604			BWN_PHY_SET(mac, BWN_PHY_RFOVERVAL, 0x8000);
4605		}
4606	}
4607	BWN_RF_MASK(mac, 0x7a, 0x00f7);
4608
4609	j = 0;
4610	loop_i_max = (phy->rf_rev == 8) ? 15 : 9;
4611	for (i = 0; i < loop_i_max; i++) {
4612		for (j = 0; j < 16; j++) {
4613			BWN_RF_WRITE(mac, 0x43, i);
4614			BWN_PHY_SETMASK(mac, BWN_PHY_RFOVERVAL, 0xf0ff,
4615			    (j << 8));
4616			BWN_PHY_SETMASK(mac, BWN_PHY_PGACTL, 0x0fff, 0xa000);
4617			BWN_PHY_SET(mac, BWN_PHY_PGACTL, 0xf000);
4618			DELAY(20);
4619			if (BWN_PHY_READ(mac, BWN_PHY_LO_LEAKAGE) >= 0xdfc)
4620				goto done0;
4621		}
4622	}
4623done0:
4624	loop1_outer_done = i;
4625	loop1_inner_done = j;
4626	if (j >= 8) {
4627		BWN_PHY_SET(mac, BWN_PHY_RFOVERVAL, 0x30);
4628		trsw_rx = 0x1b;
4629		for (j = j - 8; j < 16; j++) {
4630			BWN_PHY_SETMASK(mac, BWN_PHY_RFOVERVAL, 0xf0ff, j << 8);
4631			BWN_PHY_SETMASK(mac, BWN_PHY_PGACTL, 0x0fff, 0xa000);
4632			BWN_PHY_SET(mac, BWN_PHY_PGACTL, 0xf000);
4633			DELAY(20);
4634			trsw_rx -= 3;
4635			if (BWN_PHY_READ(mac, BWN_PHY_LO_LEAKAGE) >= 0xdfc)
4636				goto done1;
4637		}
4638	} else
4639		trsw_rx = 0x18;
4640done1:
4641
4642	if (phy->rev != 1) {
4643		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVER, backup_phy[4]);
4644		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVERVAL, backup_phy[5]);
4645	}
4646	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x5a), backup_phy[6]);
4647	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x59), backup_phy[7]);
4648	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), backup_phy[8]);
4649	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x0a), backup_phy[9]);
4650	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x03), backup_phy[10]);
4651	BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, backup_phy[11]);
4652	BWN_PHY_WRITE(mac, BWN_PHY_LO_CTL, backup_phy[12]);
4653	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2b), backup_phy[13]);
4654	BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, backup_phy[14]);
4655
4656	bwn_phy_g_set_bbatt(mac, backup_bband);
4657
4658	BWN_RF_WRITE(mac, 0x52, backup_radio[0]);
4659	BWN_RF_WRITE(mac, 0x43, backup_radio[1]);
4660	BWN_RF_WRITE(mac, 0x7a, backup_radio[2]);
4661
4662	BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, backup_phy[2] | 0x0003);
4663	DELAY(10);
4664	BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, backup_phy[2]);
4665	BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, backup_phy[3]);
4666	BWN_PHY_WRITE(mac, BWN_PHY_CRS0, backup_phy[0]);
4667	BWN_PHY_WRITE(mac, BWN_PHY_CCKBBANDCFG, backup_phy[1]);
4668
4669	pg->pg_max_lb_gain =
4670	    ((loop1_inner_done * 6) - (loop1_outer_done * 4)) - 11;
4671	pg->pg_trsw_rx_gain = trsw_rx * 2;
4672}
4673
4674static uint16_t
4675bwn_rf_init_bcm2050(struct bwn_mac *mac)
4676{
4677	struct bwn_phy *phy = &mac->mac_phy;
4678	uint32_t tmp1 = 0, tmp2 = 0;
4679	uint16_t rcc, i, j, pgactl, cck0, cck1, cck2, cck3, rfover, rfoverval,
4680	    analogover, analogoverval, crs0, classctl, lomask, loctl, syncctl,
4681	    radio0, radio1, radio2, reg0, reg1, reg2, radio78, reg, index;
4682	static const uint8_t rcc_table[] = {
4683		0x02, 0x03, 0x01, 0x0f,
4684		0x06, 0x07, 0x05, 0x0f,
4685		0x0a, 0x0b, 0x09, 0x0f,
4686		0x0e, 0x0f, 0x0d, 0x0f,
4687	};
4688
4689	loctl = lomask = reg0 = classctl = crs0 = analogoverval = analogover =
4690	    rfoverval = rfover = cck3 = 0;
4691	radio0 = BWN_RF_READ(mac, 0x43);
4692	radio1 = BWN_RF_READ(mac, 0x51);
4693	radio2 = BWN_RF_READ(mac, 0x52);
4694	pgactl = BWN_PHY_READ(mac, BWN_PHY_PGACTL);
4695	cck0 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x5a));
4696	cck1 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x59));
4697	cck2 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x58));
4698
4699	if (phy->type == BWN_PHYTYPE_B) {
4700		cck3 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x30));
4701		reg0 = BWN_READ_2(mac, 0x3ec);
4702
4703		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x30), 0xff);
4704		BWN_WRITE_2(mac, 0x3ec, 0x3f3f);
4705	} else if (phy->gmode || phy->rev >= 2) {
4706		rfover = BWN_PHY_READ(mac, BWN_PHY_RFOVER);
4707		rfoverval = BWN_PHY_READ(mac, BWN_PHY_RFOVERVAL);
4708		analogover = BWN_PHY_READ(mac, BWN_PHY_ANALOGOVER);
4709		analogoverval = BWN_PHY_READ(mac, BWN_PHY_ANALOGOVERVAL);
4710		crs0 = BWN_PHY_READ(mac, BWN_PHY_CRS0);
4711		classctl = BWN_PHY_READ(mac, BWN_PHY_CLASSCTL);
4712
4713		BWN_PHY_SET(mac, BWN_PHY_ANALOGOVER, 0x0003);
4714		BWN_PHY_MASK(mac, BWN_PHY_ANALOGOVERVAL, 0xfffc);
4715		BWN_PHY_MASK(mac, BWN_PHY_CRS0, 0x7fff);
4716		BWN_PHY_MASK(mac, BWN_PHY_CLASSCTL, 0xfffc);
4717		if (BWN_HAS_LOOPBACK(phy)) {
4718			lomask = BWN_PHY_READ(mac, BWN_PHY_LO_MASK);
4719			loctl = BWN_PHY_READ(mac, BWN_PHY_LO_CTL);
4720			if (phy->rev >= 3)
4721				BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0xc020);
4722			else
4723				BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0x8020);
4724			BWN_PHY_WRITE(mac, BWN_PHY_LO_CTL, 0);
4725		}
4726
4727		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4728		    bwn_rf_2050_rfoverval(mac, BWN_PHY_RFOVERVAL,
4729			BWN_LPD(0, 1, 1)));
4730		BWN_PHY_WRITE(mac, BWN_PHY_RFOVER,
4731		    bwn_rf_2050_rfoverval(mac, BWN_PHY_RFOVER, 0));
4732	}
4733	BWN_WRITE_2(mac, 0x3e2, BWN_READ_2(mac, 0x3e2) | 0x8000);
4734
4735	syncctl = BWN_PHY_READ(mac, BWN_PHY_SYNCCTL);
4736	BWN_PHY_MASK(mac, BWN_PHY_SYNCCTL, 0xff7f);
4737	reg1 = BWN_READ_2(mac, 0x3e6);
4738	reg2 = BWN_READ_2(mac, 0x3f4);
4739
4740	if (phy->analog == 0)
4741		BWN_WRITE_2(mac, 0x03e6, 0x0122);
4742	else {
4743		if (phy->analog >= 2)
4744			BWN_PHY_SETMASK(mac, BWN_PHY_CCK(0x03), 0xffbf, 0x40);
4745		BWN_WRITE_2(mac, BWN_CHANNEL_EXT,
4746		    (BWN_READ_2(mac, BWN_CHANNEL_EXT) | 0x2000));
4747	}
4748
4749	reg = BWN_RF_READ(mac, 0x60);
4750	index = (reg & 0x001e) >> 1;
4751	rcc = (((rcc_table[index] << 1) | (reg & 0x0001)) | 0x0020);
4752
4753	if (phy->type == BWN_PHYTYPE_B)
4754		BWN_RF_WRITE(mac, 0x78, 0x26);
4755	if (phy->gmode || phy->rev >= 2) {
4756		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4757		    bwn_rf_2050_rfoverval(mac, BWN_PHY_RFOVERVAL,
4758			BWN_LPD(0, 1, 1)));
4759	}
4760	BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xbfaf);
4761	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2b), 0x1403);
4762	if (phy->gmode || phy->rev >= 2) {
4763		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4764		    bwn_rf_2050_rfoverval(mac, BWN_PHY_RFOVERVAL,
4765			BWN_LPD(0, 0, 1)));
4766	}
4767	BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xbfa0);
4768	BWN_RF_SET(mac, 0x51, 0x0004);
4769	if (phy->rf_rev == 8)
4770		BWN_RF_WRITE(mac, 0x43, 0x1f);
4771	else {
4772		BWN_RF_WRITE(mac, 0x52, 0);
4773		BWN_RF_SETMASK(mac, 0x43, 0xfff0, 0x0009);
4774	}
4775	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0);
4776
4777	for (i = 0; i < 16; i++) {
4778		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x5a), 0x0480);
4779		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x59), 0xc810);
4780		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0x000d);
4781		if (phy->gmode || phy->rev >= 2) {
4782			BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4783			    bwn_rf_2050_rfoverval(mac,
4784				BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 1)));
4785		}
4786		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xafb0);
4787		DELAY(10);
4788		if (phy->gmode || phy->rev >= 2) {
4789			BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4790			    bwn_rf_2050_rfoverval(mac,
4791				BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 1)));
4792		}
4793		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xefb0);
4794		DELAY(10);
4795		if (phy->gmode || phy->rev >= 2) {
4796			BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4797			    bwn_rf_2050_rfoverval(mac,
4798				BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 0)));
4799		}
4800		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xfff0);
4801		DELAY(20);
4802		tmp1 += BWN_PHY_READ(mac, BWN_PHY_LO_LEAKAGE);
4803		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0);
4804		if (phy->gmode || phy->rev >= 2) {
4805			BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4806			    bwn_rf_2050_rfoverval(mac,
4807				BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 1)));
4808		}
4809		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xafb0);
4810	}
4811	DELAY(10);
4812
4813	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0);
4814	tmp1++;
4815	tmp1 >>= 9;
4816
4817	for (i = 0; i < 16; i++) {
4818		radio78 = (BWN_BITREV4(i) << 1) | 0x0020;
4819		BWN_RF_WRITE(mac, 0x78, radio78);
4820		DELAY(10);
4821		for (j = 0; j < 16; j++) {
4822			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x5a), 0x0d80);
4823			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x59), 0xc810);
4824			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0x000d);
4825			if (phy->gmode || phy->rev >= 2) {
4826				BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4827				    bwn_rf_2050_rfoverval(mac,
4828					BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 1)));
4829			}
4830			BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xafb0);
4831			DELAY(10);
4832			if (phy->gmode || phy->rev >= 2) {
4833				BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4834				    bwn_rf_2050_rfoverval(mac,
4835					BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 1)));
4836			}
4837			BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xefb0);
4838			DELAY(10);
4839			if (phy->gmode || phy->rev >= 2) {
4840				BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4841				    bwn_rf_2050_rfoverval(mac,
4842					BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 0)));
4843			}
4844			BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xfff0);
4845			DELAY(10);
4846			tmp2 += BWN_PHY_READ(mac, BWN_PHY_LO_LEAKAGE);
4847			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), 0);
4848			if (phy->gmode || phy->rev >= 2) {
4849				BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL,
4850				    bwn_rf_2050_rfoverval(mac,
4851					BWN_PHY_RFOVERVAL, BWN_LPD(1, 0, 1)));
4852			}
4853			BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xafb0);
4854		}
4855		tmp2++;
4856		tmp2 >>= 8;
4857		if (tmp1 < tmp2)
4858			break;
4859	}
4860
4861	BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, pgactl);
4862	BWN_RF_WRITE(mac, 0x51, radio1);
4863	BWN_RF_WRITE(mac, 0x52, radio2);
4864	BWN_RF_WRITE(mac, 0x43, radio0);
4865	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x5a), cck0);
4866	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x59), cck1);
4867	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x58), cck2);
4868	BWN_WRITE_2(mac, 0x3e6, reg1);
4869	if (phy->analog != 0)
4870		BWN_WRITE_2(mac, 0x3f4, reg2);
4871	BWN_PHY_WRITE(mac, BWN_PHY_SYNCCTL, syncctl);
4872	bwn_spu_workaround(mac, phy->chan);
4873	if (phy->type == BWN_PHYTYPE_B) {
4874		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x30), cck3);
4875		BWN_WRITE_2(mac, 0x3ec, reg0);
4876	} else if (phy->gmode) {
4877		BWN_WRITE_2(mac, BWN_PHY_RADIO,
4878			    BWN_READ_2(mac, BWN_PHY_RADIO)
4879			    & 0x7fff);
4880		BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, rfover);
4881		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, rfoverval);
4882		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVER, analogover);
4883		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVERVAL,
4884			      analogoverval);
4885		BWN_PHY_WRITE(mac, BWN_PHY_CRS0, crs0);
4886		BWN_PHY_WRITE(mac, BWN_PHY_CLASSCTL, classctl);
4887		if (BWN_HAS_LOOPBACK(phy)) {
4888			BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, lomask);
4889			BWN_PHY_WRITE(mac, BWN_PHY_LO_CTL, loctl);
4890		}
4891	}
4892
4893	return ((i > 15) ? radio78 : rcc);
4894}
4895
4896static void
4897bwn_phy_init_b6(struct bwn_mac *mac)
4898{
4899	struct bwn_phy *phy = &mac->mac_phy;
4900	struct bwn_phy_g *pg = &phy->phy_g;
4901	struct bwn_softc *sc = mac->mac_sc;
4902	uint16_t offset, val;
4903	uint8_t old_channel;
4904
4905	KASSERT(!(phy->rf_rev == 6 || phy->rf_rev == 7),
4906	    ("%s:%d: fail", __func__, __LINE__));
4907
4908	BWN_PHY_WRITE(mac, 0x003e, 0x817a);
4909	BWN_RF_WRITE(mac, 0x007a, BWN_RF_READ(mac, 0x007a) | 0x0058);
4910	if (phy->rf_rev == 4 || phy->rf_rev == 5) {
4911		BWN_RF_WRITE(mac, 0x51, 0x37);
4912		BWN_RF_WRITE(mac, 0x52, 0x70);
4913		BWN_RF_WRITE(mac, 0x53, 0xb3);
4914		BWN_RF_WRITE(mac, 0x54, 0x9b);
4915		BWN_RF_WRITE(mac, 0x5a, 0x88);
4916		BWN_RF_WRITE(mac, 0x5b, 0x88);
4917		BWN_RF_WRITE(mac, 0x5d, 0x88);
4918		BWN_RF_WRITE(mac, 0x5e, 0x88);
4919		BWN_RF_WRITE(mac, 0x7d, 0x88);
4920		bwn_hf_write(mac,
4921		    bwn_hf_read(mac) | BWN_HF_TSSI_RESET_PSM_WORKAROUN);
4922	}
4923	if (phy->rf_rev == 8) {
4924		BWN_RF_WRITE(mac, 0x51, 0);
4925		BWN_RF_WRITE(mac, 0x52, 0x40);
4926		BWN_RF_WRITE(mac, 0x53, 0xb7);
4927		BWN_RF_WRITE(mac, 0x54, 0x98);
4928		BWN_RF_WRITE(mac, 0x5a, 0x88);
4929		BWN_RF_WRITE(mac, 0x5b, 0x6b);
4930		BWN_RF_WRITE(mac, 0x5c, 0x0f);
4931		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_ALTIQ) {
4932			BWN_RF_WRITE(mac, 0x5d, 0xfa);
4933			BWN_RF_WRITE(mac, 0x5e, 0xd8);
4934		} else {
4935			BWN_RF_WRITE(mac, 0x5d, 0xf5);
4936			BWN_RF_WRITE(mac, 0x5e, 0xb8);
4937		}
4938		BWN_RF_WRITE(mac, 0x0073, 0x0003);
4939		BWN_RF_WRITE(mac, 0x007d, 0x00a8);
4940		BWN_RF_WRITE(mac, 0x007c, 0x0001);
4941		BWN_RF_WRITE(mac, 0x007e, 0x0008);
4942	}
4943	for (val = 0x1e1f, offset = 0x0088; offset < 0x0098; offset++) {
4944		BWN_PHY_WRITE(mac, offset, val);
4945		val -= 0x0202;
4946	}
4947	for (val = 0x3e3f, offset = 0x0098; offset < 0x00a8; offset++) {
4948		BWN_PHY_WRITE(mac, offset, val);
4949		val -= 0x0202;
4950	}
4951	for (val = 0x2120, offset = 0x00a8; offset < 0x00c8; offset++) {
4952		BWN_PHY_WRITE(mac, offset, (val & 0x3f3f));
4953		val += 0x0202;
4954	}
4955	if (phy->type == BWN_PHYTYPE_G) {
4956		BWN_RF_SET(mac, 0x007a, 0x0020);
4957		BWN_RF_SET(mac, 0x0051, 0x0004);
4958		BWN_PHY_SET(mac, 0x0802, 0x0100);
4959		BWN_PHY_SET(mac, 0x042b, 0x2000);
4960		BWN_PHY_WRITE(mac, 0x5b, 0);
4961		BWN_PHY_WRITE(mac, 0x5c, 0);
4962	}
4963
4964	old_channel = phy->chan;
4965	bwn_phy_g_switch_chan(mac, (old_channel >= 8) ? 1 : 13, 0);
4966
4967	BWN_RF_WRITE(mac, 0x0050, 0x0020);
4968	BWN_RF_WRITE(mac, 0x0050, 0x0023);
4969	DELAY(40);
4970	if (phy->rf_rev < 6 || phy->rf_rev == 8) {
4971		BWN_RF_WRITE(mac, 0x7c, BWN_RF_READ(mac, 0x7c) | 0x0002);
4972		BWN_RF_WRITE(mac, 0x50, 0x20);
4973	}
4974	if (phy->rf_rev <= 2) {
4975		BWN_RF_WRITE(mac, 0x7c, 0x20);
4976		BWN_RF_WRITE(mac, 0x5a, 0x70);
4977		BWN_RF_WRITE(mac, 0x5b, 0x7b);
4978		BWN_RF_WRITE(mac, 0x5c, 0xb0);
4979	}
4980	BWN_RF_SETMASK(mac, 0x007a, 0x00f8, 0x0007);
4981
4982	bwn_phy_g_switch_chan(mac, old_channel, 0);
4983
4984	BWN_PHY_WRITE(mac, 0x0014, 0x0200);
4985	if (phy->rf_rev >= 6)
4986		BWN_PHY_WRITE(mac, 0x2a, 0x88c2);
4987	else
4988		BWN_PHY_WRITE(mac, 0x2a, 0x8ac0);
4989	BWN_PHY_WRITE(mac, 0x0038, 0x0668);
4990	bwn_phy_g_set_txpwr_sub(mac, &pg->pg_bbatt, &pg->pg_rfatt,
4991	    pg->pg_txctl);
4992	if (phy->rf_rev <= 5)
4993		BWN_PHY_SETMASK(mac, 0x5d, 0xff80, 0x0003);
4994	if (phy->rf_rev <= 2)
4995		BWN_RF_WRITE(mac, 0x005d, 0x000d);
4996
4997	if (phy->analog == 4) {
4998		BWN_WRITE_2(mac, 0x3e4, 9);
4999		BWN_PHY_MASK(mac, 0x61, 0x0fff);
5000	} else
5001		BWN_PHY_SETMASK(mac, 0x0002, 0xffc0, 0x0004);
5002	if (phy->type == BWN_PHYTYPE_B)
5003		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5004	else if (phy->type == BWN_PHYTYPE_G)
5005		BWN_WRITE_2(mac, 0x03e6, 0x0);
5006}
5007
5008static void
5009bwn_phy_init_a(struct bwn_mac *mac)
5010{
5011	struct bwn_phy *phy = &mac->mac_phy;
5012	struct bwn_softc *sc = mac->mac_sc;
5013
5014	KASSERT(phy->type == BWN_PHYTYPE_A || phy->type == BWN_PHYTYPE_G,
5015	    ("%s:%d: fail", __func__, __LINE__));
5016
5017	if (phy->rev >= 6) {
5018		if (phy->type == BWN_PHYTYPE_A)
5019			BWN_PHY_MASK(mac, BWN_PHY_OFDM(0x1b), ~0x1000);
5020		if (BWN_PHY_READ(mac, BWN_PHY_ENCORE) & BWN_PHY_ENCORE_EN)
5021			BWN_PHY_SET(mac, BWN_PHY_ENCORE, 0x0010);
5022		else
5023			BWN_PHY_MASK(mac, BWN_PHY_ENCORE, ~0x1010);
5024	}
5025
5026	bwn_wa_init(mac);
5027
5028	if (phy->type == BWN_PHYTYPE_G &&
5029	    (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL))
5030		BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x6e), 0xe000, 0x3cf);
5031}
5032
5033static void
5034bwn_wa_write_noisescale(struct bwn_mac *mac, const uint16_t *nst)
5035{
5036	int i;
5037
5038	for (i = 0; i < BWN_TAB_NOISESCALE_SIZE; i++)
5039		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_NOISESCALE, i, nst[i]);
5040}
5041
5042static void
5043bwn_wa_agc(struct bwn_mac *mac)
5044{
5045	struct bwn_phy *phy = &mac->mac_phy;
5046
5047	if (phy->rev == 1) {
5048		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1_R1, 0, 254);
5049		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1_R1, 1, 13);
5050		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1_R1, 2, 19);
5051		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1_R1, 3, 25);
5052		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, 0, 0x2710);
5053		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, 1, 0x9b83);
5054		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, 2, 0x9b83);
5055		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, 3, 0x0f8d);
5056		BWN_PHY_WRITE(mac, BWN_PHY_LMS, 4);
5057	} else {
5058		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1, 0, 254);
5059		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1, 1, 13);
5060		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1, 2, 19);
5061		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC1, 3, 25);
5062	}
5063
5064	BWN_PHY_SETMASK(mac, BWN_PHY_CCKSHIFTBITS_WA, (uint16_t)~0xff00,
5065	    0x5700);
5066	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x1a), ~0x007f, 0x000f);
5067	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x1a), ~0x3f80, 0x2b80);
5068	BWN_PHY_SETMASK(mac, BWN_PHY_ANTWRSETT, 0xf0ff, 0x0300);
5069	BWN_RF_SET(mac, 0x7a, 0x0008);
5070	BWN_PHY_SETMASK(mac, BWN_PHY_N1P1GAIN, ~0x000f, 0x0008);
5071	BWN_PHY_SETMASK(mac, BWN_PHY_P1P2GAIN, ~0x0f00, 0x0600);
5072	BWN_PHY_SETMASK(mac, BWN_PHY_N1N2GAIN, ~0x0f00, 0x0700);
5073	BWN_PHY_SETMASK(mac, BWN_PHY_N1P1GAIN, ~0x0f00, 0x0100);
5074	if (phy->rev == 1)
5075		BWN_PHY_SETMASK(mac, BWN_PHY_N1N2GAIN, ~0x000f, 0x0007);
5076	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x88), ~0x00ff, 0x001c);
5077	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x88), ~0x3f00, 0x0200);
5078	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x96), ~0x00ff, 0x001c);
5079	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x89), ~0x00ff, 0x0020);
5080	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x89), ~0x3f00, 0x0200);
5081	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x82), ~0x00ff, 0x002e);
5082	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x96), (uint16_t)~0xff00, 0x1a00);
5083	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x81), ~0x00ff, 0x0028);
5084	BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x81), (uint16_t)~0xff00, 0x2c00);
5085	if (phy->rev == 1) {
5086		BWN_PHY_WRITE(mac, BWN_PHY_PEAK_COUNT, 0x092b);
5087		BWN_PHY_SETMASK(mac, BWN_PHY_OFDM(0x1b), ~0x001e, 0x0002);
5088	} else {
5089		BWN_PHY_MASK(mac, BWN_PHY_OFDM(0x1b), ~0x001e);
5090		BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x1f), 0x287a);
5091		BWN_PHY_SETMASK(mac, BWN_PHY_LPFGAINCTL, ~0x000f, 0x0004);
5092		if (phy->rev >= 6) {
5093			BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x22), 0x287a);
5094			BWN_PHY_SETMASK(mac, BWN_PHY_LPFGAINCTL,
5095			    (uint16_t)~0xf000, 0x3000);
5096		}
5097	}
5098	BWN_PHY_SETMASK(mac, BWN_PHY_DIVSRCHIDX, 0x8080, 0x7874);
5099	BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x8e), 0x1c00);
5100	if (phy->rev == 1) {
5101		BWN_PHY_SETMASK(mac, BWN_PHY_DIVP1P2GAIN, ~0x0f00, 0x0600);
5102		BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x8b), 0x005e);
5103		BWN_PHY_SETMASK(mac, BWN_PHY_ANTWRSETT, ~0x00ff, 0x001e);
5104		BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x8d), 0x0002);
5105		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3_R1, 0, 0);
5106		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3_R1, 1, 7);
5107		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3_R1, 2, 16);
5108		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3_R1, 3, 28);
5109	} else {
5110		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3, 0, 0);
5111		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3, 1, 7);
5112		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3, 2, 16);
5113		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC3, 3, 28);
5114	}
5115	if (phy->rev >= 6) {
5116		BWN_PHY_MASK(mac, BWN_PHY_OFDM(0x26), ~0x0003);
5117		BWN_PHY_MASK(mac, BWN_PHY_OFDM(0x26), ~0x1000);
5118	}
5119	BWN_PHY_READ(mac, BWN_PHY_VERSION_OFDM);
5120}
5121
5122static void
5123bwn_wa_grev1(struct bwn_mac *mac)
5124{
5125	struct bwn_phy *phy = &mac->mac_phy;
5126	int i;
5127	static const uint16_t bwn_tab_finefreqg[] = BWN_TAB_FINEFREQ_G;
5128	static const uint32_t bwn_tab_retard[] = BWN_TAB_RETARD;
5129	static const uint32_t bwn_tab_rotor[] = BWN_TAB_ROTOR;
5130
5131	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s fail", __func__));
5132
5133	/* init CRSTHRES and ANTDWELL */
5134	if (phy->rev == 1) {
