if_bwn.c revision 299131
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 299131 2016-05-05 19:40:26Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include <sys/param.h>
38#include <sys/systm.h>
39#include <sys/kernel.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/endian.h>
43#include <sys/errno.h>
44#include <sys/firmware.h>
45#include <sys/lock.h>
46#include <sys/mutex.h>
47#include <machine/bus.h>
48#include <machine/resource.h>
49#include <sys/bus.h>
50#include <sys/rman.h>
51#include <sys/socket.h>
52#include <sys/sockio.h>
53
54#include <net/ethernet.h>
55#include <net/if.h>
56#include <net/if_var.h>
57#include <net/if_arp.h>
58#include <net/if_dl.h>
59#include <net/if_llc.h>
60#include <net/if_media.h>
61#include <net/if_types.h>
62
63#include <dev/pci/pcivar.h>
64#include <dev/pci/pcireg.h>
65#include <dev/siba/siba_ids.h>
66#include <dev/siba/sibareg.h>
67#include <dev/siba/sibavar.h>
68
69#include <net80211/ieee80211_var.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_regdomain.h>
72#include <net80211/ieee80211_phy.h>
73#include <net80211/ieee80211_ratectl.h>
74
75#include <dev/bwn/if_bwnreg.h>
76#include <dev/bwn/if_bwnvar.h>
77
78#include <dev/bwn/if_bwn_debug.h>
79#include <dev/bwn/if_bwn_misc.h>
80#include <dev/bwn/if_bwn_phy_g.h>
81#include <dev/bwn/if_bwn_phy_lp.h>
82
83static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
84    "Broadcom driver parameters");
85
86/*
87 * Tunable & sysctl variables.
88 */
89
90#ifdef BWN_DEBUG
91static	int bwn_debug = 0;
92SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
93    "Broadcom debugging printfs");
94#endif
95
96static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
97SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
98    "uses Bad Frames Preemption");
99static int	bwn_bluetooth = 1;
100SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
101    "turns on Bluetooth Coexistence");
102static int	bwn_hwpctl = 0;
103SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
104    "uses H/W power control");
105static int	bwn_msi_disable = 0;		/* MSI disabled  */
106TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
107static int	bwn_usedma = 1;
108SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
109    "uses DMA");
110TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
111static int	bwn_wme = 1;
112SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
113    "uses WME support");
114
115static void	bwn_attach_pre(struct bwn_softc *);
116static int	bwn_attach_post(struct bwn_softc *);
117static void	bwn_sprom_bugfixes(device_t);
118static int	bwn_init(struct bwn_softc *);
119static void	bwn_parent(struct ieee80211com *);
120static void	bwn_start(struct bwn_softc *);
121static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
122static int	bwn_attach_core(struct bwn_mac *);
123static int	bwn_phy_getinfo(struct bwn_mac *, int);
124static int	bwn_chiptest(struct bwn_mac *);
125static int	bwn_setup_channels(struct bwn_mac *, int, int);
126static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
127		    uint16_t);
128static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
129		    const struct bwn_channelinfo *, int);
130static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
131		    const struct ieee80211_bpf_params *);
132static void	bwn_updateslot(struct ieee80211com *);
133static void	bwn_update_promisc(struct ieee80211com *);
134static void	bwn_wme_init(struct bwn_mac *);
135static int	bwn_wme_update(struct ieee80211com *);
136static void	bwn_wme_clear(struct bwn_softc *);
137static void	bwn_wme_load(struct bwn_mac *);
138static void	bwn_wme_loadparams(struct bwn_mac *,
139		    const struct wmeParams *, uint16_t);
140static void	bwn_scan_start(struct ieee80211com *);
141static void	bwn_scan_end(struct ieee80211com *);
142static void	bwn_set_channel(struct ieee80211com *);
143static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
144		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
145		    const uint8_t [IEEE80211_ADDR_LEN],
146		    const uint8_t [IEEE80211_ADDR_LEN]);
147static void	bwn_vap_delete(struct ieee80211vap *);
148static void	bwn_stop(struct bwn_softc *);
149static int	bwn_core_init(struct bwn_mac *);
150static void	bwn_core_start(struct bwn_mac *);
151static void	bwn_core_exit(struct bwn_mac *);
152static void	bwn_bt_disable(struct bwn_mac *);
153static int	bwn_chip_init(struct bwn_mac *);
154static void	bwn_set_txretry(struct bwn_mac *, int, int);
155static void	bwn_rate_init(struct bwn_mac *);
156static void	bwn_set_phytxctl(struct bwn_mac *);
157static void	bwn_spu_setdelay(struct bwn_mac *, int);
158static void	bwn_bt_enable(struct bwn_mac *);
159static void	bwn_set_macaddr(struct bwn_mac *);
160static void	bwn_crypt_init(struct bwn_mac *);
161static void	bwn_chip_exit(struct bwn_mac *);
162static int	bwn_fw_fillinfo(struct bwn_mac *);
163static int	bwn_fw_loaducode(struct bwn_mac *);
164static int	bwn_gpio_init(struct bwn_mac *);
165static int	bwn_fw_loadinitvals(struct bwn_mac *);
166static int	bwn_phy_init(struct bwn_mac *);
167static void	bwn_set_txantenna(struct bwn_mac *, int);
168static void	bwn_set_opmode(struct bwn_mac *);
169static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
170static uint8_t	bwn_plcp_getcck(const uint8_t);
171static uint8_t	bwn_plcp_getofdm(const uint8_t);
172static void	bwn_pio_init(struct bwn_mac *);
173static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
174static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
175		    int);
176static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
177		    struct bwn_pio_rxqueue *, int);
178static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
179static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
180		    uint16_t);
181static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
182static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
183static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
184static void	bwn_pio_handle_txeof(struct bwn_mac *,
185		    const struct bwn_txstatus *);
186static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
187static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
188static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
189		    uint16_t);
190static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
191		    uint32_t);
192static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
193		    struct mbuf *);
194static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
195static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
196		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
197static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
198		    uint16_t, uint32_t);
199static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
200		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
201static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
203static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
204		    uint16_t, struct bwn_pio_txpkt **);
205static void	bwn_dma_init(struct bwn_mac *);
206static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
207static int	bwn_dma_mask2type(uint64_t);
208static uint64_t	bwn_dma_mask(struct bwn_mac *);
209static uint16_t	bwn_dma_base(int, int);
210static void	bwn_dma_ringfree(struct bwn_dma_ring **);
211static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
212		    int, struct bwn_dmadesc_generic **,
213		    struct bwn_dmadesc_meta **);
214static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
215		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
216		    int, int);
217static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
218static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
219static void	bwn_dma_32_resume(struct bwn_dma_ring *);
220static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
221static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
222static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
223		    int, struct bwn_dmadesc_generic **,
224		    struct bwn_dmadesc_meta **);
225static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
226		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
227		    int, int);
228static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
229static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
230static void	bwn_dma_64_resume(struct bwn_dma_ring *);
231static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
232static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
233static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
234static void	bwn_dma_setup(struct bwn_dma_ring *);
235static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
236static void	bwn_dma_cleanup(struct bwn_dma_ring *);
237static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
238static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
239static void	bwn_dma_rx(struct bwn_dma_ring *);
240static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
241static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
242		    struct bwn_dmadesc_meta *);
243static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
244static int	bwn_dma_gettype(struct bwn_mac *);
245static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
246static int	bwn_dma_freeslot(struct bwn_dma_ring *);
247static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
248static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
249static int	bwn_dma_newbuf(struct bwn_dma_ring *,
250		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
251		    int);
252static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
253		    bus_size_t, int);
254static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
255static void	bwn_dma_handle_txeof(struct bwn_mac *,
256		    const struct bwn_txstatus *);
257static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
258		    struct mbuf *);
259static int	bwn_dma_getslot(struct bwn_dma_ring *);
260static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
261		    uint8_t);
262static int	bwn_dma_attach(struct bwn_mac *);
263static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
264		    int, int, int);
265static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
266		    const struct bwn_txstatus *, uint16_t, int *);
267static void	bwn_dma_free(struct bwn_mac *);
268static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
269static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
270		    const char *, struct bwn_fwfile *);
271static void	bwn_release_firmware(struct bwn_mac *);
272static void	bwn_do_release_fw(struct bwn_fwfile *);
273static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
274static int	bwn_fwinitvals_write(struct bwn_mac *,
275		    const struct bwn_fwinitvals *, size_t, size_t);
276static uint16_t	bwn_ant2phy(int);
277static void	bwn_mac_write_bssid(struct bwn_mac *);
278static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
279		    const uint8_t *);
280static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
281		    const uint8_t *, size_t, const uint8_t *);
282static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
283		    const uint8_t *);
284static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
285		    const uint8_t *);
286static void	bwn_phy_exit(struct bwn_mac *);
287static void	bwn_core_stop(struct bwn_mac *);
288static int	bwn_switch_band(struct bwn_softc *,
289		    struct ieee80211_channel *);
290static void	bwn_phy_reset(struct bwn_mac *);
291static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
292static void	bwn_set_pretbtt(struct bwn_mac *);
293static int	bwn_intr(void *);
294static void	bwn_intrtask(void *, int);
295static void	bwn_restart(struct bwn_mac *, const char *);
296static void	bwn_intr_ucode_debug(struct bwn_mac *);
297static void	bwn_intr_tbtt_indication(struct bwn_mac *);
298static void	bwn_intr_atim_end(struct bwn_mac *);
299static void	bwn_intr_beacon(struct bwn_mac *);
300static void	bwn_intr_pmq(struct bwn_mac *);
301static void	bwn_intr_noise(struct bwn_mac *);
302static void	bwn_intr_txeof(struct bwn_mac *);
303static void	bwn_hwreset(void *, int);
304static void	bwn_handle_fwpanic(struct bwn_mac *);
305static void	bwn_load_beacon0(struct bwn_mac *);
306static void	bwn_load_beacon1(struct bwn_mac *);
307static uint32_t	bwn_jssi_read(struct bwn_mac *);
308static void	bwn_noise_gensample(struct bwn_mac *);
309static void	bwn_handle_txeof(struct bwn_mac *,
310		    const struct bwn_txstatus *);
311static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
312static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
313static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
314		    struct mbuf *);
315static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
316static int	bwn_set_txhdr(struct bwn_mac *,
317		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
318		    uint16_t);
319static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
320		    const uint8_t);
321static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
322static uint8_t	bwn_get_fbrate(uint8_t);
323static void	bwn_txpwr(void *, int);
324static void	bwn_tasks(void *);
325static void	bwn_task_15s(struct bwn_mac *);
326static void	bwn_task_30s(struct bwn_mac *);
327static void	bwn_task_60s(struct bwn_mac *);
328static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
329		    uint8_t);
330static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
331static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
332		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
333		    int, int);
334static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
335static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
336static void	bwn_watchdog(void *);
337static void	bwn_dma_stop(struct bwn_mac *);
338static void	bwn_pio_stop(struct bwn_mac *);
339static void	bwn_dma_ringstop(struct bwn_dma_ring **);
340static void	bwn_led_attach(struct bwn_mac *);
341static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
342static void	bwn_led_event(struct bwn_mac *, int);
343static void	bwn_led_blink_start(struct bwn_mac *, int, int);
344static void	bwn_led_blink_next(void *);
345static void	bwn_led_blink_end(void *);
346static void	bwn_rfswitch(void *);
347static void	bwn_rf_turnon(struct bwn_mac *);
348static void	bwn_rf_turnoff(struct bwn_mac *);
349static void	bwn_sysctl_node(struct bwn_softc *);
350
351static struct resource_spec bwn_res_spec_legacy[] = {
352	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
353	{ -1,			0,		0 }
354};
355
356static struct resource_spec bwn_res_spec_msi[] = {
357	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
358	{ -1,			0,		0 }
359};
360
361static const struct bwn_channelinfo bwn_chantable_bg = {
362	.channels = {
363		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
364		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
365		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
366		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
367		{ 2472, 13, 30 }, { 2484, 14, 30 } },
368	.nchannels = 14
369};
370
371static const struct bwn_channelinfo bwn_chantable_a = {
372	.channels = {
373		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
374		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
375		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
376		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
377		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
378		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
379		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
380		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
381		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
382		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
383		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
384		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
385		{ 6080, 216, 30 } },
386	.nchannels = 37
387};
388
389static const struct bwn_channelinfo bwn_chantable_n = {
390	.channels = {
391		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
392		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
393		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
394		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
395		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
396		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
397		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
398		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
399		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
400		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
401		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
402		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
403		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
404		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
405		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
406		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
407		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
408		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
409		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
410		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
411		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
412		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
413		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
414		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
415		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
416		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
417		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
418		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
419		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
420		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
421		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
422		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
423		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
424		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
425		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
426		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
427		{ 6130, 226, 30 }, { 6140, 228, 30 } },
428	.nchannels = 110
429};
430
431#define	VENDOR_LED_ACT(vendor)				\
432{							\
433	.vid = PCI_VENDOR_##vendor,			\
434	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
435}
436
437static const struct {
438	uint16_t	vid;
439	uint8_t		led_act[BWN_LED_MAX];
440} bwn_vendor_led_act[] = {
441	VENDOR_LED_ACT(COMPAQ),
442	VENDOR_LED_ACT(ASUSTEK)
443};
444
445static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
446	{ BWN_VENDOR_LED_ACT_DEFAULT };
447
448#undef VENDOR_LED_ACT
449
450static const struct {
451	int		on_dur;
452	int		off_dur;
453} bwn_led_duration[109] = {
454	[0]	= { 400, 100 },
455	[2]	= { 150, 75 },
456	[4]	= { 90, 45 },
457	[11]	= { 66, 34 },
458	[12]	= { 53, 26 },
459	[18]	= { 42, 21 },
460	[22]	= { 35, 17 },
461	[24]	= { 32, 16 },
462	[36]	= { 21, 10 },
463	[48]	= { 16, 8 },
464	[72]	= { 11, 5 },
465	[96]	= { 9, 4 },
466	[108]	= { 7, 3 }
467};
468
469static const uint16_t bwn_wme_shm_offsets[] = {
470	[0] = BWN_WME_BESTEFFORT,
471	[1] = BWN_WME_BACKGROUND,
472	[2] = BWN_WME_VOICE,
473	[3] = BWN_WME_VIDEO,
474};
475
476static const struct siba_devid bwn_devs[] = {
477	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
478	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
479	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
480	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
481	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
482	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
483	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
484	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
485	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
486};
487
488static int
489bwn_probe(device_t dev)
490{
491	int i;
492
493	for (i = 0; i < nitems(bwn_devs); i++) {
494		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
495		    siba_get_device(dev) == bwn_devs[i].sd_device &&
496		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
497			return (BUS_PROBE_DEFAULT);
498	}
499
500	return (ENXIO);
501}
502
503static int
504bwn_attach(device_t dev)
505{
506	struct bwn_mac *mac;
507	struct bwn_softc *sc = device_get_softc(dev);
508	int error, i, msic, reg;
509
510	sc->sc_dev = dev;
511#ifdef BWN_DEBUG
512	sc->sc_debug = bwn_debug;
513#endif
514
515	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
516		bwn_attach_pre(sc);
517		bwn_sprom_bugfixes(dev);
518		sc->sc_flags |= BWN_FLAG_ATTACHED;
519	}
520
521	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
522		if (siba_get_pci_device(dev) != 0x4313 &&
523		    siba_get_pci_device(dev) != 0x431a &&
524		    siba_get_pci_device(dev) != 0x4321) {
525			device_printf(sc->sc_dev,
526			    "skip 802.11 cores\n");
527			return (ENODEV);
528		}
529	}
530
531	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
532	mac->mac_sc = sc;
533	mac->mac_status = BWN_MAC_STATUS_UNINIT;
534	if (bwn_bfp != 0)
535		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
536
537	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
538	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
539	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
540
541	error = bwn_attach_core(mac);
542	if (error)
543		goto fail0;
544	bwn_led_attach(mac);
545
546	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
547	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
548	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
549	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
550	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
551	    mac->mac_phy.rf_rev);
552	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
553		device_printf(sc->sc_dev, "DMA (%d bits)\n",
554		    mac->mac_method.dma.dmatype);
555	else
556		device_printf(sc->sc_dev, "PIO\n");
557
558	/*
559	 * setup PCI resources and interrupt.
560	 */
561	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
562		msic = pci_msi_count(dev);
563		if (bootverbose)
564			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
565	} else
566		msic = 0;
567
568	mac->mac_intr_spec = bwn_res_spec_legacy;
569	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
570		if (pci_alloc_msi(dev, &msic) == 0) {
571			device_printf(sc->sc_dev,
572			    "Using %d MSI messages\n", msic);
573			mac->mac_intr_spec = bwn_res_spec_msi;
574			mac->mac_msi = 1;
575		}
576	}
577
578	error = bus_alloc_resources(dev, mac->mac_intr_spec,
579	    mac->mac_res_irq);
580	if (error) {
581		device_printf(sc->sc_dev,
582		    "couldn't allocate IRQ resources (%d)\n", error);
583		goto fail1;
584	}
585
586	if (mac->mac_msi == 0)
587		error = bus_setup_intr(dev, mac->mac_res_irq[0],
588		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
589		    &mac->mac_intrhand[0]);
590	else {
591		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
592			error = bus_setup_intr(dev, mac->mac_res_irq[i],
593			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
594			    &mac->mac_intrhand[i]);
595			if (error != 0) {
596				device_printf(sc->sc_dev,
597				    "couldn't setup interrupt (%d)\n", error);
598				break;
599			}
600		}
601	}
602
603	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
604
605	/*
606	 * calls attach-post routine
607	 */
608	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
609		bwn_attach_post(sc);
610
611	return (0);
612fail1:
613	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
614		pci_release_msi(dev);
615fail0:
616	free(mac, M_DEVBUF);
617	return (error);
618}
619
620static int
621bwn_is_valid_ether_addr(uint8_t *addr)
622{
623	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
624
625	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
626		return (FALSE);
627
628	return (TRUE);
629}
630
631static int
632bwn_attach_post(struct bwn_softc *sc)
633{
634	struct ieee80211com *ic = &sc->sc_ic;
635
636	ic->ic_softc = sc;
637	ic->ic_name = device_get_nameunit(sc->sc_dev);
638	/* XXX not right but it's not used anywhere important */
639	ic->ic_phytype = IEEE80211_T_OFDM;
640	ic->ic_opmode = IEEE80211_M_STA;
641	ic->ic_caps =
642		  IEEE80211_C_STA		/* station mode supported */
643		| IEEE80211_C_MONITOR		/* monitor mode */
644		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
645		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
646		| IEEE80211_C_SHSLOT		/* short slot time supported */
647		| IEEE80211_C_WME		/* WME/WMM supported */
648		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
649		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
650		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
651		;
652
653	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
654
655	IEEE80211_ADDR_COPY(ic->ic_macaddr,
656	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
657	    siba_sprom_get_mac_80211a(sc->sc_dev) :
658	    siba_sprom_get_mac_80211bg(sc->sc_dev));
659
660	/* call MI attach routine. */
661	ieee80211_ifattach(ic);
662
663	ic->ic_headroom = sizeof(struct bwn_txhdr);
664
665	/* override default methods */
666	ic->ic_raw_xmit = bwn_raw_xmit;
667	ic->ic_updateslot = bwn_updateslot;
668	ic->ic_update_promisc = bwn_update_promisc;
669	ic->ic_wme.wme_update = bwn_wme_update;
670	ic->ic_scan_start = bwn_scan_start;
671	ic->ic_scan_end = bwn_scan_end;
672	ic->ic_set_channel = bwn_set_channel;
673	ic->ic_vap_create = bwn_vap_create;
674	ic->ic_vap_delete = bwn_vap_delete;
675	ic->ic_transmit = bwn_transmit;
676	ic->ic_parent = bwn_parent;
677
678	ieee80211_radiotap_attach(ic,
679	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
680	    BWN_TX_RADIOTAP_PRESENT,
681	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
682	    BWN_RX_RADIOTAP_PRESENT);
683
684	bwn_sysctl_node(sc);
685
686	if (bootverbose)
687		ieee80211_announce(ic);
688	return (0);
689}
690
691static void
692bwn_phy_detach(struct bwn_mac *mac)
693{
694
695	if (mac->mac_phy.detach != NULL)
696		mac->mac_phy.detach(mac);
697}
698
699static int
700bwn_detach(device_t dev)
701{
702	struct bwn_softc *sc = device_get_softc(dev);
703	struct bwn_mac *mac = sc->sc_curmac;
704	struct ieee80211com *ic = &sc->sc_ic;
705	int i;
706
707	sc->sc_flags |= BWN_FLAG_INVALID;
708
709	if (device_is_attached(sc->sc_dev)) {
710		BWN_LOCK(sc);
711		bwn_stop(sc);
712		BWN_UNLOCK(sc);
713		bwn_dma_free(mac);
714		callout_drain(&sc->sc_led_blink_ch);
715		callout_drain(&sc->sc_rfswitch_ch);
716		callout_drain(&sc->sc_task_ch);
717		callout_drain(&sc->sc_watchdog_ch);
718		bwn_phy_detach(mac);
719		ieee80211_draintask(ic, &mac->mac_hwreset);
720		ieee80211_draintask(ic, &mac->mac_txpower);
721		ieee80211_ifdetach(ic);
722	}
723	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
724	taskqueue_free(sc->sc_tq);
725
726	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
727		if (mac->mac_intrhand[i] != NULL) {
728			bus_teardown_intr(dev, mac->mac_res_irq[i],
729			    mac->mac_intrhand[i]);
730			mac->mac_intrhand[i] = NULL;
731		}
732	}
733	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
734	if (mac->mac_msi != 0)
735		pci_release_msi(dev);
736	mbufq_drain(&sc->sc_snd);
737	BWN_LOCK_DESTROY(sc);
738	return (0);
739}
740
741static void
742bwn_attach_pre(struct bwn_softc *sc)
743{
744
745	BWN_LOCK_INIT(sc);
746	TAILQ_INIT(&sc->sc_maclist);
747	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
748	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
749	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
750	mbufq_init(&sc->sc_snd, ifqmaxlen);
751	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
752		taskqueue_thread_enqueue, &sc->sc_tq);
753	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
754		"%s taskq", device_get_nameunit(sc->sc_dev));
755}
756
757static void
758bwn_sprom_bugfixes(device_t dev)
759{
760#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
761	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
762	 (siba_get_pci_device(dev) == _device) &&			\
763	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
764	 (siba_get_pci_subdevice(dev) == _subdevice))
765
766	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
767	    siba_get_pci_subdevice(dev) == 0x4e &&
768	    siba_get_pci_revid(dev) > 0x40)
769		siba_sprom_set_bf_lo(dev,
770		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
771	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
772	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
773		siba_sprom_set_bf_lo(dev,
774		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
775	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
776		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
777		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
778		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
779		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
780		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
781		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
782		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
783			siba_sprom_set_bf_lo(dev,
784			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
785	}
786#undef	BWN_ISDEV
787}
788
789static void
790bwn_parent(struct ieee80211com *ic)
791{
792	struct bwn_softc *sc = ic->ic_softc;
793	int startall = 0;
794
795	BWN_LOCK(sc);
796	if (ic->ic_nrunning > 0) {
797		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
798			bwn_init(sc);
799			startall = 1;
800		} else
801			bwn_update_promisc(ic);
802	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
803		bwn_stop(sc);
804	BWN_UNLOCK(sc);
805
806	if (startall)
807		ieee80211_start_all(ic);
808}
809
810static int
811bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
812{
813	struct bwn_softc *sc = ic->ic_softc;
814	int error;
815
816	BWN_LOCK(sc);
817	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
818		BWN_UNLOCK(sc);
819		return (ENXIO);
820	}
821	error = mbufq_enqueue(&sc->sc_snd, m);
822	if (error) {
823		BWN_UNLOCK(sc);
824		return (error);
825	}
826	bwn_start(sc);
827	BWN_UNLOCK(sc);
828	return (0);
829}
830
831static void
832bwn_start(struct bwn_softc *sc)
833{
834	struct bwn_mac *mac = sc->sc_curmac;
835	struct ieee80211_frame *wh;
836	struct ieee80211_node *ni;
837	struct ieee80211_key *k;
838	struct mbuf *m;
839
840	BWN_ASSERT_LOCKED(sc);
841
842	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
843	    mac->mac_status < BWN_MAC_STATUS_STARTED)
844		return;
845
846	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
847		if (bwn_tx_isfull(sc, m))
848			break;
849		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
850		if (ni == NULL) {
851			device_printf(sc->sc_dev, "unexpected NULL ni\n");
852			m_freem(m);
853			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
854			continue;
855		}
856		wh = mtod(m, struct ieee80211_frame *);
857		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
858			k = ieee80211_crypto_encap(ni, m);
859			if (k == NULL) {
860				if_inc_counter(ni->ni_vap->iv_ifp,
861				    IFCOUNTER_OERRORS, 1);
862				ieee80211_free_node(ni);
863				m_freem(m);
864				continue;
865			}
866		}
867		wh = NULL;	/* Catch any invalid use */
868		if (bwn_tx_start(sc, ni, m) != 0) {
869			if (ni != NULL) {
870				if_inc_counter(ni->ni_vap->iv_ifp,
871				    IFCOUNTER_OERRORS, 1);
872				ieee80211_free_node(ni);
873			}
874			continue;
875		}
876		sc->sc_watchdog_timer = 5;
877	}
878}
879
880static int
881bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
882{
883	struct bwn_dma_ring *dr;
884	struct bwn_mac *mac = sc->sc_curmac;
885	struct bwn_pio_txqueue *tq;
886	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
887
888	BWN_ASSERT_LOCKED(sc);
889
890	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
891		dr = bwn_dma_select(mac, M_WME_GETAC(m));
892		if (dr->dr_stop == 1 ||
893		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
894			dr->dr_stop = 1;
895			goto full;
896		}
897	} else {
898		tq = bwn_pio_select(mac, M_WME_GETAC(m));
899		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
900		    pktlen > (tq->tq_size - tq->tq_used))
901			goto full;
902	}
903	return (0);
904full:
905	mbufq_prepend(&sc->sc_snd, m);
906	return (1);
907}
908
909static int
910bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
911{
912	struct bwn_mac *mac = sc->sc_curmac;
913	int error;
914
915	BWN_ASSERT_LOCKED(sc);
916
917	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
918		m_freem(m);
919		return (ENXIO);
920	}
921
922	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
923	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
924	if (error) {
925		m_freem(m);
926		return (error);
927	}
928	return (0);
929}
930
931static int
932bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
933{
934	struct bwn_pio_txpkt *tp;
935	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
936	struct bwn_softc *sc = mac->mac_sc;
937	struct bwn_txhdr txhdr;
938	struct mbuf *m_new;
939	uint32_t ctl32;
940	int error;
941	uint16_t ctl16;
942
943	BWN_ASSERT_LOCKED(sc);
944
945	/* XXX TODO send packets after DTIM */
946
947	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
948	tp = TAILQ_FIRST(&tq->tq_pktlist);
949	tp->tp_ni = ni;
950	tp->tp_m = m;
951
952	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
953	if (error) {
954		device_printf(sc->sc_dev, "tx fail\n");
955		return (error);
956	}
957
958	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
959	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
960	tq->tq_free--;
961
962	if (siba_get_revid(sc->sc_dev) >= 8) {
963		/*
964		 * XXX please removes m_defrag(9)
965		 */
966		m_new = m_defrag(m, M_NOWAIT);
967		if (m_new == NULL) {
968			device_printf(sc->sc_dev,
969			    "%s: can't defrag TX buffer\n",
970			    __func__);
971			return (ENOBUFS);
972		}
973		if (m_new->m_next != NULL)
974			device_printf(sc->sc_dev,
975			    "TODO: fragmented packets for PIO\n");
976		tp->tp_m = m_new;
977
978		/* send HEADER */
979		ctl32 = bwn_pio_write_multi_4(mac, tq,
980		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
981			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
982		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
983		/* send BODY */
984		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
985		    mtod(m_new, const void *), m_new->m_pkthdr.len);
986		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
987		    ctl32 | BWN_PIO8_TXCTL_EOF);
988	} else {
989		ctl16 = bwn_pio_write_multi_2(mac, tq,
990		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
991			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
992		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
993		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
994		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
995		    ctl16 | BWN_PIO_TXCTL_EOF);
996	}
997
998	return (0);
999}
1000
1001static struct bwn_pio_txqueue *
1002bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1003{
1004
1005	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1006		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1007
1008	switch (prio) {
1009	case 0:
1010		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1011	case 1:
1012		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1013	case 2:
1014		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1015	case 3:
1016		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1017	}
1018	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1019	return (NULL);
1020}
1021
1022static int
1023bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1024{
1025#define	BWN_GET_TXHDRCACHE(slot)					\
1026	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1027	struct bwn_dma *dma = &mac->mac_method.dma;
1028	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1029	struct bwn_dmadesc_generic *desc;
1030	struct bwn_dmadesc_meta *mt;
1031	struct bwn_softc *sc = mac->mac_sc;
1032	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1033	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1034
1035	BWN_ASSERT_LOCKED(sc);
1036	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1037
1038	/* XXX send after DTIM */
1039
1040	slot = bwn_dma_getslot(dr);
1041	dr->getdesc(dr, slot, &desc, &mt);
1042	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1043	    ("%s:%d: fail", __func__, __LINE__));
1044
1045	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1046	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1047	    BWN_DMA_COOKIE(dr, slot));
1048	if (error)
1049		goto fail;
1050	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1051	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1052	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1053	if (error) {
1054		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1055		    __func__, error);
1056		goto fail;
1057	}
1058	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1059	    BUS_DMASYNC_PREWRITE);
1060	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1061	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1062	    BUS_DMASYNC_PREWRITE);
1063
1064	slot = bwn_dma_getslot(dr);
1065	dr->getdesc(dr, slot, &desc, &mt);
1066	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1067	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1068	mt->mt_m = m;
1069	mt->mt_ni = ni;
1070
1071	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1072	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1073	if (error && error != EFBIG) {
1074		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1075		    __func__, error);
1076		goto fail;
1077	}
1078	if (error) {    /* error == EFBIG */
1079		struct mbuf *m_new;
1080
1081		m_new = m_defrag(m, M_NOWAIT);
1082		if (m_new == NULL) {
1083			device_printf(sc->sc_dev,
1084			    "%s: can't defrag TX buffer\n",
1085			    __func__);
1086			error = ENOBUFS;
1087			goto fail;
1088		} else {
1089			m = m_new;
1090		}
1091
1092		mt->mt_m = m;
1093		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1094		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1095		if (error) {
1096			device_printf(sc->sc_dev,
1097			    "%s: can't load TX buffer (2) %d\n",
1098			    __func__, error);
1099			goto fail;
1100		}
1101	}
1102	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1103	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1104	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1105	    BUS_DMASYNC_PREWRITE);
1106
1107	/* XXX send after DTIM */
1108
1109	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1110	return (0);
1111fail:
1112	dr->dr_curslot = backup[0];
1113	dr->dr_usedslot = backup[1];
1114	return (error);
1115#undef BWN_GET_TXHDRCACHE
1116}
1117
1118static void
1119bwn_watchdog(void *arg)
1120{
1121	struct bwn_softc *sc = arg;
1122
1123	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1124		device_printf(sc->sc_dev, "device timeout\n");
1125		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1126	}
1127	callout_schedule(&sc->sc_watchdog_ch, hz);
1128}
1129
1130static int
1131bwn_attach_core(struct bwn_mac *mac)
1132{
1133	struct bwn_softc *sc = mac->mac_sc;
1134	int error, have_bg = 0, have_a = 0;
1135	uint32_t high;
1136
1137	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1138	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1139
1140	siba_powerup(sc->sc_dev, 0);
1141
1142	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1143	bwn_reset_core(mac,
1144	    (high & BWN_TGSHIGH_HAVE_2GHZ) ? BWN_TGSLOW_SUPPORT_G : 0);
1145	error = bwn_phy_getinfo(mac, high);
1146	if (error)
1147		goto fail;
1148
1149	have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1150	have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1151	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1152	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1153	    siba_get_pci_device(sc->sc_dev) != 0x4324) {
1154		have_a = have_bg = 0;
1155		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1156			have_a = 1;
1157		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1158		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1159		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1160			have_bg = 1;
1161		else
1162			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1163			    mac->mac_phy.type));
1164	}
1165	/* XXX turns off PHY A because it's not supported */
1166	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1167	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1168		have_a = 0;
1169		have_bg = 1;
1170	}
1171
1172	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1173		mac->mac_phy.attach = bwn_phy_g_attach;
1174		mac->mac_phy.detach = bwn_phy_g_detach;
1175		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1176		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1177		mac->mac_phy.init = bwn_phy_g_init;
1178		mac->mac_phy.exit = bwn_phy_g_exit;
1179		mac->mac_phy.phy_read = bwn_phy_g_read;
1180		mac->mac_phy.phy_write = bwn_phy_g_write;
1181		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1182		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1183		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1184		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1185		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1186		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1187		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1188		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1189		mac->mac_phy.set_im = bwn_phy_g_im;
1190		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1191		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1192		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1193		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1194	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1195		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1196		mac->mac_phy.init = bwn_phy_lp_init;
1197		mac->mac_phy.phy_read = bwn_phy_lp_read;
1198		mac->mac_phy.phy_write = bwn_phy_lp_write;
1199		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1200		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1201		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1202		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1203		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1204		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1205		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1206		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1207		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1208	} else {
1209		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1210		    mac->mac_phy.type);
1211		error = ENXIO;
1212		goto fail;
1213	}
1214
1215	mac->mac_phy.gmode = have_bg;
1216	if (mac->mac_phy.attach != NULL) {
1217		error = mac->mac_phy.attach(mac);
1218		if (error) {
1219			device_printf(sc->sc_dev, "failed\n");
1220			goto fail;
1221		}
1222	}
1223
1224	bwn_reset_core(mac, have_bg ? BWN_TGSLOW_SUPPORT_G : 0);
1225
1226	error = bwn_chiptest(mac);
1227	if (error)
1228		goto fail;
1229	error = bwn_setup_channels(mac, have_bg, have_a);
1230	if (error) {
1231		device_printf(sc->sc_dev, "failed to setup channels\n");
1232		goto fail;
1233	}
1234
1235	if (sc->sc_curmac == NULL)
1236		sc->sc_curmac = mac;
1237
1238	error = bwn_dma_attach(mac);
1239	if (error != 0) {
1240		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1241		goto fail;
1242	}
1243
1244	mac->mac_phy.switch_analog(mac, 0);
1245
1246	siba_dev_down(sc->sc_dev, 0);
1247fail:
1248	siba_powerdown(sc->sc_dev);
1249	return (error);
1250}
1251
1252void
1253bwn_reset_core(struct bwn_mac *mac, uint32_t flags)
1254{
1255	struct bwn_softc *sc = mac->mac_sc;
1256	uint32_t low, ctl;
1257
1258	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1259
1260	siba_dev_up(sc->sc_dev, flags);
1261	DELAY(2000);
1262
1263	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1264	    ~BWN_TGSLOW_PHYRESET;
1265	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1266	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1267	DELAY(1000);
1268	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1269	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1270	DELAY(1000);
1271
1272	if (mac->mac_phy.switch_analog != NULL)
1273		mac->mac_phy.switch_analog(mac, 1);
1274
1275	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1276	if (flags & BWN_TGSLOW_SUPPORT_G)
1277		ctl |= BWN_MACCTL_GMODE;
1278	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1279}
1280
1281static int
1282bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1283{
1284	struct bwn_phy *phy = &mac->mac_phy;
1285	struct bwn_softc *sc = mac->mac_sc;
1286	uint32_t tmp;
1287
1288	/* PHY */
1289	tmp = BWN_READ_2(mac, BWN_PHYVER);
1290	phy->gmode = (tgshigh & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1291	phy->rf_on = 1;
1292	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1293	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1294	phy->rev = (tmp & BWN_PHYVER_VERSION);
1295	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1296	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1297		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1298	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1299	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1300	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1301		goto unsupphy;
1302
1303	/* RADIO */
1304	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1305		if (siba_get_chiprev(sc->sc_dev) == 0)
1306			tmp = 0x3205017f;
1307		else if (siba_get_chiprev(sc->sc_dev) == 1)
1308			tmp = 0x4205017f;
1309		else
1310			tmp = 0x5205017f;
1311	} else {
1312		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1313		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1314		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1315		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1316	}
1317	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1318	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1319	phy->rf_manuf = (tmp & 0x00000fff);
1320	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1321		goto unsupradio;
1322	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1323	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1324	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1325	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1326	    (phy->type == BWN_PHYTYPE_N &&
1327	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1328	    (phy->type == BWN_PHYTYPE_LP &&
1329	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1330		goto unsupradio;
1331
1332	return (0);
1333unsupphy:
1334	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1335	    "analog %#x)\n",
1336	    phy->type, phy->rev, phy->analog);
1337	return (ENXIO);
1338unsupradio:
1339	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1340	    "rev %#x)\n",
1341	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1342	return (ENXIO);
1343}
1344
1345static int
1346bwn_chiptest(struct bwn_mac *mac)
1347{
1348#define	TESTVAL0	0x55aaaa55
1349#define	TESTVAL1	0xaa5555aa
1350	struct bwn_softc *sc = mac->mac_sc;
1351	uint32_t v, backup;
1352
1353	BWN_LOCK(sc);
1354
1355	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1356
1357	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1358	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1359		goto error;
1360	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1361	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1362		goto error;
1363
1364	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1365
1366	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1367	    (siba_get_revid(sc->sc_dev) <= 10)) {
1368		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1369		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1370		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1371			goto error;
1372		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1373			goto error;
1374	}
1375	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1376
1377	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1378	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1379		goto error;
1380
1381	BWN_UNLOCK(sc);
1382	return (0);
1383error:
1384	BWN_UNLOCK(sc);
1385	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1386	return (ENODEV);
1387}
1388
1389#define	IEEE80211_CHAN_HTG	(IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1390#define	IEEE80211_CHAN_HTA	(IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1391
1392static int
1393bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1394{
1395	struct bwn_softc *sc = mac->mac_sc;
1396	struct ieee80211com *ic = &sc->sc_ic;
1397
1398	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1399	ic->ic_nchans = 0;
1400
1401	if (have_bg)
1402		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1403		    &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1404	if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1405		if (have_a)
1406			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1407			    &ic->ic_nchans, &bwn_chantable_n,
1408			    IEEE80211_CHAN_HTA);
1409	} else {
1410		if (have_a)
1411			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1412			    &ic->ic_nchans, &bwn_chantable_a,
1413			    IEEE80211_CHAN_A);
1414	}
1415
1416	mac->mac_phy.supports_2ghz = have_bg;
1417	mac->mac_phy.supports_5ghz = have_a;
1418
1419	return (ic->ic_nchans == 0 ? ENXIO : 0);
1420}
1421
1422uint32_t
1423bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1424{
1425	uint32_t ret;
1426
1427	BWN_ASSERT_LOCKED(mac->mac_sc);
1428
1429	if (way == BWN_SHARED) {
1430		KASSERT((offset & 0x0001) == 0,
1431		    ("%s:%d warn", __func__, __LINE__));
1432		if (offset & 0x0003) {
1433			bwn_shm_ctlword(mac, way, offset >> 2);
1434			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1435			ret <<= 16;
1436			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1437			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1438			goto out;
1439		}
1440		offset >>= 2;
1441	}
1442	bwn_shm_ctlword(mac, way, offset);
1443	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1444out:
1445	return (ret);
1446}
1447
1448uint16_t
1449bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1450{
1451	uint16_t ret;
1452
1453	BWN_ASSERT_LOCKED(mac->mac_sc);
1454
1455	if (way == BWN_SHARED) {
1456		KASSERT((offset & 0x0001) == 0,
1457		    ("%s:%d warn", __func__, __LINE__));
1458		if (offset & 0x0003) {
1459			bwn_shm_ctlword(mac, way, offset >> 2);
1460			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1461			goto out;
1462		}
1463		offset >>= 2;
1464	}
1465	bwn_shm_ctlword(mac, way, offset);
1466	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1467out:
1468
1469	return (ret);
1470}
1471
1472static void
1473bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1474    uint16_t offset)
1475{
1476	uint32_t control;
1477
1478	control = way;
1479	control <<= 16;
1480	control |= offset;
1481	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1482}
1483
1484void
1485bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1486    uint32_t value)
1487{
1488	BWN_ASSERT_LOCKED(mac->mac_sc);
1489
1490	if (way == BWN_SHARED) {
1491		KASSERT((offset & 0x0001) == 0,
1492		    ("%s:%d warn", __func__, __LINE__));
1493		if (offset & 0x0003) {
1494			bwn_shm_ctlword(mac, way, offset >> 2);
1495			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1496				    (value >> 16) & 0xffff);
1497			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1498			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1499			return;
1500		}
1501		offset >>= 2;
1502	}
1503	bwn_shm_ctlword(mac, way, offset);
1504	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1505}
1506
1507void
1508bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1509    uint16_t value)
1510{
1511	BWN_ASSERT_LOCKED(mac->mac_sc);
1512
1513	if (way == BWN_SHARED) {
1514		KASSERT((offset & 0x0001) == 0,
1515		    ("%s:%d warn", __func__, __LINE__));
1516		if (offset & 0x0003) {
1517			bwn_shm_ctlword(mac, way, offset >> 2);
1518			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1519			return;
1520		}
1521		offset >>= 2;
1522	}
1523	bwn_shm_ctlword(mac, way, offset);
1524	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1525}
1526
1527static void
1528bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1529    int txpow)
1530{
1531
1532	c->ic_freq = freq;
1533	c->ic_flags = flags;
1534	c->ic_ieee = ieee;
1535	c->ic_minpower = 0;
1536	c->ic_maxpower = 2 * txpow;
1537	c->ic_maxregpower = txpow;
1538}
1539
1540static void
1541bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1542    const struct bwn_channelinfo *ci, int flags)
1543{
1544	struct ieee80211_channel *c;
1545	int i;
1546
1547	c = &chans[*nchans];
1548
1549	for (i = 0; i < ci->nchannels; i++) {
1550		const struct bwn_channel *hc;
1551
1552		hc = &ci->channels[i];
1553		if (*nchans >= maxchans)
1554			break;
1555		bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1556		c++, (*nchans)++;
1557		if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1558			/* g channel have a separate b-only entry */
1559			if (*nchans >= maxchans)
1560				break;
1561			c[0] = c[-1];
1562			c[-1].ic_flags = IEEE80211_CHAN_B;
1563			c++, (*nchans)++;
1564		}
1565		if (flags == IEEE80211_CHAN_HTG) {
1566			/* HT g channel have a separate g-only entry */
1567			if (*nchans >= maxchans)
1568				break;
1569			c[-1].ic_flags = IEEE80211_CHAN_G;
1570			c[0] = c[-1];
1571			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1572			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1573			c++, (*nchans)++;
1574		}
1575		if (flags == IEEE80211_CHAN_HTA) {
1576			/* HT a channel have a separate a-only entry */
1577			if (*nchans >= maxchans)
1578				break;
1579			c[-1].ic_flags = IEEE80211_CHAN_A;
1580			c[0] = c[-1];
1581			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1582			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1583			c++, (*nchans)++;
1584		}
1585	}
1586}
1587
1588static int
1589bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1590	const struct ieee80211_bpf_params *params)
1591{
1592	struct ieee80211com *ic = ni->ni_ic;
1593	struct bwn_softc *sc = ic->ic_softc;
1594	struct bwn_mac *mac = sc->sc_curmac;
1595	int error;
1596
1597	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1598	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1599		m_freem(m);
1600		return (ENETDOWN);
1601	}
1602
1603	BWN_LOCK(sc);
1604	if (bwn_tx_isfull(sc, m)) {
1605		m_freem(m);
1606		BWN_UNLOCK(sc);
1607		return (ENOBUFS);
1608	}
1609
1610	error = bwn_tx_start(sc, ni, m);
1611	if (error == 0)
1612		sc->sc_watchdog_timer = 5;
1613	BWN_UNLOCK(sc);
1614	return (error);
1615}
1616
1617/*
1618 * Callback from the 802.11 layer to update the slot time
1619 * based on the current setting.  We use it to notify the
1620 * firmware of ERP changes and the f/w takes care of things
1621 * like slot time and preamble.