5135		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES1_R1, 0x4f19);
5136	} else if (phy->rev == 2) {
5137		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES1, 0x1861);
5138		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES2, 0x0271);
5139		BWN_PHY_SET(mac, BWN_PHY_ANTDWELL, 0x0800);
5140	} else {
5141		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES1, 0x0098);
5142		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES2, 0x0070);
5143		BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0xc9), 0x0080);
5144		BWN_PHY_SET(mac, BWN_PHY_ANTDWELL, 0x0800);
5145	}
5146	BWN_PHY_SETMASK(mac, BWN_PHY_CRS0, ~0x03c0, 0xd000);
5147	BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0x2c), 0x005a);
5148	BWN_PHY_WRITE(mac, BWN_PHY_CCKSHIFTBITS, 0x0026);
5149
5150	/* XXX support PHY-A??? */
5151	for (i = 0; i < N(bwn_tab_finefreqg); i++)
5152		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_DACRFPABB, i,
5153		    bwn_tab_finefreqg[i]);
5154
5155	/* XXX support PHY-A??? */
5156	if (phy->rev == 1)
5157		for (i = 0; i < N(bwn_tab_noise_g1); i++)
5158			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, i,
5159			    bwn_tab_noise_g1[i]);
5160	else
5161		for (i = 0; i < N(bwn_tab_noise_g2); i++)
5162			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, i,
5163			    bwn_tab_noise_g2[i]);
5164
5165
5166	for (i = 0; i < N(bwn_tab_rotor); i++)
5167		bwn_ofdmtab_write_4(mac, BWN_OFDMTAB_ROTOR, i,
5168		    bwn_tab_rotor[i]);
5169
5170	/* XXX support PHY-A??? */
5171	if (phy->rev >= 6) {
5172		if (BWN_PHY_READ(mac, BWN_PHY_ENCORE) &
5173		    BWN_PHY_ENCORE_EN)
5174			bwn_wa_write_noisescale(mac, bwn_tab_noisescale_g3);
5175		else
5176			bwn_wa_write_noisescale(mac, bwn_tab_noisescale_g2);
5177	} else
5178		bwn_wa_write_noisescale(mac, bwn_tab_noisescale_g1);
5179
5180	for (i = 0; i < N(bwn_tab_retard); i++)
5181		bwn_ofdmtab_write_4(mac, BWN_OFDMTAB_ADVRETARD, i,
5182		    bwn_tab_retard[i]);
5183
5184	if (phy->rev == 1) {
5185		for (i = 0; i < 16; i++)
5186			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_WRSSI_R1,
5187			    i, 0x0020);
5188	} else {
5189		for (i = 0; i < 32; i++)
5190			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_WRSSI, i, 0x0820);
5191	}
5192
5193	bwn_wa_agc(mac);
5194}
5195
5196static void
5197bwn_wa_grev26789(struct bwn_mac *mac)
5198{
5199	struct bwn_phy *phy = &mac->mac_phy;
5200	int i;
5201	static const uint16_t bwn_tab_sigmasqr2[] = BWN_TAB_SIGMASQR2;
5202	uint16_t ofdmrev;
5203
5204	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s fail", __func__));
5205
5206	bwn_gtab_write(mac, BWN_GTAB_ORIGTR, 0, 0xc480);
5207
5208	/* init CRSTHRES and ANTDWELL */
5209	if (phy->rev == 1)
5210		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES1_R1, 0x4f19);
5211	else if (phy->rev == 2) {
5212		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES1, 0x1861);
5213		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES2, 0x0271);
5214		BWN_PHY_SET(mac, BWN_PHY_ANTDWELL, 0x0800);
5215	} else {
5216		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES1, 0x0098);
5217		BWN_PHY_WRITE(mac, BWN_PHY_CRSTHRES2, 0x0070);
5218		BWN_PHY_WRITE(mac, BWN_PHY_OFDM(0xc9), 0x0080);
5219		BWN_PHY_SET(mac, BWN_PHY_ANTDWELL, 0x0800);
5220	}
5221
5222	for (i = 0; i < 64; i++)
5223		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_RSSI, i, i);
5224
5225	/* XXX support PHY-A??? */
5226	if (phy->rev == 1)
5227		for (i = 0; i < N(bwn_tab_noise_g1); i++)
5228			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, i,
5229			    bwn_tab_noise_g1[i]);
5230	else
5231		for (i = 0; i < N(bwn_tab_noise_g2); i++)
5232			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_AGC2, i,
5233			    bwn_tab_noise_g2[i]);
5234
5235	/* XXX support PHY-A??? */
5236	if (phy->rev >= 6) {
5237		if (BWN_PHY_READ(mac, BWN_PHY_ENCORE) &
5238		    BWN_PHY_ENCORE_EN)
5239			bwn_wa_write_noisescale(mac, bwn_tab_noisescale_g3);
5240		else
5241			bwn_wa_write_noisescale(mac, bwn_tab_noisescale_g2);
5242	} else
5243		bwn_wa_write_noisescale(mac, bwn_tab_noisescale_g1);
5244
5245	for (i = 0; i < N(bwn_tab_sigmasqr2); i++)
5246		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_MINSIGSQ, i,
5247		    bwn_tab_sigmasqr2[i]);
5248
5249	if (phy->rev == 1) {
5250		for (i = 0; i < 16; i++)
5251			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_WRSSI_R1, i,
5252			    0x0020);
5253	} else {
5254		for (i = 0; i < 32; i++)
5255			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_WRSSI, i, 0x0820);
5256	}
5257
5258	bwn_wa_agc(mac);
5259
5260	ofdmrev = BWN_PHY_READ(mac, BWN_PHY_VERSION_OFDM) & BWN_PHYVER_VERSION;
5261	if (ofdmrev > 2) {
5262		if (phy->type == BWN_PHYTYPE_A)
5263			BWN_PHY_WRITE(mac, BWN_PHY_PWRDOWN, 0x1808);
5264		else
5265			BWN_PHY_WRITE(mac, BWN_PHY_PWRDOWN, 0x1000);
5266	} else {
5267		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_DAC, 3, 0x1044);
5268		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_DAC, 4, 0x7201);
5269		bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_DAC, 6, 0x0040);
5270	}
5271
5272	bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_UNKNOWN_0F, 2, 15);
5273	bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_UNKNOWN_0F, 3, 20);
5274}
5275
5276static void
5277bwn_wa_init(struct bwn_mac *mac)
5278{
5279	struct bwn_phy *phy = &mac->mac_phy;
5280	struct bwn_softc *sc = mac->mac_sc;
5281
5282	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s fail", __func__));
5283
5284	switch (phy->rev) {
5285	case 1:
5286		bwn_wa_grev1(mac);
5287		break;
5288	case 2:
5289	case 6:
5290	case 7:
5291	case 8:
5292	case 9:
5293		bwn_wa_grev26789(mac);
5294		break;
5295	default:
5296		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5297	}
5298
5299	if (siba_get_pci_subvendor(sc->sc_dev) != SIBA_BOARDVENDOR_BCM ||
5300	    siba_get_pci_subdevice(sc->sc_dev) != SIBA_BOARD_BU4306 ||
5301	    siba_get_pci_revid(sc->sc_dev) != 0x17) {
5302		if (phy->rev < 2) {
5303			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX_R1, 1,
5304			    0x0002);
5305			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX_R1, 2,
5306			    0x0001);
5307		} else {
5308			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX, 1, 0x0002);
5309			bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX, 2, 0x0001);
5310			if ((siba_sprom_get_bf_lo(sc->sc_dev) &
5311			     BWN_BFL_EXTLNA) &&
5312			    (phy->rev >= 7)) {
5313				BWN_PHY_MASK(mac, BWN_PHY_EXTG(0x11), 0xf7ff);
5314				bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX,
5315				    0x0020, 0x0001);
5316				bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX,
5317				    0x0021, 0x0001);
5318				bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX,
5319				    0x0022, 0x0001);
5320				bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX,
5321				    0x0023, 0x0000);
5322				bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX,
5323				    0x0000, 0x0000);
5324				bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_GAINX,
5325				    0x0003, 0x0002);
5326			}
5327		}
5328	}
5329	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_FEM) {
5330		BWN_PHY_WRITE(mac, BWN_PHY_GTABCTL, 0x3120);
5331		BWN_PHY_WRITE(mac, BWN_PHY_GTABDATA, 0xc480);
5332	}
5333
5334	bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_UNKNOWN_11, 0, 0);
5335	bwn_ofdmtab_write_2(mac, BWN_OFDMTAB_UNKNOWN_11, 1, 0);
5336}
5337
5338static void
5339bwn_ofdmtab_write_2(struct bwn_mac *mac, uint16_t table, uint16_t offset,
5340    uint16_t value)
5341{
5342	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5343	uint16_t addr;
5344
5345	addr = table + offset;
5346	if ((pg->pg_ofdmtab_dir != BWN_OFDMTAB_DIR_WRITE) ||
5347	    (addr - 1 != pg->pg_ofdmtab_addr)) {
5348		BWN_PHY_WRITE(mac, BWN_PHY_OTABLECTL, addr);
5349		pg->pg_ofdmtab_dir = BWN_OFDMTAB_DIR_WRITE;
5350	}
5351	pg->pg_ofdmtab_addr = addr;
5352	BWN_PHY_WRITE(mac, BWN_PHY_OTABLEI, value);
5353}
5354
5355static void
5356bwn_ofdmtab_write_4(struct bwn_mac *mac, uint16_t table, uint16_t offset,
5357    uint32_t value)
5358{
5359	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5360	uint16_t addr;
5361
5362	addr = table + offset;
5363	if ((pg->pg_ofdmtab_dir != BWN_OFDMTAB_DIR_WRITE) ||
5364	    (addr - 1 != pg->pg_ofdmtab_addr)) {
5365		BWN_PHY_WRITE(mac, BWN_PHY_OTABLECTL, addr);
5366		pg->pg_ofdmtab_dir = BWN_OFDMTAB_DIR_WRITE;
5367	}
5368	pg->pg_ofdmtab_addr = addr;
5369
5370	BWN_PHY_WRITE(mac, BWN_PHY_OTABLEI, value);
5371	BWN_PHY_WRITE(mac, BWN_PHY_OTABLEQ, (value >> 16));
5372}
5373
5374static void
5375bwn_gtab_write(struct bwn_mac *mac, uint16_t table, uint16_t offset,
5376    uint16_t value)
5377{
5378
5379	BWN_PHY_WRITE(mac, BWN_PHY_GTABCTL, table + offset);
5380	BWN_PHY_WRITE(mac, BWN_PHY_GTABDATA, value);
5381}
5382
5383static void
5384bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
5385{
5386	struct bwn_phy *phy = &mac->mac_phy;
5387	struct bwn_softc *sc = mac->mac_sc;
5388	unsigned int i, max_loop;
5389	uint16_t value;
5390	uint32_t buffer[5] = {
5391		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
5392	};
5393
5394	if (ofdm) {
5395		max_loop = 0x1e;
5396		buffer[0] = 0x000201cc;
5397	} else {
5398		max_loop = 0xfa;
5399		buffer[0] = 0x000b846e;
5400	}
5401
5402	BWN_ASSERT_LOCKED(mac->mac_sc);
5403
5404	for (i = 0; i < 5; i++)
5405		bwn_ram_write(mac, i * 4, buffer[i]);
5406
5407	BWN_WRITE_2(mac, 0x0568, 0x0000);
5408	BWN_WRITE_2(mac, 0x07c0,
5409	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
5410	value = ((phy->type == BWN_PHYTYPE_A) ? 0x41 : 0x40);
5411	BWN_WRITE_2(mac, 0x050c, value);
5412	if (phy->type == BWN_PHYTYPE_LP)
5413		BWN_WRITE_2(mac, 0x0514, 0x1a02);
5414	BWN_WRITE_2(mac, 0x0508, 0x0000);
5415	BWN_WRITE_2(mac, 0x050a, 0x0000);
5416	BWN_WRITE_2(mac, 0x054c, 0x0000);
5417	BWN_WRITE_2(mac, 0x056a, 0x0014);
5418	BWN_WRITE_2(mac, 0x0568, 0x0826);
5419	BWN_WRITE_2(mac, 0x0500, 0x0000);
5420	if (phy->type == BWN_PHYTYPE_LP)
5421		BWN_WRITE_2(mac, 0x0502, 0x0050);
5422	else
5423		BWN_WRITE_2(mac, 0x0502, 0x0030);
5424
5425	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
5426		BWN_RF_WRITE(mac, 0x0051, 0x0017);
5427	for (i = 0x00; i < max_loop; i++) {
5428		value = BWN_READ_2(mac, 0x050e);
5429		if (value & 0x0080)
5430			break;
5431		DELAY(10);
5432	}
5433	for (i = 0x00; i < 0x0a; i++) {
5434		value = BWN_READ_2(mac, 0x050e);
5435		if (value & 0x0400)
5436			break;
5437		DELAY(10);
5438	}
5439	for (i = 0x00; i < 0x19; i++) {
5440		value = BWN_READ_2(mac, 0x0690);
5441		if (!(value & 0x0100))
5442			break;
5443		DELAY(10);
5444	}
5445	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
5446		BWN_RF_WRITE(mac, 0x0051, 0x0037);
5447}
5448
5449static void
5450bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
5451{
5452	uint32_t macctl;
5453
5454	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
5455
5456	macctl = BWN_READ_4(mac, BWN_MACCTL);
5457	if (macctl & BWN_MACCTL_BIGENDIAN)
5458		printf("TODO: need swap\n");
5459
5460	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
5461	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
5462	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
5463}
5464
5465static void
5466bwn_lo_write(struct bwn_mac *mac, struct bwn_loctl *ctl)
5467{
5468	uint16_t value;
5469
5470	KASSERT(mac->mac_phy.type == BWN_PHYTYPE_G,
5471	    ("%s:%d: fail", __func__, __LINE__));
5472
5473	value = (uint8_t) (ctl->q);
5474	value |= ((uint8_t) (ctl->i)) << 8;
5475	BWN_PHY_WRITE(mac, BWN_PHY_LO_CTL, value);
5476}
5477
5478static uint16_t
5479bwn_lo_calcfeed(struct bwn_mac *mac,
5480    uint16_t lna, uint16_t pga, uint16_t trsw_rx)
5481{
5482	struct bwn_phy *phy = &mac->mac_phy;
5483	struct bwn_softc *sc = mac->mac_sc;
5484	uint16_t rfover;
5485	uint16_t feedthrough;
5486
5487	if (phy->gmode) {
5488		lna <<= BWN_PHY_RFOVERVAL_LNA_SHIFT;
5489		pga <<= BWN_PHY_RFOVERVAL_PGA_SHIFT;
5490
5491		KASSERT((lna & ~BWN_PHY_RFOVERVAL_LNA) == 0,
5492		    ("%s:%d: fail", __func__, __LINE__));
5493		KASSERT((pga & ~BWN_PHY_RFOVERVAL_PGA) == 0,
5494		    ("%s:%d: fail", __func__, __LINE__));
5495
5496		trsw_rx &= (BWN_PHY_RFOVERVAL_TRSWRX | BWN_PHY_RFOVERVAL_BW);
5497
5498		rfover = BWN_PHY_RFOVERVAL_UNK | pga | lna | trsw_rx;
5499		if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_EXTLNA) &&
5500		    phy->rev > 6)
5501			rfover |= BWN_PHY_RFOVERVAL_EXTLNA;
5502
5503		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xe300);
5504		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, rfover);
5505		DELAY(10);
5506		rfover |= BWN_PHY_RFOVERVAL_BW_LBW;
5507		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, rfover);
5508		DELAY(10);
5509		rfover |= BWN_PHY_RFOVERVAL_BW_LPF;
5510		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, rfover);
5511		DELAY(10);
5512		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xf300);
5513	} else {
5514		pga |= BWN_PHY_PGACTL_UNKNOWN;
5515		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, pga);
5516		DELAY(10);
5517		pga |= BWN_PHY_PGACTL_LOWBANDW;
5518		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, pga);
5519		DELAY(10);
5520		pga |= BWN_PHY_PGACTL_LPF;
5521		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, pga);
5522	}
5523	DELAY(21);
5524	feedthrough = BWN_PHY_READ(mac, BWN_PHY_LO_LEAKAGE);
5525
5526	return (feedthrough);
5527}
5528
5529static uint16_t
5530bwn_lo_txctl_regtable(struct bwn_mac *mac,
5531    uint16_t *value, uint16_t *pad_mix_gain)
5532{
5533	struct bwn_phy *phy = &mac->mac_phy;
5534	uint16_t reg, v, padmix;
5535
5536	if (phy->type == BWN_PHYTYPE_B) {
5537		v = 0x30;
5538		if (phy->rf_rev <= 5) {
5539			reg = 0x43;
5540			padmix = 0;
5541		} else {
5542			reg = 0x52;
5543			padmix = 5;
5544		}
5545	} else {
5546		if (phy->rev >= 2 && phy->rf_rev == 8) {
5547			reg = 0x43;
5548			v = 0x10;
5549			padmix = 2;
5550		} else {
5551			reg = 0x52;
5552			v = 0x30;
5553			padmix = 5;
5554		}
5555	}
5556	if (value)
5557		*value = v;
5558	if (pad_mix_gain)
5559		*pad_mix_gain = padmix;
5560
5561	return (reg);
5562}
5563
5564static void
5565bwn_lo_measure_txctl_values(struct bwn_mac *mac)
5566{
5567	struct bwn_phy *phy = &mac->mac_phy;
5568	struct bwn_phy_g *pg = &phy->phy_g;
5569	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
5570	uint16_t reg, mask;
5571	uint16_t trsw_rx, pga;
5572	uint16_t rf_pctl_reg;
5573
5574	static const uint8_t tx_bias_values[] = {
5575		0x09, 0x08, 0x0a, 0x01, 0x00,
5576		0x02, 0x05, 0x04, 0x06,
5577	};
5578	static const uint8_t tx_magn_values[] = {
5579		0x70, 0x40,
5580	};
5581
5582	if (!BWN_HAS_LOOPBACK(phy)) {
5583		rf_pctl_reg = 6;
5584		trsw_rx = 2;
5585		pga = 0;
5586	} else {
5587		int lb_gain;
5588
5589		trsw_rx = 0;
5590		lb_gain = pg->pg_max_lb_gain / 2;
5591		if (lb_gain > 10) {
5592			rf_pctl_reg = 0;
5593			pga = abs(10 - lb_gain) / 6;
5594			pga = MIN(MAX(pga, 0), 15);
5595		} else {
5596			int cmp_val;
5597			int tmp;
5598
5599			pga = 0;
5600			cmp_val = 0x24;
5601			if ((phy->rev >= 2) &&
5602			    (phy->rf_ver == 0x2050) && (phy->rf_rev == 8))
5603				cmp_val = 0x3c;
5604			tmp = lb_gain;
5605			if ((10 - lb_gain) < cmp_val)
5606				tmp = (10 - lb_gain);
5607			if (tmp < 0)
5608				tmp += 6;
5609			else
5610				tmp += 3;
5611			cmp_val /= 4;
5612			tmp /= 4;
5613			if (tmp >= cmp_val)
5614				rf_pctl_reg = cmp_val;
5615			else
5616				rf_pctl_reg = tmp;
5617		}
5618	}
5619	BWN_RF_SETMASK(mac, 0x43, 0xfff0, rf_pctl_reg);
5620	bwn_phy_g_set_bbatt(mac, 2);
5621
5622	reg = bwn_lo_txctl_regtable(mac, &mask, NULL);
5623	mask = ~mask;
5624	BWN_RF_MASK(mac, reg, mask);
5625
5626	if (BWN_HAS_TXMAG(phy)) {
5627		int i, j;
5628		int feedthrough;
5629		int min_feedth = 0xffff;
5630		uint8_t tx_magn, tx_bias;
5631
5632		for (i = 0; i < N(tx_magn_values); i++) {
5633			tx_magn = tx_magn_values[i];
5634			BWN_RF_SETMASK(mac, 0x52, 0xff0f, tx_magn);
5635			for (j = 0; j < N(tx_bias_values); j++) {
5636				tx_bias = tx_bias_values[j];
5637				BWN_RF_SETMASK(mac, 0x52, 0xfff0, tx_bias);
5638				feedthrough = bwn_lo_calcfeed(mac, 0, pga,
5639				    trsw_rx);
5640				if (feedthrough < min_feedth) {
5641					lo->tx_bias = tx_bias;
5642					lo->tx_magn = tx_magn;
5643					min_feedth = feedthrough;
5644				}
5645				if (lo->tx_bias == 0)
5646					break;
5647			}
5648			BWN_RF_WRITE(mac, 0x52,
5649					  (BWN_RF_READ(mac, 0x52)
5650					   & 0xff00) | lo->tx_bias | lo->
5651					  tx_magn);
5652		}
5653	} else {
5654		lo->tx_magn = 0;
5655		lo->tx_bias = 0;
5656		BWN_RF_MASK(mac, 0x52, 0xfff0);
5657	}
5658
5659	BWN_GETTIME(lo->txctl_measured_time);
5660}
5661
5662static void
5663bwn_lo_get_powervector(struct bwn_mac *mac)
5664{
5665	struct bwn_phy *phy = &mac->mac_phy;
5666	struct bwn_phy_g *pg = &phy->phy_g;
5667	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
5668	int i;
5669	uint64_t tmp;
5670	uint64_t power_vector = 0;
5671
5672	for (i = 0; i < 8; i += 2) {
5673		tmp = bwn_shm_read_2(mac, BWN_SHARED, 0x310 + i);
5674		power_vector |= (tmp << (i * 8));
5675		bwn_shm_write_2(mac, BWN_SHARED, 0x310 + i, 0);
5676	}
5677	if (power_vector)
5678		lo->power_vector = power_vector;
5679
5680	BWN_GETTIME(lo->pwr_vec_read_time);
5681}
5682
5683static void
5684bwn_lo_measure_gain_values(struct bwn_mac *mac, int16_t max_rx_gain,
5685    int use_trsw_rx)
5686{
5687	struct bwn_phy *phy = &mac->mac_phy;
5688	struct bwn_phy_g *pg = &phy->phy_g;
5689	uint16_t tmp;
5690
5691	if (max_rx_gain < 0)
5692		max_rx_gain = 0;
5693
5694	if (BWN_HAS_LOOPBACK(phy)) {
5695		int trsw_rx = 0;
5696		int trsw_rx_gain;
5697
5698		if (use_trsw_rx) {
5699			trsw_rx_gain = pg->pg_trsw_rx_gain / 2;
5700			if (max_rx_gain >= trsw_rx_gain) {
5701				trsw_rx_gain = max_rx_gain - trsw_rx_gain;
5702				trsw_rx = 0x20;
5703			}
5704		} else
5705			trsw_rx_gain = max_rx_gain;
5706		if (trsw_rx_gain < 9) {
5707			pg->pg_lna_lod_gain = 0;
5708		} else {
5709			pg->pg_lna_lod_gain = 1;
5710			trsw_rx_gain -= 8;
5711		}
5712		trsw_rx_gain = MIN(MAX(trsw_rx_gain, 0), 0x2d);
5713		pg->pg_pga_gain = trsw_rx_gain / 3;
5714		if (pg->pg_pga_gain >= 5) {
5715			pg->pg_pga_gain -= 5;
5716			pg->pg_lna_gain = 2;
5717		} else
5718			pg->pg_lna_gain = 0;
5719	} else {
5720		pg->pg_lna_gain = 0;
5721		pg->pg_trsw_rx_gain = 0x20;
5722		if (max_rx_gain >= 0x14) {
5723			pg->pg_lna_lod_gain = 1;
5724			pg->pg_pga_gain = 2;
5725		} else if (max_rx_gain >= 0x12) {
5726			pg->pg_lna_lod_gain = 1;
5727			pg->pg_pga_gain = 1;
5728		} else if (max_rx_gain >= 0xf) {
5729			pg->pg_lna_lod_gain = 1;
5730			pg->pg_pga_gain = 0;
5731		} else {
5732			pg->pg_lna_lod_gain = 0;
5733			pg->pg_pga_gain = 0;
5734		}
5735	}
5736
5737	tmp = BWN_RF_READ(mac, 0x7a);
5738	if (pg->pg_lna_lod_gain == 0)
5739		tmp &= ~0x0008;
5740	else
5741		tmp |= 0x0008;
5742	BWN_RF_WRITE(mac, 0x7a, tmp);
5743}
5744
5745static void
5746bwn_lo_save(struct bwn_mac *mac, struct bwn_lo_g_value *sav)
5747{
5748	struct bwn_phy *phy = &mac->mac_phy;
5749	struct bwn_phy_g *pg = &phy->phy_g;
5750	struct bwn_softc *sc = mac->mac_sc;
5751	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
5752	struct timespec ts;
5753	uint16_t tmp;
5754
5755	if (bwn_has_hwpctl(mac)) {
5756		sav->phy_lomask = BWN_PHY_READ(mac, BWN_PHY_LO_MASK);
5757		sav->phy_extg = BWN_PHY_READ(mac, BWN_PHY_EXTG(0x01));
5758		sav->phy_dacctl_hwpctl = BWN_PHY_READ(mac, BWN_PHY_DACCTL);
5759		sav->phy_cck4 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x14));
5760		sav->phy_hpwr_tssictl = BWN_PHY_READ(mac, BWN_PHY_HPWR_TSSICTL);
5761
5762		BWN_PHY_SET(mac, BWN_PHY_HPWR_TSSICTL, 0x100);
5763		BWN_PHY_SET(mac, BWN_PHY_EXTG(0x01), 0x40);
5764		BWN_PHY_SET(mac, BWN_PHY_DACCTL, 0x40);
5765		BWN_PHY_SET(mac, BWN_PHY_CCK(0x14), 0x200);
5766	}
5767	if (phy->type == BWN_PHYTYPE_B &&
5768	    phy->rf_ver == 0x2050 && phy->rf_rev < 6) {
5769		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x16), 0x410);
5770		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x17), 0x820);
5771	}
5772	if (phy->rev >= 2) {
5773		sav->phy_analogover = BWN_PHY_READ(mac, BWN_PHY_ANALOGOVER);
5774		sav->phy_analogoverval =
5775		    BWN_PHY_READ(mac, BWN_PHY_ANALOGOVERVAL);
5776		sav->phy_rfover = BWN_PHY_READ(mac, BWN_PHY_RFOVER);
5777		sav->phy_rfoverval = BWN_PHY_READ(mac, BWN_PHY_RFOVERVAL);
5778		sav->phy_classctl = BWN_PHY_READ(mac, BWN_PHY_CLASSCTL);
5779		sav->phy_cck3 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x3e));
5780		sav->phy_crs0 = BWN_PHY_READ(mac, BWN_PHY_CRS0);
5781
5782		BWN_PHY_MASK(mac, BWN_PHY_CLASSCTL, 0xfffc);
5783		BWN_PHY_MASK(mac, BWN_PHY_CRS0, 0x7fff);
5784		BWN_PHY_SET(mac, BWN_PHY_ANALOGOVER, 0x0003);
5785		BWN_PHY_MASK(mac, BWN_PHY_ANALOGOVERVAL, 0xfffc);
5786		if (phy->type == BWN_PHYTYPE_G) {
5787			if ((phy->rev >= 7) &&
5788			    (siba_sprom_get_bf_lo(sc->sc_dev) &
5789			     BWN_BFL_EXTLNA)) {
5790				BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, 0x933);
5791			} else {
5792				BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, 0x133);
5793			}
5794		} else {
5795			BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, 0);
5796		}
5797		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x3e), 0);
5798	}
5799	sav->reg0 = BWN_READ_2(mac, 0x3f4);
5800	sav->reg1 = BWN_READ_2(mac, 0x3e2);
5801	sav->rf0 = BWN_RF_READ(mac, 0x43);
5802	sav->rf1 = BWN_RF_READ(mac, 0x7a);
5803	sav->phy_pgactl = BWN_PHY_READ(mac, BWN_PHY_PGACTL);
5804	sav->phy_cck2 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x2a));
5805	sav->phy_syncctl = BWN_PHY_READ(mac, BWN_PHY_SYNCCTL);
5806	sav->phy_dacctl = BWN_PHY_READ(mac, BWN_PHY_DACCTL);