1622 */
1623static void
1624bwn_updateslot(struct ieee80211com *ic)
1625{
1626	struct bwn_softc *sc = ic->ic_softc;
1627	struct bwn_mac *mac;
1628
1629	BWN_LOCK(sc);
1630	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1631		mac = (struct bwn_mac *)sc->sc_curmac;
1632		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1633	}
1634	BWN_UNLOCK(sc);
1635}
1636
1637/*
1638 * Callback from the 802.11 layer after a promiscuous mode change.
1639 * Note this interface does not check the operating mode as this
1640 * is an internal callback and we are expected to honor the current
1641 * state (e.g. this is used for setting the interface in promiscuous
1642 * mode when operating in hostap mode to do ACS).
1643 */
1644static void
1645bwn_update_promisc(struct ieee80211com *ic)
1646{
1647	struct bwn_softc *sc = ic->ic_softc;
1648	struct bwn_mac *mac = sc->sc_curmac;
1649
1650	BWN_LOCK(sc);
1651	mac = sc->sc_curmac;
1652	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1653		if (ic->ic_promisc > 0)
1654			sc->sc_filters |= BWN_MACCTL_PROMISC;
1655		else
1656			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1657		bwn_set_opmode(mac);
1658	}
1659	BWN_UNLOCK(sc);
1660}
1661
1662/*
1663 * Callback from the 802.11 layer to update WME parameters.
1664 */
1665static int
1666bwn_wme_update(struct ieee80211com *ic)
1667{
1668	struct bwn_softc *sc = ic->ic_softc;
1669	struct bwn_mac *mac = sc->sc_curmac;
1670	struct wmeParams *wmep;
1671	int i;
1672
1673	BWN_LOCK(sc);
1674	mac = sc->sc_curmac;
1675	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1676		bwn_mac_suspend(mac);
1677		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1678			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1679			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1680		}
1681		bwn_mac_enable(mac);
1682	}
1683	BWN_UNLOCK(sc);
1684	return (0);
1685}
1686
1687static void
1688bwn_scan_start(struct ieee80211com *ic)
1689{
1690	struct bwn_softc *sc = ic->ic_softc;
1691	struct bwn_mac *mac;
1692
1693	BWN_LOCK(sc);
1694	mac = sc->sc_curmac;
1695	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1696		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1697		bwn_set_opmode(mac);
1698		/* disable CFP update during scan */
1699		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1700	}
1701	BWN_UNLOCK(sc);
1702}
1703
1704static void
1705bwn_scan_end(struct ieee80211com *ic)
1706{
1707	struct bwn_softc *sc = ic->ic_softc;
1708	struct bwn_mac *mac;
1709
1710	BWN_LOCK(sc);
1711	mac = sc->sc_curmac;
1712	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1713		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1714		bwn_set_opmode(mac);
1715		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1716	}
1717	BWN_UNLOCK(sc);
1718}
1719
1720static void
1721bwn_set_channel(struct ieee80211com *ic)
1722{
1723	struct bwn_softc *sc = ic->ic_softc;
1724	struct bwn_mac *mac = sc->sc_curmac;
1725	struct bwn_phy *phy = &mac->mac_phy;
1726	int chan, error;
1727
1728	BWN_LOCK(sc);
1729
1730	error = bwn_switch_band(sc, ic->ic_curchan);
1731	if (error)
1732		goto fail;
1733	bwn_mac_suspend(mac);
1734	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1735	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1736	if (chan != phy->chan)
1737		bwn_switch_channel(mac, chan);
1738
1739	/* TX power level */
1740	if (ic->ic_curchan->ic_maxpower != 0 &&
1741	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1742		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1743		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1744		    BWN_TXPWR_IGNORE_TSSI);
1745	}
1746
1747	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1748	if (phy->set_antenna)
1749		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1750
1751	if (sc->sc_rf_enabled != phy->rf_on) {
1752		if (sc->sc_rf_enabled) {
1753			bwn_rf_turnon(mac);
1754			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1755				device_printf(sc->sc_dev,
1756				    "please turn on the RF switch\n");
1757		} else
1758			bwn_rf_turnoff(mac);
1759	}
1760
1761	bwn_mac_enable(mac);
1762
1763fail:
1764	/*
1765	 * Setup radio tap channel freq and flags
1766	 */
1767	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1768		htole16(ic->ic_curchan->ic_freq);
1769	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1770		htole16(ic->ic_curchan->ic_flags & 0xffff);
1771
1772	BWN_UNLOCK(sc);
1773}
1774
1775static struct ieee80211vap *
1776bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1777    enum ieee80211_opmode opmode, int flags,
1778    const uint8_t bssid[IEEE80211_ADDR_LEN],
1779    const uint8_t mac[IEEE80211_ADDR_LEN])
1780{
1781	struct ieee80211vap *vap;
1782	struct bwn_vap *bvp;
1783
1784	switch (opmode) {
1785	case IEEE80211_M_HOSTAP:
1786	case IEEE80211_M_MBSS:
1787	case IEEE80211_M_STA:
1788	case IEEE80211_M_WDS:
1789	case IEEE80211_M_MONITOR:
1790	case IEEE80211_M_IBSS:
1791	case IEEE80211_M_AHDEMO:
1792		break;
1793	default:
1794		return (NULL);
1795	}
1796
1797	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1798	vap = &bvp->bv_vap;
1799	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1800	/* override with driver methods */
1801	bvp->bv_newstate = vap->iv_newstate;
1802	vap->iv_newstate = bwn_newstate;
1803
1804	/* override max aid so sta's cannot assoc when we're out of sta id's */
1805	vap->iv_max_aid = BWN_STAID_MAX;
1806
1807	ieee80211_ratectl_init(vap);
1808
1809	/* complete setup */
1810	ieee80211_vap_attach(vap, ieee80211_media_change,
1811	    ieee80211_media_status, mac);
1812	return (vap);
1813}
1814
1815static void
1816bwn_vap_delete(struct ieee80211vap *vap)
1817{
1818	struct bwn_vap *bvp = BWN_VAP(vap);
1819
1820	ieee80211_ratectl_deinit(vap);
1821	ieee80211_vap_detach(vap);
1822	free(bvp, M_80211_VAP);
1823}
1824
1825static int
1826bwn_init(struct bwn_softc *sc)
1827{
1828	struct bwn_mac *mac;
1829	int error;
1830
1831	BWN_ASSERT_LOCKED(sc);
1832
1833	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1834	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1835	sc->sc_filters = 0;
1836	bwn_wme_clear(sc);
1837	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1838	sc->sc_rf_enabled = 1;
1839
1840	mac = sc->sc_curmac;
1841	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1842		error = bwn_core_init(mac);
1843		if (error != 0)
1844			return (error);
1845	}
1846	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1847		bwn_core_start(mac);
1848
1849	bwn_set_opmode(mac);
1850	bwn_set_pretbtt(mac);
1851	bwn_spu_setdelay(mac, 0);
1852	bwn_set_macaddr(mac);
1853
1854	sc->sc_flags |= BWN_FLAG_RUNNING;
1855	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1856	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1857
1858	return (0);
1859}
1860
1861static void
1862bwn_stop(struct bwn_softc *sc)
1863{
1864	struct bwn_mac *mac = sc->sc_curmac;
1865
1866	BWN_ASSERT_LOCKED(sc);
1867
1868	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1869		/* XXX FIXME opmode not based on VAP */
1870		bwn_set_opmode(mac);
1871		bwn_set_macaddr(mac);
1872	}
1873
1874	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1875		bwn_core_stop(mac);
1876
1877	callout_stop(&sc->sc_led_blink_ch);
1878	sc->sc_led_blinking = 0;
1879
1880	bwn_core_exit(mac);
1881	sc->sc_rf_enabled = 0;
1882
1883	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1884}
1885
1886static void
1887bwn_wme_clear(struct bwn_softc *sc)
1888{
1889#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1890	struct wmeParams *p;
1891	unsigned int i;
1892
1893	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1894	    ("%s:%d: fail", __func__, __LINE__));
1895
1896	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1897		p = &(sc->sc_wmeParams[i]);
1898
1899		switch (bwn_wme_shm_offsets[i]) {
1900		case BWN_WME_VOICE:
1901			p->wmep_txopLimit = 0;
1902			p->wmep_aifsn = 2;
1903			/* XXX FIXME: log2(cwmin) */
1904			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1905			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1906			break;
1907		case BWN_WME_VIDEO:
1908			p->wmep_txopLimit = 0;
1909			p->wmep_aifsn = 2;
1910			/* XXX FIXME: log2(cwmin) */
1911			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1912			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1913			break;
1914		case BWN_WME_BESTEFFORT:
1915			p->wmep_txopLimit = 0;
1916			p->wmep_aifsn = 3;
1917			/* XXX FIXME: log2(cwmin) */
1918			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1919			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1920			break;
1921		case BWN_WME_BACKGROUND:
1922			p->wmep_txopLimit = 0;
1923			p->wmep_aifsn = 7;
1924			/* XXX FIXME: log2(cwmin) */
1925			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1926			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1927			break;
1928		default:
1929			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1930		}
1931	}
1932}
1933
1934static int
1935bwn_core_init(struct bwn_mac *mac)
1936{
1937	struct bwn_softc *sc = mac->mac_sc;
1938	uint64_t hf;
1939	int error;
1940
1941	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
1942	    ("%s:%d: fail", __func__, __LINE__));
1943
1944	siba_powerup(sc->sc_dev, 0);
1945	if (!siba_dev_isup(sc->sc_dev))
1946		bwn_reset_core(mac,
1947		    mac->mac_phy.gmode ? BWN_TGSLOW_SUPPORT_G : 0);
1948
1949	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
1950	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
1951	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
1952	BWN_GETTIME(mac->mac_phy.nexttime);
1953	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
1954	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
1955	mac->mac_stats.link_noise = -95;
1956	mac->mac_reason_intr = 0;
1957	bzero(mac->mac_reason, sizeof(mac->mac_reason));
1958	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
1959#ifdef BWN_DEBUG
1960	if (sc->sc_debug & BWN_DEBUG_XMIT)
1961		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
1962#endif
1963	mac->mac_suspended = 1;
1964	mac->mac_task_state = 0;
1965	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
1966
1967	mac->mac_phy.init_pre(mac);
1968
1969	siba_pcicore_intr(sc->sc_dev);
1970
1971	siba_fix_imcfglobug(sc->sc_dev);
1972	bwn_bt_disable(mac);
1973	if (mac->mac_phy.prepare_hw) {
1974		error = mac->mac_phy.prepare_hw(mac);
1975		if (error)
1976			goto fail0;
1977	}
1978	error = bwn_chip_init(mac);
1979	if (error)
1980		goto fail0;
1981	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
1982	    siba_get_revid(sc->sc_dev));
1983	hf = bwn_hf_read(mac);
1984	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1985		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
1986		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
1987			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
1988		if (mac->mac_phy.rev == 1)
1989			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
1990	}
1991	if (mac->mac_phy.rf_ver == 0x2050) {
1992		if (mac->mac_phy.rf_rev < 6)
1993			hf |= BWN_HF_FORCE_VCO_RECALC;
1994		if (mac->mac_phy.rf_rev == 6)
1995			hf |= BWN_HF_4318_TSSI;
1996	}
1997	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
1998		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
1999	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2000	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2001		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2002	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2003	bwn_hf_write(mac, hf);
2004
2005	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2006	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2007	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2008	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2009
2010	bwn_rate_init(mac);
2011	bwn_set_phytxctl(mac);
2012
2013	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2014	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2015	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2016
2017	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2018		bwn_pio_init(mac);
2019	else
2020		bwn_dma_init(mac);
2021	bwn_wme_init(mac);
2022	bwn_spu_setdelay(mac, 1);
2023	bwn_bt_enable(mac);
2024
2025	siba_powerup(sc->sc_dev,
2026	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2027	bwn_set_macaddr(mac);
2028	bwn_crypt_init(mac);
2029
2030	/* XXX LED initializatin */
2031
2032	mac->mac_status = BWN_MAC_STATUS_INITED;
2033
2034	return (error);
2035
2036fail0:
2037	siba_powerdown(sc->sc_dev);
2038	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2039	    ("%s:%d: fail", __func__, __LINE__));
2040	return (error);
2041}
2042
2043static void
2044bwn_core_start(struct bwn_mac *mac)
2045{
2046	struct bwn_softc *sc = mac->mac_sc;
2047	uint32_t tmp;
2048
2049	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2050	    ("%s:%d: fail", __func__, __LINE__));
2051
2052	if (siba_get_revid(sc->sc_dev) < 5)
2053		return;
2054
2055	while (1) {
2056		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2057		if (!(tmp & 0x00000001))
2058			break;
2059		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2060	}
2061
2062	bwn_mac_enable(mac);
2063	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2064	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2065
2066	mac->mac_status = BWN_MAC_STATUS_STARTED;
2067}
2068
2069static void
2070bwn_core_exit(struct bwn_mac *mac)
2071{
2072	struct bwn_softc *sc = mac->mac_sc;
2073	uint32_t macctl;
2074
2075	BWN_ASSERT_LOCKED(mac->mac_sc);
2076
2077	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2078	    ("%s:%d: fail", __func__, __LINE__));
2079
2080	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2081		return;
2082	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2083
2084	macctl = BWN_READ_4(mac, BWN_MACCTL);
2085	macctl &= ~BWN_MACCTL_MCODE_RUN;
2086	macctl |= BWN_MACCTL_MCODE_JMP0;
2087	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2088
2089	bwn_dma_stop(mac);
2090	bwn_pio_stop(mac);
2091	bwn_chip_exit(mac);
2092	mac->mac_phy.switch_analog(mac, 0);
2093	siba_dev_down(sc->sc_dev, 0);
2094	siba_powerdown(sc->sc_dev);
2095}
2096
2097static void
2098bwn_bt_disable(struct bwn_mac *mac)
2099{
2100	struct bwn_softc *sc = mac->mac_sc;
2101
2102	(void)sc;
2103	/* XXX do nothing yet */
2104}
2105
2106static int
2107bwn_chip_init(struct bwn_mac *mac)
2108{
2109	struct bwn_softc *sc = mac->mac_sc;
2110	struct bwn_phy *phy = &mac->mac_phy;
2111	uint32_t macctl;
2112	int error;
2113
2114	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2115	if (phy->gmode)
2116		macctl |= BWN_MACCTL_GMODE;
2117	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2118
2119	error = bwn_fw_fillinfo(mac);
2120	if (error)
2121		return (error);
2122	error = bwn_fw_loaducode(mac);
2123	if (error)
2124		return (error);
2125
2126	error = bwn_gpio_init(mac);
2127	if (error)
2128		return (error);
2129
2130	error = bwn_fw_loadinitvals(mac);
2131	if (error) {
2132		siba_gpio_set(sc->sc_dev, 0);
2133		return (error);
2134	}
2135	phy->switch_analog(mac, 1);
2136	error = bwn_phy_init(mac);
2137	if (error) {
2138		siba_gpio_set(sc->sc_dev, 0);
2139		return (error);
2140	}
2141	if (phy->set_im)
2142		phy->set_im(mac, BWN_IMMODE_NONE);
2143	if (phy->set_antenna)
2144		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2145	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2146
2147	if (phy->type == BWN_PHYTYPE_B)
2148		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2149	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2150	if (siba_get_revid(sc->sc_dev) < 5)
2151		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2152
2153	BWN_WRITE_4(mac, BWN_MACCTL,
2154	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2155	BWN_WRITE_4(mac, BWN_MACCTL,
2156	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2157	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2158
2159	bwn_set_opmode(mac);
2160	if (siba_get_revid(sc->sc_dev) < 3) {
2161		BWN_WRITE_2(mac, 0x060e, 0x0000);
2162		BWN_WRITE_2(mac, 0x0610, 0x8000);
2163		BWN_WRITE_2(mac, 0x0604, 0x0000);
2164		BWN_WRITE_2(mac, 0x0606, 0x0200);
2165	} else {
2166		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2167		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2168	}
2169	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2170	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2171	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2172	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2173	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2174	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2175	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2176	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
2177	    siba_read_4(sc->sc_dev, SIBA_TGSLOW) | 0x00100000);
2178	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2179	return (error);
2180}
2181
2182/* read hostflags */
2183uint64_t
2184bwn_hf_read(struct bwn_mac *mac)
2185{
2186	uint64_t ret;
2187
2188	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2189	ret <<= 16;
2190	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2191	ret <<= 16;
2192	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2193	return (ret);
2194}
2195
2196void
2197bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2198{
2199
2200	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2201	    (value & 0x00000000ffffull));
2202	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2203	    (value & 0x0000ffff0000ull) >> 16);
2204	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2205	    (value & 0xffff00000000ULL) >> 32);
2206}
2207
2208static void
2209bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2210{
2211
2212	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2213	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2214}
2215
2216static void
2217bwn_rate_init(struct bwn_mac *mac)
2218{
2219
2220	switch (mac->mac_phy.type) {
2221	case BWN_PHYTYPE_A:
2222	case BWN_PHYTYPE_G:
2223	case BWN_PHYTYPE_LP:
2224	case BWN_PHYTYPE_N:
2225		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2226		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2227		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2228		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2229		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2230		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2231		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2232		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2233			break;
2234		/* FALLTHROUGH */
2235	case BWN_PHYTYPE_B:
2236		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2237		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2238		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2239		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2240		break;
2241	default:
2242		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2243	}
2244}
2245
2246static void
2247bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2248{
2249	uint16_t offset;
2250
2251	if (ofdm) {
2252		offset = 0x480;
2253		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2254	} else {
2255		offset = 0x4c0;
2256		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2257	}
2258	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2259	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2260}
2261
2262static uint8_t
2263bwn_plcp_getcck(const uint8_t bitrate)
2264{
2265
2266	switch (bitrate) {
2267	case BWN_CCK_RATE_1MB:
2268		return (0x0a);
2269	case BWN_CCK_RATE_2MB:
2270		return (0x14);
2271	case BWN_CCK_RATE_5MB:
2272		return (0x37);
2273	case BWN_CCK_RATE_11MB:
2274		return (0x6e);
2275	}
2276	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2277	return (0);
2278}
2279
2280static uint8_t
2281bwn_plcp_getofdm(const uint8_t bitrate)
2282{
2283
2284	switch (bitrate) {
2285	case BWN_OFDM_RATE_6MB:
2286		return (0xb);
2287	case BWN_OFDM_RATE_9MB:
2288		return (0xf);
2289	case BWN_OFDM_RATE_12MB:
2290		return (0xa);
2291	case BWN_OFDM_RATE_18MB:
2292		return (0xe);
2293	case BWN_OFDM_RATE_24MB:
2294		return (0x9);
2295	case BWN_OFDM_RATE_36MB:
2296		return (0xd);
2297	case BWN_OFDM_RATE_48MB:
2298		return (0x8);
2299	case BWN_OFDM_RATE_54MB:
2300		return (0xc);
2301	}
2302	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2303	return (0);
2304}
2305
2306static void
2307bwn_set_phytxctl(struct bwn_mac *mac)
2308{
2309	uint16_t ctl;
2310
2311	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2312	    BWN_TX_PHY_TXPWR);
2313	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2314	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2315	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2316}
2317
2318static void
2319bwn_pio_init(struct bwn_mac *mac)
2320{
2321	struct bwn_pio *pio = &mac->mac_method.pio;
2322
2323	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2324	    & ~BWN_MACCTL_BIGENDIAN);
2325	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2326
2327	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2328	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2329	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2330	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2331	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2332	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2333}
2334
2335static void
2336bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2337    int index)
2338{
2339	struct bwn_pio_txpkt *tp;
2340	struct bwn_softc *sc = mac->mac_sc;
2341	unsigned int i;
2342
2343	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2344	tq->tq_index = index;
2345
2346	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2347	if (siba_get_revid(sc->sc_dev) >= 8)
2348		tq->tq_size = 1920;
2349	else {
2350		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2351		tq->tq_size -= 80;
2352	}
2353
2354	TAILQ_INIT(&tq->tq_pktlist);
2355	for (i = 0; i < N(tq->tq_pkts); i++) {
2356		tp = &(tq->tq_pkts[i]);
2357		tp->tp_index = i;
2358		tp->tp_queue = tq;
2359		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2360	}
2361}
2362
2363static uint16_t
2364bwn_pio_idx2base(struct bwn_mac *mac, int index)
2365{
2366	struct bwn_softc *sc = mac->mac_sc;
2367	static const uint16_t bases[] = {
2368		BWN_PIO_BASE0,
2369		BWN_PIO_BASE1,
2370		BWN_PIO_BASE2,
2371		BWN_PIO_BASE3,
2372		BWN_PIO_BASE4,
2373		BWN_PIO_BASE5,
2374		BWN_PIO_BASE6,
2375		BWN_PIO_BASE7,
2376	};
2377	static const uint16_t bases_rev11[] = {
2378		BWN_PIO11_BASE0,
2379		BWN_PIO11_BASE1,
2380		BWN_PIO11_BASE2,
2381		BWN_PIO11_BASE3,
2382		BWN_PIO11_BASE4,
2383		BWN_PIO11_BASE5,
2384	};
2385
2386	if (siba_get_revid(sc->sc_dev) >= 11) {
2387		if (index >= N(bases_rev11))
2388			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2389		return (bases_rev11[index]);
2390	}
2391	if (index >= N(bases))
2392		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2393	return (bases[index]);
2394}
2395
2396static void
2397bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2398    int index)
2399{
2400	struct bwn_softc *sc = mac->mac_sc;
2401
2402	prq->prq_mac = mac;
2403	prq->prq_rev = siba_get_revid(sc->sc_dev);
2404	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2405	bwn_dma_rxdirectfifo(mac, index, 1);
2406}
2407
2408static void
2409bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2410{
2411	if (tq == NULL)
2412		return;
2413	bwn_pio_cancel_tx_packets(tq);
2414}
2415
2416static void
2417bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2418{
2419
2420	bwn_destroy_pioqueue_tx(pio);
2421}
2422
2423static uint16_t
2424bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2425    uint16_t offset)
2426{
2427
2428	return (BWN_READ_2(mac, tq->tq_base + offset));
2429}
2430
2431static void
2432bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2433{
2434	uint32_t ctl;
2435	int type;
2436	uint16_t base;
2437
2438	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2439	base = bwn_dma_base(type, idx);
2440	if (type == BWN_DMA_64BIT) {
2441		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2442		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2443		if (enable)
2444			ctl |= BWN_DMA64_RXDIRECTFIFO;
2445		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2446	} else {
2447		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2448		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2449		if (enable)
2450			ctl |= BWN_DMA32_RXDIRECTFIFO;
2451		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2452	}
2453}
2454
2455static uint64_t
2456bwn_dma_mask(struct bwn_mac *mac)
2457{
2458	uint32_t tmp;
2459	uint16_t base;
2460
2461	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2462	if (tmp & SIBA_TGSHIGH_DMA64)
2463		return (BWN_DMA_BIT_MASK(64));
2464	base = bwn_dma_base(0, 0);
2465	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2466	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2467	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2468		return (BWN_DMA_BIT_MASK(32));
2469
2470	return (BWN_DMA_BIT_MASK(30));
2471}
2472
2473static int
2474bwn_dma_mask2type(uint64_t dmamask)
2475{
2476
2477	if (dmamask == BWN_DMA_BIT_MASK(30))
2478		return (BWN_DMA_30BIT);
2479	if (dmamask == BWN_DMA_BIT_MASK(32))
2480		return (BWN_DMA_32BIT);
2481	if (dmamask == BWN_DMA_BIT_MASK(64))
2482		return (BWN_DMA_64BIT);
2483	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2484	return (BWN_DMA_30BIT);
2485}
2486
2487static void
2488bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2489{
2490	struct bwn_pio_txpkt *tp;
2491	unsigned int i;
2492
2493	for (i = 0; i < N(tq->tq_pkts); i++) {
2494		tp = &(tq->tq_pkts[i]);
2495		if (tp->tp_m) {
2496			m_freem(tp->tp_m);
2497			tp->tp_m = NULL;
2498		}
2499	}
2500}
2501
2502static uint16_t
2503bwn_dma_base(int type, int controller_idx)
2504{
2505	static const uint16_t map64[] = {
2506		BWN_DMA64_BASE0,
2507		BWN_DMA64_BASE1,
2508		BWN_DMA64_BASE2,
2509		BWN_DMA64_BASE3,
2510		BWN_DMA64_BASE4,
2511		BWN_DMA64_BASE5,
2512	};
2513	static const uint16_t map32[] = {
2514		BWN_DMA32_BASE0,
2515		BWN_DMA32_BASE1,
2516		BWN_DMA32_BASE2,
2517		BWN_DMA32_BASE3,
2518		BWN_DMA32_BASE4,
2519		BWN_DMA32_BASE5,
2520	};
2521
2522	if (type == BWN_DMA_64BIT) {
2523		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2524		    ("%s:%d: fail", __func__, __LINE__));
2525		return (map64[controller_idx]);
2526	}
2527	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2528	    ("%s:%d: fail", __func__, __LINE__));
2529	return (map32[controller_idx]);
2530}
2531
2532static void
2533bwn_dma_init(struct bwn_mac *mac)
2534{
2535	struct bwn_dma *dma = &mac->mac_method.dma;
2536
2537	/* setup TX DMA channels. */
2538	bwn_dma_setup(dma->wme[WME_AC_BK]);
2539	bwn_dma_setup(dma->wme[WME_AC_BE]);
2540	bwn_dma_setup(dma->wme[WME_AC_VI]);
2541	bwn_dma_setup(dma->wme[WME_AC_VO]);
2542	bwn_dma_setup(dma->mcast);
2543	/* setup RX DMA channel. */
2544	bwn_dma_setup(dma->rx);
2545}
2546
2547static struct bwn_dma_ring *
2548bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2549    int for_tx, int type)
2550{
2551	struct bwn_dma *dma = &mac->mac_method.dma;
2552	struct bwn_dma_ring *dr;
2553	struct bwn_dmadesc_generic *desc;
2554	struct bwn_dmadesc_meta *mt;
2555	struct bwn_softc *sc = mac->mac_sc;
2556	int error, i;
2557
2558	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2559	if (dr == NULL)
2560		goto out;
2561	dr->dr_numslots = BWN_RXRING_SLOTS;
2562	if (for_tx)
2563		dr->dr_numslots = BWN_TXRING_SLOTS;
2564
2565	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2566	    M_DEVBUF, M_NOWAIT | M_ZERO);
2567	if (dr->dr_meta == NULL)
2568		goto fail0;
2569
2570	dr->dr_type = type;
2571	dr->dr_mac = mac;
2572	dr->dr_base = bwn_dma_base(type, controller_index);
2573	dr->dr_index = controller_index;
2574	if (type == BWN_DMA_64BIT) {
2575		dr->getdesc = bwn_dma_64_getdesc;
2576		dr->setdesc = bwn_dma_64_setdesc;
2577		dr->start_transfer = bwn_dma_64_start_transfer;
2578		dr->suspend = bwn_dma_64_suspend;
2579		dr->resume = bwn_dma_64_resume;
2580		dr->get_curslot = bwn_dma_64_get_curslot;
2581		dr->set_curslot = bwn_dma_64_set_curslot;
2582	} else {
2583		dr->getdesc = bwn_dma_32_getdesc;
2584		dr->setdesc = bwn_dma_32_setdesc;
2585		dr->start_transfer = bwn_dma_32_start_transfer;
2586		dr->suspend = bwn_dma_32_suspend;
2587		dr->resume = bwn_dma_32_resume;
2588		dr->get_curslot = bwn_dma_32_get_curslot;
2589		dr->set_curslot = bwn_dma_32_set_curslot;
2590	}
2591	if (for_tx) {
2592		dr->dr_tx = 1;
2593		dr->dr_curslot = -1;
2594	} else {
2595		if (dr->dr_index == 0) {
2596			dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2597			dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2598		} else
2599			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2600	}
2601
2602	error = bwn_dma_allocringmemory(dr);
2603	if (error)
2604		goto fail2;
2605
2606	if (for_tx) {
2607		/*
2608		 * Assumption: BWN_TXRING_SLOTS can be divided by
2609		 * BWN_TX_SLOTS_PER_FRAME
2610		 */
2611		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2612		    ("%s:%d: fail", __func__, __LINE__));
2613
2614		dr->dr_txhdr_cache =
2615		    malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2616			BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
2617		KASSERT(dr->dr_txhdr_cache != NULL,
2618		    ("%s:%d: fail", __func__, __LINE__));
2619
2620		/*
2621		 * Create TX ring DMA stuffs
2622		 */
2623		error = bus_dma_tag_create(dma->parent_dtag,
2624				    BWN_ALIGN, 0,
2625				    BUS_SPACE_MAXADDR,
2626				    BUS_SPACE_MAXADDR,
2627				    NULL, NULL,
2628				    BWN_HDRSIZE(mac),
2629				    1,
2630				    BUS_SPACE_MAXSIZE_32BIT,
2631				    0,
2632				    NULL, NULL,
2633				    &dr->dr_txring_dtag);
2634		if (error) {
2635			device_printf(sc->sc_dev,
2636			    "can't create TX ring DMA tag: TODO frees\n");
2637			goto fail1;
2638		}
2639
2640		for (i = 0; i < dr->dr_numslots; i += 2) {
2641			dr->getdesc(dr, i, &desc, &mt);
2642
2643			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2644			mt->mt_m = NULL;
2645			mt->mt_ni = NULL;
2646			mt->mt_islast = 0;
2647			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2648			    &mt->mt_dmap);
2649			if (error) {
2650				device_printf(sc->sc_dev,
2651				     "can't create RX buf DMA map\n");
2652				goto fail1;
2653			}
2654
2655			dr->getdesc(dr, i + 1, &desc, &mt);
2656
2657			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2658			mt->mt_m = NULL;
2659			mt->mt_ni = NULL;
2660			mt->mt_islast = 1;
2661			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2662			    &mt->mt_dmap);
2663			if (error) {
2664				device_printf(sc->sc_dev,
2665				     "can't create RX buf DMA map\n");
2666				goto fail1;
2667			}
2668		}
2669	} else {
2670		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2671		    &dr->dr_spare_dmap);
2672		if (error) {
2673			device_printf(sc->sc_dev,
2674			    "can't create RX buf DMA map\n");
2675			goto out;		/* XXX wrong! */
2676		}
2677
2678		for (i = 0; i < dr->dr_numslots; i++) {
2679			dr->getdesc(dr, i, &desc, &mt);
2680
2681			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2682			    &mt->mt_dmap);
2683			if (error) {
2684				device_printf(sc->sc_dev,
2685				    "can't create RX buf DMA map\n");
2686				goto out;	/* XXX wrong! */
2687			}
2688			error = bwn_dma_newbuf(dr, desc, mt, 1);
2689			if (error) {
2690				device_printf(sc->sc_dev,
2691				    "failed to allocate RX buf\n");
2692				goto out;	/* XXX wrong! */
2693			}
2694		}
2695
2696		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2697		    BUS_DMASYNC_PREWRITE);
2698
2699		dr->dr_usedslot = dr->dr_numslots;
2700	}
2701
2702      out:
2703	return (dr);
2704
2705fail2:
2706	free(dr->dr_txhdr_cache, M_DEVBUF);
2707fail1:
2708	free(dr->dr_meta, M_DEVBUF);
2709fail0:
2710	free(dr, M_DEVBUF);
2711	return (NULL);
2712}
2713
2714static void
2715bwn_dma_ringfree(struct bwn_dma_ring **dr)
2716{
2717
2718	if (dr == NULL)
2719		return;
2720
2721	bwn_dma_free_descbufs(*dr);
2722	bwn_dma_free_ringmemory(*dr);
2723
2724	free((*dr)->dr_txhdr_cache, M_DEVBUF);
2725	free((*dr)->dr_meta, M_DEVBUF);
2726	free(*dr, M_DEVBUF);
2727
2728	*dr = NULL;
2729}
2730
2731static void
2732bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2733    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2734{
2735	struct bwn_dmadesc32 *desc;
2736
2737	*meta = &(dr->dr_meta[slot]);
2738	desc = dr->dr_ring_descbase;
2739	desc = &(desc[slot]);
2740
2741	*gdesc = (struct bwn_dmadesc_generic *)desc;
2742}
2743
2744static void
2745bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2746    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2747    int start, int end, int irq)
2748{
2749	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2750	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2751	uint32_t addr, addrext, ctl;
2752	int slot;
2753
2754	slot = (int)(&(desc->dma.dma32) - descbase);
2755	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2756	    ("%s:%d: fail", __func__, __LINE__));
2757
2758	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2759	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2760	addr |= siba_dma_translation(sc->sc_dev);
2761	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2762	if (slot == dr->dr_numslots - 1)
2763		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2764	if (start)
2765		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2766	if (end)
2767		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2768	if (irq)
2769		ctl |= BWN_DMA32_DCTL_IRQ;
2770	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2771	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2772
2773	desc->dma.dma32.control = htole32(ctl);
2774	desc->dma.dma32.address = htole32(addr);
2775}
2776
2777static void
2778bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2779{
2780
2781	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2782	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2783}
2784
2785static void
2786bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2787{
2788
2789	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2790	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2791}
2792
2793static void
2794bwn_dma_32_resume(struct bwn_dma_ring *dr)
2795{
2796
2797	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2798	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2799}
2800
2801static int
2802bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2803{
2804	uint32_t val;
2805
2806	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2807	val &= BWN_DMA32_RXDPTR;
2808
2809	return (val / sizeof(struct bwn_dmadesc32));
2810}
2811
2812static void
2813bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2814{
2815
2816	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2817	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2818}
2819
2820static void
2821bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2822    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2823{
2824	struct bwn_dmadesc64 *desc;
2825
2826	*meta = &(dr->dr_meta[slot]);
2827	desc = dr->dr_ring_descbase;
2828	desc = &(desc[slot]);
2829
2830	*gdesc = (struct bwn_dmadesc_generic *)desc;
2831}
2832
2833static void
2834bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2835    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2836    int start, int end, int irq)
2837{
2838	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2839	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2840	int slot;
2841	uint32_t ctl0 = 0, ctl1 = 0;
2842	uint32_t addrlo, addrhi;
2843	uint32_t addrext;
2844
2845	slot = (int)(&(desc->dma.dma64) - descbase);
2846	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2847	    ("%s:%d: fail", __func__, __LINE__));
2848
2849	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2850	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2851	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2852	    30;
2853	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2854	if (slot == dr->dr_numslots - 1)
2855		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2856	if (start)
2857		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2858	if (end)
2859		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2860	if (irq)
2861		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2862	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2863	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2864	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2865
2866	desc->dma.dma64.control0 = htole32(ctl0);
2867	desc->dma.dma64.control1 = htole32(ctl1);
2868	desc->dma.dma64.address_low = htole32(addrlo);
2869	desc->dma.dma64.address_high = htole32(addrhi);
2870}
2871
2872static void
2873bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2874{
2875
2876	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2877	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2878}
2879
2880static void
2881bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2882{
2883
2884	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2885	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2886}
2887
2888static void
2889bwn_dma_64_resume(struct bwn_dma_ring *dr)
2890{
2891
2892	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2893	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2894}
2895
2896static int
2897bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2898{
2899	uint32_t val;
2900
2901	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2902	val &= BWN_DMA64_RXSTATDPTR;
2903
2904	return (val / sizeof(struct bwn_dmadesc64));
2905}
2906
2907static void
2908bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
2909{
2910
2911	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
2912	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2913}
2914
2915static int
2916bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
2917{
2918	struct bwn_mac *mac = dr->dr_mac;
2919	struct bwn_dma *dma = &mac->mac_method.dma;
2920	struct bwn_softc *sc = mac->mac_sc;
2921	int error;
2922
2923	error = bus_dma_tag_create(dma->parent_dtag,
2924			    BWN_ALIGN, 0,
2925			    BUS_SPACE_MAXADDR,
2926			    BUS_SPACE_MAXADDR,
2927			    NULL, NULL,
2928			    BWN_DMA_RINGMEMSIZE,
2929			    1,
2930			    BUS_SPACE_MAXSIZE_32BIT,
2931			    0,
2932			    NULL, NULL,
2933			    &dr->dr_ring_dtag);
2934	if (error) {
2935		device_printf(sc->sc_dev,
2936		    "can't create TX ring DMA tag: TODO frees\n");
2937		return (-1);
2938	}
2939
2940	error = bus_dmamem_alloc(dr->dr_ring_dtag,
2941	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
2942	    &dr->dr_ring_dmap);
2943	if (error) {
2944		device_printf(sc->sc_dev,
2945		    "can't allocate DMA mem: TODO frees\n");
2946		return (-1);
2947	}
2948	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
2949	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
2950	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
2951	if (error) {
2952		device_printf(sc->sc_dev,
2953		    "can't load DMA mem: TODO free\n");
2954		return (-1);
2955	}
2956
2957	return (0);
2958}
2959
2960static void
2961bwn_dma_setup(struct bwn_dma_ring *dr)
2962{
2963	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2964	uint64_t ring64;
2965	uint32_t addrext, ring32, value;
2966	uint32_t trans = siba_dma_translation(sc->sc_dev);
2967
2968	if (dr->dr_tx) {
2969		dr->dr_curslot = -1;
2970
2971		if (dr->dr_type == BWN_DMA_64BIT) {
2972			ring64 = (uint64_t)(dr->dr_ring_dmabase);
2973			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
2974			    >> 30;
2975			value = BWN_DMA64_TXENABLE;
2976			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
2977			    & BWN_DMA64_TXADDREXT_MASK;
2978			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
2979			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
2980			    (ring64 & 0xffffffff));
2981			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
2982			    ((ring64 >> 32) &
2983			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
2984		} else {
2985			ring32 = (uint32_t)(dr->dr_ring_dmabase);
2986			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
2987			value = BWN_DMA32_TXENABLE;
2988			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
2989			    & BWN_DMA32_TXADDREXT_MASK;
2990			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
2991			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
2992			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
2993		}
2994		return;
2995	}
2996
2997	/*
2998	 * set for RX
2999	 */
3000	dr->dr_usedslot = dr->dr_numslots;
3001
3002	if (dr->dr_type == BWN_DMA_64BIT) {
3003		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3004		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3005		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3006		value |= BWN_DMA64_RXENABLE;
3007		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3008		    & BWN_DMA64_RXADDREXT_MASK;
3009		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3010		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3011		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3012		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3013		    | (trans << 1));
3014		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3015		    sizeof(struct bwn_dmadesc64));
3016	} else {
3017		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3018		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3019		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3020		value |= BWN_DMA32_RXENABLE;
3021		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3022		    & BWN_DMA32_RXADDREXT_MASK;
3023		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3024		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3025		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3026		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3027		    sizeof(struct bwn_dmadesc32));
3028	}
3029}
3030
3031static void
3032bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3033{
3034
3035	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3036	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3037	    dr->dr_ring_dmap);
3038}
3039
3040static void
3041bwn_dma_cleanup(struct bwn_dma_ring *dr)
3042{
3043
3044	if (dr->dr_tx) {
3045		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3046		if (dr->dr_type == BWN_DMA_64BIT) {
3047			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3048			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3049		} else
3050			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3051	} else {
3052		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3053		if (dr->dr_type == BWN_DMA_64BIT) {
3054			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3055			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3056		} else
3057			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3058	}
3059}
3060
3061static void
3062bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3063{
3064	struct bwn_dmadesc_generic *desc;
3065	struct bwn_dmadesc_meta *meta;
3066	struct bwn_mac *mac = dr->dr_mac;
3067	struct bwn_dma *dma = &mac->mac_method.dma;
3068	struct bwn_softc *sc = mac->mac_sc;
3069	int i;
3070
3071	if (!dr->dr_usedslot)
3072		return;
3073	for (i = 0; i < dr->dr_numslots; i++) {
3074		dr->getdesc(dr, i, &desc, &meta);
3075
3076		if (meta->mt_m == NULL) {
3077			if (!dr->dr_tx)
3078				device_printf(sc->sc_dev, "%s: not TX?\n",
3079				    __func__);
3080			continue;
3081		}
3082		if (dr->dr_tx) {
3083			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3084				bus_dmamap_unload(dr->dr_txring_dtag,
3085				    meta->mt_dmap);
3086			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3087				bus_dmamap_unload(dma->txbuf_dtag,
3088				    meta->mt_dmap);
3089		} else
3090			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3091		bwn_dma_free_descbuf(dr, meta);
3092	}
3093}
3094
3095static int
3096bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3097    int type)
3098{
3099	struct bwn_softc *sc = mac->mac_sc;
3100	uint32_t value;
3101	int i;
3102	uint16_t offset;
3103
3104	for (i = 0; i < 10; i++) {
3105		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3106		    BWN_DMA32_TXSTATUS;
3107		value = BWN_READ_4(mac, base + offset);
3108		if (type == BWN_DMA_64BIT) {
3109			value &= BWN_DMA64_TXSTAT;
3110			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3111			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3112			    value == BWN_DMA64_TXSTAT_STOPPED)
3113				break;
3114		} else {
3115			value &= BWN_DMA32_TXSTATE;
3116			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3117			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3118			    value == BWN_DMA32_TXSTAT_STOPPED)
3119				break;
3120		}
3121		DELAY(1000);
3122	}
3123	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3124	BWN_WRITE_4(mac, base + offset, 0);
3125	for (i = 0; i < 10; i++) {
3126		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3127						   BWN_DMA32_TXSTATUS;
3128		value = BWN_READ_4(mac, base + offset);
3129		if (type == BWN_DMA_64BIT) {
3130			value &= BWN_DMA64_TXSTAT;
3131			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3132				i = -1;
3133				break;
3134			}
3135		} else {
3136			value &= BWN_DMA32_TXSTATE;
3137			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3138				i = -1;
3139				break;
3140			}
3141		}
3142		DELAY(1000);
3143	}
3144	if (i != -1) {
3145		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3146		return (ENODEV);
3147	}
3148	DELAY(1000);
3149
3150	return (0);
3151}
3152
3153static int
3154bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3155    int type)
3156{
3157	struct bwn_softc *sc = mac->mac_sc;
3158	uint32_t value;
3159	int i;
3160	uint16_t offset;
3161
3162	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3163	BWN_WRITE_4(mac, base + offset, 0);
3164	for (i = 0; i < 10; i++) {
3165		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3166		    BWN_DMA32_RXSTATUS;
3167		value = BWN_READ_4(mac, base + offset);
3168		if (type == BWN_DMA_64BIT) {
3169			value &= BWN_DMA64_RXSTAT;