5807
5808	if (!BWN_HAS_TXMAG(phy)) {
5809		sav->rf2 = BWN_RF_READ(mac, 0x52);
5810		sav->rf2 &= 0x00f0;
5811	}
5812	if (phy->type == BWN_PHYTYPE_B) {
5813		sav->phy_cck0 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x30));
5814		sav->phy_cck1 = BWN_PHY_READ(mac, BWN_PHY_CCK(0x06));
5815		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x30), 0x00ff);
5816		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x06), 0x3f3f);
5817	} else {
5818		BWN_WRITE_2(mac, 0x3e2, BWN_READ_2(mac, 0x3e2)
5819			    | 0x8000);
5820	}
5821	BWN_WRITE_2(mac, 0x3f4, BWN_READ_2(mac, 0x3f4)
5822		    & 0xf000);
5823
5824	tmp =
5825	    (phy->type == BWN_PHYTYPE_G) ? BWN_PHY_LO_MASK : BWN_PHY_CCK(0x2e);
5826	BWN_PHY_WRITE(mac, tmp, 0x007f);
5827
5828	tmp = sav->phy_syncctl;
5829	BWN_PHY_WRITE(mac, BWN_PHY_SYNCCTL, tmp & 0xff7f);
5830	tmp = sav->rf1;
5831	BWN_RF_WRITE(mac, 0x007a, tmp & 0xfff0);
5832
5833	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2a), 0x8a3);
5834	if (phy->type == BWN_PHYTYPE_G ||
5835	    (phy->type == BWN_PHYTYPE_B &&
5836	     phy->rf_ver == 0x2050 && phy->rf_rev >= 6)) {
5837		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2b), 0x1003);
5838	} else
5839		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2b), 0x0802);
5840	if (phy->rev >= 2)
5841		bwn_dummy_transmission(mac, 0, 1);
5842	bwn_phy_g_switch_chan(mac, 6, 0);
5843	BWN_RF_READ(mac, 0x51);
5844	if (phy->type == BWN_PHYTYPE_G)
5845		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2f), 0);
5846
5847	nanouptime(&ts);
5848	if (ieee80211_time_before(lo->txctl_measured_time,
5849	    (ts.tv_nsec / 1000000 + ts.tv_sec * 1000) - BWN_LO_TXCTL_EXPIRE))
5850		bwn_lo_measure_txctl_values(mac);
5851
5852	if (phy->type == BWN_PHYTYPE_G && phy->rev >= 3)
5853		BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0xc078);
5854	else {
5855		if (phy->type == BWN_PHYTYPE_B)
5856			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2e), 0x8078);
5857		else
5858			BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, 0x8078);
5859	}
5860}
5861
5862static void
5863bwn_lo_restore(struct bwn_mac *mac, struct bwn_lo_g_value *sav)
5864{
5865	struct bwn_phy *phy = &mac->mac_phy;
5866	struct bwn_phy_g *pg = &phy->phy_g;
5867	uint16_t tmp;
5868
5869	if (phy->rev >= 2) {
5870		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, 0xe300);
5871		tmp = (pg->pg_pga_gain << 8);
5872		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, tmp | 0xa0);
5873		DELAY(5);
5874		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, tmp | 0xa2);
5875		DELAY(2);
5876		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, tmp | 0xa3);
5877	} else {
5878		tmp = (pg->pg_pga_gain | 0xefa0);
5879		BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, tmp);
5880	}
5881	if (phy->type == BWN_PHYTYPE_G) {
5882		if (phy->rev >= 3)
5883			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2e), 0xc078);
5884		else
5885			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2e), 0x8078);
5886		if (phy->rev >= 2)
5887			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2f), 0x0202);
5888		else
5889			BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2f), 0x0101);
5890	}
5891	BWN_WRITE_2(mac, 0x3f4, sav->reg0);
5892	BWN_PHY_WRITE(mac, BWN_PHY_PGACTL, sav->phy_pgactl);
5893	BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x2a), sav->phy_cck2);
5894	BWN_PHY_WRITE(mac, BWN_PHY_SYNCCTL, sav->phy_syncctl);
5895	BWN_PHY_WRITE(mac, BWN_PHY_DACCTL, sav->phy_dacctl);
5896	BWN_RF_WRITE(mac, 0x43, sav->rf0);
5897	BWN_RF_WRITE(mac, 0x7a, sav->rf1);
5898	if (!BWN_HAS_TXMAG(phy)) {
5899		tmp = sav->rf2;
5900		BWN_RF_SETMASK(mac, 0x52, 0xff0f, tmp);
5901	}
5902	BWN_WRITE_2(mac, 0x3e2, sav->reg1);
5903	if (phy->type == BWN_PHYTYPE_B &&
5904	    phy->rf_ver == 0x2050 && phy->rf_rev <= 5) {
5905		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x30), sav->phy_cck0);
5906		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x06), sav->phy_cck1);
5907	}
5908	if (phy->rev >= 2) {
5909		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVER, sav->phy_analogover);
5910		BWN_PHY_WRITE(mac, BWN_PHY_ANALOGOVERVAL,
5911			      sav->phy_analogoverval);
5912		BWN_PHY_WRITE(mac, BWN_PHY_CLASSCTL, sav->phy_classctl);
5913		BWN_PHY_WRITE(mac, BWN_PHY_RFOVER, sav->phy_rfover);
5914		BWN_PHY_WRITE(mac, BWN_PHY_RFOVERVAL, sav->phy_rfoverval);
5915		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x3e), sav->phy_cck3);
5916		BWN_PHY_WRITE(mac, BWN_PHY_CRS0, sav->phy_crs0);
5917	}
5918	if (bwn_has_hwpctl(mac)) {
5919		tmp = (sav->phy_lomask & 0xbfff);
5920		BWN_PHY_WRITE(mac, BWN_PHY_LO_MASK, tmp);
5921		BWN_PHY_WRITE(mac, BWN_PHY_EXTG(0x01), sav->phy_extg);
5922		BWN_PHY_WRITE(mac, BWN_PHY_DACCTL, sav->phy_dacctl_hwpctl);
5923		BWN_PHY_WRITE(mac, BWN_PHY_CCK(0x14), sav->phy_cck4);
5924		BWN_PHY_WRITE(mac, BWN_PHY_HPWR_TSSICTL, sav->phy_hpwr_tssictl);
5925	}
5926	bwn_phy_g_switch_chan(mac, sav->old_channel, 1);
5927}
5928
5929static int
5930bwn_lo_probe_loctl(struct bwn_mac *mac,
5931    struct bwn_loctl *probe, struct bwn_lo_g_sm *d)
5932{
5933	struct bwn_phy *phy = &mac->mac_phy;
5934	struct bwn_phy_g *pg = &phy->phy_g;
5935	struct bwn_loctl orig, test;
5936	struct bwn_loctl prev = { -100, -100 };
5937	static const struct bwn_loctl modifiers[] = {
5938		{  1,  1,}, {  1,  0,}, {  1, -1,}, {  0, -1,},
5939		{ -1, -1,}, { -1,  0,}, { -1,  1,}, {  0,  1,}
5940	};
5941	int begin, end, lower = 0, i;
5942	uint16_t feedth;
5943
5944	if (d->curstate == 0) {
5945		begin = 1;
5946		end = 8;
5947	} else if (d->curstate % 2 == 0) {
5948		begin = d->curstate - 1;
5949		end = d->curstate + 1;
5950	} else {
5951		begin = d->curstate - 2;
5952		end = d->curstate + 2;
5953	}
5954	if (begin < 1)
5955		begin += 8;
5956	if (end > 8)
5957		end -= 8;
5958
5959	memcpy(&orig, probe, sizeof(struct bwn_loctl));
5960	i = begin;
5961	d->curstate = i;
5962	while (1) {
5963		KASSERT(i >= 1 && i <= 8, ("%s:%d: fail", __func__, __LINE__));
5964		memcpy(&test, &orig, sizeof(struct bwn_loctl));
5965		test.i += modifiers[i - 1].i * d->multipler;
5966		test.q += modifiers[i - 1].q * d->multipler;
5967		if ((test.i != prev.i || test.q != prev.q) &&
5968		    (abs(test.i) <= 16 && abs(test.q) <= 16)) {
5969			bwn_lo_write(mac, &test);
5970			feedth = bwn_lo_calcfeed(mac, pg->pg_lna_gain,
5971			    pg->pg_pga_gain, pg->pg_trsw_rx_gain);
5972			if (feedth < d->feedth) {
5973				memcpy(probe, &test,
5974				    sizeof(struct bwn_loctl));
5975				lower = 1;
5976				d->feedth = feedth;
5977				if (d->nmeasure < 2 && !BWN_HAS_LOOPBACK(phy))
5978					break;
5979			}
5980		}
5981		memcpy(&prev, &test, sizeof(prev));
5982		if (i == end)
5983			break;
5984		if (i == 8)
5985			i = 1;
5986		else
5987			i++;
5988		d->curstate = i;
5989	}
5990
5991	return (lower);
5992}
5993
5994static void
5995bwn_lo_probe_sm(struct bwn_mac *mac, struct bwn_loctl *loctl, int *rxgain)
5996{
5997	struct bwn_phy *phy = &mac->mac_phy;
5998	struct bwn_phy_g *pg = &phy->phy_g;
5999	struct bwn_lo_g_sm d;
6000	struct bwn_loctl probe;
6001	int lower, repeat, cnt = 0;
6002	uint16_t feedth;
6003
6004	d.nmeasure = 0;
6005	d.multipler = 1;
6006	if (BWN_HAS_LOOPBACK(phy))
6007		d.multipler = 3;
6008
6009	memcpy(&d.loctl, loctl, sizeof(struct bwn_loctl));
6010	repeat = (BWN_HAS_LOOPBACK(phy)) ? 4 : 1;
6011
6012	do {
6013		bwn_lo_write(mac, &d.loctl);
6014		feedth = bwn_lo_calcfeed(mac, pg->pg_lna_gain,
6015		    pg->pg_pga_gain, pg->pg_trsw_rx_gain);
6016		if (feedth < 0x258) {
6017			if (feedth >= 0x12c)
6018				*rxgain += 6;
6019			else
6020				*rxgain += 3;
6021			feedth = bwn_lo_calcfeed(mac, pg->pg_lna_gain,
6022			    pg->pg_pga_gain, pg->pg_trsw_rx_gain);
6023		}
6024		d.feedth = feedth;
6025		d.curstate = 0;
6026		do {
6027			KASSERT(d.curstate >= 0 && d.curstate <= 8,
6028			    ("%s:%d: fail", __func__, __LINE__));
6029			memcpy(&probe, &d.loctl,
6030			       sizeof(struct bwn_loctl));
6031			lower = bwn_lo_probe_loctl(mac, &probe, &d);
6032			if (!lower)
6033				break;
6034			if ((probe.i == d.loctl.i) && (probe.q == d.loctl.q))
6035				break;
6036			memcpy(&d.loctl, &probe, sizeof(struct bwn_loctl));
6037			d.nmeasure++;
6038		} while (d.nmeasure < 24);
6039		memcpy(loctl, &d.loctl, sizeof(struct bwn_loctl));
6040
6041		if (BWN_HAS_LOOPBACK(phy)) {
6042			if (d.feedth > 0x1194)
6043				*rxgain -= 6;
6044			else if (d.feedth < 0x5dc)
6045				*rxgain += 3;
6046			if (cnt == 0) {
6047				if (d.feedth <= 0x5dc) {
6048					d.multipler = 1;
6049					cnt++;
6050				} else
6051					d.multipler = 2;
6052			} else if (cnt == 2)
6053				d.multipler = 1;
6054		}
6055		bwn_lo_measure_gain_values(mac, *rxgain, BWN_HAS_LOOPBACK(phy));
6056	} while (++cnt < repeat);
6057}
6058
6059static struct bwn_lo_calib *
6060bwn_lo_calibset(struct bwn_mac *mac,
6061    const struct bwn_bbatt *bbatt, const struct bwn_rfatt *rfatt)
6062{
6063	struct bwn_phy *phy = &mac->mac_phy;
6064	struct bwn_phy_g *pg = &phy->phy_g;
6065	struct bwn_loctl loctl = { 0, 0 };
6066	struct bwn_lo_calib *cal;
6067	struct bwn_lo_g_value sval = { 0 };
6068	int rxgain;
6069	uint16_t pad, reg, value;
6070
6071	sval.old_channel = phy->chan;
6072	bwn_mac_suspend(mac);
6073	bwn_lo_save(mac, &sval);
6074
6075	reg = bwn_lo_txctl_regtable(mac, &value, &pad);
6076	BWN_RF_SETMASK(mac, 0x43, 0xfff0, rfatt->att);
6077	BWN_RF_SETMASK(mac, reg, ~value, (rfatt->padmix ? value :0));
6078
6079	rxgain = (rfatt->att * 2) + (bbatt->att / 2);
6080	if (rfatt->padmix)
6081		rxgain -= pad;
6082	if (BWN_HAS_LOOPBACK(phy))
6083		rxgain += pg->pg_max_lb_gain;
6084	bwn_lo_measure_gain_values(mac, rxgain, BWN_HAS_LOOPBACK(phy));
6085	bwn_phy_g_set_bbatt(mac, bbatt->att);
6086	bwn_lo_probe_sm(mac, &loctl, &rxgain);
6087
6088	bwn_lo_restore(mac, &sval);
6089	bwn_mac_enable(mac);
6090
6091	cal = malloc(sizeof(*cal), M_DEVBUF, M_NOWAIT | M_ZERO);
6092	if (!cal) {
6093		device_printf(mac->mac_sc->sc_dev, "out of memory\n");
6094		return (NULL);
6095	}
6096	memcpy(&cal->bbatt, bbatt, sizeof(*bbatt));
6097	memcpy(&cal->rfatt, rfatt, sizeof(*rfatt));
6098	memcpy(&cal->ctl, &loctl, sizeof(loctl));
6099
6100	BWN_GETTIME(cal->calib_time);
6101
6102	return (cal);
6103}
6104
6105static struct bwn_lo_calib *
6106bwn_lo_get_calib(struct bwn_mac *mac, const struct bwn_bbatt *bbatt,
6107    const struct bwn_rfatt *rfatt)
6108{
6109	struct bwn_txpwr_loctl *lo = &mac->mac_phy.phy_g.pg_loctl;
6110	struct bwn_lo_calib *c;
6111
6112	TAILQ_FOREACH(c, &lo->calib_list, list) {
6113		if (!BWN_BBATTCMP(&c->bbatt, bbatt))
6114			continue;
6115		if (!BWN_RFATTCMP(&c->rfatt, rfatt))
6116			continue;
6117		return (c);
6118	}
6119
6120	c = bwn_lo_calibset(mac, bbatt, rfatt);
6121	if (!c)
6122		return (NULL);
6123	TAILQ_INSERT_TAIL(&lo->calib_list, c, list);
6124
6125	return (c);
6126}
6127
6128static void
6129bwn_phy_g_dc_lookup_init(struct bwn_mac *mac, uint8_t update)
6130{
6131	struct bwn_phy *phy = &mac->mac_phy;
6132	struct bwn_phy_g *pg = &phy->phy_g;
6133	struct bwn_softc *sc = mac->mac_sc;
6134	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
6135	const struct bwn_rfatt *rfatt;
6136	const struct bwn_bbatt *bbatt;
6137	uint64_t pvector;
6138	int i;
6139	int rf_offset, bb_offset;
6140	uint8_t changed = 0;
6141
6142	KASSERT(BWN_DC_LT_SIZE == 32, ("%s:%d: fail", __func__, __LINE__));
6143	KASSERT(lo->rfatt.len * lo->bbatt.len <= 64,
6144	    ("%s:%d: fail", __func__, __LINE__));
6145
6146	pvector = lo->power_vector;
6147	if (!update && !pvector)
6148		return;
6149
6150	bwn_mac_suspend(mac);
6151
6152	for (i = 0; i < BWN_DC_LT_SIZE * 2; i++) {
6153		struct bwn_lo_calib *cal;
6154		int idx;
6155		uint16_t val;
6156
6157		if (!update && !(pvector & (((uint64_t)1ULL) << i)))
6158			continue;
6159		bb_offset = i / lo->rfatt.len;
6160		rf_offset = i % lo->rfatt.len;
6161		bbatt = &(lo->bbatt.array[bb_offset]);
6162		rfatt = &(lo->rfatt.array[rf_offset]);
6163
6164		cal = bwn_lo_calibset(mac, bbatt, rfatt);
6165		if (!cal) {
6166			device_printf(sc->sc_dev, "LO: Could not "
6167			    "calibrate DC table entry\n");
6168			continue;
6169		}
6170		val = (uint8_t)(cal->ctl.q);
6171		val |= ((uint8_t)(cal->ctl.i)) << 4;
6172		free(cal, M_DEVBUF);
6173
6174		idx = i / 2;
6175		if (i % 2)
6176			lo->dc_lt[idx] = (lo->dc_lt[idx] & 0x00ff)
6177			    | ((val & 0x00ff) << 8);
6178		else
6179			lo->dc_lt[idx] = (lo->dc_lt[idx] & 0xff00)
6180			    | (val & 0x00ff);
6181		changed = 1;
6182	}
6183	if (changed) {
6184		for (i = 0; i < BWN_DC_LT_SIZE; i++)
6185			BWN_PHY_WRITE(mac, 0x3a0 + i, lo->dc_lt[i]);
6186	}
6187	bwn_mac_enable(mac);
6188}
6189
6190static void
6191bwn_lo_fixup_rfatt(struct bwn_rfatt *rf)
6192{
6193
6194	if (!rf->padmix)
6195		return;
6196	if ((rf->att != 1) && (rf->att != 2) && (rf->att != 3))
6197		rf->att = 4;
6198}
6199
6200static void
6201bwn_lo_g_adjust(struct bwn_mac *mac)
6202{
6203	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
6204	struct bwn_lo_calib *cal;
6205	struct bwn_rfatt rf;
6206
6207	memcpy(&rf, &pg->pg_rfatt, sizeof(rf));
6208	bwn_lo_fixup_rfatt(&rf);
6209
6210	cal = bwn_lo_get_calib(mac, &pg->pg_bbatt, &rf);
6211	if (!cal)
6212		return;
6213	bwn_lo_write(mac, &cal->ctl);
6214}
6215
6216static void
6217bwn_lo_g_init(struct bwn_mac *mac)
6218{
6219
6220	if (!bwn_has_hwpctl(mac))
6221		return;
6222
6223	bwn_lo_get_powervector(mac);
6224	bwn_phy_g_dc_lookup_init(mac, 1);
6225}
6226
6227void
6228bwn_mac_suspend(struct bwn_mac *mac)
6229{
6230	struct bwn_softc *sc = mac->mac_sc;
6231	int i;
6232	uint32_t tmp;
6233
6234	KASSERT(mac->mac_suspended >= 0,
6235	    ("%s:%d: fail", __func__, __LINE__));
6236
6237	if (mac->mac_suspended == 0) {
6238		bwn_psctl(mac, BWN_PS_AWAKE);
6239		BWN_WRITE_4(mac, BWN_MACCTL,
6240			    BWN_READ_4(mac, BWN_MACCTL)
6241			    & ~BWN_MACCTL_ON);
6242		BWN_READ_4(mac, BWN_MACCTL);
6243		for (i = 35; i; i--) {
6244			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
6245			if (tmp & BWN_INTR_MAC_SUSPENDED)
6246				goto out;
6247			DELAY(10);
6248		}
6249		for (i = 40; i; i--) {
6250			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
6251			if (tmp & BWN_INTR_MAC_SUSPENDED)
6252				goto out;
6253			DELAY(1000);
6254		}
6255		device_printf(sc->sc_dev, "MAC suspend failed\n");
6256	}
6257out:
6258	mac->mac_suspended++;
6259}
6260
6261void
6262bwn_mac_enable(struct bwn_mac *mac)
6263{
6264	struct bwn_softc *sc = mac->mac_sc;
6265	uint16_t state;
6266
6267	state = bwn_shm_read_2(mac, BWN_SHARED,
6268	    BWN_SHARED_UCODESTAT);
6269	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
6270	    state != BWN_SHARED_UCODESTAT_SLEEP)
6271		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
6272
6273	mac->mac_suspended--;
6274	KASSERT(mac->mac_suspended >= 0,
6275	    ("%s:%d: fail", __func__, __LINE__));
6276	if (mac->mac_suspended == 0) {
6277		BWN_WRITE_4(mac, BWN_MACCTL,
6278		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
6279		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
6280		BWN_READ_4(mac, BWN_MACCTL);
6281		BWN_READ_4(mac, BWN_INTR_REASON);
6282		bwn_psctl(mac, 0);
6283	}
6284}
6285
6286static void
6287bwn_psctl(struct bwn_mac *mac, uint32_t flags)
6288{
6289	struct bwn_softc *sc = mac->mac_sc;
6290	int i;
6291	uint16_t ucstat;
6292
6293	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
6294	    ("%s:%d: fail", __func__, __LINE__));
6295	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
6296	    ("%s:%d: fail", __func__, __LINE__));
6297
6298	/* XXX forcibly awake and hwps-off */
6299
6300	BWN_WRITE_4(mac, BWN_MACCTL,
6301	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
6302	    ~BWN_MACCTL_HWPS);
6303	BWN_READ_4(mac, BWN_MACCTL);
6304	if (siba_get_revid(sc->sc_dev) >= 5) {
6305		for (i = 0; i < 100; i++) {
6306			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
6307			    BWN_SHARED_UCODESTAT);
6308			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
6309				break;
6310			DELAY(10);
6311		}
6312	}
6313}
6314
6315static int16_t
6316bwn_nrssi_read(struct bwn_mac *mac, uint16_t offset)
6317{
6318
6319	BWN_PHY_WRITE(mac, BWN_PHY_NRSSI_CTRL, offset);
6320	return ((int16_t)BWN_PHY_READ(mac, BWN_PHY_NRSSI_DATA));
6321}
6322
6323static void
6324bwn_nrssi_threshold(struct bwn_mac *mac)
6325{
6326	struct bwn_phy *phy = &mac->mac_phy;
6327	struct bwn_phy_g *pg = &phy->phy_g;
6328	struct bwn_softc *sc = mac->mac_sc;
6329	int32_t a, b;
6330	int16_t tmp16;
6331	uint16_t tmpu16;
6332
6333	KASSERT(phy->type == BWN_PHYTYPE_G, ("%s: fail", __func__));
6334
6335	if (phy->gmode && (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_RSSI)) {
6336		if (!pg->pg_aci_wlan_automatic && pg->pg_aci_enable) {
6337			a = 0x13;
6338			b = 0x12;
6339		} else {
6340			a = 0xe;
6341			b = 0x11;
6342		}
6343
6344		a = a * (pg->pg_nrssi[1] - pg->pg_nrssi[0]);
6345		a += (pg->pg_nrssi[0] << 6);
6346		a += (a < 32) ? 31 : 32;
6347		a = a >> 6;
6348		a = MIN(MAX(a, -31), 31);
6349
6350		b = b * (pg->pg_nrssi[1] - pg->pg_nrssi[0]);
6351		b += (pg->pg_nrssi[0] << 6);
6352		if (b < 32)
6353			b += 31;
6354		else
6355			b += 32;
6356		b = b >> 6;
6357		b = MIN(MAX(b, -31), 31);
6358
6359		tmpu16 = BWN_PHY_READ(mac, 0x048a) & 0xf000;
6360		tmpu16 |= ((uint32_t)b & 0x0000003f);
6361		tmpu16 |= (((uint32_t)a & 0x0000003f) << 6);
6362		BWN_PHY_WRITE(mac, 0x048a, tmpu16);
6363		return;
6364	}
6365
6366	tmp16 = bwn_nrssi_read(mac, 0x20);
6367	if (tmp16 >= 0x20)
6368		tmp16 -= 0x40;
6369	BWN_PHY_SETMASK(mac, 0x048a, 0xf000, (tmp16 < 3) ? 0x09eb : 0x0aed);
6370}
6371
6372static void
6373bwn_nrssi_slope_11g(struct bwn_mac *mac)
6374{
6375#define	SAVE_RF_MAX		3
6376#define	SAVE_PHY_COMM_MAX	4
6377#define	SAVE_PHY3_MAX		8
6378	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
6379		{ 0x7a, 0x52, 0x43 };
6380	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
6381		{ 0x15, 0x5a, 0x59, 0x58 };
6382	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
6383		0x002e, 0x002f, 0x080f, BWN_PHY_G_LOCTL,
6384		0x0801, 0x0060, 0x0014, 0x0478
6385	};
6386	struct bwn_phy *phy = &mac->mac_phy;
6387	struct bwn_phy_g *pg = &phy->phy_g;
6388	int32_t i, tmp32, phy3_idx = 0;
6389	uint16_t delta, tmp;
6390	uint16_t save_rf[SAVE_RF_MAX];
6391	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
6392	uint16_t save_phy3[SAVE_PHY3_MAX];
6393	uint16_t ant_div, phy0, chan_ex;
6394	int16_t nrssi0, nrssi1;
6395
6396	KASSERT(phy->type == BWN_PHYTYPE_G,
6397	    ("%s:%d: fail", __func__, __LINE__));
6398
6399	if (phy->rf_rev >= 9)
6400		return;
6401	if (phy->rf_rev == 8)
6402		bwn_nrssi_offset(mac);
6403
6404	BWN_PHY_MASK(mac, BWN_PHY_G_CRS, 0x7fff);
6405	BWN_PHY_MASK(mac, 0x0802, 0xfffc);
6406
6407	/*
6408	 * Save RF/PHY registers for later restoration
6409	 */
6410	ant_div = BWN_READ_2(mac, 0x03e2);
6411	BWN_WRITE_2(mac, 0x03e2, BWN_READ_2(mac, 0x03e2) | 0x8000);
6412	for (i = 0; i < SAVE_RF_MAX; ++i)
6413		save_rf[i] = BWN_RF_READ(mac, save_rf_regs[i]);
6414	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
6415		save_phy_comm[i] = BWN_PHY_READ(mac, save_phy_comm_regs[i]);
6416
6417	phy0 = BWN_READ_2(mac, BWN_PHY0);
6418	chan_ex = BWN_READ_2(mac, BWN_CHANNEL_EXT);
6419	if (phy->rev >= 3) {
6420		for (i = 0; i < SAVE_PHY3_MAX; ++i)
6421			save_phy3[i] = BWN_PHY_READ(mac, save_phy3_regs[i]);
6422		BWN_PHY_WRITE(mac, 0x002e, 0);
6423		BWN_PHY_WRITE(mac, BWN_PHY_G_LOCTL, 0);
6424		switch (phy->rev) {
6425		case 4:
6426		case 6:
6427		case 7:
6428			BWN_PHY_SET(mac, 0x0478, 0x0100);
6429			BWN_PHY_SET(mac, 0x0801, 0x0040);
6430			break;
6431		case 3:
6432		case 5:
6433			BWN_PHY_MASK(mac, 0x0801, 0xffbf);
6434			break;
6435		}
6436		BWN_PHY_SET(mac, 0x0060, 0x0040);
6437		BWN_PHY_SET(mac, 0x0014, 0x0200);
6438	}
6439	/*
6440	 * Calculate nrssi0
6441	 */
6442	BWN_RF_SET(mac, 0x007a, 0x0070);
6443	bwn_set_all_gains(mac, 0, 8, 0);
6444	BWN_RF_MASK(mac, 0x007a, 0x00f7);
6445	if (phy->rev >= 2) {
6446		BWN_PHY_SETMASK(mac, 0x0811, 0xffcf, 0x0030);
6447		BWN_PHY_SETMASK(mac, 0x0812, 0xffcf, 0x0010);
6448	}
6449	BWN_RF_SET(mac, 0x007a, 0x0080);
6450	DELAY(20);
6451
6452	nrssi0 = (int16_t) ((BWN_PHY_READ(mac, 0x047f) >> 8) & 0x003f);
6453	if (nrssi0 >= 0x0020)
6454		nrssi0 -= 0x0040;
6455
6456	/*
6457	 * Calculate nrssi1
6458	 */
6459	BWN_RF_MASK(mac, 0x007a, 0x007f);
6460	if (phy->rev >= 2)
6461		BWN_PHY_SETMASK(mac, 0x0003, 0xff9f, 0x0040);
6462
6463	BWN_WRITE_2(mac, BWN_CHANNEL_EXT,
6464	    BWN_READ_2(mac, BWN_CHANNEL_EXT) | 0x2000);
6465	BWN_RF_SET(mac, 0x007a, 0x000f);
6466	BWN_PHY_WRITE(mac, 0x0015, 0xf330);
6467	if (phy->rev >= 2) {
6468		BWN_PHY_SETMASK(mac, 0x0812, 0xffcf, 0x0020);
6469		BWN_PHY_SETMASK(mac, 0x0811, 0xffcf, 0x0020);
6470	}
6471
6472	bwn_set_all_gains(mac, 3, 0, 1);
6473	if (phy->rf_rev == 8) {
6474		BWN_RF_WRITE(mac, 0x0043, 0x001f);
6475	} else {
6476		tmp = BWN_RF_READ(mac, 0x0052) & 0xff0f;
6477		BWN_RF_WRITE(mac, 0x0052, tmp | 0x0060);
6478		tmp = BWN_RF_READ(mac, 0x0043) & 0xfff0;
6479		BWN_RF_WRITE(mac, 0x0043, tmp | 0x0009);
6480	}
6481	BWN_PHY_WRITE(mac, 0x005a, 0x0480);
6482	BWN_PHY_WRITE(mac, 0x0059, 0x0810);
6483	BWN_PHY_WRITE(mac, 0x0058, 0x000d);
6484	DELAY(20);
6485	nrssi1 = (int16_t) ((BWN_PHY_READ(mac, 0x047f) >> 8) & 0x003f);
6486
6487	/*
6488	 * Install calculated narrow RSSI values
6489	 */
6490	if (nrssi1 >= 0x0020)
6491		nrssi1 -= 0x0040;
6492	if (nrssi0 == nrssi1)
6493		pg->pg_nrssi_slope = 0x00010000;
6494	else
6495		pg->pg_nrssi_slope = 0x00400000 / (nrssi0 - nrssi1);
6496	if (nrssi0 >= -4) {
6497		pg->pg_nrssi[0] = nrssi1;
6498		pg->pg_nrssi[1] = nrssi0;
6499	}
6500
6501	/*
6502	 * Restore saved RF/PHY registers
6503	 */
6504	if (phy->rev >= 3) {
6505		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
6506			BWN_PHY_WRITE(mac, save_phy3_regs[phy3_idx],
6507			    save_phy3[phy3_idx]);
6508		}
6509	}
6510	if (phy->rev >= 2) {
6511		BWN_PHY_MASK(mac, 0x0812, 0xffcf);
6512		BWN_PHY_MASK(mac, 0x0811, 0xffcf);
6513	}
6514
6515	for (i = 0; i < SAVE_RF_MAX; ++i)
6516		BWN_RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
6517
6518	BWN_WRITE_2(mac, 0x03e2, ant_div);
6519	BWN_WRITE_2(mac, 0x03e6, phy0);
6520	BWN_WRITE_2(mac, BWN_CHANNEL_EXT, chan_ex);
6521
6522	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
6523		BWN_PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
6524
6525	bwn_spu_workaround(mac, phy->chan);
6526	BWN_PHY_SET(mac, 0x0802, (0x0001 | 0x0002));
6527	bwn_set_original_gains(mac);
6528	BWN_PHY_SET(mac, BWN_PHY_G_CRS, 0x8000);
6529	if (phy->rev >= 3) {
6530		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
6531			BWN_PHY_WRITE(mac, save_phy3_regs[phy3_idx],
6532			    save_phy3[phy3_idx]);
6533		}
6534	}
6535
6536	delta = 0x1f - pg->pg_nrssi[0];
6537	for (i = 0; i < 64; i++) {
6538		tmp32 = (((i - delta) * pg->pg_nrssi_slope) / 0x10000) + 0x3a;
6539		tmp32 = MIN(MAX(tmp32, 0), 0x3f);
6540		pg->pg_nrssi_lt[i] = tmp32;
6541	}
6542
6543	bwn_nrssi_threshold(mac);
6544#undef SAVE_RF_MAX
6545#undef SAVE_PHY_COMM_MAX
6546#undef SAVE_PHY3_MAX
6547}
6548
6549static void
6550bwn_nrssi_offset(struct bwn_mac *mac)
6551{
6552#define	SAVE_RF_MAX		2
6553#define	SAVE_PHY_COMM_MAX	10
6554#define	SAVE_PHY6_MAX		8
6555	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
6556		{ 0x7a, 0x43 };
6557	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
6558		0x0001, 0x0811, 0x0812, 0x0814,
6559		0x0815, 0x005a, 0x0059, 0x0058,
6560		0x000a, 0x0003
6561	};
6562	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
6563		0x002e, 0x002f, 0x080f, 0x0810,
6564		0x0801, 0x0060, 0x0014, 0x0478
6565	};
6566	struct bwn_phy *phy = &mac->mac_phy;
6567	int i, phy6_idx = 0;
6568	uint16_t save_rf[SAVE_RF_MAX];
6569	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
6570	uint16_t save_phy6[SAVE_PHY6_MAX];
6571	int16_t nrssi;
6572	uint16_t saved = 0xffff;
6573
6574	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
6575		save_phy_comm[i] = BWN_PHY_READ(mac, save_phy_comm_regs[i]);
6576	for (i = 0; i < SAVE_RF_MAX; ++i)
6577		save_rf[i] = BWN_RF_READ(mac, save_rf_regs[i]);
6578
6579	BWN_PHY_MASK(mac, 0x0429, 0x7fff);
6580	BWN_PHY_SETMASK(mac, 0x0001, 0x3fff, 0x4000);
6581	BWN_PHY_SET(mac, 0x0811, 0x000c);
6582	BWN_PHY_SETMASK(mac, 0x0812, 0xfff3, 0x0004);
6583	BWN_PHY_MASK(mac, 0x0802, ~(0x1 | 0x2));
6584	if (phy->rev >= 6) {
6585		for (i = 0; i < SAVE_PHY6_MAX; ++i)
6586			save_phy6[i] = BWN_PHY_READ(mac, save_phy6_regs[i]);
6587
6588		BWN_PHY_WRITE(mac, 0x002e, 0);
6589		BWN_PHY_WRITE(mac, 0x002f, 0);
6590		BWN_PHY_WRITE(mac, 0x080f, 0);
6591		BWN_PHY_WRITE(mac, 0x0810, 0);
6592		BWN_PHY_SET(mac, 0x0478, 0x0100);
6593		BWN_PHY_SET(mac, 0x0801, 0x0040);
6594		BWN_PHY_SET(mac, 0x0060, 0x0040);
6595		BWN_PHY_SET(mac, 0x0014, 0x0200);
6596	}
6597	BWN_RF_SET(mac, 0x007a, 0x0070);
6598	BWN_RF_SET(mac, 0x007a, 0x0080);
6599	DELAY(30);
6600
6601	nrssi = (int16_t) ((BWN_PHY_READ(mac, 0x047f) >> 8) & 0x003f);
6602	if (nrssi >= 0x20)
6603		nrssi -= 0x40;
6604	if (nrssi == 31) {
6605		for (i = 7; i >= 4; i--) {
6606			BWN_RF_WRITE(mac, 0x007b, i);
6607			DELAY(20);
6608			nrssi = (int16_t) ((BWN_PHY_READ(mac, 0x047f) >> 8) &
6609			    0x003f);
6610			if (nrssi >= 0x20)
6611				nrssi -= 0x40;
6612			if (nrssi < 31 && saved == 0xffff)
6613				saved = i;
6614		}
6615		if (saved == 0xffff)
6616			saved = 4;
6617	} else {
6618		BWN_RF_MASK(mac, 0x007a, 0x007f);
6619		if (phy->rev != 1) {
6620			BWN_PHY_SET(mac, 0x0814, 0x0001);
6621			BWN_PHY_MASK(mac, 0x0815, 0xfffe);
6622		}
6623		BWN_PHY_SET(mac, 0x0811, 0x000c);
6624		BWN_PHY_SET(mac, 0x0812, 0x000c);
6625		BWN_PHY_SET(mac, 0x0811, 0x0030);
6626		BWN_PHY_SET(mac, 0x0812, 0x0030);
6627		BWN_PHY_WRITE(mac, 0x005a, 0x0480);
6628		BWN_PHY_WRITE(mac, 0x0059, 0x0810);
6629		BWN_PHY_WRITE(mac, 0x0058, 0x000d);
6630		if (phy->rev == 0)
6631			BWN_PHY_WRITE(mac, 0x0003, 0x0122);
6632		else
6633			BWN_PHY_SET(mac, 0x000a, 0x2000);
6634		if (phy->rev != 1) {
6635			BWN_PHY_SET(mac, 0x0814, 0x0004);
6636			BWN_PHY_MASK(mac, 0x0815, 0xfffb);
6637		}
6638		BWN_PHY_SETMASK(mac, 0x0003, 0xff9f, 0x0040);
6639		BWN_RF_SET(mac, 0x007a, 0x000f);
6640		bwn_set_all_gains(mac, 3, 0, 1);
6641		BWN_RF_SETMASK(mac, 0x0043, 0x00f0, 0x000f);
6642		DELAY(30);
6643		nrssi = (int16_t) ((BWN_PHY_READ(mac, 0x047f) >> 8) & 0x003f);
6644		if (nrssi >= 0x20)
6645			nrssi -= 0x40;
6646		if (nrssi == -32) {
6647			for (i = 0; i < 4; i++) {
6648				BWN_RF_WRITE(mac, 0x007b, i);
6649				DELAY(20);
6650				nrssi = (int16_t)((BWN_PHY_READ(mac,
6651				    0x047f) >> 8) & 0x003f);
6652				if (nrssi >= 0x20)
6653					nrssi -= 0x40;
6654				if (nrssi > -31 && saved == 0xffff)
6655					saved = i;
6656			}
6657			if (saved == 0xffff)
6658				saved = 3;
6659		} else
6660			saved = 0;
6661	}
6662	BWN_RF_WRITE(mac, 0x007b, saved);
6663
6664	/*
6665	 * Restore saved RF/PHY registers
6666	 */
6667	if (phy->rev >= 6) {
6668		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
6669			BWN_PHY_WRITE(mac, save_phy6_regs[phy6_idx],
6670			    save_phy6[phy6_idx]);
6671		}
6672	}
6673	if (phy->rev != 1) {
6674		for (i = 3; i < 5; i++)
6675			BWN_PHY_WRITE(mac, save_phy_comm_regs[i],
6676			    save_phy_comm[i]);
6677	}
6678	for (i = 5; i < SAVE_PHY_COMM_MAX; i++)
6679		BWN_PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
6680
6681	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
6682		BWN_RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
6683
6684	BWN_PHY_WRITE(mac, 0x0802, BWN_PHY_READ(mac, 0x0802) | 0x1 | 0x2);
6685	BWN_PHY_SET(mac, 0x0429, 0x8000);
6686	bwn_set_original_gains(mac);
6687	if (phy->rev >= 6) {
6688		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
6689			BWN_PHY_WRITE(mac, save_phy6_regs[phy6_idx],
6690			    save_phy6[phy6_idx]);
6691		}
6692	}
6693
6694	BWN_PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
6695	BWN_PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
6696	BWN_PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
6697}
6698
6699static void
6700bwn_set_all_gains(struct bwn_mac *mac, int16_t first, int16_t second,
6701    int16_t third)
6702{
6703	struct bwn_phy *phy = &mac->mac_phy;
6704	uint16_t i;
6705	uint16_t start = 0x08, end = 0x18;
6706	uint16_t tmp;
6707	uint16_t table;
6708
6709	if (phy->rev <= 1) {
6710		start = 0x10;
6711		end = 0x20;
6712	}
6713
6714	table = BWN_OFDMTAB_GAINX;
6715	if (phy->rev <= 1)
6716		table = BWN_OFDMTAB_GAINX_R1;
6717	for (i = 0; i < 4; i++)
6718		bwn_ofdmtab_write_2(mac, table, i, first);
6719
6720	for (i = start; i < end; i++)
6721		bwn_ofdmtab_write_2(mac, table, i, second);
6722
6723	if (third != -1) {
6724		tmp = ((uint16_t) third << 14) | ((uint16_t) third << 6);
6725		BWN_PHY_SETMASK(mac, 0x04a0, 0xbfbf, tmp);
6726		BWN_PHY_SETMASK(mac, 0x04a1, 0xbfbf, tmp);
6727		BWN_PHY_SETMASK(mac, 0x04a2, 0xbfbf, tmp);
6728	}
6729	bwn_dummy_transmission(mac, 0, 1);
6730}
6731
6732static void
6733bwn_set_original_gains(struct bwn_mac *mac)
6734{
6735	struct bwn_phy *phy = &mac->mac_phy;
6736	uint16_t i, tmp;
6737	uint16_t table;
6738	uint16_t start = 0x0008, end = 0x0018;
6739
6740	if (phy->rev <= 1) {
6741		start = 0x0010;
6742		end = 0x0020;
6743	}
6744
6745	table = BWN_OFDMTAB_GAINX;
6746	if (phy->rev <= 1)
6747		table = BWN_OFDMTAB_GAINX_R1;
6748	for (i = 0; i < 4; i++) {
6749		tmp = (i & 0xfffc);
6750		tmp |= (i & 0x0001) << 1;
6751		tmp |= (i & 0x0002) >> 1;
6752
6753		bwn_ofdmtab_write_2(mac, table, i, tmp);
6754	}
6755
6756	for (i = start; i < end; i++)
6757		bwn_ofdmtab_write_2(mac, table, i, i - start);
6758
6759	BWN_PHY_SETMASK(mac, 0x04a0, 0xbfbf, 0x4040);
6760	BWN_PHY_SETMASK(mac, 0x04a1, 0xbfbf, 0x4040);
6761	BWN_PHY_SETMASK(mac, 0x04a2, 0xbfbf, 0x4000);
6762	bwn_dummy_transmission(mac, 0, 1);
6763}
6764
6765static void
6766bwn_phy_hwpctl_init(struct bwn_mac *mac)
6767{
6768	struct bwn_phy *phy = &mac->mac_phy;
6769	struct bwn_phy_g *pg = &phy->phy_g;
6770	struct bwn_rfatt old_rfatt, rfatt;
6771	struct bwn_bbatt old_bbatt, bbatt;
6772	struct bwn_softc *sc = mac->mac_sc;
6773	uint8_t old_txctl = 0;
6774
6775	KASSERT(phy->type == BWN_PHYTYPE_G,
6776	    ("%s:%d: fail", __func__, __LINE__));
6777
6778	if ((siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM) &&
6779	    (siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306))
6780		return;
6781
6782	BWN_PHY_WRITE(mac, 0x0028, 0x8018);
6783
6784	BWN_WRITE_2(mac, BWN_PHY0, BWN_READ_2(mac, BWN_PHY0) & 0xffdf);
6785
6786	if (!phy->gmode)
6787		return;
6788	bwn_hwpctl_early_init(mac);
6789	if (pg->pg_curtssi == 0) {
6790		if (phy->rf_ver == 0x2050 && phy->analog == 0) {
6791			BWN_RF_SETMASK(mac, 0x0076, 0x00f7, 0x0084);
6792		} else {
6793			memcpy(&old_rfatt, &pg->pg_rfatt, sizeof(old_rfatt));
6794			memcpy(&old_bbatt, &pg->pg_bbatt, sizeof(old_bbatt));
6795			old_txctl = pg->pg_txctl;
6796
6797			bbatt.att = 11;
6798			if (phy->rf_rev == 8) {
6799				rfatt.att = 15;
6800				rfatt.padmix = 1;
6801			} else {
6802				rfatt.att = 9;
6803				rfatt.padmix = 0;
6804			}
6805			bwn_phy_g_set_txpwr_sub(mac, &bbatt, &rfatt, 0);
6806		}
6807		bwn_dummy_transmission(mac, 0, 1);
6808		pg->pg_curtssi = BWN_PHY_READ(mac, BWN_PHY_TSSI);
6809		if (phy->rf_ver == 0x2050 && phy->analog == 0)
6810			BWN_RF_MASK(mac, 0x0076, 0xff7b);
6811		else
6812			bwn_phy_g_set_txpwr_sub(mac, &old_bbatt,
6813			    &old_rfatt, old_txctl);
6814	}
6815	bwn_hwpctl_init_gphy(mac);
6816
6817	/* clear TSSI */
6818	bwn_shm_write_2(mac, BWN_SHARED, 0x0058, 0x7f7f);
6819	bwn_shm_write_2(mac, BWN_SHARED, 0x005a, 0x7f7f);
6820	bwn_shm_write_2(mac, BWN_SHARED, 0x0070, 0x7f7f);
6821	bwn_shm_write_2(mac, BWN_SHARED, 0x0072, 0x7f7f);
6822}
6823
6824static void
6825bwn_hwpctl_early_init(struct bwn_mac *mac)
6826{
6827	struct bwn_phy *phy = &mac->mac_phy;
6828
6829	if (!bwn_has_hwpctl(mac)) {
6830		BWN_PHY_WRITE(mac, 0x047a, 0xc111);
6831		return;
6832	}
6833
6834	BWN_PHY_MASK(mac, 0x0036, 0xfeff);
6835	BWN_PHY_WRITE(mac, 0x002f, 0x0202);
6836	BWN_PHY_SET(mac, 0x047c, 0x0002);
6837	BWN_PHY_SET(mac, 0x047a, 0xf000);
6838	if (phy->rf_ver == 0x2050 && phy->rf_rev == 8) {
6839		BWN_PHY_SETMASK(mac, 0x047a, 0xff0f, 0x0010);
6840		BWN_PHY_SET(mac, 0x005d, 0x8000);
6841		BWN_PHY_SETMASK(mac, 0x004e, 0xffc0, 0x0010);
6842		BWN_PHY_WRITE(mac, 0x002e, 0xc07f);
6843		BWN_PHY_SET(mac, 0x0036, 0x0400);
6844	} else {
6845		BWN_PHY_SET(mac, 0x0036, 0x0200);
6846		BWN_PHY_SET(mac, 0x0036, 0x0400);
6847		BWN_PHY_MASK(mac, 0x005d, 0x7fff);
6848		BWN_PHY_MASK(mac, 0x004f, 0xfffe);
6849		BWN_PHY_SETMASK(mac, 0x004e, 0xffc0, 0x0010);
6850		BWN_PHY_WRITE(mac, 0x002e, 0xc07f);
6851		BWN_PHY_SETMASK(mac, 0x047a, 0xff0f, 0x0010);
6852	}
6853}
6854
6855static void
6856bwn_hwpctl_init_gphy(struct bwn_mac *mac)
6857{
6858	struct bwn_phy *phy = &mac->mac_phy;
6859	struct bwn_phy_g *pg = &phy->phy_g;
6860	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
6861	int i;
6862	uint16_t nr_written = 0, tmp, value;
6863	uint8_t rf, bb;
6864
6865	if (!bwn_has_hwpctl(mac)) {
6866		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_HW_POWERCTL);
6867		return;
6868	}
6869
6870	BWN_PHY_SETMASK(mac, 0x0036, 0xffc0,
6871	    (pg->pg_idletssi - pg->pg_curtssi));
6872	BWN_PHY_SETMASK(mac, 0x0478, 0xff00,
6873	    (pg->pg_idletssi - pg->pg_curtssi));
6874
6875	for (i = 0; i < 32; i++)
6876		bwn_ofdmtab_write_2(mac, 0x3c20, i, pg->pg_tssi2dbm[i]);
6877	for (i = 32; i < 64; i++)
6878		bwn_ofdmtab_write_2(mac, 0x3c00, i - 32, pg->pg_tssi2dbm[i]);
6879	for (i = 0; i < 64; i += 2) {
6880		value = (uint16_t) pg->pg_tssi2dbm[i];
6881		value |= ((uint16_t) pg->pg_tssi2dbm[i + 1]) << 8;
6882		BWN_PHY_WRITE(mac, 0x380 + (i / 2), value);
6883	}
6884
6885	for (rf = 0; rf < lo->rfatt.len; rf++) {
6886		for (bb = 0; bb < lo->bbatt.len; bb++) {
6887			if (nr_written >= 0x40)
6888				return;
6889			tmp = lo->bbatt.array[bb].att;
6890			tmp <<= 8;
6891			if (phy->rf_rev == 8)
6892				tmp |= 0x50;
6893			else
6894				tmp |= 0x40;
6895			tmp |= lo->rfatt.array[rf].att;
6896			BWN_PHY_WRITE(mac, 0x3c0 + nr_written, tmp);
6897			nr_written++;
6898		}
6899	}
6900
6901	BWN_PHY_MASK(mac, 0x0060, 0xffbf);
6902	BWN_PHY_WRITE(mac, 0x0014, 0x0000);
6903
6904	KASSERT(phy->rev >= 6, ("%s:%d: fail", __func__, __LINE__));
6905	BWN_PHY_SET(mac, 0x0478, 0x0800);
6906	BWN_PHY_MASK(mac, 0x0478, 0xfeff);
6907	BWN_PHY_MASK(mac, 0x0801, 0xffbf);
6908
6909	bwn_phy_g_dc_lookup_init(mac, 1);
6910	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_HW_POWERCTL);
6911}
6912
6913static void
6914bwn_phy_g_switch_chan(struct bwn_mac *mac, int channel, uint8_t spu)
6915{
6916	struct bwn_softc *sc = mac->mac_sc;
6917
6918	if (spu != 0)
6919		bwn_spu_workaround(mac, channel);
6920
6921	BWN_WRITE_2(mac, BWN_CHANNEL, bwn_phy_g_chan2freq(channel));
6922
6923	if (channel == 14) {
6924		if (siba_sprom_get_ccode(sc->sc_dev) == SIBA_CCODE_JAPAN)
6925			bwn_hf_write(mac,
6926			    bwn_hf_read(mac) & ~BWN_HF_JAPAN_CHAN14_OFF);
6927		else
6928			bwn_hf_write(mac,
6929			    bwn_hf_read(mac) | BWN_HF_JAPAN_CHAN14_OFF);
6930		BWN_WRITE_2(mac, BWN_CHANNEL_EXT,
6931		    BWN_READ_2(mac, BWN_CHANNEL_EXT) | (1 << 11));
6932		return;
6933	}
6934
6935	BWN_WRITE_2(mac, BWN_CHANNEL_EXT,
6936	    BWN_READ_2(mac, BWN_CHANNEL_EXT) & 0xf7bf);
6937}
6938
6939static uint16_t
6940bwn_phy_g_chan2freq(uint8_t channel)
6941{
6942	static const uint8_t bwn_phy_g_rf_channels[] = BWN_PHY_G_RF_CHANNELS;
6943
6944	KASSERT(channel >= 1 && channel <= 14,
6945	    ("%s:%d: fail", __func__, __LINE__));
6946
6947	return (bwn_phy_g_rf_channels[channel - 1]);
6948}
6949
6950static void
6951bwn_phy_g_set_txpwr_sub(struct bwn_mac *mac, const struct bwn_bbatt *bbatt,
6952    const struct bwn_rfatt *rfatt, uint8_t txctl)
6953{
6954	struct bwn_phy *phy = &mac->mac_phy;
6955	struct bwn_phy_g *pg = &phy->phy_g;
6956	struct bwn_txpwr_loctl *lo = &pg->pg_loctl;
6957	uint16_t bb, rf;
6958	uint16_t tx_bias, tx_magn;
6959
6960	bb = bbatt->att;
6961	rf = rfatt->att;
6962	tx_bias = lo->tx_bias;
6963	tx_magn = lo->tx_magn;
6964	if (tx_bias == 0xff)
6965		tx_bias = 0;
6966
6967	pg->pg_txctl = txctl;
6968	memmove(&pg->pg_rfatt, rfatt, sizeof(*rfatt));
6969	pg->pg_rfatt.padmix = (txctl & BWN_TXCTL_TXMIX) ? 1 : 0;
6970	memmove(&pg->pg_bbatt, bbatt, sizeof(*bbatt));
6971	bwn_phy_g_set_bbatt(mac, bb);
6972	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RADIO_ATT, rf);
6973	if (phy->rf_ver == 0x2050 && phy->rf_rev == 8)
6974		BWN_RF_WRITE(mac, 0x43, (rf & 0x000f) | (txctl & 0x0070));
6975	else {
6976		BWN_RF_SETMASK(mac, 0x43, 0xfff0, (rf & 0x000f));
6977		BWN_RF_SETMASK(mac, 0x52, ~0x0070, (txctl & 0x0070));
6978	}
6979	if (BWN_HAS_TXMAG(phy))
6980		BWN_RF_WRITE(mac, 0x52, tx_magn | tx_bias);
6981	else
6982		BWN_RF_SETMASK(mac, 0x52, 0xfff0, (tx_bias & 0x000f));
6983	bwn_lo_g_adjust(mac);
6984}
6985
6986static void
6987bwn_phy_g_set_bbatt(struct bwn_mac *mac,
6988    uint16_t bbatt)
6989{
6990	struct bwn_phy *phy = &mac->mac_phy;
6991
6992	if (phy->analog == 0) {
6993		BWN_WRITE_2(mac, BWN_PHY0,
6994		    (BWN_READ_2(mac, BWN_PHY0) & 0xfff0) | bbatt);
6995		return;
6996	}
6997	if (phy->analog > 1) {
6998		BWN_PHY_SETMASK(mac, BWN_PHY_DACCTL, 0xffc3, bbatt << 2);
6999		return;
7000	}
7001	BWN_PHY_SETMASK(mac, BWN_PHY_DACCTL, 0xff87, bbatt << 3);
7002}
7003
7004static uint16_t
7005bwn_rf_2050_rfoverval(struct bwn_mac *mac, uint16_t reg, uint32_t lpd)
7006{
7007	struct bwn_phy *phy = &mac->mac_phy;
7008	struct bwn_phy_g *pg = &phy->phy_g;
7009	struct bwn_softc *sc = mac->mac_sc;
7010	int max_lb_gain;
7011	uint16_t extlna;
7012	uint16_t i;
7013
7014	if (phy->gmode == 0)
7015		return (0);
7016
7017	if (BWN_HAS_LOOPBACK(phy)) {
7018		max_lb_gain = pg->pg_max_lb_gain;
7019		max_lb_gain += (phy->rf_rev == 8) ? 0x3e : 0x26;
7020		if (max_lb_gain >= 0x46) {
7021			extlna = 0x3000;
7022			max_lb_gain -= 0x46;
7023		} else if (max_lb_gain >= 0x3a) {
7024			extlna = 0x1000;
7025			max_lb_gain -= 0x3a;
7026		} else if (max_lb_gain >= 0x2e) {
7027			extlna = 0x2000;
7028			max_lb_gain -= 0x2e;
7029		} else {
7030			extlna = 0;
7031			max_lb_gain -= 0x10;
7032		}
7033
7034		for (i = 0; i < 16; i++) {
7035			max_lb_gain -= (i * 6);
7036			if (max_lb_gain < 6)
7037				break;
7038		}
7039
7040		if ((phy->rev < 7) ||
7041		    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_EXTLNA)) {
7042			if (reg == BWN_PHY_RFOVER) {
7043				return (0x1b3);
7044			} else if (reg == BWN_PHY_RFOVERVAL) {
7045				extlna |= (i << 8);
7046				switch (lpd) {
7047				case BWN_LPD(0, 1, 1):
7048					return (0x0f92);
7049				case BWN_LPD(0, 0, 1):
7050				case BWN_LPD(1, 0, 1):
7051					return (0x0092 | extlna);
7052				case BWN_LPD(1, 0, 0):
7053					return (0x0093 | extlna);
7054				}
7055				KASSERT(0 == 1,
7056				    ("%s:%d: fail", __func__, __LINE__));
7057			}
7058			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
7059		} else {
7060			if (reg == BWN_PHY_RFOVER)
7061				return (0x9b3);
7062			if (reg == BWN_PHY_RFOVERVAL) {
7063				if (extlna)
7064					extlna |= 0x8000;
7065				extlna |= (i << 8);
7066				switch (lpd) {
7067				case BWN_LPD(0, 1, 1):
7068					return (0x8f92);
7069				case BWN_LPD(0, 0, 1):
7070					return (0x8092 | extlna);
7071				case BWN_LPD(1, 0, 1):
7072					return (0x2092 | extlna);
7073				case BWN_LPD(1, 0, 0):
7074					return (0x2093 | extlna);
7075				}
7076				KASSERT(0 == 1,
7077				    ("%s:%d: fail", __func__, __LINE__));
7078			}
7079			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
7080		}
7081		return (0);
7082	}
7083
7084	if ((phy->rev < 7) ||
7085	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_EXTLNA)) {
7086		if (reg == BWN_PHY_RFOVER) {
7087			return (0x1b3);
7088		} else if (reg == BWN_PHY_RFOVERVAL) {
7089			switch (lpd) {
7090			case BWN_LPD(0, 1, 1):
7091				return (0x0fb2);
7092			case BWN_LPD(0, 0, 1):
7093				return (0x00b2);
7094			case BWN_LPD(1, 0, 1):
7095				return (0x30b2);
7096			case BWN_LPD(1, 0, 0):
7097				return (0x30b3);
7098			}
7099			KASSERT(0 == 1,
7100			    ("%s:%d: fail", __func__, __LINE__));
7101		}
7102		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
7103	} else {
7104		if (reg == BWN_PHY_RFOVER) {
7105			return (0x9b3);
7106		} else if (reg == BWN_PHY_RFOVERVAL) {
7107			switch (lpd) {
7108			case BWN_LPD(0, 1, 1):
7109				return (0x8fb2);
7110			case BWN_LPD(0, 0, 1):
7111				return (0x80b2);
7112			case BWN_LPD(1, 0, 1):
7113				return (0x20b2);
7114			case BWN_LPD(1, 0, 0):
7115				return (0x20b3);
7116			}
7117			KASSERT(0 == 1,
7118			    ("%s:%d: fail", __func__, __LINE__));
7119		}
7120		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
7121	}
7122	return (0);
7123}
7124
7125static void
7126bwn_spu_workaround(struct bwn_mac *mac, uint8_t channel)
7127{
7128
7129	if (mac->mac_phy.rf_ver != 0x2050 || mac->mac_phy.rf_rev >= 6)
7130		return;
7131	BWN_WRITE_2(mac, BWN_CHANNEL, (channel <= 10) ?
7132	    bwn_phy_g_chan2freq(channel + 4) : bwn_phy_g_chan2freq(1));
7133	DELAY(1000);
7134	BWN_WRITE_2(mac, BWN_CHANNEL, bwn_phy_g_chan2freq(channel));
7135}
7136
7137static int
7138bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
7139{
7140	struct bwn_softc *sc = mac->mac_sc;
7141	struct bwn_fw *fw = &mac->mac_fw;
7142	const uint8_t rev = siba_get_revid(sc->sc_dev);
7143	const char *filename;
7144	uint32_t high;
7145	int error;
7146
7147	/* microcode */
7148	if (rev >= 5 && rev <= 10)
7149		filename = "ucode5";
7150	else if (rev >= 11 && rev <= 12)
7151		filename = "ucode11";
7152	else if (rev == 13)
7153		filename = "ucode13";
7154	else if (rev == 14)
7155		filename = "ucode14";
7156	else if (rev >= 15)
7157		filename = "ucode15";
7158	else {
7159		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
7160		bwn_release_firmware(mac);
7161		return (EOPNOTSUPP);
7162	}
7163	error = bwn_fw_get(mac, type, filename, &fw->ucode);
7164	if (error) {
7165		bwn_release_firmware(mac);
7166		return (error);
7167	}
7168
7169	/* PCM */
7170	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
7171	if (rev >= 5 && rev <= 10) {
7172		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
7173		if (error == ENOENT)
7174			fw->no_pcmfile = 1;
7175		else if (error) {
7176			bwn_release_firmware(mac);
7177			return (error);
7178		}
7179	} else if (rev < 11) {
7180		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
7181		return (EOPNOTSUPP);
7182	}
7183
7184	/* initvals */
7185	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
7186	switch (mac->mac_phy.type) {
7187	case BWN_PHYTYPE_A:
7188		if (rev < 5 || rev > 10)
7189			goto fail1;
7190		if (high & BWN_TGSHIGH_HAVE_2GHZ)
7191			filename = "a0g1initvals5";
7192		else
7193			filename = "a0g0initvals5";
7194		break;
7195	case BWN_PHYTYPE_G:
7196		if (rev >= 5 && rev <= 10)
7197			filename = "b0g0initvals5";
7198		else if (rev >= 13)
7199			filename = "b0g0initvals13";
7200		else
7201			goto fail1;
7202		break;
7203	case BWN_PHYTYPE_LP:
7204		if (rev == 13)
7205			filename = "lp0initvals13";
7206		else if (rev == 14)
7207			filename = "lp0initvals14";
7208		else if (rev >= 15)
7209			filename = "lp0initvals15";
7210		else
7211			goto fail1;
7212		break;
7213	case BWN_PHYTYPE_N:
7214		if (rev >= 11 && rev <= 12)