3170			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3171				i = -1;
3172				break;
3173			}
3174		} else {
3175			value &= BWN_DMA32_RXSTATE;
3176			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3177				i = -1;
3178				break;
3179			}
3180		}
3181		DELAY(1000);
3182	}
3183	if (i != -1) {
3184		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3185		return (ENODEV);
3186	}
3187
3188	return (0);
3189}
3190
3191static void
3192bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3193    struct bwn_dmadesc_meta *meta)
3194{
3195
3196	if (meta->mt_m != NULL) {
3197		m_freem(meta->mt_m);
3198		meta->mt_m = NULL;
3199	}
3200	if (meta->mt_ni != NULL) {
3201		ieee80211_free_node(meta->mt_ni);
3202		meta->mt_ni = NULL;
3203	}
3204}
3205
3206static void
3207bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3208{
3209	struct bwn_rxhdr4 *rxhdr;
3210	unsigned char *frame;
3211
3212	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3213	rxhdr->frame_len = 0;
3214
3215	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3216	    sizeof(struct bwn_plcp6) + 2,
3217	    ("%s:%d: fail", __func__, __LINE__));
3218	frame = mtod(m, char *) + dr->dr_frameoffset;
3219	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3220}
3221
3222static uint8_t
3223bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3224{
3225	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3226
3227	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3228	    == 0xff);
3229}
3230
3231static void
3232bwn_wme_init(struct bwn_mac *mac)
3233{
3234
3235	bwn_wme_load(mac);
3236
3237	/* enable WME support. */
3238	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3239	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3240	    BWN_IFSCTL_USE_EDCF);
3241}
3242
3243static void
3244bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3245{
3246	struct bwn_softc *sc = mac->mac_sc;
3247	struct ieee80211com *ic = &sc->sc_ic;
3248	uint16_t delay;	/* microsec */
3249
3250	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3251	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3252		delay = 500;
3253	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3254		delay = max(delay, (uint16_t)2400);
3255
3256	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3257}
3258
3259static void
3260bwn_bt_enable(struct bwn_mac *mac)
3261{
3262	struct bwn_softc *sc = mac->mac_sc;
3263	uint64_t hf;
3264
3265	if (bwn_bluetooth == 0)
3266		return;
3267	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3268		return;
3269	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3270		return;
3271
3272	hf = bwn_hf_read(mac);
3273	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3274		hf |= BWN_HF_BT_COEXISTALT;
3275	else
3276		hf |= BWN_HF_BT_COEXIST;
3277	bwn_hf_write(mac, hf);
3278}
3279
3280static void
3281bwn_set_macaddr(struct bwn_mac *mac)
3282{
3283
3284	bwn_mac_write_bssid(mac);
3285	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3286	    mac->mac_sc->sc_ic.ic_macaddr);
3287}
3288
3289static void
3290bwn_clear_keys(struct bwn_mac *mac)
3291{
3292	int i;
3293
3294	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3295		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3296		    ("%s:%d: fail", __func__, __LINE__));
3297
3298		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3299		    NULL, BWN_SEC_KEYSIZE, NULL);
3300		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3301			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3302			    NULL, BWN_SEC_KEYSIZE, NULL);
3303		}
3304		mac->mac_key[i].keyconf = NULL;
3305	}
3306}
3307
3308static void
3309bwn_crypt_init(struct bwn_mac *mac)
3310{
3311	struct bwn_softc *sc = mac->mac_sc;
3312
3313	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3314	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3315	    ("%s:%d: fail", __func__, __LINE__));
3316	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3317	mac->mac_ktp *= 2;
3318	if (siba_get_revid(sc->sc_dev) >= 5)
3319		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3320	bwn_clear_keys(mac);
3321}
3322
3323static void
3324bwn_chip_exit(struct bwn_mac *mac)
3325{
3326	struct bwn_softc *sc = mac->mac_sc;
3327
3328	bwn_phy_exit(mac);
3329	siba_gpio_set(sc->sc_dev, 0);
3330}
3331
3332static int
3333bwn_fw_fillinfo(struct bwn_mac *mac)
3334{
3335	int error;
3336
3337	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3338	if (error == 0)
3339		return (0);
3340	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3341	if (error == 0)
3342		return (0);
3343	return (error);
3344}
3345
3346static int
3347bwn_gpio_init(struct bwn_mac *mac)
3348{
3349	struct bwn_softc *sc = mac->mac_sc;
3350	uint32_t mask = 0x1f, set = 0xf, value;
3351
3352	BWN_WRITE_4(mac, BWN_MACCTL,
3353	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3354	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3355	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3356
3357	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3358		mask |= 0x0060;
3359		set |= 0x0060;
3360	}
3361	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3362		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3363		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3364		mask |= 0x0200;
3365		set |= 0x0200;
3366	}
3367	if (siba_get_revid(sc->sc_dev) >= 2)
3368		mask |= 0x0010;
3369
3370	value = siba_gpio_get(sc->sc_dev);
3371	if (value == -1)
3372		return (0);
3373	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3374
3375	return (0);
3376}
3377
3378static int
3379bwn_fw_loadinitvals(struct bwn_mac *mac)
3380{
3381#define	GETFWOFFSET(fwp, offset)				\
3382	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3383	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3384	const struct bwn_fwhdr *hdr;
3385	struct bwn_fw *fw = &mac->mac_fw;
3386	int error;
3387
3388	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3389	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3390	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3391	if (error)
3392		return (error);
3393	if (fw->initvals_band.fw) {
3394		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3395		error = bwn_fwinitvals_write(mac,
3396		    GETFWOFFSET(fw->initvals_band, hdr_len),
3397		    be32toh(hdr->size),
3398		    fw->initvals_band.fw->datasize - hdr_len);
3399	}
3400	return (error);
3401#undef GETFWOFFSET
3402}
3403
3404static int
3405bwn_phy_init(struct bwn_mac *mac)
3406{
3407	struct bwn_softc *sc = mac->mac_sc;
3408	int error;
3409
3410	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3411	mac->mac_phy.rf_onoff(mac, 1);
3412	error = mac->mac_phy.init(mac);
3413	if (error) {
3414		device_printf(sc->sc_dev, "PHY init failed\n");
3415		goto fail0;
3416	}
3417	error = bwn_switch_channel(mac,
3418	    mac->mac_phy.get_default_chan(mac));
3419	if (error) {
3420		device_printf(sc->sc_dev,
3421		    "failed to switch default channel\n");
3422		goto fail1;
3423	}
3424	return (0);
3425fail1:
3426	if (mac->mac_phy.exit)
3427		mac->mac_phy.exit(mac);
3428fail0:
3429	mac->mac_phy.rf_onoff(mac, 0);
3430
3431	return (error);
3432}
3433
3434static void
3435bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3436{
3437	uint16_t ant;
3438	uint16_t tmp;
3439
3440	ant = bwn_ant2phy(antenna);
3441
3442	/* For ACK/CTS */
3443	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3444	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3445	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3446	/* For Probe Resposes */
3447	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3448	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3449	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3450}
3451
3452static void
3453bwn_set_opmode(struct bwn_mac *mac)
3454{
3455	struct bwn_softc *sc = mac->mac_sc;
3456	struct ieee80211com *ic = &sc->sc_ic;
3457	uint32_t ctl;
3458	uint16_t cfp_pretbtt;
3459
3460	ctl = BWN_READ_4(mac, BWN_MACCTL);
3461	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3462	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3463	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3464	ctl |= BWN_MACCTL_STA;
3465
3466	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3467	    ic->ic_opmode == IEEE80211_M_MBSS)
3468		ctl |= BWN_MACCTL_HOSTAP;
3469	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3470		ctl &= ~BWN_MACCTL_STA;
3471	ctl |= sc->sc_filters;
3472
3473	if (siba_get_revid(sc->sc_dev) <= 4)
3474		ctl |= BWN_MACCTL_PROMISC;
3475
3476	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3477
3478	cfp_pretbtt = 2;
3479	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3480		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3481		    siba_get_chiprev(sc->sc_dev) == 3)
3482			cfp_pretbtt = 100;
3483		else
3484			cfp_pretbtt = 50;
3485	}
3486	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3487}
3488
3489static int
3490bwn_dma_gettype(struct bwn_mac *mac)
3491{
3492	uint32_t tmp;
3493	uint16_t base;
3494
3495	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3496	if (tmp & SIBA_TGSHIGH_DMA64)
3497		return (BWN_DMA_64BIT);
3498	base = bwn_dma_base(0, 0);
3499	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3500	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3501	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3502		return (BWN_DMA_32BIT);
3503
3504	return (BWN_DMA_30BIT);
3505}
3506
3507static void
3508bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3509{
3510	if (!error) {
3511		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3512		*((bus_addr_t *)arg) = seg->ds_addr;
3513	}
3514}
3515
3516void
3517bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3518{
3519	struct bwn_phy *phy = &mac->mac_phy;
3520	struct bwn_softc *sc = mac->mac_sc;
3521	unsigned int i, max_loop;
3522	uint16_t value;
3523	uint32_t buffer[5] = {
3524		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3525	};
3526
3527	if (ofdm) {
3528		max_loop = 0x1e;
3529		buffer[0] = 0x000201cc;
3530	} else {
3531		max_loop = 0xfa;
3532		buffer[0] = 0x000b846e;
3533	}
3534
3535	BWN_ASSERT_LOCKED(mac->mac_sc);
3536
3537	for (i = 0; i < 5; i++)
3538		bwn_ram_write(mac, i * 4, buffer[i]);
3539
3540	BWN_WRITE_2(mac, 0x0568, 0x0000);
3541	BWN_WRITE_2(mac, 0x07c0,
3542	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3543
3544	value = (ofdm ? 0x41 : 0x40);
3545	BWN_WRITE_2(mac, 0x050c, value);
3546
3547	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3548	    phy->type == BWN_PHYTYPE_LCN)
3549		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3550	BWN_WRITE_2(mac, 0x0508, 0x0000);
3551	BWN_WRITE_2(mac, 0x050a, 0x0000);
3552	BWN_WRITE_2(mac, 0x054c, 0x0000);
3553	BWN_WRITE_2(mac, 0x056a, 0x0014);
3554	BWN_WRITE_2(mac, 0x0568, 0x0826);
3555	BWN_WRITE_2(mac, 0x0500, 0x0000);
3556
3557	/* XXX TODO: n phy pa override? */
3558
3559	switch (phy->type) {
3560	case BWN_PHYTYPE_N:
3561	case BWN_PHYTYPE_LCN:
3562		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3563		break;
3564	case BWN_PHYTYPE_LP:
3565		BWN_WRITE_2(mac, 0x0502, 0x0050);
3566		break;
3567	default:
3568		BWN_WRITE_2(mac, 0x0502, 0x0030);
3569		break;
3570	}
3571
3572	/* flush */
3573	BWN_READ_2(mac, 0x0502);
3574
3575	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3576		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3577	for (i = 0x00; i < max_loop; i++) {
3578		value = BWN_READ_2(mac, 0x050e);
3579		if (value & 0x0080)
3580			break;
3581		DELAY(10);
3582	}
3583	for (i = 0x00; i < 0x0a; i++) {
3584		value = BWN_READ_2(mac, 0x050e);
3585		if (value & 0x0400)
3586			break;
3587		DELAY(10);
3588	}
3589	for (i = 0x00; i < 0x19; i++) {
3590		value = BWN_READ_2(mac, 0x0690);
3591		if (!(value & 0x0100))
3592			break;
3593		DELAY(10);
3594	}
3595	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3596		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3597}
3598
3599void
3600bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3601{
3602	uint32_t macctl;
3603
3604	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3605
3606	macctl = BWN_READ_4(mac, BWN_MACCTL);
3607	if (macctl & BWN_MACCTL_BIGENDIAN)
3608		printf("TODO: need swap\n");
3609
3610	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3611	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3612	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3613}
3614
3615void
3616bwn_mac_suspend(struct bwn_mac *mac)
3617{
3618	struct bwn_softc *sc = mac->mac_sc;
3619	int i;
3620	uint32_t tmp;
3621
3622	KASSERT(mac->mac_suspended >= 0,
3623	    ("%s:%d: fail", __func__, __LINE__));
3624
3625	if (mac->mac_suspended == 0) {
3626		bwn_psctl(mac, BWN_PS_AWAKE);
3627		BWN_WRITE_4(mac, BWN_MACCTL,
3628			    BWN_READ_4(mac, BWN_MACCTL)
3629			    & ~BWN_MACCTL_ON);
3630		BWN_READ_4(mac, BWN_MACCTL);
3631		for (i = 35; i; i--) {
3632			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3633			if (tmp & BWN_INTR_MAC_SUSPENDED)
3634				goto out;
3635			DELAY(10);
3636		}
3637		for (i = 40; i; i--) {
3638			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3639			if (tmp & BWN_INTR_MAC_SUSPENDED)
3640				goto out;
3641			DELAY(1000);
3642		}
3643		device_printf(sc->sc_dev, "MAC suspend failed\n");
3644	}
3645out:
3646	mac->mac_suspended++;
3647}
3648
3649void
3650bwn_mac_enable(struct bwn_mac *mac)
3651{
3652	struct bwn_softc *sc = mac->mac_sc;
3653	uint16_t state;
3654
3655	state = bwn_shm_read_2(mac, BWN_SHARED,
3656	    BWN_SHARED_UCODESTAT);
3657	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3658	    state != BWN_SHARED_UCODESTAT_SLEEP)
3659		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3660
3661	mac->mac_suspended--;
3662	KASSERT(mac->mac_suspended >= 0,
3663	    ("%s:%d: fail", __func__, __LINE__));
3664	if (mac->mac_suspended == 0) {
3665		BWN_WRITE_4(mac, BWN_MACCTL,
3666		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3667		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3668		BWN_READ_4(mac, BWN_MACCTL);
3669		BWN_READ_4(mac, BWN_INTR_REASON);
3670		bwn_psctl(mac, 0);
3671	}
3672}
3673
3674void
3675bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3676{
3677	struct bwn_softc *sc = mac->mac_sc;
3678	int i;
3679	uint16_t ucstat;
3680
3681	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3682	    ("%s:%d: fail", __func__, __LINE__));
3683	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3684	    ("%s:%d: fail", __func__, __LINE__));
3685
3686	/* XXX forcibly awake and hwps-off */
3687
3688	BWN_WRITE_4(mac, BWN_MACCTL,
3689	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3690	    ~BWN_MACCTL_HWPS);
3691	BWN_READ_4(mac, BWN_MACCTL);
3692	if (siba_get_revid(sc->sc_dev) >= 5) {
3693		for (i = 0; i < 100; i++) {
3694			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3695			    BWN_SHARED_UCODESTAT);
3696			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3697				break;
3698			DELAY(10);
3699		}
3700	}
3701}
3702
3703static int
3704bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3705{
3706	struct bwn_softc *sc = mac->mac_sc;
3707	struct bwn_fw *fw = &mac->mac_fw;
3708	const uint8_t rev = siba_get_revid(sc->sc_dev);
3709	const char *filename;
3710	uint32_t high;
3711	int error;
3712
3713	/* microcode */
3714	if (rev >= 5 && rev <= 10)
3715		filename = "ucode5";
3716	else if (rev >= 11 && rev <= 12)
3717		filename = "ucode11";
3718	else if (rev == 13)
3719		filename = "ucode13";
3720	else if (rev == 14)
3721		filename = "ucode14";
3722	else if (rev >= 15)
3723		filename = "ucode15";
3724	else {
3725		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3726		bwn_release_firmware(mac);
3727		return (EOPNOTSUPP);
3728	}
3729	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3730	if (error) {
3731		bwn_release_firmware(mac);
3732		return (error);
3733	}
3734
3735	/* PCM */
3736	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3737	if (rev >= 5 && rev <= 10) {
3738		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3739		if (error == ENOENT)
3740			fw->no_pcmfile = 1;
3741		else if (error) {
3742			bwn_release_firmware(mac);
3743			return (error);
3744		}
3745	} else if (rev < 11) {
3746		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3747		return (EOPNOTSUPP);
3748	}
3749
3750	/* initvals */
3751	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3752	switch (mac->mac_phy.type) {
3753	case BWN_PHYTYPE_A:
3754		if (rev < 5 || rev > 10)
3755			goto fail1;
3756		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3757			filename = "a0g1initvals5";
3758		else
3759			filename = "a0g0initvals5";
3760		break;
3761	case BWN_PHYTYPE_G:
3762		if (rev >= 5 && rev <= 10)
3763			filename = "b0g0initvals5";
3764		else if (rev >= 13)
3765			filename = "b0g0initvals13";
3766		else
3767			goto fail1;
3768		break;
3769	case BWN_PHYTYPE_LP:
3770		if (rev == 13)
3771			filename = "lp0initvals13";
3772		else if (rev == 14)
3773			filename = "lp0initvals14";
3774		else if (rev >= 15)
3775			filename = "lp0initvals15";
3776		else
3777			goto fail1;
3778		break;
3779	case BWN_PHYTYPE_N:
3780		if (rev >= 11 && rev <= 12)
3781			filename = "n0initvals11";
3782		else
3783			goto fail1;
3784		break;
3785	default:
3786		goto fail1;
3787	}
3788	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3789	if (error) {
3790		bwn_release_firmware(mac);
3791		return (error);
3792	}
3793
3794	/* bandswitch initvals */
3795	switch (mac->mac_phy.type) {
3796	case BWN_PHYTYPE_A:
3797		if (rev >= 5 && rev <= 10) {
3798			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3799				filename = "a0g1bsinitvals5";
3800			else
3801				filename = "a0g0bsinitvals5";
3802		} else if (rev >= 11)
3803			filename = NULL;
3804		else
3805			goto fail1;
3806		break;
3807	case BWN_PHYTYPE_G:
3808		if (rev >= 5 && rev <= 10)
3809			filename = "b0g0bsinitvals5";
3810		else if (rev >= 11)
3811			filename = NULL;
3812		else
3813			goto fail1;
3814		break;
3815	case BWN_PHYTYPE_LP:
3816		if (rev == 13)
3817			filename = "lp0bsinitvals13";
3818		else if (rev == 14)
3819			filename = "lp0bsinitvals14";
3820		else if (rev >= 15)
3821			filename = "lp0bsinitvals15";
3822		else
3823			goto fail1;
3824		break;
3825	case BWN_PHYTYPE_N:
3826		if (rev >= 11 && rev <= 12)
3827			filename = "n0bsinitvals11";
3828		else
3829			goto fail1;
3830		break;
3831	default:
3832		goto fail1;
3833	}
3834	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
3835	if (error) {
3836		bwn_release_firmware(mac);
3837		return (error);
3838	}
3839	return (0);
3840fail1:
3841	device_printf(sc->sc_dev, "no INITVALS for rev %d\n", rev);
3842	bwn_release_firmware(mac);
3843	return (EOPNOTSUPP);
3844}
3845
3846static int
3847bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
3848    const char *name, struct bwn_fwfile *bfw)
3849{
3850	const struct bwn_fwhdr *hdr;
3851	struct bwn_softc *sc = mac->mac_sc;
3852	const struct firmware *fw;
3853	char namebuf[64];
3854
3855	if (name == NULL) {
3856		bwn_do_release_fw(bfw);
3857		return (0);
3858	}
3859	if (bfw->filename != NULL) {
3860		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
3861			return (0);
3862		bwn_do_release_fw(bfw);
3863	}
3864
3865	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
3866	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
3867	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
3868	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
3869	fw = firmware_get(namebuf);
3870	if (fw == NULL) {
3871		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
3872		    namebuf);
3873		return (ENOENT);
3874	}
3875	if (fw->datasize < sizeof(struct bwn_fwhdr))
3876		goto fail;
3877	hdr = (const struct bwn_fwhdr *)(fw->data);
3878	switch (hdr->type) {
3879	case BWN_FWTYPE_UCODE:
3880	case BWN_FWTYPE_PCM:
3881		if (be32toh(hdr->size) !=
3882		    (fw->datasize - sizeof(struct bwn_fwhdr)))
3883			goto fail;
3884		/* FALLTHROUGH */
3885	case BWN_FWTYPE_IV:
3886		if (hdr->ver != 1)
3887			goto fail;
3888		break;
3889	default:
3890		goto fail;
3891	}
3892	bfw->filename = name;
3893	bfw->fw = fw;
3894	bfw->type = type;
3895	return (0);
3896fail:
3897	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
3898	if (fw != NULL)
3899		firmware_put(fw, FIRMWARE_UNLOAD);
3900	return (EPROTO);
3901}
3902
3903static void
3904bwn_release_firmware(struct bwn_mac *mac)
3905{
3906
3907	bwn_do_release_fw(&mac->mac_fw.ucode);
3908	bwn_do_release_fw(&mac->mac_fw.pcm);
3909	bwn_do_release_fw(&mac->mac_fw.initvals);
3910	bwn_do_release_fw(&mac->mac_fw.initvals_band);
3911}
3912
3913static void
3914bwn_do_release_fw(struct bwn_fwfile *bfw)
3915{
3916
3917	if (bfw->fw != NULL)
3918		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
3919	bfw->fw = NULL;
3920	bfw->filename = NULL;
3921}
3922
3923static int
3924bwn_fw_loaducode(struct bwn_mac *mac)
3925{
3926#define	GETFWOFFSET(fwp, offset)	\
3927	((const uint32_t *)((const char *)fwp.fw->data + offset))
3928#define	GETFWSIZE(fwp, offset)	\
3929	((fwp.fw->datasize - offset) / sizeof(uint32_t))
3930	struct bwn_softc *sc = mac->mac_sc;
3931	const uint32_t *data;
3932	unsigned int i;
3933	uint32_t ctl;
3934	uint16_t date, fwcaps, time;
3935	int error = 0;
3936
3937	ctl = BWN_READ_4(mac, BWN_MACCTL);
3938	ctl |= BWN_MACCTL_MCODE_JMP0;
3939	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
3940	    __LINE__));
3941	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3942	for (i = 0; i < 64; i++)
3943		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
3944	for (i = 0; i < 4096; i += 2)
3945		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
3946
3947	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3948	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
3949	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3950	     i++) {
3951		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3952		DELAY(10);
3953	}
3954
3955	if (mac->mac_fw.pcm.fw) {
3956		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
3957		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
3958		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
3959		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
3960		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
3961		    sizeof(struct bwn_fwhdr)); i++) {
3962			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3963			DELAY(10);
3964		}
3965	}
3966
3967	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
3968	BWN_WRITE_4(mac, BWN_MACCTL,
3969	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
3970	    BWN_MACCTL_MCODE_RUN);
3971
3972	for (i = 0; i < 21; i++) {
3973		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
3974			break;
3975		if (i >= 20) {
3976			device_printf(sc->sc_dev, "ucode timeout\n");
3977			error = ENXIO;
3978			goto error;
3979		}
3980		DELAY(50000);
3981	}
3982	BWN_READ_4(mac, BWN_INTR_REASON);
3983
3984	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
3985	if (mac->mac_fw.rev <= 0x128) {
3986		device_printf(sc->sc_dev, "the firmware is too old\n");
3987		error = EOPNOTSUPP;
3988		goto error;
3989	}
3990
3991	/*
3992	 * Determine firmware header version; needed for TX/RX packet
3993	 * handling.
3994	 */
3995	if (mac->mac_fw.rev >= 598)
3996		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
3997	else if (mac->mac_fw.rev >= 410)
3998		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
3999	else
4000		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4001
4002	/*
4003	 * We don't support rev 598 or later; that requires
4004	 * another round of changes to the TX/RX descriptor
4005	 * and status layout.
4006	 *
4007	 * So, complain this is the case and exit out, rather
4008	 * than attaching and then failing.
4009	 */
4010	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4011		device_printf(sc->sc_dev,
4012		    "firmware is too new (>=598); not supported\n");
4013		error = EOPNOTSUPP;
4014		goto error;
4015	}
4016
4017	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4018	    BWN_SHARED_UCODE_PATCH);
4019	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4020	mac->mac_fw.opensource = (date == 0xffff);
4021	if (bwn_wme != 0)
4022		mac->mac_flags |= BWN_MAC_FLAG_WME;
4023	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4024
4025	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4026	if (mac->mac_fw.opensource == 0) {
4027		device_printf(sc->sc_dev,
4028		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4029		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4030		if (mac->mac_fw.no_pcmfile)
4031			device_printf(sc->sc_dev,
4032			    "no HW crypto acceleration due to pcm5\n");
4033	} else {
4034		mac->mac_fw.patch = time;
4035		fwcaps = bwn_fwcaps_read(mac);
4036		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4037			device_printf(sc->sc_dev,
4038			    "disabling HW crypto acceleration\n");
4039			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4040		}
4041		if (!(fwcaps & BWN_FWCAPS_WME)) {
4042			device_printf(sc->sc_dev, "disabling WME support\n");
4043			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4044		}
4045	}
4046
4047	if (BWN_ISOLDFMT(mac))
4048		device_printf(sc->sc_dev, "using old firmware image\n");
4049
4050	return (0);
4051
4052error:
4053	BWN_WRITE_4(mac, BWN_MACCTL,
4054	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4055	    BWN_MACCTL_MCODE_JMP0);
4056
4057	return (error);
4058#undef GETFWSIZE
4059#undef GETFWOFFSET
4060}
4061
4062/* OpenFirmware only */
4063static uint16_t
4064bwn_fwcaps_read(struct bwn_mac *mac)
4065{
4066
4067	KASSERT(mac->mac_fw.opensource == 1,
4068	    ("%s:%d: fail", __func__, __LINE__));
4069	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4070}
4071
4072static int
4073bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4074    size_t count, size_t array_size)
4075{
4076#define	GET_NEXTIV16(iv)						\
4077	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4078	    sizeof(uint16_t) + sizeof(uint16_t)))
4079#define	GET_NEXTIV32(iv)						\
4080	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4081	    sizeof(uint16_t) + sizeof(uint32_t)))
4082	struct bwn_softc *sc = mac->mac_sc;
4083	const struct bwn_fwinitvals *iv;
4084	uint16_t offset;
4085	size_t i;
4086	uint8_t bit32;
4087
4088	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4089	    ("%s:%d: fail", __func__, __LINE__));
4090	iv = ivals;
4091	for (i = 0; i < count; i++) {
4092		if (array_size < sizeof(iv->offset_size))
4093			goto fail;
4094		array_size -= sizeof(iv->offset_size);
4095		offset = be16toh(iv->offset_size);
4096		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4097		offset &= BWN_FWINITVALS_OFFSET_MASK;
4098		if (offset >= 0x1000)
4099			goto fail;
4100		if (bit32) {
4101			if (array_size < sizeof(iv->data.d32))
4102				goto fail;
4103			array_size -= sizeof(iv->data.d32);
4104			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4105			iv = GET_NEXTIV32(iv);
4106		} else {
4107
4108			if (array_size < sizeof(iv->data.d16))
4109				goto fail;
4110			array_size -= sizeof(iv->data.d16);
4111			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4112
4113			iv = GET_NEXTIV16(iv);
4114		}
4115	}
4116	if (array_size != 0)
4117		goto fail;
4118	return (0);
4119fail:
4120	device_printf(sc->sc_dev, "initvals: invalid format\n");
4121	return (EPROTO);
4122#undef GET_NEXTIV16
4123#undef GET_NEXTIV32
4124}
4125
4126int
4127bwn_switch_channel(struct bwn_mac *mac, int chan)
4128{
4129	struct bwn_phy *phy = &(mac->mac_phy);
4130	struct bwn_softc *sc = mac->mac_sc;
4131	struct ieee80211com *ic = &sc->sc_ic;
4132	uint16_t channelcookie, savedcookie;
4133	int error;
4134
4135	if (chan == 0xffff)
4136		chan = phy->get_default_chan(mac);
4137
4138	channelcookie = chan;
4139	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4140		channelcookie |= 0x100;
4141	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4142	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4143	error = phy->switch_channel(mac, chan);
4144	if (error)
4145		goto fail;
4146
4147	mac->mac_phy.chan = chan;
4148	DELAY(8000);
4149	return (0);
4150fail:
4151	device_printf(sc->sc_dev, "failed to switch channel\n");
4152	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4153	return (error);
4154}
4155
4156static uint16_t
4157bwn_ant2phy(int antenna)
4158{
4159
4160	switch (antenna) {
4161	case BWN_ANT0:
4162		return (BWN_TX_PHY_ANT0);
4163	case BWN_ANT1:
4164		return (BWN_TX_PHY_ANT1);
4165	case BWN_ANT2:
4166		return (BWN_TX_PHY_ANT2);
4167	case BWN_ANT3:
4168		return (BWN_TX_PHY_ANT3);
4169	case BWN_ANTAUTO:
4170		return (BWN_TX_PHY_ANT01AUTO);
4171	}
4172	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4173	return (0);
4174}
4175
4176static void
4177bwn_wme_load(struct bwn_mac *mac)
4178{
4179	struct bwn_softc *sc = mac->mac_sc;
4180	int i;
4181
4182	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4183	    ("%s:%d: fail", __func__, __LINE__));
4184
4185	bwn_mac_suspend(mac);
4186	for (i = 0; i < N(sc->sc_wmeParams); i++)
4187		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4188		    bwn_wme_shm_offsets[i]);
4189	bwn_mac_enable(mac);
4190}
4191
4192static void
4193bwn_wme_loadparams(struct bwn_mac *mac,
4194    const struct wmeParams *p, uint16_t shm_offset)
4195{
4196#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4197	struct bwn_softc *sc = mac->mac_sc;
4198	uint16_t params[BWN_NR_WMEPARAMS];
4199	int slot, tmp;
4200	unsigned int i;
4201
4202	slot = BWN_READ_2(mac, BWN_RNG) &
4203	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4204
4205	memset(&params, 0, sizeof(params));
4206
4207	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4208	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4209	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4210
4211	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4212	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4213	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4214	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4215	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4216	params[BWN_WMEPARAM_BSLOTS] = slot;
4217	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4218
4219	for (i = 0; i < N(params); i++) {
4220		if (i == BWN_WMEPARAM_STATUS) {
4221			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4222			    shm_offset + (i * 2));
4223			tmp |= 0x100;
4224			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4225			    tmp);
4226		} else {
4227			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4228			    params[i]);
4229		}
4230	}
4231}
4232
4233static void
4234bwn_mac_write_bssid(struct bwn_mac *mac)
4235{
4236	struct bwn_softc *sc = mac->mac_sc;
4237	uint32_t tmp;
4238	int i;
4239	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4240
4241	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4242	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4243	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4244	    IEEE80211_ADDR_LEN);
4245
4246	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4247		tmp = (uint32_t) (mac_bssid[i + 0]);
4248		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4249		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4250		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4251		bwn_ram_write(mac, 0x20 + i, tmp);
4252	}
4253}
4254
4255static void
4256bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4257    const uint8_t *macaddr)
4258{
4259	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4260	uint16_t data;
4261
4262	if (!mac)
4263		macaddr = zero;
4264
4265	offset |= 0x0020;
4266	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4267
4268	data = macaddr[0];
4269	data |= macaddr[1] << 8;
4270	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4271	data = macaddr[2];
4272	data |= macaddr[3] << 8;
4273	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4274	data = macaddr[4];
4275	data |= macaddr[5] << 8;
4276	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4277}
4278
4279static void
4280bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4281    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4282{
4283	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4284	uint8_t per_sta_keys_start = 8;
4285
4286	if (BWN_SEC_NEWAPI(mac))
4287		per_sta_keys_start = 4;
4288
4289	KASSERT(index < mac->mac_max_nr_keys,
4290	    ("%s:%d: fail", __func__, __LINE__));
4291	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4292	    ("%s:%d: fail", __func__, __LINE__));
4293
4294	if (index >= per_sta_keys_start)
4295		bwn_key_macwrite(mac, index, NULL);
4296	if (key)
4297		memcpy(buf, key, key_len);
4298	bwn_key_write(mac, index, algorithm, buf);
4299	if (index >= per_sta_keys_start)
4300		bwn_key_macwrite(mac, index, mac_addr);
4301
4302	mac->mac_key[index].algorithm = algorithm;
4303}
4304
4305static void
4306bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4307{
4308	struct bwn_softc *sc = mac->mac_sc;
4309	uint32_t addrtmp[2] = { 0, 0 };
4310	uint8_t start = 8;
4311
4312	if (BWN_SEC_NEWAPI(mac))
4313		start = 4;
4314
4315	KASSERT(index >= start,
4316	    ("%s:%d: fail", __func__, __LINE__));
4317	index -= start;
4318
4319	if (addr) {
4320		addrtmp[0] = addr[0];
4321		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4322		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4323		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4324		addrtmp[1] = addr[4];
4325		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4326	}
4327
4328	if (siba_get_revid(sc->sc_dev) >= 5) {
4329		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4330		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4331	} else {
4332		if (index >= 8) {
4333			bwn_shm_write_4(mac, BWN_SHARED,
4334			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4335			bwn_shm_write_2(mac, BWN_SHARED,
4336			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4337		}
4338	}
4339}
4340
4341static void
4342bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4343    const uint8_t *key)
4344{
4345	unsigned int i;
4346	uint32_t offset;
4347	uint16_t kidx, value;
4348
4349	kidx = BWN_SEC_KEY2FW(mac, index);
4350	bwn_shm_write_2(mac, BWN_SHARED,
4351	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4352
4353	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4354	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4355		value = key[i];
4356		value |= (uint16_t)(key[i + 1]) << 8;
4357		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4358	}
4359}
4360
4361static void
4362bwn_phy_exit(struct bwn_mac *mac)
4363{
4364
4365	mac->mac_phy.rf_onoff(mac, 0);
4366	if (mac->mac_phy.exit != NULL)
4367		mac->mac_phy.exit(mac);
4368}
4369
4370static void
4371bwn_dma_free(struct bwn_mac *mac)
4372{
4373	struct bwn_dma *dma;
4374
4375	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4376		return;
4377	dma = &mac->mac_method.dma;
4378
4379	bwn_dma_ringfree(&dma->rx);
4380	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4381	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4382	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4383	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4384	bwn_dma_ringfree(&dma->mcast);
4385}
4386
4387static void
4388bwn_core_stop(struct bwn_mac *mac)
4389{
4390	struct bwn_softc *sc = mac->mac_sc;
4391
4392	BWN_ASSERT_LOCKED(sc);
4393
4394	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4395		return;
4396
4397	callout_stop(&sc->sc_rfswitch_ch);
4398	callout_stop(&sc->sc_task_ch);
4399	callout_stop(&sc->sc_watchdog_ch);
4400	sc->sc_watchdog_timer = 0;
4401	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4402	BWN_READ_4(mac, BWN_INTR_MASK);
4403	bwn_mac_suspend(mac);
4404
4405	mac->mac_status = BWN_MAC_STATUS_INITED;
4406}
4407
4408static int
4409bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4410{
4411	struct bwn_mac *up_dev = NULL;
4412	struct bwn_mac *down_dev;
4413	struct bwn_mac *mac;
4414	int err, status;
4415	uint8_t gmode;
4416
4417	BWN_ASSERT_LOCKED(sc);
4418
4419	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4420		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4421		    mac->mac_phy.supports_2ghz) {
4422			up_dev = mac;
4423			gmode = 1;
4424		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4425		    mac->mac_phy.supports_5ghz) {
4426			up_dev = mac;
4427			gmode = 0;
4428		} else {
4429			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4430			return (EINVAL);
4431		}
4432		if (up_dev != NULL)
4433			break;
4434	}
4435	if (up_dev == NULL) {
4436		device_printf(sc->sc_dev, "Could not find a device\n");
4437		return (ENODEV);
4438	}
4439	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4440		return (0);
4441
4442	device_printf(sc->sc_dev, "switching to %s-GHz band\n",
4443	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4444
4445	down_dev = sc->sc_curmac;
4446	status = down_dev->mac_status;
4447	if (status >= BWN_MAC_STATUS_STARTED)
4448		bwn_core_stop(down_dev);
4449	if (status >= BWN_MAC_STATUS_INITED)
4450		bwn_core_exit(down_dev);
4451
4452	if (down_dev != up_dev)
4453		bwn_phy_reset(down_dev);
4454
4455	up_dev->mac_phy.gmode = gmode;
4456	if (status >= BWN_MAC_STATUS_INITED) {
4457		err = bwn_core_init(up_dev);
4458		if (err) {
4459			device_printf(sc->sc_dev,
4460			    "fatal: failed to initialize for %s-GHz\n",
4461			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4462			goto fail;
4463		}
4464	}
4465	if (status >= BWN_MAC_STATUS_STARTED)
4466		bwn_core_start(up_dev);
4467	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4468	sc->sc_curmac = up_dev;
4469
4470	return (0);
4471fail:
4472	sc->sc_curmac = NULL;
4473	return (err);
4474}
4475
4476static void
4477bwn_rf_turnon(struct bwn_mac *mac)
4478{
4479
4480	bwn_mac_suspend(mac);
4481	mac->mac_phy.rf_onoff(mac, 1);
4482	mac->mac_phy.rf_on = 1;
4483	bwn_mac_enable(mac);
4484}
4485
4486static void
4487bwn_rf_turnoff(struct bwn_mac *mac)
4488{
4489
4490	bwn_mac_suspend(mac);
4491	mac->mac_phy.rf_onoff(mac, 0);
4492	mac->mac_phy.rf_on = 0;
4493	bwn_mac_enable(mac);
4494}
4495
4496static void
4497bwn_phy_reset(struct bwn_mac *mac)
4498{
4499	struct bwn_softc *sc = mac->mac_sc;
4500
4501	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4502	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4503	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4504	DELAY(1000);
4505	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4506	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC) |
4507	    BWN_TGSLOW_PHYRESET);
4508	DELAY(1000);
4509}
4510
4511static int
4512bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4513{
4514	struct bwn_vap *bvp = BWN_VAP(vap);
4515	struct ieee80211com *ic= vap->iv_ic;
4516	enum ieee80211_state ostate = vap->iv_state;
4517	struct bwn_softc *sc = ic->ic_softc;
4518	struct bwn_mac *mac = sc->sc_curmac;
4519	int error;
4520
4521	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4522	    ieee80211_state_name[vap->iv_state],
4523	    ieee80211_state_name[nstate]);
4524
4525	error = bvp->bv_newstate(vap, nstate, arg);
4526	if (error != 0)
4527		return (error);
4528
4529	BWN_LOCK(sc);
4530
4531	bwn_led_newstate(mac, nstate);
4532
4533	/*
4534	 * Clear the BSSID when we stop a STA
4535	 */
4536	if (vap->iv_opmode == IEEE80211_M_STA) {
4537		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4538			/*
4539			 * Clear out the BSSID.  If we reassociate to
4540			 * the same AP, this will reinialize things
4541			 * correctly...