7215			filename = "n0initvals11";
7216		else
7217			goto fail1;
7218		break;
7219	default:
7220		goto fail1;
7221	}
7222	error = bwn_fw_get(mac, type, filename, &fw->initvals);
7223	if (error) {
7224		bwn_release_firmware(mac);
7225		return (error);
7226	}
7227
7228	/* bandswitch initvals */
7229	switch (mac->mac_phy.type) {
7230	case BWN_PHYTYPE_A:
7231		if (rev >= 5 && rev <= 10) {
7232			if (high & BWN_TGSHIGH_HAVE_2GHZ)
7233				filename = "a0g1bsinitvals5";
7234			else
7235				filename = "a0g0bsinitvals5";
7236		} else if (rev >= 11)
7237			filename = NULL;
7238		else
7239			goto fail1;
7240		break;
7241	case BWN_PHYTYPE_G:
7242		if (rev >= 5 && rev <= 10)
7243			filename = "b0g0bsinitvals5";
7244		else if (rev >= 11)
7245			filename = NULL;
7246		else
7247			goto fail1;
7248		break;
7249	case BWN_PHYTYPE_LP:
7250		if (rev == 13)
7251			filename = "lp0bsinitvals13";
7252		else if (rev == 14)
7253			filename = "lp0bsinitvals14";
7254		else if (rev >= 15)
7255			filename = "lp0bsinitvals15";
7256		else
7257			goto fail1;
7258		break;
7259	case BWN_PHYTYPE_N:
7260		if (rev >= 11 && rev <= 12)
7261			filename = "n0bsinitvals11";
7262		else
7263			goto fail1;
7264		break;
7265	default:
7266		goto fail1;
7267	}
7268	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
7269	if (error) {
7270		bwn_release_firmware(mac);
7271		return (error);
7272	}
7273	return (0);
7274fail1:
7275	device_printf(sc->sc_dev, "no INITVALS for rev %d\n", rev);
7276	bwn_release_firmware(mac);
7277	return (EOPNOTSUPP);
7278}
7279
7280static int
7281bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
7282    const char *name, struct bwn_fwfile *bfw)
7283{
7284	const struct bwn_fwhdr *hdr;
7285	struct bwn_softc *sc = mac->mac_sc;
7286	const struct firmware *fw;
7287	char namebuf[64];
7288
7289	if (name == NULL) {
7290		bwn_do_release_fw(bfw);
7291		return (0);
7292	}
7293	if (bfw->filename != NULL) {
7294		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
7295			return (0);
7296		bwn_do_release_fw(bfw);
7297	}
7298
7299	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
7300	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
7301	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
7302	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
7303	fw = firmware_get(namebuf);
7304	if (fw == NULL) {
7305		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
7306		    namebuf);
7307		return (ENOENT);
7308	}
7309	if (fw->datasize < sizeof(struct bwn_fwhdr))
7310		goto fail;
7311	hdr = (const struct bwn_fwhdr *)(fw->data);
7312	switch (hdr->type) {
7313	case BWN_FWTYPE_UCODE:
7314	case BWN_FWTYPE_PCM:
7315		if (be32toh(hdr->size) !=
7316		    (fw->datasize - sizeof(struct bwn_fwhdr)))
7317			goto fail;
7318		/* FALLTHROUGH */
7319	case BWN_FWTYPE_IV:
7320		if (hdr->ver != 1)
7321			goto fail;
7322		break;
7323	default:
7324		goto fail;
7325	}
7326	bfw->filename = name;
7327	bfw->fw = fw;
7328	bfw->type = type;
7329	return (0);
7330fail:
7331	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
7332	if (fw != NULL)
7333		firmware_put(fw, FIRMWARE_UNLOAD);
7334	return (EPROTO);
7335}
7336
7337static void
7338bwn_release_firmware(struct bwn_mac *mac)
7339{
7340
7341	bwn_do_release_fw(&mac->mac_fw.ucode);
7342	bwn_do_release_fw(&mac->mac_fw.pcm);
7343	bwn_do_release_fw(&mac->mac_fw.initvals);
7344	bwn_do_release_fw(&mac->mac_fw.initvals_band);
7345}
7346
7347static void
7348bwn_do_release_fw(struct bwn_fwfile *bfw)
7349{
7350
7351	if (bfw->fw != NULL)
7352		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
7353	bfw->fw = NULL;
7354	bfw->filename = NULL;
7355}
7356
7357static int
7358bwn_fw_loaducode(struct bwn_mac *mac)
7359{
7360#define	GETFWOFFSET(fwp, offset)	\
7361	((const uint32_t *)((const char *)fwp.fw->data + offset))
7362#define	GETFWSIZE(fwp, offset)	\
7363	((fwp.fw->datasize - offset) / sizeof(uint32_t))
7364	struct bwn_softc *sc = mac->mac_sc;
7365	const uint32_t *data;
7366	unsigned int i;
7367	uint32_t ctl;
7368	uint16_t date, fwcaps, time;
7369	int error = 0;
7370
7371	ctl = BWN_READ_4(mac, BWN_MACCTL);
7372	ctl |= BWN_MACCTL_MCODE_JMP0;
7373	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
7374	    __LINE__));
7375	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
7376	for (i = 0; i < 64; i++)
7377		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
7378	for (i = 0; i < 4096; i += 2)
7379		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
7380
7381	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
7382	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
7383	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
7384	     i++) {
7385		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
7386		DELAY(10);
7387	}
7388
7389	if (mac->mac_fw.pcm.fw) {
7390		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
7391		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
7392		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
7393		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
7394		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
7395		    sizeof(struct bwn_fwhdr)); i++) {
7396			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
7397			DELAY(10);
7398		}
7399	}
7400
7401	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
7402	BWN_WRITE_4(mac, BWN_MACCTL,
7403	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
7404	    BWN_MACCTL_MCODE_RUN);
7405
7406	for (i = 0; i < 21; i++) {
7407		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
7408			break;
7409		if (i >= 20) {
7410			device_printf(sc->sc_dev, "ucode timeout\n");
7411			error = ENXIO;
7412			goto error;
7413		}
7414		DELAY(50000);
7415	}
7416	BWN_READ_4(mac, BWN_INTR_REASON);
7417
7418	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
7419	if (mac->mac_fw.rev <= 0x128) {
7420		device_printf(sc->sc_dev, "the firmware is too old\n");
7421		error = EOPNOTSUPP;
7422		goto error;
7423	}
7424	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
7425	    BWN_SHARED_UCODE_PATCH);
7426	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
7427	mac->mac_fw.opensource = (date == 0xffff);
7428	if (bwn_wme != 0)
7429		mac->mac_flags |= BWN_MAC_FLAG_WME;
7430	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
7431
7432	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
7433	if (mac->mac_fw.opensource == 0) {
7434		device_printf(sc->sc_dev,
7435		    "firmware version (rev %u patch %u date %#x time %#x)\n",
7436		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
7437		if (mac->mac_fw.no_pcmfile)
7438			device_printf(sc->sc_dev,
7439			    "no HW crypto acceleration due to pcm5\n");
7440	} else {
7441		mac->mac_fw.patch = time;
7442		fwcaps = bwn_fwcaps_read(mac);
7443		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
7444			device_printf(sc->sc_dev,
7445			    "disabling HW crypto acceleration\n");
7446			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
7447		}
7448		if (!(fwcaps & BWN_FWCAPS_WME)) {
7449			device_printf(sc->sc_dev, "disabling WME support\n");
7450			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
7451		}
7452	}
7453
7454	if (BWN_ISOLDFMT(mac))
7455		device_printf(sc->sc_dev, "using old firmware image\n");
7456
7457	return (0);
7458
7459error:
7460	BWN_WRITE_4(mac, BWN_MACCTL,
7461	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
7462	    BWN_MACCTL_MCODE_JMP0);
7463
7464	return (error);
7465#undef GETFWSIZE
7466#undef GETFWOFFSET
7467}
7468
7469/* OpenFirmware only */
7470static uint16_t
7471bwn_fwcaps_read(struct bwn_mac *mac)
7472{
7473
7474	KASSERT(mac->mac_fw.opensource == 1,
7475	    ("%s:%d: fail", __func__, __LINE__));
7476	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
7477}
7478
7479static int
7480bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
7481    size_t count, size_t array_size)
7482{
7483#define	GET_NEXTIV16(iv)						\
7484	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
7485	    sizeof(uint16_t) + sizeof(uint16_t)))
7486#define	GET_NEXTIV32(iv)						\
7487	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
7488	    sizeof(uint16_t) + sizeof(uint32_t)))
7489	struct bwn_softc *sc = mac->mac_sc;
7490	const struct bwn_fwinitvals *iv;
7491	uint16_t offset;
7492	size_t i;
7493	uint8_t bit32;
7494
7495	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
7496	    ("%s:%d: fail", __func__, __LINE__));
7497	iv = ivals;
7498	for (i = 0; i < count; i++) {
7499		if (array_size < sizeof(iv->offset_size))
7500			goto fail;
7501		array_size -= sizeof(iv->offset_size);
7502		offset = be16toh(iv->offset_size);
7503		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
7504		offset &= BWN_FWINITVALS_OFFSET_MASK;
7505		if (offset >= 0x1000)
7506			goto fail;
7507		if (bit32) {
7508			if (array_size < sizeof(iv->data.d32))
7509				goto fail;
7510			array_size -= sizeof(iv->data.d32);
7511			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
7512			iv = GET_NEXTIV32(iv);
7513		} else {
7514
7515			if (array_size < sizeof(iv->data.d16))
7516				goto fail;
7517			array_size -= sizeof(iv->data.d16);
7518			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
7519
7520			iv = GET_NEXTIV16(iv);
7521		}
7522	}
7523	if (array_size != 0)
7524		goto fail;
7525	return (0);
7526fail:
7527	device_printf(sc->sc_dev, "initvals: invalid format\n");
7528	return (EPROTO);
7529#undef GET_NEXTIV16
7530#undef GET_NEXTIV32
7531}
7532
7533static int
7534bwn_switch_channel(struct bwn_mac *mac, int chan)
7535{
7536	struct bwn_phy *phy = &(mac->mac_phy);
7537	struct bwn_softc *sc = mac->mac_sc;
7538	struct ieee80211com *ic = &sc->sc_ic;
7539	uint16_t channelcookie, savedcookie;
7540	int error;
7541
7542	if (chan == 0xffff)
7543		chan = phy->get_default_chan(mac);
7544
7545	channelcookie = chan;
7546	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
7547		channelcookie |= 0x100;
7548	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
7549	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
7550	error = phy->switch_channel(mac, chan);
7551	if (error)
7552		goto fail;
7553
7554	mac->mac_phy.chan = chan;
7555	DELAY(8000);
7556	return (0);
7557fail:
7558	device_printf(sc->sc_dev, "failed to switch channel\n");
7559	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
7560	return (error);
7561}
7562
7563static uint16_t
7564bwn_ant2phy(int antenna)
7565{
7566
7567	switch (antenna) {
7568	case BWN_ANT0:
7569		return (BWN_TX_PHY_ANT0);
7570	case BWN_ANT1:
7571		return (BWN_TX_PHY_ANT1);
7572	case BWN_ANT2:
7573		return (BWN_TX_PHY_ANT2);
7574	case BWN_ANT3:
7575		return (BWN_TX_PHY_ANT3);
7576	case BWN_ANTAUTO:
7577		return (BWN_TX_PHY_ANT01AUTO);
7578	}
7579	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
7580	return (0);
7581}
7582
7583static void
7584bwn_wme_load(struct bwn_mac *mac)
7585{
7586	struct bwn_softc *sc = mac->mac_sc;
7587	int i;
7588
7589	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
7590	    ("%s:%d: fail", __func__, __LINE__));
7591
7592	bwn_mac_suspend(mac);
7593	for (i = 0; i < N(sc->sc_wmeParams); i++)
7594		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
7595		    bwn_wme_shm_offsets[i]);
7596	bwn_mac_enable(mac);
7597}
7598
7599static void
7600bwn_wme_loadparams(struct bwn_mac *mac,
7601    const struct wmeParams *p, uint16_t shm_offset)
7602{
7603#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
7604	struct bwn_softc *sc = mac->mac_sc;
7605	uint16_t params[BWN_NR_WMEPARAMS];
7606	int slot, tmp;
7607	unsigned int i;
7608
7609	slot = BWN_READ_2(mac, BWN_RNG) &
7610	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
7611
7612	memset(&params, 0, sizeof(params));
7613
7614	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
7615	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
7616	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
7617
7618	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
7619	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
7620	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
7621	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
7622	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
7623	params[BWN_WMEPARAM_BSLOTS] = slot;
7624	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
7625
7626	for (i = 0; i < N(params); i++) {
7627		if (i == BWN_WMEPARAM_STATUS) {
7628			tmp = bwn_shm_read_2(mac, BWN_SHARED,
7629			    shm_offset + (i * 2));
7630			tmp |= 0x100;
7631			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
7632			    tmp);
7633		} else {
7634			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
7635			    params[i]);
7636		}
7637	}
7638}
7639
7640static void
7641bwn_mac_write_bssid(struct bwn_mac *mac)
7642{
7643	struct bwn_softc *sc = mac->mac_sc;
7644	uint32_t tmp;
7645	int i;
7646	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
7647
7648	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
7649	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
7650	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
7651	    IEEE80211_ADDR_LEN);
7652
7653	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
7654		tmp = (uint32_t) (mac_bssid[i + 0]);
7655		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
7656		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
7657		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
7658		bwn_ram_write(mac, 0x20 + i, tmp);
7659	}
7660}
7661
7662static void
7663bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
7664    const uint8_t *macaddr)
7665{
7666	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
7667	uint16_t data;
7668
7669	if (!mac)
7670		macaddr = zero;
7671
7672	offset |= 0x0020;
7673	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
7674
7675	data = macaddr[0];
7676	data |= macaddr[1] << 8;
7677	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
7678	data = macaddr[2];
7679	data |= macaddr[3] << 8;
7680	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
7681	data = macaddr[4];
7682	data |= macaddr[5] << 8;
7683	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
7684}
7685
7686static void
7687bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
7688    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
7689{
7690	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
7691	uint8_t per_sta_keys_start = 8;
7692
7693	if (BWN_SEC_NEWAPI(mac))
7694		per_sta_keys_start = 4;
7695
7696	KASSERT(index < mac->mac_max_nr_keys,
7697	    ("%s:%d: fail", __func__, __LINE__));
7698	KASSERT(key_len <= BWN_SEC_KEYSIZE,
7699	    ("%s:%d: fail", __func__, __LINE__));
7700
7701	if (index >= per_sta_keys_start)
7702		bwn_key_macwrite(mac, index, NULL);
7703	if (key)
7704		memcpy(buf, key, key_len);
7705	bwn_key_write(mac, index, algorithm, buf);
7706	if (index >= per_sta_keys_start)
7707		bwn_key_macwrite(mac, index, mac_addr);
7708
7709	mac->mac_key[index].algorithm = algorithm;
7710}
7711
7712static void
7713bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
7714{
7715	struct bwn_softc *sc = mac->mac_sc;
7716	uint32_t addrtmp[2] = { 0, 0 };
7717	uint8_t start = 8;
7718
7719	if (BWN_SEC_NEWAPI(mac))
7720		start = 4;
7721
7722	KASSERT(index >= start,
7723	    ("%s:%d: fail", __func__, __LINE__));
7724	index -= start;
7725
7726	if (addr) {
7727		addrtmp[0] = addr[0];
7728		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
7729		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
7730		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
7731		addrtmp[1] = addr[4];
7732		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
7733	}
7734
7735	if (siba_get_revid(sc->sc_dev) >= 5) {
7736		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
7737		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
7738	} else {
7739		if (index >= 8) {
7740			bwn_shm_write_4(mac, BWN_SHARED,
7741			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
7742			bwn_shm_write_2(mac, BWN_SHARED,
7743			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
7744		}
7745	}
7746}
7747
7748static void
7749bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
7750    const uint8_t *key)
7751{
7752	unsigned int i;
7753	uint32_t offset;
7754	uint16_t kidx, value;
7755
7756	kidx = BWN_SEC_KEY2FW(mac, index);
7757	bwn_shm_write_2(mac, BWN_SHARED,
7758	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
7759
7760	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
7761	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
7762		value = key[i];
7763		value |= (uint16_t)(key[i + 1]) << 8;
7764		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
7765	}
7766}
7767
7768static void
7769bwn_phy_exit(struct bwn_mac *mac)
7770{
7771
7772	mac->mac_phy.rf_onoff(mac, 0);
7773	if (mac->mac_phy.exit != NULL)
7774		mac->mac_phy.exit(mac);
7775}
7776
7777static void
7778bwn_dma_free(struct bwn_mac *mac)
7779{
7780	struct bwn_dma *dma;
7781
7782	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7783		return;
7784	dma = &mac->mac_method.dma;
7785
7786	bwn_dma_ringfree(&dma->rx);
7787	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7788	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7789	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7790	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7791	bwn_dma_ringfree(&dma->mcast);
7792}
7793
7794static void
7795bwn_core_stop(struct bwn_mac *mac)
7796{
7797	struct bwn_softc *sc = mac->mac_sc;
7798
7799	BWN_ASSERT_LOCKED(sc);
7800
7801	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
7802		return;
7803
7804	callout_stop(&sc->sc_rfswitch_ch);
7805	callout_stop(&sc->sc_task_ch);
7806	callout_stop(&sc->sc_watchdog_ch);
7807	sc->sc_watchdog_timer = 0;
7808	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
7809	BWN_READ_4(mac, BWN_INTR_MASK);
7810	bwn_mac_suspend(mac);
7811
7812	mac->mac_status = BWN_MAC_STATUS_INITED;
7813}
7814
7815static int
7816bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
7817{
7818	struct bwn_mac *up_dev = NULL;
7819	struct bwn_mac *down_dev;
7820	struct bwn_mac *mac;
7821	int err, status;
7822	uint8_t gmode;
7823
7824	BWN_ASSERT_LOCKED(sc);
7825
7826	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
7827		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
7828		    mac->mac_phy.supports_2ghz) {
7829			up_dev = mac;
7830			gmode = 1;
7831		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
7832		    mac->mac_phy.supports_5ghz) {
7833			up_dev = mac;
7834			gmode = 0;
7835		} else {
7836			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
7837			return (EINVAL);
7838		}
7839		if (up_dev != NULL)
7840			break;
7841	}
7842	if (up_dev == NULL) {
7843		device_printf(sc->sc_dev, "Could not find a device\n");
7844		return (ENODEV);
7845	}
7846	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
7847		return (0);
7848
7849	device_printf(sc->sc_dev, "switching to %s-GHz band\n",
7850	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
7851
7852	down_dev = sc->sc_curmac;
7853	status = down_dev->mac_status;
7854	if (status >= BWN_MAC_STATUS_STARTED)
7855		bwn_core_stop(down_dev);
7856	if (status >= BWN_MAC_STATUS_INITED)
7857		bwn_core_exit(down_dev);
7858
7859	if (down_dev != up_dev)
7860		bwn_phy_reset(down_dev);
7861
7862	up_dev->mac_phy.gmode = gmode;
7863	if (status >= BWN_MAC_STATUS_INITED) {
7864		err = bwn_core_init(up_dev);
7865		if (err) {
7866			device_printf(sc->sc_dev,
7867			    "fatal: failed to initialize for %s-GHz\n",
7868			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
7869			goto fail;
7870		}
7871	}
7872	if (status >= BWN_MAC_STATUS_STARTED)
7873		bwn_core_start(up_dev);
7874	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
7875	sc->sc_curmac = up_dev;
7876
7877	return (0);
7878fail:
7879	sc->sc_curmac = NULL;
7880	return (err);
7881}
7882
7883static void
7884bwn_rf_turnon(struct bwn_mac *mac)
7885{
7886
7887	bwn_mac_suspend(mac);
7888	mac->mac_phy.rf_onoff(mac, 1);
7889	mac->mac_phy.rf_on = 1;
7890	bwn_mac_enable(mac);
7891}
7892
7893static void
7894bwn_rf_turnoff(struct bwn_mac *mac)
7895{
7896
7897	bwn_mac_suspend(mac);
7898	mac->mac_phy.rf_onoff(mac, 0);
7899	mac->mac_phy.rf_on = 0;
7900	bwn_mac_enable(mac);
7901}
7902
7903static void
7904bwn_phy_reset(struct bwn_mac *mac)
7905{
7906	struct bwn_softc *sc = mac->mac_sc;
7907
7908	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
7909	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
7910	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
7911	DELAY(1000);
7912	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
7913	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC) |
7914	    BWN_TGSLOW_PHYRESET);
7915	DELAY(1000);
7916}
7917
7918static int
7919bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
7920{
7921	struct bwn_vap *bvp = BWN_VAP(vap);
7922	struct ieee80211com *ic= vap->iv_ic;
7923	enum ieee80211_state ostate = vap->iv_state;
7924	struct bwn_softc *sc = ic->ic_softc;
7925	struct bwn_mac *mac = sc->sc_curmac;
7926	int error;
7927
7928	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
7929	    ieee80211_state_name[vap->iv_state],
7930	    ieee80211_state_name[nstate]);
7931
7932	error = bvp->bv_newstate(vap, nstate, arg);
7933	if (error != 0)
7934		return (error);
7935
7936	BWN_LOCK(sc);
7937
7938	bwn_led_newstate(mac, nstate);
7939
7940	/*
7941	 * Clear the BSSID when we stop a STA
7942	 */
7943	if (vap->iv_opmode == IEEE80211_M_STA) {
7944		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
7945			/*
7946			 * Clear out the BSSID.  If we reassociate to
7947			 * the same AP, this will reinialize things
7948			 * correctly...