4542			 */
4543			if (ic->ic_opmode == IEEE80211_M_STA &&
4544			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4545				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4546				bwn_set_macaddr(mac);
4547			}
4548		}
4549	}
4550
4551	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4552	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4553		/* XXX nothing to do? */
4554	} else if (nstate == IEEE80211_S_RUN) {
4555		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4556		bwn_set_opmode(mac);
4557		bwn_set_pretbtt(mac);
4558		bwn_spu_setdelay(mac, 0);
4559		bwn_set_macaddr(mac);
4560	}
4561
4562	BWN_UNLOCK(sc);
4563
4564	return (error);
4565}
4566
4567static void
4568bwn_set_pretbtt(struct bwn_mac *mac)
4569{
4570	struct bwn_softc *sc = mac->mac_sc;
4571	struct ieee80211com *ic = &sc->sc_ic;
4572	uint16_t pretbtt;
4573
4574	if (ic->ic_opmode == IEEE80211_M_IBSS)
4575		pretbtt = 2;
4576	else
4577		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4578	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4579	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4580}
4581
4582static int
4583bwn_intr(void *arg)
4584{
4585	struct bwn_mac *mac = arg;
4586	struct bwn_softc *sc = mac->mac_sc;
4587	uint32_t reason;
4588
4589	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4590	    (sc->sc_flags & BWN_FLAG_INVALID))
4591		return (FILTER_STRAY);
4592
4593	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4594	if (reason == 0xffffffff)	/* shared IRQ */
4595		return (FILTER_STRAY);
4596	reason &= mac->mac_intr_mask;
4597	if (reason == 0)
4598		return (FILTER_HANDLED);
4599
4600	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4601	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4602	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4603	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4604	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4605	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4606	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4607	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4608	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4609	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4610	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4611
4612	/* Disable interrupts. */
4613	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4614
4615	mac->mac_reason_intr = reason;
4616
4617	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4618	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4619
4620	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4621	return (FILTER_HANDLED);
4622}
4623
4624static void
4625bwn_intrtask(void *arg, int npending)
4626{
4627	struct bwn_mac *mac = arg;
4628	struct bwn_softc *sc = mac->mac_sc;
4629	uint32_t merged = 0;
4630	int i, tx = 0, rx = 0;
4631
4632	BWN_LOCK(sc);
4633	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4634	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4635		BWN_UNLOCK(sc);
4636		return;
4637	}
4638
4639	for (i = 0; i < N(mac->mac_reason); i++)
4640		merged |= mac->mac_reason[i];
4641
4642	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4643		device_printf(sc->sc_dev, "MAC trans error\n");
4644
4645	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4646		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4647		mac->mac_phy.txerrors--;
4648		if (mac->mac_phy.txerrors == 0) {
4649			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4650			bwn_restart(mac, "PHY TX errors");
4651		}
4652	}
4653
4654	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4655		if (merged & BWN_DMAINTR_FATALMASK) {
4656			device_printf(sc->sc_dev,
4657			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4658			    mac->mac_reason[0], mac->mac_reason[1],
4659			    mac->mac_reason[2], mac->mac_reason[3],
4660			    mac->mac_reason[4], mac->mac_reason[5]);
4661			bwn_restart(mac, "DMA error");
4662			BWN_UNLOCK(sc);
4663			return;
4664		}
4665		if (merged & BWN_DMAINTR_NONFATALMASK) {
4666			device_printf(sc->sc_dev,
4667			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4668			    mac->mac_reason[0], mac->mac_reason[1],
4669			    mac->mac_reason[2], mac->mac_reason[3],
4670			    mac->mac_reason[4], mac->mac_reason[5]);
4671		}
4672	}
4673
4674	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4675		bwn_intr_ucode_debug(mac);
4676	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4677		bwn_intr_tbtt_indication(mac);
4678	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4679		bwn_intr_atim_end(mac);
4680	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4681		bwn_intr_beacon(mac);
4682	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4683		bwn_intr_pmq(mac);
4684	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4685		bwn_intr_noise(mac);
4686
4687	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4688		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4689			bwn_dma_rx(mac->mac_method.dma.rx);
4690			rx = 1;
4691		}
4692	} else
4693		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4694
4695	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4696	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4697	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4698	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4699	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4700
4701	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4702		bwn_intr_txeof(mac);
4703		tx = 1;
4704	}
4705
4706	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4707
4708	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4709		int evt = BWN_LED_EVENT_NONE;
4710
4711		if (tx && rx) {
4712			if (sc->sc_rx_rate > sc->sc_tx_rate)
4713				evt = BWN_LED_EVENT_RX;
4714			else
4715				evt = BWN_LED_EVENT_TX;
4716		} else if (tx) {
4717			evt = BWN_LED_EVENT_TX;
4718		} else if (rx) {
4719			evt = BWN_LED_EVENT_RX;
4720		} else if (rx == 0) {
4721			evt = BWN_LED_EVENT_POLL;
4722		}
4723
4724		if (evt != BWN_LED_EVENT_NONE)
4725			bwn_led_event(mac, evt);
4726       }
4727
4728	if (mbufq_first(&sc->sc_snd) != NULL)
4729		bwn_start(sc);
4730
4731	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4732	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4733
4734	BWN_UNLOCK(sc);
4735}
4736
4737static void
4738bwn_restart(struct bwn_mac *mac, const char *msg)
4739{
4740	struct bwn_softc *sc = mac->mac_sc;
4741	struct ieee80211com *ic = &sc->sc_ic;
4742
4743	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4744		return;
4745
4746	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4747	ieee80211_runtask(ic, &mac->mac_hwreset);
4748}
4749
4750static void
4751bwn_intr_ucode_debug(struct bwn_mac *mac)
4752{
4753	struct bwn_softc *sc = mac->mac_sc;
4754	uint16_t reason;
4755
4756	if (mac->mac_fw.opensource == 0)
4757		return;
4758
4759	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4760	switch (reason) {
4761	case BWN_DEBUGINTR_PANIC:
4762		bwn_handle_fwpanic(mac);
4763		break;
4764	case BWN_DEBUGINTR_DUMP_SHM:
4765		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4766		break;
4767	case BWN_DEBUGINTR_DUMP_REGS:
4768		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4769		break;
4770	case BWN_DEBUGINTR_MARKER:
4771		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4772		break;
4773	default:
4774		device_printf(sc->sc_dev,
4775		    "ucode debug unknown reason: %#x\n", reason);
4776	}
4777
4778	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4779	    BWN_DEBUGINTR_ACK);
4780}
4781
4782static void
4783bwn_intr_tbtt_indication(struct bwn_mac *mac)
4784{
4785	struct bwn_softc *sc = mac->mac_sc;
4786	struct ieee80211com *ic = &sc->sc_ic;
4787
4788	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4789		bwn_psctl(mac, 0);
4790	if (ic->ic_opmode == IEEE80211_M_IBSS)
4791		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4792}
4793
4794static void
4795bwn_intr_atim_end(struct bwn_mac *mac)
4796{
4797
4798	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4799		BWN_WRITE_4(mac, BWN_MACCMD,
4800		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4801		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4802	}
4803}
4804
4805static void
4806bwn_intr_beacon(struct bwn_mac *mac)
4807{
4808	struct bwn_softc *sc = mac->mac_sc;
4809	struct ieee80211com *ic = &sc->sc_ic;
4810	uint32_t cmd, beacon0, beacon1;
4811
4812	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4813	    ic->ic_opmode == IEEE80211_M_MBSS)
4814		return;
4815
4816	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
4817
4818	cmd = BWN_READ_4(mac, BWN_MACCMD);
4819	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
4820	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
4821
4822	if (beacon0 && beacon1) {
4823		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
4824		mac->mac_intr_mask |= BWN_INTR_BEACON;
4825		return;
4826	}
4827
4828	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
4829		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
4830		bwn_load_beacon0(mac);
4831		bwn_load_beacon1(mac);
4832		cmd = BWN_READ_4(mac, BWN_MACCMD);
4833		cmd |= BWN_MACCMD_BEACON0_VALID;
4834		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4835	} else {
4836		if (!beacon0) {
4837			bwn_load_beacon0(mac);
4838			cmd = BWN_READ_4(mac, BWN_MACCMD);
4839			cmd |= BWN_MACCMD_BEACON0_VALID;
4840			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4841		} else if (!beacon1) {
4842			bwn_load_beacon1(mac);
4843			cmd = BWN_READ_4(mac, BWN_MACCMD);
4844			cmd |= BWN_MACCMD_BEACON1_VALID;
4845			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4846		}
4847	}
4848}
4849
4850static void
4851bwn_intr_pmq(struct bwn_mac *mac)
4852{
4853	uint32_t tmp;
4854
4855	while (1) {
4856		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
4857		if (!(tmp & 0x00000008))
4858			break;
4859	}
4860	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
4861}
4862
4863static void
4864bwn_intr_noise(struct bwn_mac *mac)
4865{
4866	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
4867	uint16_t tmp;
4868	uint8_t noise[4];
4869	uint8_t i, j;
4870	int32_t average;
4871
4872	if (mac->mac_phy.type != BWN_PHYTYPE_G)
4873		return;
4874
4875	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
4876	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
4877	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
4878	    noise[3] == 0x7f)
4879		goto new;
4880
4881	KASSERT(mac->mac_noise.noi_nsamples < 8,
4882	    ("%s:%d: fail", __func__, __LINE__));
4883	i = mac->mac_noise.noi_nsamples;
4884	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
4885	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
4886	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
4887	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
4888	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
4889	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
4890	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
4891	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
4892	mac->mac_noise.noi_nsamples++;
4893	if (mac->mac_noise.noi_nsamples == 8) {
4894		average = 0;
4895		for (i = 0; i < 8; i++) {
4896			for (j = 0; j < 4; j++)
4897				average += mac->mac_noise.noi_samples[i][j];
4898		}
4899		average = (((average / 32) * 125) + 64) / 128;
4900		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
4901		if (tmp >= 8)
4902			average += 2;
4903		else
4904			average -= 25;
4905		average -= (tmp == 8) ? 72 : 48;
4906
4907		mac->mac_stats.link_noise = average;
4908		mac->mac_noise.noi_running = 0;
4909		return;
4910	}
4911new:
4912	bwn_noise_gensample(mac);
4913}
4914
4915static int
4916bwn_pio_rx(struct bwn_pio_rxqueue *prq)
4917{
4918	struct bwn_mac *mac = prq->prq_mac;
4919	struct bwn_softc *sc = mac->mac_sc;
4920	unsigned int i;
4921
4922	BWN_ASSERT_LOCKED(sc);
4923
4924	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4925		return (0);
4926
4927	for (i = 0; i < 5000; i++) {
4928		if (bwn_pio_rxeof(prq) == 0)
4929			break;
4930	}
4931	if (i >= 5000)
4932		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
4933	return ((i > 0) ? 1 : 0);
4934}
4935
4936static void
4937bwn_dma_rx(struct bwn_dma_ring *dr)
4938{
4939	int slot, curslot;
4940
4941	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
4942	curslot = dr->get_curslot(dr);
4943	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
4944	    ("%s:%d: fail", __func__, __LINE__));
4945
4946	slot = dr->dr_curslot;
4947	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
4948		bwn_dma_rxeof(dr, &slot);
4949
4950	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
4951	    BUS_DMASYNC_PREWRITE);
4952
4953	dr->set_curslot(dr, slot);
4954	dr->dr_curslot = slot;
4955}
4956
4957static void
4958bwn_intr_txeof(struct bwn_mac *mac)
4959{
4960	struct bwn_txstatus stat;
4961	uint32_t stat0, stat1;
4962	uint16_t tmp;
4963
4964	BWN_ASSERT_LOCKED(mac->mac_sc);
4965
4966	while (1) {
4967		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
4968		if (!(stat0 & 0x00000001))
4969			break;
4970		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
4971
4972		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
4973		    "%s: stat0=0x%08x, stat1=0x%08x\n",
4974		    __func__,
4975		    stat0,
4976		    stat1);
4977
4978		stat.cookie = (stat0 >> 16);
4979		stat.seq = (stat1 & 0x0000ffff);
4980		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
4981		tmp = (stat0 & 0x0000ffff);
4982		stat.framecnt = ((tmp & 0xf000) >> 12);
4983		stat.rtscnt = ((tmp & 0x0f00) >> 8);
4984		stat.sreason = ((tmp & 0x001c) >> 2);
4985		stat.pm = (tmp & 0x0080) ? 1 : 0;
4986		stat.im = (tmp & 0x0040) ? 1 : 0;
4987		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
4988		stat.ack = (tmp & 0x0002) ? 1 : 0;
4989
4990		bwn_handle_txeof(mac, &stat);
4991	}
4992}
4993
4994static void
4995bwn_hwreset(void *arg, int npending)
4996{
4997	struct bwn_mac *mac = arg;
4998	struct bwn_softc *sc = mac->mac_sc;
4999	int error = 0;
5000	int prev_status;
5001
5002	BWN_LOCK(sc);
5003
5004	prev_status = mac->mac_status;
5005	if (prev_status >= BWN_MAC_STATUS_STARTED)
5006		bwn_core_stop(mac);
5007	if (prev_status >= BWN_MAC_STATUS_INITED)
5008		bwn_core_exit(mac);
5009
5010	if (prev_status >= BWN_MAC_STATUS_INITED) {
5011		error = bwn_core_init(mac);
5012		if (error)
5013			goto out;
5014	}
5015	if (prev_status >= BWN_MAC_STATUS_STARTED)
5016		bwn_core_start(mac);
5017out:
5018	if (error) {
5019		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5020		sc->sc_curmac = NULL;
5021	}
5022	BWN_UNLOCK(sc);
5023}
5024
5025static void
5026bwn_handle_fwpanic(struct bwn_mac *mac)
5027{
5028	struct bwn_softc *sc = mac->mac_sc;
5029	uint16_t reason;
5030
5031	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5032	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5033
5034	if (reason == BWN_FWPANIC_RESTART)
5035		bwn_restart(mac, "ucode panic");
5036}
5037
5038static void
5039bwn_load_beacon0(struct bwn_mac *mac)
5040{
5041
5042	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5043}
5044
5045static void
5046bwn_load_beacon1(struct bwn_mac *mac)
5047{
5048
5049	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5050}
5051
5052static uint32_t
5053bwn_jssi_read(struct bwn_mac *mac)
5054{
5055	uint32_t val = 0;
5056
5057	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5058	val <<= 16;
5059	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5060
5061	return (val);
5062}
5063
5064static void
5065bwn_noise_gensample(struct bwn_mac *mac)
5066{
5067	uint32_t jssi = 0x7f7f7f7f;
5068
5069	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5070	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5071	BWN_WRITE_4(mac, BWN_MACCMD,
5072	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5073}
5074
5075static int
5076bwn_dma_freeslot(struct bwn_dma_ring *dr)
5077{
5078	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5079
5080	return (dr->dr_numslots - dr->dr_usedslot);
5081}
5082
5083static int
5084bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5085{
5086	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5087
5088	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5089	    ("%s:%d: fail", __func__, __LINE__));
5090	if (slot == dr->dr_numslots - 1)
5091		return (0);
5092	return (slot + 1);
5093}
5094
5095static void
5096bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5097{
5098	struct bwn_mac *mac = dr->dr_mac;
5099	struct bwn_softc *sc = mac->mac_sc;
5100	struct bwn_dma *dma = &mac->mac_method.dma;
5101	struct bwn_dmadesc_generic *desc;
5102	struct bwn_dmadesc_meta *meta;
5103	struct bwn_rxhdr4 *rxhdr;
5104	struct mbuf *m;
5105	uint32_t macstat;
5106	int32_t tmp;
5107	int cnt = 0;
5108	uint16_t len;
5109
5110	dr->getdesc(dr, *slot, &desc, &meta);
5111
5112	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5113	m = meta->mt_m;
5114
5115	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5116		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5117		return;
5118	}
5119
5120	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5121	len = le16toh(rxhdr->frame_len);
5122	if (len <= 0) {
5123		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5124		return;
5125	}
5126	if (bwn_dma_check_redzone(dr, m)) {
5127		device_printf(sc->sc_dev, "redzone error.\n");
5128		bwn_dma_set_redzone(dr, m);
5129		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5130		    BUS_DMASYNC_PREWRITE);
5131		return;
5132	}
5133	if (len > dr->dr_rx_bufsize) {
5134		tmp = len;
5135		while (1) {
5136			dr->getdesc(dr, *slot, &desc, &meta);
5137			bwn_dma_set_redzone(dr, meta->mt_m);
5138			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5139			    BUS_DMASYNC_PREWRITE);
5140			*slot = bwn_dma_nextslot(dr, *slot);
5141			cnt++;
5142			tmp -= dr->dr_rx_bufsize;
5143			if (tmp <= 0)
5144				break;
5145		}
5146		device_printf(sc->sc_dev, "too small buffer "
5147		       "(len %u buffer %u dropped %d)\n",
5148		       len, dr->dr_rx_bufsize, cnt);
5149		return;
5150	}
5151	macstat = le32toh(rxhdr->mac_status);
5152	if (macstat & BWN_RX_MAC_FCSERR) {
5153		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5154			device_printf(sc->sc_dev, "RX drop\n");
5155			return;
5156		}
5157	}
5158
5159	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5160	m_adj(m, dr->dr_frameoffset);
5161
5162	bwn_rxeof(dr->dr_mac, m, rxhdr);
5163}
5164
5165static void
5166bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5167{
5168	struct bwn_softc *sc = mac->mac_sc;
5169	struct bwn_stats *stats = &mac->mac_stats;
5170
5171	BWN_ASSERT_LOCKED(mac->mac_sc);
5172
5173	if (status->im)
5174		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5175	if (status->ampdu)
5176		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5177	if (status->rtscnt) {
5178		if (status->rtscnt == 0xf)
5179			stats->rtsfail++;
5180		else
5181			stats->rts++;
5182	}
5183
5184	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5185		bwn_dma_handle_txeof(mac, status);
5186	} else {
5187		bwn_pio_handle_txeof(mac, status);
5188	}
5189
5190	bwn_phy_txpower_check(mac, 0);
5191}
5192
5193static uint8_t
5194bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5195{
5196	struct bwn_mac *mac = prq->prq_mac;
5197	struct bwn_softc *sc = mac->mac_sc;
5198	struct bwn_rxhdr4 rxhdr;
5199	struct mbuf *m;
5200	uint32_t ctl32, macstat, v32;
5201	unsigned int i, padding;
5202	uint16_t ctl16, len, totlen, v16;
5203	unsigned char *mp;
5204	char *data;
5205
5206	memset(&rxhdr, 0, sizeof(rxhdr));
5207
5208	if (prq->prq_rev >= 8) {
5209		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5210		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5211			return (0);
5212		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5213		    BWN_PIO8_RXCTL_FRAMEREADY);
5214		for (i = 0; i < 10; i++) {
5215			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5216			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5217				goto ready;
5218			DELAY(10);
5219		}
5220	} else {
5221		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5222		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5223			return (0);
5224		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5225		    BWN_PIO_RXCTL_FRAMEREADY);
5226		for (i = 0; i < 10; i++) {
5227			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5228			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5229				goto ready;
5230			DELAY(10);
5231		}
5232	}
5233	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5234	return (1);
5235ready:
5236	if (prq->prq_rev >= 8)
5237		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5238		    prq->prq_base + BWN_PIO8_RXDATA);
5239	else
5240		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5241		    prq->prq_base + BWN_PIO_RXDATA);
5242	len = le16toh(rxhdr.frame_len);
5243	if (len > 0x700) {
5244		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5245		goto error;
5246	}
5247	if (len == 0) {
5248		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5249		goto error;
5250	}
5251
5252	macstat = le32toh(rxhdr.mac_status);
5253	if (macstat & BWN_RX_MAC_FCSERR) {
5254		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5255			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5256			goto error;
5257		}
5258	}
5259
5260	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5261	totlen = len + padding;
5262	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5263	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5264	if (m == NULL) {
5265		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5266		goto error;
5267	}
5268	mp = mtod(m, unsigned char *);
5269	if (prq->prq_rev >= 8) {
5270		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5271		    prq->prq_base + BWN_PIO8_RXDATA);
5272		if (totlen & 3) {
5273			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5274			data = &(mp[totlen - 1]);
5275			switch (totlen & 3) {
5276			case 3:
5277				*data = (v32 >> 16);
5278				data--;
5279			case 2:
5280				*data = (v32 >> 8);
5281				data--;
5282			case 1:
5283				*data = v32;
5284			}
5285		}
5286	} else {
5287		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5288		    prq->prq_base + BWN_PIO_RXDATA);
5289		if (totlen & 1) {
5290			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5291			mp[totlen - 1] = v16;
5292		}
5293	}
5294
5295	m->m_len = m->m_pkthdr.len = totlen;
5296
5297	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5298
5299	return (1);
5300error:
5301	if (prq->prq_rev >= 8)
5302		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5303		    BWN_PIO8_RXCTL_DATAREADY);
5304	else
5305		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5306	return (1);
5307}
5308
5309static int
5310bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5311    struct bwn_dmadesc_meta *meta, int init)
5312{
5313	struct bwn_mac *mac = dr->dr_mac;
5314	struct bwn_dma *dma = &mac->mac_method.dma;
5315	struct bwn_rxhdr4 *hdr;
5316	bus_dmamap_t map;
5317	bus_addr_t paddr;
5318	struct mbuf *m;
5319	int error;
5320
5321	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5322	if (m == NULL) {
5323		error = ENOBUFS;
5324
5325		/*
5326		 * If the NIC is up and running, we need to:
5327		 * - Clear RX buffer's header.