7949			 */
7950			if (ic->ic_opmode == IEEE80211_M_STA &&
7951			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
7952				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
7953				bwn_set_macaddr(mac);
7954			}
7955		}
7956	}
7957
7958	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
7959	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
7960		/* XXX nothing to do? */
7961	} else if (nstate == IEEE80211_S_RUN) {
7962		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
7963		bwn_set_opmode(mac);
7964		bwn_set_pretbtt(mac);
7965		bwn_spu_setdelay(mac, 0);
7966		bwn_set_macaddr(mac);
7967	}
7968
7969	BWN_UNLOCK(sc);
7970
7971	return (error);
7972}
7973
7974static void
7975bwn_set_pretbtt(struct bwn_mac *mac)
7976{
7977	struct bwn_softc *sc = mac->mac_sc;
7978	struct ieee80211com *ic = &sc->sc_ic;
7979	uint16_t pretbtt;
7980
7981	if (ic->ic_opmode == IEEE80211_M_IBSS)
7982		pretbtt = 2;
7983	else
7984		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
7985	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
7986	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
7987}
7988
7989static int
7990bwn_intr(void *arg)
7991{
7992	struct bwn_mac *mac = arg;
7993	struct bwn_softc *sc = mac->mac_sc;
7994	uint32_t reason;
7995
7996	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
7997	    (sc->sc_flags & BWN_FLAG_INVALID))
7998		return (FILTER_STRAY);
7999
8000	reason = BWN_READ_4(mac, BWN_INTR_REASON);
8001	if (reason == 0xffffffff)	/* shared IRQ */
8002		return (FILTER_STRAY);
8003	reason &= mac->mac_intr_mask;
8004	if (reason == 0)
8005		return (FILTER_HANDLED);
8006
8007	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
8008	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
8009	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
8010	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
8011	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
8012	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
8013	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
8014	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
8015	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
8016	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
8017	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
8018
8019	/* Disable interrupts. */
8020	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
8021
8022	mac->mac_reason_intr = reason;
8023
8024	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
8025	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
8026
8027	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
8028	return (FILTER_HANDLED);
8029}
8030
8031static void
8032bwn_intrtask(void *arg, int npending)
8033{
8034	struct bwn_mac *mac = arg;
8035	struct bwn_softc *sc = mac->mac_sc;
8036	uint32_t merged = 0;
8037	int i, tx = 0, rx = 0;
8038
8039	BWN_LOCK(sc);
8040	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
8041	    (sc->sc_flags & BWN_FLAG_INVALID)) {
8042		BWN_UNLOCK(sc);
8043		return;
8044	}
8045
8046	for (i = 0; i < N(mac->mac_reason); i++)
8047		merged |= mac->mac_reason[i];
8048
8049	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
8050		device_printf(sc->sc_dev, "MAC trans error\n");
8051
8052	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
8053		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
8054		mac->mac_phy.txerrors--;
8055		if (mac->mac_phy.txerrors == 0) {
8056			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
8057			bwn_restart(mac, "PHY TX errors");
8058		}
8059	}
8060
8061	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
8062		if (merged & BWN_DMAINTR_FATALMASK) {
8063			device_printf(sc->sc_dev,
8064			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
8065			    mac->mac_reason[0], mac->mac_reason[1],
8066			    mac->mac_reason[2], mac->mac_reason[3],
8067			    mac->mac_reason[4], mac->mac_reason[5]);
8068			bwn_restart(mac, "DMA error");
8069			BWN_UNLOCK(sc);
8070			return;
8071		}
8072		if (merged & BWN_DMAINTR_NONFATALMASK) {
8073			device_printf(sc->sc_dev,
8074			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
8075			    mac->mac_reason[0], mac->mac_reason[1],
8076			    mac->mac_reason[2], mac->mac_reason[3],
8077			    mac->mac_reason[4], mac->mac_reason[5]);
8078		}
8079	}
8080
8081	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
8082		bwn_intr_ucode_debug(mac);
8083	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
8084		bwn_intr_tbtt_indication(mac);
8085	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
8086		bwn_intr_atim_end(mac);
8087	if (mac->mac_reason_intr & BWN_INTR_BEACON)
8088		bwn_intr_beacon(mac);
8089	if (mac->mac_reason_intr & BWN_INTR_PMQ)
8090		bwn_intr_pmq(mac);
8091	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
8092		bwn_intr_noise(mac);
8093
8094	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
8095		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
8096			bwn_dma_rx(mac->mac_method.dma.rx);
8097			rx = 1;
8098		}
8099	} else
8100		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
8101
8102	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
8103	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
8104	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
8105	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
8106	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
8107
8108	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
8109		bwn_intr_txeof(mac);
8110		tx = 1;
8111	}
8112
8113	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
8114
8115	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
8116		int evt = BWN_LED_EVENT_NONE;
8117
8118		if (tx && rx) {
8119			if (sc->sc_rx_rate > sc->sc_tx_rate)
8120				evt = BWN_LED_EVENT_RX;
8121			else
8122				evt = BWN_LED_EVENT_TX;
8123		} else if (tx) {
8124			evt = BWN_LED_EVENT_TX;
8125		} else if (rx) {
8126			evt = BWN_LED_EVENT_RX;
8127		} else if (rx == 0) {
8128			evt = BWN_LED_EVENT_POLL;
8129		}
8130
8131		if (evt != BWN_LED_EVENT_NONE)
8132			bwn_led_event(mac, evt);
8133       }
8134
8135	if (mbufq_first(&sc->sc_snd) != NULL)
8136		bwn_start(sc);
8137
8138	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
8139	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
8140
8141	BWN_UNLOCK(sc);
8142}
8143
8144static void
8145bwn_restart(struct bwn_mac *mac, const char *msg)
8146{
8147	struct bwn_softc *sc = mac->mac_sc;
8148	struct ieee80211com *ic = &sc->sc_ic;
8149
8150	if (mac->mac_status < BWN_MAC_STATUS_INITED)
8151		return;
8152
8153	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
8154	ieee80211_runtask(ic, &mac->mac_hwreset);
8155}
8156
8157static void
8158bwn_intr_ucode_debug(struct bwn_mac *mac)
8159{
8160	struct bwn_softc *sc = mac->mac_sc;
8161	uint16_t reason;
8162
8163	if (mac->mac_fw.opensource == 0)
8164		return;
8165
8166	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
8167	switch (reason) {
8168	case BWN_DEBUGINTR_PANIC:
8169		bwn_handle_fwpanic(mac);
8170		break;
8171	case BWN_DEBUGINTR_DUMP_SHM:
8172		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
8173		break;
8174	case BWN_DEBUGINTR_DUMP_REGS:
8175		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
8176		break;
8177	case BWN_DEBUGINTR_MARKER:
8178		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
8179		break;
8180	default:
8181		device_printf(sc->sc_dev,
8182		    "ucode debug unknown reason: %#x\n", reason);
8183	}
8184
8185	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
8186	    BWN_DEBUGINTR_ACK);
8187}
8188
8189static void
8190bwn_intr_tbtt_indication(struct bwn_mac *mac)
8191{
8192	struct bwn_softc *sc = mac->mac_sc;
8193	struct ieee80211com *ic = &sc->sc_ic;
8194
8195	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
8196		bwn_psctl(mac, 0);
8197	if (ic->ic_opmode == IEEE80211_M_IBSS)
8198		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
8199}
8200
8201static void
8202bwn_intr_atim_end(struct bwn_mac *mac)
8203{
8204
8205	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
8206		BWN_WRITE_4(mac, BWN_MACCMD,
8207		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
8208		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
8209	}
8210}
8211
8212static void
8213bwn_intr_beacon(struct bwn_mac *mac)
8214{
8215	struct bwn_softc *sc = mac->mac_sc;
8216	struct ieee80211com *ic = &sc->sc_ic;
8217	uint32_t cmd, beacon0, beacon1;
8218
8219	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
8220	    ic->ic_opmode == IEEE80211_M_MBSS)
8221		return;
8222
8223	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
8224
8225	cmd = BWN_READ_4(mac, BWN_MACCMD);
8226	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
8227	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
8228
8229	if (beacon0 && beacon1) {
8230		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
8231		mac->mac_intr_mask |= BWN_INTR_BEACON;
8232		return;
8233	}
8234
8235	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
8236		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
8237		bwn_load_beacon0(mac);
8238		bwn_load_beacon1(mac);
8239		cmd = BWN_READ_4(mac, BWN_MACCMD);
8240		cmd |= BWN_MACCMD_BEACON0_VALID;
8241		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
8242	} else {
8243		if (!beacon0) {
8244			bwn_load_beacon0(mac);
8245			cmd = BWN_READ_4(mac, BWN_MACCMD);
8246			cmd |= BWN_MACCMD_BEACON0_VALID;
8247			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
8248		} else if (!beacon1) {
8249			bwn_load_beacon1(mac);
8250			cmd = BWN_READ_4(mac, BWN_MACCMD);
8251			cmd |= BWN_MACCMD_BEACON1_VALID;
8252			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
8253		}
8254	}
8255}
8256
8257static void
8258bwn_intr_pmq(struct bwn_mac *mac)
8259{
8260	uint32_t tmp;
8261
8262	while (1) {
8263		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
8264		if (!(tmp & 0x00000008))
8265			break;
8266	}
8267	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
8268}
8269
8270static void
8271bwn_intr_noise(struct bwn_mac *mac)
8272{
8273	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
8274	uint16_t tmp;
8275	uint8_t noise[4];
8276	uint8_t i, j;
8277	int32_t average;
8278
8279	if (mac->mac_phy.type != BWN_PHYTYPE_G)
8280		return;
8281
8282	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
8283	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
8284	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
8285	    noise[3] == 0x7f)
8286		goto new;
8287
8288	KASSERT(mac->mac_noise.noi_nsamples < 8,
8289	    ("%s:%d: fail", __func__, __LINE__));
8290	i = mac->mac_noise.noi_nsamples;
8291	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
8292	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
8293	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
8294	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
8295	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
8296	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
8297	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
8298	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
8299	mac->mac_noise.noi_nsamples++;
8300	if (mac->mac_noise.noi_nsamples == 8) {
8301		average = 0;
8302		for (i = 0; i < 8; i++) {
8303			for (j = 0; j < 4; j++)
8304				average += mac->mac_noise.noi_samples[i][j];
8305		}
8306		average = (((average / 32) * 125) + 64) / 128;
8307		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
8308		if (tmp >= 8)
8309			average += 2;
8310		else
8311			average -= 25;
8312		average -= (tmp == 8) ? 72 : 48;
8313
8314		mac->mac_stats.link_noise = average;
8315		mac->mac_noise.noi_running = 0;
8316		return;
8317	}
8318new:
8319	bwn_noise_gensample(mac);
8320}
8321
8322static int
8323bwn_pio_rx(struct bwn_pio_rxqueue *prq)
8324{
8325	struct bwn_mac *mac = prq->prq_mac;
8326	struct bwn_softc *sc = mac->mac_sc;
8327	unsigned int i;
8328
8329	BWN_ASSERT_LOCKED(sc);
8330
8331	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
8332		return (0);
8333
8334	for (i = 0; i < 5000; i++) {
8335		if (bwn_pio_rxeof(prq) == 0)
8336			break;
8337	}
8338	if (i >= 5000)
8339		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
8340	return ((i > 0) ? 1 : 0);
8341}
8342
8343static void
8344bwn_dma_rx(struct bwn_dma_ring *dr)
8345{
8346	int slot, curslot;
8347
8348	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
8349	curslot = dr->get_curslot(dr);
8350	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
8351	    ("%s:%d: fail", __func__, __LINE__));
8352
8353	slot = dr->dr_curslot;
8354	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
8355		bwn_dma_rxeof(dr, &slot);
8356
8357	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
8358	    BUS_DMASYNC_PREWRITE);
8359
8360	dr->set_curslot(dr, slot);
8361	dr->dr_curslot = slot;
8362}
8363
8364static void
8365bwn_intr_txeof(struct bwn_mac *mac)
8366{
8367	struct bwn_txstatus stat;
8368	uint32_t stat0, stat1;
8369	uint16_t tmp;
8370
8371	BWN_ASSERT_LOCKED(mac->mac_sc);
8372
8373	while (1) {
8374		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
8375		if (!(stat0 & 0x00000001))
8376			break;
8377		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
8378
8379		stat.cookie = (stat0 >> 16);
8380		stat.seq = (stat1 & 0x0000ffff);
8381		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
8382		tmp = (stat0 & 0x0000ffff);
8383		stat.framecnt = ((tmp & 0xf000) >> 12);
8384		stat.rtscnt = ((tmp & 0x0f00) >> 8);
8385		stat.sreason = ((tmp & 0x001c) >> 2);
8386		stat.pm = (tmp & 0x0080) ? 1 : 0;
8387		stat.im = (tmp & 0x0040) ? 1 : 0;
8388		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
8389		stat.ack = (tmp & 0x0002) ? 1 : 0;
8390
8391		bwn_handle_txeof(mac, &stat);
8392	}
8393}
8394
8395static void
8396bwn_hwreset(void *arg, int npending)
8397{
8398	struct bwn_mac *mac = arg;
8399	struct bwn_softc *sc = mac->mac_sc;
8400	int error = 0;
8401	int prev_status;
8402
8403	BWN_LOCK(sc);
8404
8405	prev_status = mac->mac_status;
8406	if (prev_status >= BWN_MAC_STATUS_STARTED)
8407		bwn_core_stop(mac);
8408	if (prev_status >= BWN_MAC_STATUS_INITED)
8409		bwn_core_exit(mac);
8410
8411	if (prev_status >= BWN_MAC_STATUS_INITED) {
8412		error = bwn_core_init(mac);
8413		if (error)
8414			goto out;
8415	}
8416	if (prev_status >= BWN_MAC_STATUS_STARTED)
8417		bwn_core_start(mac);
8418out:
8419	if (error) {
8420		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
8421		sc->sc_curmac = NULL;
8422	}
8423	BWN_UNLOCK(sc);
8424}
8425
8426static void
8427bwn_handle_fwpanic(struct bwn_mac *mac)
8428{
8429	struct bwn_softc *sc = mac->mac_sc;
8430	uint16_t reason;
8431
8432	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
8433	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
8434
8435	if (reason == BWN_FWPANIC_RESTART)
8436		bwn_restart(mac, "ucode panic");
8437}
8438
8439static void
8440bwn_load_beacon0(struct bwn_mac *mac)
8441{
8442
8443	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
8444}
8445
8446static void
8447bwn_load_beacon1(struct bwn_mac *mac)
8448{
8449
8450	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
8451}
8452
8453static uint32_t
8454bwn_jssi_read(struct bwn_mac *mac)
8455{
8456	uint32_t val = 0;
8457
8458	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
8459	val <<= 16;
8460	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
8461
8462	return (val);
8463}
8464
8465static void
8466bwn_noise_gensample(struct bwn_mac *mac)
8467{
8468	uint32_t jssi = 0x7f7f7f7f;
8469
8470	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
8471	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
8472	BWN_WRITE_4(mac, BWN_MACCMD,
8473	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
8474}
8475
8476static int
8477bwn_dma_freeslot(struct bwn_dma_ring *dr)
8478{
8479	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
8480
8481	return (dr->dr_numslots - dr->dr_usedslot);
8482}
8483
8484static int
8485bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
8486{
8487	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
8488
8489	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
8490	    ("%s:%d: fail", __func__, __LINE__));
8491	if (slot == dr->dr_numslots - 1)
8492		return (0);
8493	return (slot + 1);
8494}
8495
8496static void
8497bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
8498{
8499	struct bwn_mac *mac = dr->dr_mac;
8500	struct bwn_softc *sc = mac->mac_sc;
8501	struct bwn_dma *dma = &mac->mac_method.dma;
8502	struct bwn_dmadesc_generic *desc;
8503	struct bwn_dmadesc_meta *meta;
8504	struct bwn_rxhdr4 *rxhdr;
8505	struct mbuf *m;
8506	uint32_t macstat;
8507	int32_t tmp;
8508	int cnt = 0;
8509	uint16_t len;
8510
8511	dr->getdesc(dr, *slot, &desc, &meta);
8512
8513	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
8514	m = meta->mt_m;
8515
8516	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
8517		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
8518		return;
8519	}
8520
8521	rxhdr = mtod(m, struct bwn_rxhdr4 *);
8522	len = le16toh(rxhdr->frame_len);
8523	if (len <= 0) {
8524		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
8525		return;
8526	}
8527	if (bwn_dma_check_redzone(dr, m)) {
8528		device_printf(sc->sc_dev, "redzone error.\n");
8529		bwn_dma_set_redzone(dr, m);
8530		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
8531		    BUS_DMASYNC_PREWRITE);
8532		return;
8533	}
8534	if (len > dr->dr_rx_bufsize) {
8535		tmp = len;
8536		while (1) {
8537			dr->getdesc(dr, *slot, &desc, &meta);
8538			bwn_dma_set_redzone(dr, meta->mt_m);
8539			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
8540			    BUS_DMASYNC_PREWRITE);
8541			*slot = bwn_dma_nextslot(dr, *slot);
8542			cnt++;
8543			tmp -= dr->dr_rx_bufsize;
8544			if (tmp <= 0)
8545				break;
8546		}
8547		device_printf(sc->sc_dev, "too small buffer "
8548		       "(len %u buffer %u dropped %d)\n",
8549		       len, dr->dr_rx_bufsize, cnt);
8550		return;
8551	}
8552	macstat = le32toh(rxhdr->mac_status);
8553	if (macstat & BWN_RX_MAC_FCSERR) {
8554		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
8555			device_printf(sc->sc_dev, "RX drop\n");
8556			return;
8557		}
8558	}
8559
8560	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
8561	m_adj(m, dr->dr_frameoffset);
8562
8563	bwn_rxeof(dr->dr_mac, m, rxhdr);
8564}
8565
8566static void
8567bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
8568{
8569	struct bwn_dma_ring *dr;
8570	struct bwn_dmadesc_generic *desc;
8571	struct bwn_dmadesc_meta *meta;
8572	struct bwn_pio_txqueue *tq;
8573	struct bwn_pio_txpkt *tp = NULL;
8574	struct bwn_softc *sc = mac->mac_sc;
8575	struct bwn_stats *stats = &mac->mac_stats;
8576	struct ieee80211_node *ni;
8577	struct ieee80211vap *vap;
8578	int retrycnt = 0, slot;
8579
8580	BWN_ASSERT_LOCKED(mac->mac_sc);
8581
8582	if (status->im)
8583		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
8584	if (status->ampdu)
8585		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
8586	if (status->rtscnt) {
8587		if (status->rtscnt == 0xf)
8588			stats->rtsfail++;
8589		else
8590			stats->rts++;
8591	}
8592
8593	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
8594		if (status->ack) {
8595			dr = bwn_dma_parse_cookie(mac, status,
8596			    status->cookie, &slot);
8597			if (dr == NULL) {
8598				device_printf(sc->sc_dev,
8599				    "failed to parse cookie\n");
8600				return;
8601			}
8602			while (1) {
8603				dr->getdesc(dr, slot, &desc, &meta);
8604				if (meta->mt_islast) {
8605					ni = meta->mt_ni;
8606					vap = ni->ni_vap;
8607					ieee80211_ratectl_tx_complete(vap, ni,
8608					    status->ack ?
8609					      IEEE80211_RATECTL_TX_SUCCESS :
8610					      IEEE80211_RATECTL_TX_FAILURE,
8611					    &retrycnt, 0);
8612					break;
8613				}
8614				slot = bwn_dma_nextslot(dr, slot);
8615			}
8616		}
8617		bwn_dma_handle_txeof(mac, status);
8618	} else {
8619		if (status->ack) {
8620			tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
8621			if (tq == NULL) {
8622				device_printf(sc->sc_dev,
8623				    "failed to parse cookie\n");
8624				return;
8625			}
8626			ni = tp->tp_ni;
8627			vap = ni->ni_vap;
8628			ieee80211_ratectl_tx_complete(vap, ni,
8629			    status->ack ?
8630			      IEEE80211_RATECTL_TX_SUCCESS :
8631			      IEEE80211_RATECTL_TX_FAILURE,
8632			    &retrycnt, 0);
8633		}
8634		bwn_pio_handle_txeof(mac, status);
8635	}
8636
8637	bwn_phy_txpower_check(mac, 0);
8638}
8639
8640static uint8_t
8641bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
8642{
8643	struct bwn_mac *mac = prq->prq_mac;
8644	struct bwn_softc *sc = mac->mac_sc;
8645	struct bwn_rxhdr4 rxhdr;
8646	struct mbuf *m;
8647	uint32_t ctl32, macstat, v32;
8648	unsigned int i, padding;
8649	uint16_t ctl16, len, totlen, v16;
8650	unsigned char *mp;
8651	char *data;
8652
8653	memset(&rxhdr, 0, sizeof(rxhdr));
8654
8655	if (prq->prq_rev >= 8) {
8656		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
8657		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
8658			return (0);
8659		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
8660		    BWN_PIO8_RXCTL_FRAMEREADY);
8661		for (i = 0; i < 10; i++) {
8662			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
8663			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
8664				goto ready;
8665			DELAY(10);
8666		}
8667	} else {
8668		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
8669		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
8670			return (0);
8671		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
8672		    BWN_PIO_RXCTL_FRAMEREADY);
8673		for (i = 0; i < 10; i++) {
8674			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
8675			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
8676				goto ready;
8677			DELAY(10);
8678		}
8679	}
8680	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
8681	return (1);
8682ready:
8683	if (prq->prq_rev >= 8)
8684		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
8685		    prq->prq_base + BWN_PIO8_RXDATA);
8686	else
8687		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
8688		    prq->prq_base + BWN_PIO_RXDATA);
8689	len = le16toh(rxhdr.frame_len);
8690	if (len > 0x700) {
8691		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
8692		goto error;
8693	}
8694	if (len == 0) {
8695		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
8696		goto error;
8697	}
8698
8699	macstat = le32toh(rxhdr.mac_status);
8700	if (macstat & BWN_RX_MAC_FCSERR) {
8701		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
8702			device_printf(sc->sc_dev, "%s: FCS error", __func__);
8703			goto error;
8704		}
8705	}
8706
8707	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
8708	totlen = len + padding;
8709	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
8710	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
8711	if (m == NULL) {
8712		device_printf(sc->sc_dev, "%s: out of memory", __func__);
8713		goto error;
8714	}
8715	mp = mtod(m, unsigned char *);
8716	if (prq->prq_rev >= 8) {
8717		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
8718		    prq->prq_base + BWN_PIO8_RXDATA);
8719		if (totlen & 3) {
8720			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
8721			data = &(mp[totlen - 1]);
8722			switch (totlen & 3) {
8723			case 3:
8724				*data = (v32 >> 16);
8725				data--;
8726			case 2:
8727				*data = (v32 >> 8);
8728				data--;
8729			case 1:
8730				*data = v32;
8731			}
8732		}
8733	} else {
8734		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
8735		    prq->prq_base + BWN_PIO_RXDATA);
8736		if (totlen & 1) {
8737			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
8738			mp[totlen - 1] = v16;
8739		}
8740	}
8741
8742	m->m_len = m->m_pkthdr.len = totlen;
8743
8744	bwn_rxeof(prq->prq_mac, m, &rxhdr);
8745
8746	return (1);
8747error:
8748	if (prq->prq_rev >= 8)
8749		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
8750		    BWN_PIO8_RXCTL_DATAREADY);
8751	else
8752		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
8753	return (1);
8754}
8755
8756static int
8757bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
8758    struct bwn_dmadesc_meta *meta, int init)
8759{
8760	struct bwn_mac *mac = dr->dr_mac;
8761	struct bwn_dma *dma = &mac->mac_method.dma;
8762	struct bwn_rxhdr4 *hdr;
8763	bus_dmamap_t map;
8764	bus_addr_t paddr;
8765	struct mbuf *m;
8766	int error;
8767
8768	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
8769	if (m == NULL) {
8770		error = ENOBUFS;
8771
8772		/*
8773		 * If the NIC is up and running, we need to:
8774		 * - Clear RX buffer's header.
8775		 * - Restore RX descriptor settings.
8776		 */
8777		if (init)
8778			return (error);
8779		else
8780			goto back;
8781	}
8782	m->m_len = m->m_pkthdr.len = MCLBYTES;
8783
8784	bwn_dma_set_redzone(dr, m);
8785
8786	/*
8787	 * Try to load RX buf into temporary DMA map
8788	 */
8789	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
8790	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
8791	if (error) {
8792		m_freem(m);
8793
8794		/*
8795		 * See the comment above
8796		 */
8797		if (init)
8798			return (error);
8799		else
8800			goto back;
8801	}
8802
8803	if (!init)
8804		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
8805	meta->mt_m = m;
8806	meta->mt_paddr = paddr;
8807
8808	/*
8809	 * Swap RX buf's DMA map with the loaded temporary one
8810	 */
8811	map = meta->mt_dmap;
8812	meta->mt_dmap = dr->dr_spare_dmap;
8813	dr->dr_spare_dmap = map;
8814
8815back:
8816	/*
8817	 * Clear RX buf header
8818	 */
8819	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
8820	bzero(hdr, sizeof(*hdr));
8821	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
8822	    BUS_DMASYNC_PREWRITE);
8823
8824	/*
8825	 * Setup RX buf descriptor
8826	 */
8827	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
8828	    sizeof(*hdr), 0, 0, 0);
8829	return (error);
8830}
8831
8832static void
8833bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
8834		 bus_size_t mapsz __unused, int error)
8835{
8836
8837	if (!error) {
8838		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
8839		*((bus_addr_t *)arg) = seg->ds_addr;
8840	}
8841}
8842
8843static int
8844bwn_hwrate2ieeerate(int rate)
8845{
8846
8847	switch (rate) {
8848	case BWN_CCK_RATE_1MB:
8849		return (2);
8850	case BWN_CCK_RATE_2MB:
8851		return (4);
8852	case BWN_CCK_RATE_5MB:
8853		return (11);
8854	case BWN_CCK_RATE_11MB:
8855		return (22);
8856	case BWN_OFDM_RATE_6MB:
8857		return (12);
8858	case BWN_OFDM_RATE_9MB:
8859		return (18);
8860	case BWN_OFDM_RATE_12MB:
8861		return (24);
8862	case BWN_OFDM_RATE_18MB:
8863		return (36);
8864	case BWN_OFDM_RATE_24MB:
8865		return (48);
8866	case BWN_OFDM_RATE_36MB:
8867		return (72);
8868	case BWN_OFDM_RATE_48MB:
8869		return (96);
8870	case BWN_OFDM_RATE_54MB:
8871		return (108);
8872	default:
8873		printf("Ooops\n");
8874		return (0);
8875	}
8876}
8877
8878static void
8879bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
8880{
8881	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
8882	struct bwn_plcp6 *plcp;
8883	struct bwn_softc *sc = mac->mac_sc;
8884	struct ieee80211_frame_min *wh;
8885	struct ieee80211_node *ni;
8886	struct ieee80211com *ic = &sc->sc_ic;
8887	uint32_t macstat;
8888	int padding, rate, rssi = 0, noise = 0, type;
8889	uint16_t phytype, phystat0, phystat3, chanstat;
8890	unsigned char *mp = mtod(m, unsigned char *);
8891	static int rx_mac_dec_rpt = 0;
8892
8893	BWN_ASSERT_LOCKED(sc);
8894
8895	phystat0 = le16toh(rxhdr->phy_status0);
8896	phystat3 = le16toh(rxhdr->phy_status3);
8897	macstat = le32toh(rxhdr->mac_status);
8898	chanstat = le16toh(rxhdr->channel);
8899	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
8900
8901	if (macstat & BWN_RX_MAC_FCSERR)
8902		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
8903	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
8904		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
8905	if (macstat & BWN_RX_MAC_DECERR)
8906		goto drop;
8907
8908	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
8909	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
8910		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
8911		    m->m_pkthdr.len);
8912		goto drop;
8913	}
8914	plcp = (struct bwn_plcp6 *)(mp + padding);
8915	m_adj(m, sizeof(struct bwn_plcp6) + padding);
8916	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
8917		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
8918		    m->m_pkthdr.len);
8919		goto drop;
8920	}
8921	wh = mtod(m, struct ieee80211_frame_min *);
8922
8923	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
8924		device_printf(sc->sc_dev,
8925		    "RX decryption attempted (old %d keyidx %#x)\n",
8926		    BWN_ISOLDFMT(mac),
8927		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
8928
8929	/* XXX calculating RSSI & noise & antenna */
8930
8931	if (phystat0 & BWN_RX_PHYST0_OFDM)
8932		rate = bwn_plcp_get_ofdmrate(mac, plcp,
8933		    phytype == BWN_PHYTYPE_A);
8934	else
8935		rate = bwn_plcp_get_cckrate(mac, plcp);
8936	if (rate == -1) {
8937		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
8938			goto drop;
8939	}
8940	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
8941
8942	/* RX radio tap */
8943	if (ieee80211_radiotap_active(ic))
8944		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
8945	m_adj(m, -IEEE80211_CRC_LEN);
8946
8947	rssi = rxhdr->phy.abg.rssi;	/* XXX incorrect RSSI calculation? */
8948	noise = mac->mac_stats.link_noise;
8949
8950	BWN_UNLOCK(sc);
8951
8952	ni = ieee80211_find_rxnode(ic, wh);
8953	if (ni != NULL) {
8954		type = ieee80211_input(ni, m, rssi, noise);
8955		ieee80211_free_node(ni);
8956	} else
8957		type = ieee80211_input_all(ic, m, rssi, noise);
8958
8959	BWN_LOCK(sc);
8960	return;
8961drop:
8962	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
8963}
8964
8965static void
8966bwn_dma_handle_txeof(struct bwn_mac *mac,
8967    const struct bwn_txstatus *status)
8968{
8969	struct bwn_dma *dma = &mac->mac_method.dma;
8970	struct bwn_dma_ring *dr;
8971	struct bwn_dmadesc_generic *desc;
8972	struct bwn_dmadesc_meta *meta;
8973	struct bwn_softc *sc = mac->mac_sc;
8974	int slot;
8975
8976	BWN_ASSERT_LOCKED(sc);
8977
8978	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
8979	if (dr == NULL) {
8980		device_printf(sc->sc_dev, "failed to parse cookie\n");
8981		return;
8982	}
8983	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
8984
8985	while (1) {
8986		KASSERT(slot >= 0 && slot < dr->dr_numslots,
8987		    ("%s:%d: fail", __func__, __LINE__));
8988		dr->getdesc(dr, slot, &desc, &meta);
8989
8990		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
8991			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
8992		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
8993			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
8994
8995		if (meta->mt_islast) {
8996			KASSERT(meta->mt_m != NULL,
8997			    ("%s:%d: fail", __func__, __LINE__));
8998
8999			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
9000			meta->mt_ni = NULL;
9001			meta->mt_m = NULL;
9002		} else
9003			KASSERT(meta->mt_m == NULL,
9004			    ("%s:%d: fail", __func__, __LINE__));
9005
9006		dr->dr_usedslot--;
9007		if (meta->mt_islast)
9008			break;
9009		slot = bwn_dma_nextslot(dr, slot);
9010	}
9011	sc->sc_watchdog_timer = 0;
9012	if (dr->dr_stop) {
9013		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
9014		    ("%s:%d: fail", __func__, __LINE__));
9015		dr->dr_stop = 0;
9016	}
9017}
9018
9019static void
9020bwn_pio_handle_txeof(struct bwn_mac *mac,
9021    const struct bwn_txstatus *status)
9022{
9023	struct bwn_pio_txqueue *tq;
9024	struct bwn_pio_txpkt *tp = NULL;
9025	struct bwn_softc *sc = mac->mac_sc;
9026
9027	BWN_ASSERT_LOCKED(sc);
9028
9029	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
9030	if (tq == NULL)
9031		return;
9032
9033	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
9034	tq->tq_free++;
9035
9036	if (tp->tp_ni != NULL) {
9037		/*
9038		 * Do any tx complete callback.  Note this must
9039		 * be done before releasing the node reference.
9040		 */
9041		if (tp->tp_m->m_flags & M_TXCB)
9042			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
9043		ieee80211_free_node(tp->tp_ni);
9044		tp->tp_ni = NULL;
9045	}
9046	m_freem(tp->tp_m);
9047	tp->tp_m = NULL;
9048	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
9049
9050	sc->sc_watchdog_timer = 0;
9051}
9052
9053static void
9054bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
9055{
9056	struct bwn_softc *sc = mac->mac_sc;
9057	struct bwn_phy *phy = &mac->mac_phy;
9058	struct ieee80211com *ic = &sc->sc_ic;
9059	unsigned long now;
9060	int result;
9061
9062	BWN_GETTIME(now);
9063
9064	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
9065		return;
9066	phy->nexttime = now + 2 * 1000;
9067
9068	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
9069	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
9070		return;
9071
9072	if (phy->recalc_txpwr != NULL) {
9073		result = phy->recalc_txpwr(mac,
9074		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
9075		if (result == BWN_TXPWR_RES_DONE)
9076			return;
9077		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
9078		    ("%s: fail", __func__));
9079		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
9080
9081		ieee80211_runtask(ic, &mac->mac_txpower);
9082	}
9083}
9084
9085static uint16_t
9086bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
9087{
9088
9089	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
9090}
9091
9092static uint32_t
9093bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
9094{
9095
9096	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
9097}
9098
9099static void
9100bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
9101{
9102
9103	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
9104}
9105
9106static void
9107bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
9108{
9109
9110	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
9111}
9112
9113static int
9114bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
9115{
9116
9117	switch (rate) {
9118	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
9119	case 12:
9120		return (BWN_OFDM_RATE_6MB);
9121	case 18:
9122		return (BWN_OFDM_RATE_9MB);
9123	case 24:
9124		return (BWN_OFDM_RATE_12MB);
9125	case 36:
9126		return (BWN_OFDM_RATE_18MB);
9127	case 48:
9128		return (BWN_OFDM_RATE_24MB);
9129	case 72:
9130		return (BWN_OFDM_RATE_36MB);
9131	case 96:
9132		return (BWN_OFDM_RATE_48MB);
9133	case 108:
9134		return (BWN_OFDM_RATE_54MB);
9135	/* CCK rates (NB: not IEEE std, device-specific) */
9136	case 2:
9137		return (BWN_CCK_RATE_1MB);
9138	case 4:
9139		return (BWN_CCK_RATE_2MB);
9140	case 11:
9141		return (BWN_CCK_RATE_5MB);
9142	case 22:
9143		return (BWN_CCK_RATE_11MB);
9144	}
9145
9146	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
9147	return (BWN_CCK_RATE_1MB);
9148}
9149
9150static int
9151bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
9152    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
9153{
9154	const struct bwn_phy *phy = &mac->mac_phy;
9155	struct bwn_softc *sc = mac->mac_sc;
9156	struct ieee80211_frame *wh;
9157	struct ieee80211_frame *protwh;
9158	struct ieee80211_frame_cts *cts;
9159	struct ieee80211_frame_rts *rts;
9160	const struct ieee80211_txparam *tp;
9161	struct ieee80211vap *vap = ni->ni_vap;
9162	struct ieee80211com *ic = &sc->sc_ic;
9163	struct mbuf *mprot;
9164	unsigned int len;
9165	uint32_t macctl = 0;
9166	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
9167	uint16_t phyctl = 0;
9168	uint8_t rate, rate_fb;
9169
9170	wh = mtod(m, struct ieee80211_frame *);
9171	memset(txhdr, 0, sizeof(*txhdr));
9172
9173	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
9174	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
9175	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
9176
9177	/*
9178	 * Find TX rate
9179	 */
9180	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
9181	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
9182		rate = rate_fb = tp->mgmtrate;
9183	else if (ismcast)
9184		rate = rate_fb = tp->mcastrate;
9185	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
9186		rate = rate_fb = tp->ucastrate;
9187	else {
9188		rix = ieee80211_ratectl_rate(ni, NULL, 0);
9189		rate = ni->ni_txrate;
9190
9191		if (rix > 0)
9192			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
9193			    IEEE80211_RATE_VAL;
9194		else
9195			rate_fb = rate;
9196	}
9197
9198	sc->sc_tx_rate = rate;
9199
9200	rate = bwn_ieeerate2hwrate(sc, rate);
9201	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
9202
9203	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
9204	    bwn_plcp_getcck(rate);
9205	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
9206	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
9207
9208	if ((rate_fb == rate) ||
9209	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
9210	    (*(u_int16_t *)wh->i_dur == htole16(0)))
9211		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
9212	else
9213		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
9214		    m->m_pkthdr.len, rate, isshort);
9215
9216	/* XXX TX encryption */
9217	bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
9218	    (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
9219	    (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
9220	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
9221	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
9222	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
9223
9224	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
9225	    BWN_TX_EFT_FB_CCK;
9226	txhdr->chan = phy->chan;
9227	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
9228	    BWN_TX_PHY_ENC_CCK;
9229	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
9230	     rate == BWN_CCK_RATE_11MB))
9231		phyctl |= BWN_TX_PHY_SHORTPRMBL;
9232
9233	/* XXX TX antenna selection */
9234
9235	switch (bwn_antenna_sanitize(mac, 0)) {
9236	case 0:
9237		phyctl |= BWN_TX_PHY_ANT01AUTO;
9238		break;
9239	case 1:
9240		phyctl |= BWN_TX_PHY_ANT0;
9241		break;
9242	case 2:
9243		phyctl |= BWN_TX_PHY_ANT1;
9244		break;
9245	case 3:
9246		phyctl |= BWN_TX_PHY_ANT2;
9247		break;
9248	case 4:
9249		phyctl |= BWN_TX_PHY_ANT3;
9250		break;
9251	default:
9252		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
9253	}
9254
9255	if (!ismcast)
9256		macctl |= BWN_TX_MAC_ACK;
9257
9258	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
9259	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
9260	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
9261		macctl |= BWN_TX_MAC_LONGFRAME;
9262
9263	if (ic->ic_flags & IEEE80211_F_USEPROT) {
9264		/* XXX RTS rate is always 1MB??? */
9265		rts_rate = BWN_CCK_RATE_1MB;
9266		rts_rate_fb = bwn_get_fbrate(rts_rate);
9267
9268		protdur = ieee80211_compute_duration(ic->ic_rt,
9269		    m->m_pkthdr.len, rate, isshort) +
9270		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
9271
9272		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
9273			cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
9274			    (txhdr->body.old.rts_frame) :
9275			    (txhdr->body.new.rts_frame));
9276			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
9277			    protdur);
9278			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
9279			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
9280			    mprot->m_pkthdr.len);
9281			m_freem(mprot);
9282			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
9283			len = sizeof(struct ieee80211_frame_cts);
9284		} else {
9285			rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
9286			    (txhdr->body.old.rts_frame) :
9287			    (txhdr->body.new.rts_frame));
9288			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
9289			    isshort);
9290			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
9291			    wh->i_addr2, protdur);
9292			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
9293			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
9294			    mprot->m_pkthdr.len);
9295			m_freem(mprot);
9296			macctl |= BWN_TX_MAC_SEND_RTSCTS;
9297			len = sizeof(struct ieee80211_frame_rts);
9298		}
9299		len += IEEE80211_CRC_LEN;
9300		bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
9301		    &txhdr->body.old.rts_plcp :
9302		    &txhdr->body.new.rts_plcp), len, rts_rate);
9303		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
9304		    rts_rate_fb);
9305
9306		protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
9307		    (&txhdr->body.old.rts_frame) :
9308		    (&txhdr->body.new.rts_frame));
9309		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
9310
9311		if (BWN_ISOFDMRATE(rts_rate)) {
9312			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
9313			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
9314		} else {
9315			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
9316			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
9317		}
9318		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
9319		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
9320	}
9321
9322	if (BWN_ISOLDFMT(mac))
9323		txhdr->body.old.cookie = htole16(cookie);
9324	else
9325		txhdr->body.new.cookie = htole16(cookie);
9326
9327	txhdr->macctl = htole32(macctl);
9328	txhdr->phyctl = htole16(phyctl);
9329
9330	/*
9331	 * TX radio tap
9332	 */
9333	if (ieee80211_radiotap_active_vap(vap)) {
9334		sc->sc_tx_th.wt_flags = 0;
9335		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
9336			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
9337		if (isshort &&
9338		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
9339		     rate == BWN_CCK_RATE_11MB))
9340			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
9341		sc->sc_tx_th.wt_rate = rate;
9342
9343		ieee80211_radiotap_tx(vap, m);
9344	}
9345
9346	return (0);
9347}
9348
9349static void
9350bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
9351    const uint8_t rate)
9352{
9353	uint32_t d, plen;
9354	uint8_t *raw = plcp->o.raw;
9355
9356	if (BWN_ISOFDMRATE(rate)) {
9357		d = bwn_plcp_getofdm(rate);
9358		KASSERT(!(octets & 0xf000),
9359		    ("%s:%d: fail", __func__, __LINE__));
9360		d |= (octets << 5);
9361		plcp->o.data = htole32(d);
9362	} else {
9363		plen = octets * 16 / rate;
9364		if ((octets * 16 % rate) > 0) {
9365			plen++;
9366			if ((rate == BWN_CCK_RATE_11MB)
9367			    && ((octets * 8 % 11) < 4)) {
9368				raw[1] = 0x84;
9369			} else
9370				raw[1] = 0x04;
9371		} else
9372			raw[1] = 0x04;
9373		plcp->o.data |= htole32(plen << 16);
9374		raw[0] = bwn_plcp_getcck(rate);
9375	}
9376}
9377
9378static uint8_t
9379bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
9380{
9381	struct bwn_softc *sc = mac->mac_sc;
9382	uint8_t mask;
9383
9384	if (n == 0)
9385		return (0);
9386	if (mac->mac_phy.gmode)
9387		mask = siba_sprom_get_ant_bg(sc->sc_dev);
9388	else
9389		mask = siba_sprom_get_ant_a(sc->sc_dev);
9390	if (!(mask & (1 << (n - 1))))
9391		return (0);
9392	return (n);
9393}
9394
9395static uint8_t
9396bwn_get_fbrate(uint8_t bitrate)
9397{
9398	switch (bitrate) {
9399	case BWN_CCK_RATE_1MB:
9400		return (BWN_CCK_RATE_1MB);
9401	case BWN_CCK_RATE_2MB:
9402		return (BWN_CCK_RATE_1MB);
9403	case BWN_CCK_RATE_5MB:
9404		return (BWN_CCK_RATE_2MB);
9405	case BWN_CCK_RATE_11MB:
9406		return (BWN_CCK_RATE_5MB);
9407	case BWN_OFDM_RATE_6MB:
9408		return (BWN_CCK_RATE_5MB);
9409	case BWN_OFDM_RATE_9MB:
9410		return (BWN_OFDM_RATE_6MB);
9411	case BWN_OFDM_RATE_12MB:
9412		return (BWN_OFDM_RATE_9MB);
9413	case BWN_OFDM_RATE_18MB:
9414		return (BWN_OFDM_RATE_12MB);
9415	case BWN_OFDM_RATE_24MB:
9416		return (BWN_OFDM_RATE_18MB);
9417	case BWN_OFDM_RATE_36MB:
9418		return (BWN_OFDM_RATE_24MB);
9419	case BWN_OFDM_RATE_48MB:
9420		return (BWN_OFDM_RATE_36MB);
9421	case BWN_OFDM_RATE_54MB:
9422		return (BWN_OFDM_RATE_48MB);
9423	}
9424	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
9425	return (0);
9426}
9427
9428static uint32_t
9429bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
9430    uint32_t ctl, const void *_data, int len)
9431{
9432	struct bwn_softc *sc = mac->mac_sc;
9433	uint32_t value = 0;
9434	const uint8_t *data = _data;
9435
9436	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
9437	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
9438	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
9439
9440	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
9441	    tq->tq_base + BWN_PIO8_TXDATA);
9442	if (len & 3) {
9443		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
9444		    BWN_PIO8_TXCTL_24_31);
9445		data = &(data[len - 1]);
9446		switch (len & 3) {
9447		case 3:
9448			ctl |= BWN_PIO8_TXCTL_16_23;
9449			value |= (uint32_t)(*data) << 16;
9450			data--;
9451		case 2:
9452			ctl |= BWN_PIO8_TXCTL_8_15;
9453			value |= (uint32_t)(*data) << 8;
9454			data--;
9455		case 1:
9456			value |= (uint32_t)(*data);
9457		}
9458		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
9459		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
9460	}
9461
9462	return (ctl);
9463}
9464
9465static void
9466bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
9467    uint16_t offset, uint32_t value)
9468{
9469
9470	BWN_WRITE_4(mac, tq->tq_base + offset, value);
9471}
9472
9473static uint16_t
9474bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
9475    uint16_t ctl, const void *_data, int len)
9476{
9477	struct bwn_softc *sc = mac->mac_sc;
9478	const uint8_t *data = _data;
9479
9480	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
9481	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
9482
9483	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
9484	    tq->tq_base + BWN_PIO_TXDATA);
9485	if (len & 1) {
9486		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
9487		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
9488		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
9489	}
9490
9491	return (ctl);
9492}
9493
9494static uint16_t
9495bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
9496    uint16_t ctl, struct mbuf *m0)
9497{
9498	int i, j = 0;
9499	uint16_t data = 0;
9500	const uint8_t *buf;
9501	struct mbuf *m = m0;
9502
9503	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
9504	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
9505
9506	for (; m != NULL; m = m->m_next) {
9507		buf = mtod(m, const uint8_t *);
9508		for (i = 0; i < m->m_len; i++) {
9509			if (!((j++) % 2))
9510				data |= buf[i];
9511			else {
9512				data |= (buf[i] << 8);
9513				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
9514				data = 0;
9515			}
9516		}
9517	}
9518	if (m0->m_pkthdr.len % 2) {
9519		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
9520		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
9521		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
9522	}
9523
9524	return (ctl);
9525}
9526
9527static void
9528bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
9529{
9530
9531	if (mac->mac_phy.type != BWN_PHYTYPE_G)
9532		return;
9533	BWN_WRITE_2(mac, 0x684, 510 + time);
9534	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
9535}
9536
9537static struct bwn_dma_ring *
9538bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
9539{
9540
9541	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
9542		return (mac->mac_method.dma.wme[WME_AC_BE]);
9543
9544	switch (prio) {
9545	case 3:
9546		return (mac->mac_method.dma.wme[WME_AC_VO]);
9547	case 2:
9548		return (mac->mac_method.dma.wme[WME_AC_VI]);
9549	case 0:
9550		return (mac->mac_method.dma.wme[WME_AC_BE]);
9551	case 1:
9552		return (mac->mac_method.dma.wme[WME_AC_BK]);
9553	}
9554	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
9555	return (NULL);
9556}
9557
9558static int
9559bwn_dma_getslot(struct bwn_dma_ring *dr)
9560{
9561	int slot;
9562
9563	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
9564
9565	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
9566	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
9567	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
9568
9569	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
9570	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
9571	dr->dr_curslot = slot;
9572	dr->dr_usedslot++;
9573
9574	return (slot);
9575}
9576
9577static int
9578bwn_phy_shm_tssi_read(struct bwn_mac *mac, uint16_t shm_offset)
9579{
9580	const uint8_t ofdm = (shm_offset != BWN_SHARED_TSSI_CCK);
9581	unsigned int a, b, c, d;
9582	unsigned int avg;
9583	uint32_t tmp;
9584
9585	tmp = bwn_shm_read_4(mac, BWN_SHARED, shm_offset);
9586	a = tmp & 0xff;
9587	b = (tmp >> 8) & 0xff;
9588	c = (tmp >> 16) & 0xff;
9589	d = (tmp >> 24) & 0xff;
9590	if (a == 0 || a == BWN_TSSI_MAX || b == 0 || b == BWN_TSSI_MAX ||
9591	    c == 0 || c == BWN_TSSI_MAX || d == 0 || d == BWN_TSSI_MAX)
9592		return (ENOENT);
9593	bwn_shm_write_4(mac, BWN_SHARED, shm_offset,
9594	    BWN_TSSI_MAX | (BWN_TSSI_MAX << 8) |
9595	    (BWN_TSSI_MAX << 16) | (BWN_TSSI_MAX << 24));
9596
9597	if (ofdm) {
9598		a = (a + 32) & 0x3f;
9599		b = (b + 32) & 0x3f;
9600		c = (c + 32) & 0x3f;
9601		d = (d + 32) & 0x3f;
9602	}
9603
9604	avg = (a + b + c + d + 2) / 4;
9605	if (ofdm) {
9606		if (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO)
9607		    & BWN_HF_4DB_CCK_POWERBOOST)
9608			avg = (avg >= 13) ? (avg - 13) : 0;
9609	}
9610	return (avg);
9611}
9612
9613static void
9614bwn_phy_g_setatt(struct bwn_mac *mac, int *bbattp, int *rfattp)
9615{
9616	struct bwn_txpwr_loctl *lo = &mac->mac_phy.phy_g.pg_loctl;
9617	int rfatt = *rfattp;
9618	int bbatt = *bbattp;
9619
9620	while (1) {
9621		if (rfatt > lo->rfatt.max && bbatt > lo->bbatt.max - 4)
9622			break;
9623		if (rfatt < lo->rfatt.min && bbatt < lo->bbatt.min + 4)
9624			break;
9625		if (bbatt > lo->bbatt.max && rfatt > lo->rfatt.max - 1)
9626			break;
9627		if (bbatt < lo->bbatt.min && rfatt < lo->rfatt.min + 1)
9628			break;
9629		if (bbatt > lo->bbatt.max) {
9630			bbatt -= 4;
9631			rfatt += 1;
9632			continue;
9633		}
9634		if (bbatt < lo->bbatt.min) {
9635			bbatt += 4;
9636			rfatt -= 1;
9637			continue;
9638		}
9639		if (rfatt > lo->rfatt.max) {
9640			rfatt -= 1;
9641			bbatt += 4;
9642			continue;
9643		}
9644		if (rfatt < lo->rfatt.min) {
9645			rfatt += 1;
9646			bbatt -= 4;
9647			continue;
9648		}
9649		break;
9650	}
9651
9652	*rfattp = MIN(MAX(rfatt, lo->rfatt.min), lo->rfatt.max);
9653	*bbattp = MIN(MAX(bbatt, lo->bbatt.min), lo->bbatt.max);
9654}
9655
9656static void
9657bwn_phy_lock(struct bwn_mac *mac)
9658{
9659	struct bwn_softc *sc = mac->mac_sc;
9660	struct ieee80211com *ic = &sc->sc_ic;
9661
9662	KASSERT(siba_get_revid(sc->sc_dev) >= 3,
9663	    ("%s: unsupported rev %d", __func__, siba_get_revid(sc->sc_dev)));
9664
9665	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
9666		bwn_psctl(mac, BWN_PS_AWAKE);
9667}
9668
9669static void
9670bwn_phy_unlock(struct bwn_mac *mac)
9671{
9672	struct bwn_softc *sc = mac->mac_sc;
9673	struct ieee80211com *ic = &sc->sc_ic;
9674
9675	KASSERT(siba_get_revid(sc->sc_dev) >= 3,
9676	    ("%s: unsupported rev %d", __func__, siba_get_revid(sc->sc_dev)));
9677
9678	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
9679		bwn_psctl(mac, 0);
9680}
9681
9682static void
9683bwn_rf_lock(struct bwn_mac *mac)
9684{
9685
9686	BWN_WRITE_4(mac, BWN_MACCTL,
9687	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_RADIO_LOCK);
9688	BWN_READ_4(mac, BWN_MACCTL);
9689	DELAY(10);
9690}
9691
9692static void
9693bwn_rf_unlock(struct bwn_mac *mac)
9694{
9695
9696	BWN_READ_2(mac, BWN_PHYVER);
9697	BWN_WRITE_4(mac, BWN_MACCTL,
9698	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_RADIO_LOCK);
9699}
9700
9701static struct bwn_pio_txqueue *
9702bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
9703    struct bwn_pio_txpkt **pack)
9704{
9705	struct bwn_pio *pio = &mac->mac_method.pio;
9706	struct bwn_pio_txqueue *tq = NULL;
9707	unsigned int index;
9708
9709	switch (cookie & 0xf000) {
9710	case 0x1000:
9711		tq = &pio->wme[WME_AC_BK];
9712		break;
9713	case 0x2000:
9714		tq = &pio->wme[WME_AC_BE];
9715		break;
9716	case 0x3000:
9717		tq = &pio->wme[WME_AC_VI];
9718		break;
9719	case 0x4000:
9720		tq = &pio->wme[WME_AC_VO];
9721		break;
9722	case 0x5000:
9723		tq = &pio->mcast;
9724		break;
9725	}
9726	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
9727	if (tq == NULL)
9728		return (NULL);
9729	index = (cookie & 0x0fff);
9730	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
9731	if (index >= N(tq->tq_pkts))
9732		return (NULL);
9733	*pack = &tq->tq_pkts[index];
9734	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
9735	return (tq);
9736}
9737
9738static void
9739bwn_txpwr(void *arg, int npending)
9740{
9741	struct bwn_mac *mac = arg;
9742	struct bwn_softc *sc = mac->mac_sc;
9743
9744	BWN_LOCK(sc);
9745	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
9746	    mac->mac_phy.set_txpwr != NULL)
9747		mac->mac_phy.set_txpwr(mac);
9748	BWN_UNLOCK(sc);
9749}
9750
9751static void
9752bwn_task_15s(struct bwn_mac *mac)
9753{
9754	uint16_t reg;
9755
9756	if (mac->mac_fw.opensource) {
9757		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
9758		if (reg) {
9759			bwn_restart(mac, "fw watchdog");
9760			return;
9761		}
9762		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
9763	}
9764	if (mac->mac_phy.task_15s)
9765		mac->mac_phy.task_15s(mac);
9766
9767	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
9768}
9769
9770static void
9771bwn_task_30s(struct bwn_mac *mac)
9772{
9773
9774	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
9775		return;
9776	mac->mac_noise.noi_running = 1;
9777	mac->mac_noise.noi_nsamples = 0;
9778
9779	bwn_noise_gensample(mac);
9780}
9781
9782static void
9783bwn_task_60s(struct bwn_mac *mac)
9784{
9785
9786	if (mac->mac_phy.task_60s)
9787		mac->mac_phy.task_60s(mac);
9788	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
9789}
9790
9791static void
9792bwn_tasks(void *arg)
9793{
9794	struct bwn_mac *mac = arg;
9795	struct bwn_softc *sc = mac->mac_sc;
9796
9797	BWN_ASSERT_LOCKED(sc);
9798	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
9799		return;
9800
9801	if (mac->mac_task_state % 4 == 0)
9802		bwn_task_60s(mac);
9803	if (mac->mac_task_state % 2 == 0)
9804		bwn_task_30s(mac);
9805	bwn_task_15s(mac);
9806
9807	mac->mac_task_state++;
9808	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
9809}
9810
9811static int
9812bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
9813{
9814	struct bwn_softc *sc = mac->mac_sc;
9815
9816	KASSERT(a == 0, ("not support APHY\n"));
9817
9818	switch (plcp->o.raw[0] & 0xf) {
9819	case 0xb:
9820		return (BWN_OFDM_RATE_6MB);
9821	case 0xf:
9822		return (BWN_OFDM_RATE_9MB);
9823	case 0xa:
9824		return (BWN_OFDM_RATE_12MB);
9825	case 0xe:
9826		return (BWN_OFDM_RATE_18MB);
9827	case 0x9:
9828		return (BWN_OFDM_RATE_24MB);
9829	case 0xd:
9830		return (BWN_OFDM_RATE_36MB);
9831	case 0x8:
9832		return (BWN_OFDM_RATE_48MB);
9833	case 0xc:
9834		return (BWN_OFDM_RATE_54MB);
9835	}
9836	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
9837	    plcp->o.raw[0] & 0xf);
9838	return (-1);
9839}
9840
9841static int
9842bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
9843{
9844	struct bwn_softc *sc = mac->mac_sc;
9845
9846	switch (plcp->o.raw[0]) {
9847	case 0x0a:
9848		return (BWN_CCK_RATE_1MB);
9849	case 0x14:
9850		return (BWN_CCK_RATE_2MB);
9851	case 0x37:
9852		return (BWN_CCK_RATE_5MB);
9853	case 0x6e:
9854		return (BWN_CCK_RATE_11MB);
9855	}
9856	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
9857	return (-1);
9858}
9859
9860static void
9861bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
9862    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
9863    int rssi, int noise)
9864{
9865	struct bwn_softc *sc = mac->mac_sc;
9866	const struct ieee80211_frame_min *wh;
9867	uint64_t tsf;
9868	uint16_t low_mactime_now;
9869
9870	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
9871		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
9872
9873	wh = mtod(m, const struct ieee80211_frame_min *);
9874	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
9875		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
9876
9877	bwn_tsf_read(mac, &tsf);
9878	low_mactime_now = tsf;
9879	tsf = tsf & ~0xffffULL;
9880	tsf += le16toh(rxhdr->mac_time);
9881	if (low_mactime_now < le16toh(rxhdr->mac_time))
9882		tsf -= 0x10000;
9883
9884	sc->sc_rx_th.wr_tsf = tsf;
9885	sc->sc_rx_th.wr_rate = rate;
9886	sc->sc_rx_th.wr_antsignal = rssi;
9887	sc->sc_rx_th.wr_antnoise = noise;
9888}
9889
9890static void
9891bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
9892{
9893	uint32_t low, high;
9894
9895	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
9896	    ("%s:%d: fail", __func__, __LINE__));
9897
9898	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
9899	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
9900	*tsf = high;
9901	*tsf <<= 32;
9902	*tsf |= low;
9903}
9904
9905static int
9906bwn_dma_attach(struct bwn_mac *mac)
9907{
9908	struct bwn_dma *dma = &mac->mac_method.dma;
9909	struct bwn_softc *sc = mac->mac_sc;
9910	bus_addr_t lowaddr = 0;
9911	int error;
9912
9913	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
9914		return (0);
9915
9916	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
9917
9918	mac->mac_flags |= BWN_MAC_FLAG_DMA;
9919
9920	dma->dmatype = bwn_dma_gettype(mac);
9921	if (dma->dmatype == BWN_DMA_30BIT)
9922		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
9923	else if (dma->dmatype == BWN_DMA_32BIT)
9924		lowaddr = BUS_SPACE_MAXADDR_32BIT;
9925	else
9926		lowaddr = BUS_SPACE_MAXADDR;
9927
9928	/*
9929	 * Create top level DMA tag
9930	 */
9931	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
9932			       BWN_ALIGN, 0,		/* alignment, bounds */
9933			       lowaddr,			/* lowaddr */
9934			       BUS_SPACE_MAXADDR,	/* highaddr */
9935			       NULL, NULL,		/* filter, filterarg */
9936			       BUS_SPACE_MAXSIZE,	/* maxsize */
9937			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
9938			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
9939			       0,			/* flags */
9940			       NULL, NULL,		/* lockfunc, lockarg */
9941			       &dma->parent_dtag);
9942	if (error) {
9943		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
9944		return (error);
9945	}
9946
9947	/*
9948	 * Create TX/RX mbuf DMA tag
9949	 */
9950	error = bus_dma_tag_create(dma->parent_dtag,
9951				1,
9952				0,
9953				BUS_SPACE_MAXADDR,
9954				BUS_SPACE_MAXADDR,
9955				NULL, NULL,
9956				MCLBYTES,
9957				1,
9958				BUS_SPACE_MAXSIZE_32BIT,
9959				0,
9960				NULL, NULL,
9961				&dma->rxbuf_dtag);
9962	if (error) {
9963		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
9964		goto fail0;
9965	}
9966	error = bus_dma_tag_create(dma->parent_dtag,
9967				1,
9968				0,
9969				BUS_SPACE_MAXADDR,
9970				BUS_SPACE_MAXADDR,
9971				NULL, NULL,
9972				MCLBYTES,
9973				1,
9974				BUS_SPACE_MAXSIZE_32BIT,
9975				0,
9976				NULL, NULL,
9977				&dma->txbuf_dtag);
9978	if (error) {
9979		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
9980		goto fail1;
9981	}
9982
9983	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
9984	if (!dma->wme[WME_AC_BK])
9985		goto fail2;
9986
9987	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
9988	if (!dma->wme[WME_AC_BE])
9989		goto fail3;
9990
9991	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
9992	if (!dma->wme[WME_AC_VI])
9993		goto fail4;
9994
9995	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
9996	if (!dma->wme[WME_AC_VO])
9997		goto fail5;
9998
9999	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
10000	if (!dma->mcast)
10001		goto fail6;
10002	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
10003	if (!dma->rx)
10004		goto fail7;
10005
10006	return (error);
10007
10008fail7:	bwn_dma_ringfree(&dma->mcast);
10009fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
10010fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
10011fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
10012fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
10013fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
10014fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
10015fail0:	bus_dma_tag_destroy(dma->parent_dtag);
10016	return (error);
10017}
10018
10019static struct bwn_dma_ring *
10020bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
10021    uint16_t cookie, int *slot)
10022{
10023	struct bwn_dma *dma = &mac->mac_method.dma;
10024	struct bwn_dma_ring *dr;
10025	struct bwn_softc *sc = mac->mac_sc;
10026
10027	BWN_ASSERT_LOCKED(mac->mac_sc);
10028
10029	switch (cookie & 0xf000) {
10030	case 0x1000:
10031		dr = dma->wme[WME_AC_BK];
10032		break;
10033	case 0x2000:
10034		dr = dma->wme[WME_AC_BE];
10035		break;
10036	case 0x3000:
10037		dr = dma->wme[WME_AC_VI];
10038		break;
10039	case 0x4000:
10040		dr = dma->wme[WME_AC_VO];
10041		break;
10042	case 0x5000:
10043		dr = dma->mcast;
10044		break;
10045	default:
10046		dr = NULL;
10047		KASSERT(0 == 1,
10048		    ("invalid cookie value %d", cookie & 0xf000));
10049	}
10050	*slot = (cookie & 0x0fff);
10051	if (*slot < 0 || *slot >= dr->dr_numslots) {
10052		/*
10053		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
10054		 * that it occurs events which have same H/W sequence numbers.
10055		 * When it's occurred just prints a WARNING msgs and ignores.
10056		 */
10057		KASSERT(status->seq == dma->lastseq,
10058		    ("%s:%d: fail", __func__, __LINE__));
10059		device_printf(sc->sc_dev,
10060		    "out of slot ranges (0 < %d < %d)\n", *slot,
10061		    dr->dr_numslots);
10062		return (NULL);
10063	}
10064	dma->lastseq = status->seq;
10065	return (dr);
10066}
10067
10068static void
10069bwn_dma_stop(struct bwn_mac *mac)
10070{
10071	struct bwn_dma *dma;
10072
10073	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
10074		return;
10075	dma = &mac->mac_method.dma;
10076
10077	bwn_dma_ringstop(&dma->rx);
10078	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
10079	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
10080	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
10081	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
10082	bwn_dma_ringstop(&dma->mcast);
10083}
10084
10085static void
10086bwn_dma_ringstop(struct bwn_dma_ring **dr)
10087{
10088
10089	if (dr == NULL)
10090		return;
10091
10092	bwn_dma_cleanup(*dr);
10093}
10094
10095static void
10096bwn_pio_stop(struct bwn_mac *mac)
10097{
10098	struct bwn_pio *pio;
10099
10100	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
10101		return;
10102	pio = &mac->mac_method.pio;
10103
10104	bwn_destroy_queue_tx(&pio->mcast);
10105	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
10106	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
10107	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
10108	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
10109}
10110
10111static void
10112bwn_led_attach(struct bwn_mac *mac)
10113{
10114	struct bwn_softc *sc = mac->mac_sc;
10115	const uint8_t *led_act = NULL;
10116	uint16_t val[BWN_LED_MAX];
10117	int i;
10118
10119	sc->sc_led_idle = (2350 * hz) / 1000;
10120	sc->sc_led_blink = 1;
10121
10122	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
10123		if (siba_get_pci_subvendor(sc->sc_dev) ==
10124		    bwn_vendor_led_act[i].vid) {
10125			led_act = bwn_vendor_led_act[i].led_act;
10126			break;
10127		}
10128	}
10129	if (led_act == NULL)
10130		led_act = bwn_default_led_act;
10131
10132	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
10133	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
10134	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
10135	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
10136
10137	for (i = 0; i < BWN_LED_MAX; ++i) {
10138		struct bwn_led *led = &sc->sc_leds[i];
10139
10140		if (val[i] == 0xff) {
10141			led->led_act = led_act[i];
10142		} else {
10143			if (val[i] & BWN_LED_ACT_LOW)
10144				led->led_flags |= BWN_LED_F_ACTLOW;
10145			led->led_act = val[i] & BWN_LED_ACT_MASK;
10146		}
10147		led->led_mask = (1 << i);
10148
10149		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
10150		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
10151		    led->led_act == BWN_LED_ACT_BLINK) {
10152			led->led_flags |= BWN_LED_F_BLINK;
10153			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
10154				led->led_flags |= BWN_LED_F_POLLABLE;
10155			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
10156				led->led_flags |= BWN_LED_F_SLOW;
10157
10158			if (sc->sc_blink_led == NULL) {
10159				sc->sc_blink_led = led;
10160				if (led->led_flags & BWN_LED_F_SLOW)
10161					BWN_LED_SLOWDOWN(sc->sc_led_idle);
10162			}
10163		}
10164
10165		DPRINTF(sc, BWN_DEBUG_LED,
10166		    "%dth led, act %d, lowact %d\n", i,
10167		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
10168	}
10169	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
10170}
10171
10172static __inline uint16_t
10173bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
10174{
10175
10176	if (led->led_flags & BWN_LED_F_ACTLOW)
10177		on = !on;
10178	if (on)
10179		val |= led->led_mask;
10180	else
10181		val &= ~led->led_mask;
10182	return val;
10183}
10184
10185static void
10186bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
10187{
10188	struct bwn_softc *sc = mac->mac_sc;
10189	struct ieee80211com *ic = &sc->sc_ic;
10190	uint16_t val;
10191	int i;
10192
10193	if (nstate == IEEE80211_S_INIT) {
10194		callout_stop(&sc->sc_led_blink_ch);
10195		sc->sc_led_blinking = 0;
10196	}
10197
10198	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
10199		return;
10200
10201	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
10202	for (i = 0; i < BWN_LED_MAX; ++i) {
10203		struct bwn_led *led = &sc->sc_leds[i];
10204		int on;
10205
10206		if (led->led_act == BWN_LED_ACT_UNKN ||
10207		    led->led_act == BWN_LED_ACT_NULL)
10208			continue;
10209
10210		if ((led->led_flags & BWN_LED_F_BLINK) &&
10211		    nstate != IEEE80211_S_INIT)
10212			continue;
10213
10214		switch (led->led_act) {
10215		case BWN_LED_ACT_ON:    /* Always on */
10216			on = 1;
10217			break;
10218		case BWN_LED_ACT_OFF:   /* Always off */
10219		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
10220			on = 0;
10221			break;
10222		default:
10223			on = 1;
10224			switch (nstate) {
10225			case IEEE80211_S_INIT:
10226				on = 0;
10227				break;
10228			case IEEE80211_S_RUN:
10229				if (led->led_act == BWN_LED_ACT_11G &&
10230				    ic->ic_curmode != IEEE80211_MODE_11G)
10231					on = 0;
10232				break;
10233			default:
10234				if (led->led_act == BWN_LED_ACT_ASSOC)
10235					on = 0;
10236				break;
10237			}
10238			break;
10239		}
10240
10241		val = bwn_led_onoff(led, val, on);
10242	}
10243	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
10244}
10245
10246static void
10247bwn_led_event(struct bwn_mac *mac, int event)
10248{
10249	struct bwn_softc *sc = mac->mac_sc;
10250	struct bwn_led *led = sc->sc_blink_led;
10251	int rate;
10252
10253	if (event == BWN_LED_EVENT_POLL) {
10254		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
10255			return;
10256		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
10257			return;
10258	}
10259
10260	sc->sc_led_ticks = ticks;
10261	if (sc->sc_led_blinking)
10262		return;
10263
10264	switch (event) {
10265	case BWN_LED_EVENT_RX:
10266		rate = sc->sc_rx_rate;
10267		break;
10268	case BWN_LED_EVENT_TX:
10269		rate = sc->sc_tx_rate;
10270		break;
10271	case BWN_LED_EVENT_POLL:
10272		rate = 0;
10273		break;
10274	default:
10275		panic("unknown LED event %d\n", event);
10276		break;
10277	}
10278	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
10279	    bwn_led_duration[rate].off_dur);
10280}
10281
10282static void
10283bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
10284{
10285	struct bwn_softc *sc = mac->mac_sc;
10286	struct bwn_led *led = sc->sc_blink_led;
10287	uint16_t val;
10288
10289	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
10290	val = bwn_led_onoff(led, val, 1);
10291	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
10292
10293	if (led->led_flags & BWN_LED_F_SLOW) {
10294		BWN_LED_SLOWDOWN(on_dur);
10295		BWN_LED_SLOWDOWN(off_dur);
10296	}
10297
10298	sc->sc_led_blinking = 1;
10299	sc->sc_led_blink_offdur = off_dur;
10300
10301	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
10302}
10303
10304static void
10305bwn_led_blink_next(void *arg)
10306{
10307	struct bwn_mac *mac = arg;
10308	struct bwn_softc *sc = mac->mac_sc;
10309	uint16_t val;
10310
10311	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
10312	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
10313	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
10314
10315	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
10316	    bwn_led_blink_end, mac);
10317}
10318
10319static void
10320bwn_led_blink_end(void *arg)
10321{
10322	struct bwn_mac *mac = arg;
10323	struct bwn_softc *sc = mac->mac_sc;
10324
10325	sc->sc_led_blinking = 0;
10326}
10327
10328static int
10329bwn_suspend(device_t dev)
10330{
10331	struct bwn_softc *sc = device_get_softc(dev);
10332
10333	BWN_LOCK(sc);
10334	bwn_stop(sc);
10335	BWN_UNLOCK(sc);
10336	return (0);
10337}
10338
10339static int
10340bwn_resume(device_t dev)
10341{
10342	struct bwn_softc *sc = device_get_softc(dev);
10343	int error = EDOOFUS;
10344
10345	BWN_LOCK(sc);
10346	if (sc->sc_ic.ic_nrunning > 0)
10347		error = bwn_init(sc);
10348	BWN_UNLOCK(sc);
10349	if (error == 0)
10350		ieee80211_start_all(&sc->sc_ic);
10351	return (0);
10352}
10353
10354static void
10355bwn_rfswitch(void *arg)
10356{
10357	struct bwn_softc *sc = arg;
10358	struct bwn_mac *mac = sc->sc_curmac;
10359	int cur = 0, prev = 0;
10360
10361	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
10362	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
10363
10364	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
10365		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
10366			& BWN_RF_HWENABLED_HI_MASK))
10367			cur = 1;
10368	} else {
10369		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
10370		    & BWN_RF_HWENABLED_LO_MASK)
10371			cur = 1;
10372	}
10373
10374	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
10375		prev = 1;
10376
10377	if (cur != prev) {
10378		if (cur)
10379			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
10380		else
10381			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
10382
10383		device_printf(sc->sc_dev,
10384		    "status of RF switch is changed to %s\n",
10385		    cur ? "ON" : "OFF");
10386		if (cur != mac->mac_phy.rf_on) {
10387			if (cur)
10388				bwn_rf_turnon(mac);
10389			else
10390				bwn_rf_turnoff(mac);
10391		}
10392	}
10393
10394	callout_schedule(&sc->sc_rfswitch_ch, hz);
10395}
10396
10397static void
10398bwn_sysctl_node(struct bwn_softc *sc)
10399{
10400	device_t dev = sc->sc_dev;
10401	struct bwn_mac *mac;
10402	struct bwn_stats *stats;
10403
10404	/* XXX assume that count of MAC is only 1. */
10405
10406	if ((mac = sc->sc_curmac) == NULL)
10407		return;
10408	stats = &mac->mac_stats;
10409
10410	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
10411	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
10412	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
10413	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
10414	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
10415	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
10416	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
10417	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
10418	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
10419
10420#ifdef BWN_DEBUG
10421	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
10422	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
10423	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
10424#endif
10425}
10426
10427static device_method_t bwn_methods[] = {
10428	/* Device interface */
10429	DEVMETHOD(device_probe,		bwn_probe),
10430	DEVMETHOD(device_attach,	bwn_attach),
10431	DEVMETHOD(device_detach,	bwn_detach),
10432	DEVMETHOD(device_suspend,	bwn_suspend),
10433	DEVMETHOD(device_resume,	bwn_resume),
10434	DEVMETHOD_END
10435};
10436static driver_t bwn_driver = {
10437	"bwn",
10438	bwn_methods,
10439	sizeof(struct bwn_softc)
10440};
10441static devclass_t bwn_devclass;
10442DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
10443MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
10444MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
10445MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
10446MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
10447