5328		 * - Restore RX descriptor settings.
5329		 */
5330		if (init)
5331			return (error);
5332		else
5333			goto back;
5334	}
5335	m->m_len = m->m_pkthdr.len = MCLBYTES;
5336
5337	bwn_dma_set_redzone(dr, m);
5338
5339	/*
5340	 * Try to load RX buf into temporary DMA map
5341	 */
5342	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5343	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5344	if (error) {
5345		m_freem(m);
5346
5347		/*
5348		 * See the comment above
5349		 */
5350		if (init)
5351			return (error);
5352		else
5353			goto back;
5354	}
5355
5356	if (!init)
5357		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5358	meta->mt_m = m;
5359	meta->mt_paddr = paddr;
5360
5361	/*
5362	 * Swap RX buf's DMA map with the loaded temporary one
5363	 */
5364	map = meta->mt_dmap;
5365	meta->mt_dmap = dr->dr_spare_dmap;
5366	dr->dr_spare_dmap = map;
5367
5368back:
5369	/*
5370	 * Clear RX buf header
5371	 */
5372	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5373	bzero(hdr, sizeof(*hdr));
5374	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5375	    BUS_DMASYNC_PREWRITE);
5376
5377	/*
5378	 * Setup RX buf descriptor
5379	 */
5380	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5381	    sizeof(*hdr), 0, 0, 0);
5382	return (error);
5383}
5384
5385static void
5386bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5387		 bus_size_t mapsz __unused, int error)
5388{
5389
5390	if (!error) {
5391		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5392		*((bus_addr_t *)arg) = seg->ds_addr;
5393	}
5394}
5395
5396static int
5397bwn_hwrate2ieeerate(int rate)
5398{
5399
5400	switch (rate) {
5401	case BWN_CCK_RATE_1MB:
5402		return (2);
5403	case BWN_CCK_RATE_2MB:
5404		return (4);
5405	case BWN_CCK_RATE_5MB:
5406		return (11);
5407	case BWN_CCK_RATE_11MB:
5408		return (22);
5409	case BWN_OFDM_RATE_6MB:
5410		return (12);
5411	case BWN_OFDM_RATE_9MB:
5412		return (18);
5413	case BWN_OFDM_RATE_12MB:
5414		return (24);
5415	case BWN_OFDM_RATE_18MB:
5416		return (36);
5417	case BWN_OFDM_RATE_24MB:
5418		return (48);
5419	case BWN_OFDM_RATE_36MB:
5420		return (72);
5421	case BWN_OFDM_RATE_48MB:
5422		return (96);
5423	case BWN_OFDM_RATE_54MB:
5424		return (108);
5425	default:
5426		printf("Ooops\n");
5427		return (0);
5428	}
5429}
5430
5431/*
5432 * Post process the RX provided RSSI.
5433 *
5434 * Valid for A, B, G, LP PHYs.
5435 */
5436static int8_t
5437bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5438    int ofdm, int adjust_2053, int adjust_2050)
5439{
5440	struct bwn_phy *phy = &mac->mac_phy;
5441	struct bwn_phy_g *gphy = &phy->phy_g;
5442	int tmp;
5443
5444	switch (phy->rf_ver) {
5445	case 0x2050:
5446		if (ofdm) {
5447			tmp = in_rssi;
5448			if (tmp > 127)
5449				tmp -= 256;
5450			tmp = tmp * 73 / 64;
5451			if (adjust_2050)
5452				tmp += 25;
5453			else
5454				tmp -= 3;
5455		} else {
5456			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5457			    & BWN_BFL_RSSI) {
5458				if (in_rssi > 63)
5459					in_rssi = 63;
5460				tmp = gphy->pg_nrssi_lt[in_rssi];
5461				tmp = (31 - tmp) * -131 / 128 - 57;
5462			} else {
5463				tmp = in_rssi;
5464				tmp = (31 - tmp) * -149 / 128 - 68;
5465			}
5466			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5467				tmp += 25;
5468		}
5469		break;
5470	case 0x2060:
5471		if (in_rssi > 127)
5472			tmp = in_rssi - 256;
5473		else
5474			tmp = in_rssi;
5475		break;
5476	default:
5477		tmp = in_rssi;
5478		tmp = (tmp - 11) * 103 / 64;
5479		if (adjust_2053)
5480			tmp -= 109;
5481		else
5482			tmp -= 83;
5483	}
5484
5485	return (tmp);
5486}
5487
5488static void
5489bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5490{
5491	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5492	struct bwn_plcp6 *plcp;
5493	struct bwn_softc *sc = mac->mac_sc;
5494	struct ieee80211_frame_min *wh;
5495	struct ieee80211_node *ni;
5496	struct ieee80211com *ic = &sc->sc_ic;
5497	uint32_t macstat;
5498	int padding, rate, rssi = 0, noise = 0, type;
5499	uint16_t phytype, phystat0, phystat3, chanstat;
5500	unsigned char *mp = mtod(m, unsigned char *);
5501	static int rx_mac_dec_rpt = 0;
5502
5503	BWN_ASSERT_LOCKED(sc);
5504
5505	phystat0 = le16toh(rxhdr->phy_status0);
5506	phystat3 = le16toh(rxhdr->phy_status3);
5507
5508	/* XXX Note: mactime, macstat, chanstat need fixing for fw 598 */
5509	macstat = le32toh(rxhdr->mac_status);
5510	chanstat = le16toh(rxhdr->channel);
5511
5512	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5513
5514	if (macstat & BWN_RX_MAC_FCSERR)
5515		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5516	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5517		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5518	if (macstat & BWN_RX_MAC_DECERR)
5519		goto drop;
5520
5521	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5522	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5523		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5524		    m->m_pkthdr.len);
5525		goto drop;
5526	}
5527	plcp = (struct bwn_plcp6 *)(mp + padding);
5528	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5529	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5530		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5531		    m->m_pkthdr.len);
5532		goto drop;
5533	}
5534	wh = mtod(m, struct ieee80211_frame_min *);
5535
5536	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5537		device_printf(sc->sc_dev,
5538		    "RX decryption attempted (old %d keyidx %#x)\n",
5539		    BWN_ISOLDFMT(mac),
5540		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5541
5542	if (phystat0 & BWN_RX_PHYST0_OFDM)
5543		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5544		    phytype == BWN_PHYTYPE_A);
5545	else
5546		rate = bwn_plcp_get_cckrate(mac, plcp);
5547	if (rate == -1) {
5548		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5549			goto drop;
5550	}
5551	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5552
5553	/* rssi/noise */
5554	switch (phytype) {
5555	case BWN_PHYTYPE_A:
5556	case BWN_PHYTYPE_B:
5557	case BWN_PHYTYPE_G:
5558	case BWN_PHYTYPE_LP:
5559		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5560		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5561		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5562		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5563		break;
5564	default:
5565		/* XXX TODO: implement rssi for other PHYs */
5566		break;
5567	}
5568
5569	noise = mac->mac_stats.link_noise;
5570
5571	/* RX radio tap */
5572	if (ieee80211_radiotap_active(ic))
5573		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5574	m_adj(m, -IEEE80211_CRC_LEN);
5575
5576	BWN_UNLOCK(sc);
5577
5578	ni = ieee80211_find_rxnode(ic, wh);
5579	if (ni != NULL) {
5580		type = ieee80211_input(ni, m, rssi, noise);
5581		ieee80211_free_node(ni);
5582	} else
5583		type = ieee80211_input_all(ic, m, rssi, noise);
5584
5585	BWN_LOCK(sc);
5586	return;
5587drop:
5588	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5589}
5590
5591static void
5592bwn_dma_handle_txeof(struct bwn_mac *mac,
5593    const struct bwn_txstatus *status)
5594{
5595	struct bwn_dma *dma = &mac->mac_method.dma;
5596	struct bwn_dma_ring *dr;
5597	struct bwn_dmadesc_generic *desc;
5598	struct bwn_dmadesc_meta *meta;
5599	struct bwn_softc *sc = mac->mac_sc;
5600	int slot;
5601	int retrycnt = 0;
5602
5603	BWN_ASSERT_LOCKED(sc);
5604
5605	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5606	if (dr == NULL) {
5607		device_printf(sc->sc_dev, "failed to parse cookie\n");
5608		return;
5609	}
5610	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5611
5612	while (1) {
5613		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5614		    ("%s:%d: fail", __func__, __LINE__));
5615		dr->getdesc(dr, slot, &desc, &meta);
5616
5617		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5618			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5619		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5620			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5621
5622		if (meta->mt_islast) {
5623			KASSERT(meta->mt_m != NULL,
5624			    ("%s:%d: fail", __func__, __LINE__));
5625
5626			/* Just count full frame retries for now */
5627			retrycnt = status->framecnt - 1;
5628			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5629			    status->ack ?
5630			      IEEE80211_RATECTL_TX_SUCCESS :
5631			      IEEE80211_RATECTL_TX_FAILURE,
5632			    &retrycnt, 0);
5633			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5634			meta->mt_ni = NULL;
5635			meta->mt_m = NULL;
5636		} else
5637			KASSERT(meta->mt_m == NULL,
5638			    ("%s:%d: fail", __func__, __LINE__));
5639
5640		dr->dr_usedslot--;
5641		if (meta->mt_islast)
5642			break;
5643		slot = bwn_dma_nextslot(dr, slot);
5644	}
5645	sc->sc_watchdog_timer = 0;
5646	if (dr->dr_stop) {
5647		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5648		    ("%s:%d: fail", __func__, __LINE__));
5649		dr->dr_stop = 0;
5650	}
5651}
5652
5653static void
5654bwn_pio_handle_txeof(struct bwn_mac *mac,
5655    const struct bwn_txstatus *status)
5656{
5657	struct bwn_pio_txqueue *tq;
5658	struct bwn_pio_txpkt *tp = NULL;
5659	struct bwn_softc *sc = mac->mac_sc;
5660	int retrycnt = 0;
5661
5662	BWN_ASSERT_LOCKED(sc);
5663
5664	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5665	if (tq == NULL)
5666		return;
5667
5668	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5669	tq->tq_free++;
5670
5671	if (tp->tp_ni != NULL) {
5672		/*
5673		 * Do any tx complete callback.  Note this must
5674		 * be done before releasing the node reference.
5675		 */
5676
5677		/* Just count full frame retries for now */
5678		retrycnt = status->framecnt - 1;
5679		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5680		    status->ack ?
5681		      IEEE80211_RATECTL_TX_SUCCESS :
5682		      IEEE80211_RATECTL_TX_FAILURE,
5683		    &retrycnt, 0);
5684
5685		if (tp->tp_m->m_flags & M_TXCB)
5686			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5687		ieee80211_free_node(tp->tp_ni);
5688		tp->tp_ni = NULL;
5689	}
5690	m_freem(tp->tp_m);
5691	tp->tp_m = NULL;
5692	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5693
5694	sc->sc_watchdog_timer = 0;
5695}
5696
5697static void
5698bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5699{
5700	struct bwn_softc *sc = mac->mac_sc;
5701	struct bwn_phy *phy = &mac->mac_phy;
5702	struct ieee80211com *ic = &sc->sc_ic;
5703	unsigned long now;
5704	int result;
5705
5706	BWN_GETTIME(now);
5707
5708	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5709		return;
5710	phy->nexttime = now + 2 * 1000;
5711
5712	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5713	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5714		return;
5715
5716	if (phy->recalc_txpwr != NULL) {
5717		result = phy->recalc_txpwr(mac,
5718		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5719		if (result == BWN_TXPWR_RES_DONE)
5720			return;
5721		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
5722		    ("%s: fail", __func__));
5723		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
5724
5725		ieee80211_runtask(ic, &mac->mac_txpower);
5726	}
5727}
5728
5729static uint16_t
5730bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
5731{
5732
5733	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
5734}
5735
5736static uint32_t
5737bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
5738{
5739
5740	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
5741}
5742
5743static void
5744bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
5745{
5746
5747	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
5748}
5749
5750static void
5751bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
5752{
5753
5754	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
5755}
5756
5757static int
5758bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
5759{
5760
5761	switch (rate) {
5762	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
5763	case 12:
5764		return (BWN_OFDM_RATE_6MB);
5765	case 18:
5766		return (BWN_OFDM_RATE_9MB);
5767	case 24:
5768		return (BWN_OFDM_RATE_12MB);
5769	case 36:
5770		return (BWN_OFDM_RATE_18MB);
5771	case 48:
5772		return (BWN_OFDM_RATE_24MB);
5773	case 72:
5774		return (BWN_OFDM_RATE_36MB);
5775	case 96:
5776		return (BWN_OFDM_RATE_48MB);
5777	case 108:
5778		return (BWN_OFDM_RATE_54MB);
5779	/* CCK rates (NB: not IEEE std, device-specific) */
5780	case 2:
5781		return (BWN_CCK_RATE_1MB);
5782	case 4:
5783		return (BWN_CCK_RATE_2MB);
5784	case 11:
5785		return (BWN_CCK_RATE_5MB);
5786	case 22:
5787		return (BWN_CCK_RATE_11MB);
5788	}
5789
5790	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
5791	return (BWN_CCK_RATE_1MB);
5792}
5793
5794static int
5795bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
5796    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
5797{
5798	const struct bwn_phy *phy = &mac->mac_phy;
5799	struct bwn_softc *sc = mac->mac_sc;
5800	struct ieee80211_frame *wh;
5801	struct ieee80211_frame *protwh;
5802	struct ieee80211_frame_cts *cts;
5803	struct ieee80211_frame_rts *rts;
5804	const struct ieee80211_txparam *tp;
5805	struct ieee80211vap *vap = ni->ni_vap;
5806	struct ieee80211com *ic = &sc->sc_ic;
5807	struct mbuf *mprot;
5808	unsigned int len;
5809	uint32_t macctl = 0;
5810	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
5811	uint16_t phyctl = 0;
5812	uint8_t rate, rate_fb;
5813
5814	wh = mtod(m, struct ieee80211_frame *);
5815	memset(txhdr, 0, sizeof(*txhdr));
5816
5817	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
5818	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
5819	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
5820
5821	/*
5822	 * Find TX rate
5823	 */
5824	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
5825	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
5826		rate = rate_fb = tp->mgmtrate;
5827	else if (ismcast)
5828		rate = rate_fb = tp->mcastrate;
5829	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
5830		rate = rate_fb = tp->ucastrate;
5831	else {
5832		/* XXX TODO: don't fall back to CCK rates for OFDM */
5833		rix = ieee80211_ratectl_rate(ni, NULL, 0);
5834		rate = ni->ni_txrate;
5835
5836		if (rix > 0)
5837			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
5838			    IEEE80211_RATE_VAL;
5839		else
5840			rate_fb = rate;
5841	}
5842
5843	sc->sc_tx_rate = rate;
5844
5845	/* Note: this maps the select ieee80211 rate to hardware rate */
5846	rate = bwn_ieeerate2hwrate(sc, rate);
5847	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
5848
5849	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
5850	    bwn_plcp_getcck(rate);
5851	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
5852	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
5853
5854	/* XXX rate/rate_fb is the hardware rate */
5855	if ((rate_fb == rate) ||
5856	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
5857	    (*(u_int16_t *)wh->i_dur == htole16(0)))
5858		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
5859	else
5860		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
5861		    m->m_pkthdr.len, rate, isshort);
5862
5863	/* XXX TX encryption */
5864	bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
5865	    (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
5866	    (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
5867	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
5868	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
5869	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
5870
5871	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
5872	    BWN_TX_EFT_FB_CCK;
5873	txhdr->chan = phy->chan;
5874	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
5875	    BWN_TX_PHY_ENC_CCK;
5876	/* XXX preamble? obey net80211 */
5877	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5878	     rate == BWN_CCK_RATE_11MB))
5879		phyctl |= BWN_TX_PHY_SHORTPRMBL;
5880
5881	/* XXX TX antenna selection */
5882
5883	switch (bwn_antenna_sanitize(mac, 0)) {
5884	case 0:
5885		phyctl |= BWN_TX_PHY_ANT01AUTO;
5886		break;
5887	case 1:
5888		phyctl |= BWN_TX_PHY_ANT0;
5889		break;
5890	case 2:
5891		phyctl |= BWN_TX_PHY_ANT1;
5892		break;
5893	case 3:
5894		phyctl |= BWN_TX_PHY_ANT2;
5895		break;
5896	case 4:
5897		phyctl |= BWN_TX_PHY_ANT3;
5898		break;
5899	default:
5900		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5901	}
5902
5903	if (!ismcast)
5904		macctl |= BWN_TX_MAC_ACK;
5905
5906	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
5907	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
5908	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
5909		macctl |= BWN_TX_MAC_LONGFRAME;
5910
5911	if (ic->ic_flags & IEEE80211_F_USEPROT) {
5912		/* XXX RTS rate is always 1MB??? */
5913		/* XXX TODO: don't fall back to CCK rates for OFDM */
5914		rts_rate = BWN_CCK_RATE_1MB;
5915		rts_rate_fb = bwn_get_fbrate(rts_rate);
5916
5917		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
5918		protdur = ieee80211_compute_duration(ic->ic_rt,
5919		    m->m_pkthdr.len, rate, isshort) +
5920		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
5921
5922		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
5923			cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
5924			    (txhdr->body.old.rts_frame) :
5925			    (txhdr->body.new.rts_frame));
5926			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
5927			    protdur);
5928			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5929			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
5930			    mprot->m_pkthdr.len);
5931			m_freem(mprot);
5932			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
5933			len = sizeof(struct ieee80211_frame_cts);
5934		} else {
5935			rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
5936			    (txhdr->body.old.rts_frame) :
5937			    (txhdr->body.new.rts_frame));
5938			/* XXX rate/rate_fb is the hardware rate */
5939			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
5940			    isshort);
5941			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
5942			    wh->i_addr2, protdur);
5943			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5944			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
5945			    mprot->m_pkthdr.len);
5946			m_freem(mprot);
5947			macctl |= BWN_TX_MAC_SEND_RTSCTS;
5948			len = sizeof(struct ieee80211_frame_rts);
5949		}
5950		len += IEEE80211_CRC_LEN;
5951		bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
5952		    &txhdr->body.old.rts_plcp :
5953		    &txhdr->body.new.rts_plcp), len, rts_rate);
5954		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
5955		    rts_rate_fb);
5956
5957		protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
5958		    (&txhdr->body.old.rts_frame) :
5959		    (&txhdr->body.new.rts_frame));
5960		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
5961
5962		if (BWN_ISOFDMRATE(rts_rate)) {
5963			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
5964			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
5965		} else {
5966			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
5967			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
5968		}
5969		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
5970		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
5971	}
5972
5973	if (BWN_ISOLDFMT(mac))
5974		txhdr->body.old.cookie = htole16(cookie);
5975	else
5976		txhdr->body.new.cookie = htole16(cookie);
5977
5978	txhdr->macctl = htole32(macctl);
5979	txhdr->phyctl = htole16(phyctl);
5980
5981	/*
5982	 * TX radio tap
5983	 */
5984	if (ieee80211_radiotap_active_vap(vap)) {
5985		sc->sc_tx_th.wt_flags = 0;
5986		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
5987			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5988		if (isshort &&
5989		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5990		     rate == BWN_CCK_RATE_11MB))
5991			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
5992		sc->sc_tx_th.wt_rate = rate;
5993
5994		ieee80211_radiotap_tx(vap, m);
5995	}
5996
5997	return (0);
5998}
5999
6000static void
6001bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6002    const uint8_t rate)
6003{
6004	uint32_t d, plen;
6005	uint8_t *raw = plcp->o.raw;
6006
6007	if (BWN_ISOFDMRATE(rate)) {
6008		d = bwn_plcp_getofdm(rate);
6009		KASSERT(!(octets & 0xf000),
6010		    ("%s:%d: fail", __func__, __LINE__));
6011		d |= (octets << 5);
6012		plcp->o.data = htole32(d);
6013	} else {
6014		plen = octets * 16 / rate;
6015		if ((octets * 16 % rate) > 0) {
6016			plen++;
6017			if ((rate == BWN_CCK_RATE_11MB)
6018			    && ((octets * 8 % 11) < 4)) {
6019				raw[1] = 0x84;
6020			} else
6021				raw[1] = 0x04;
6022		} else
6023			raw[1] = 0x04;
6024		plcp->o.data |= htole32(plen << 16);
6025		raw[0] = bwn_plcp_getcck(rate);
6026	}
6027}
6028
6029static uint8_t
6030bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6031{
6032	struct bwn_softc *sc = mac->mac_sc;
6033	uint8_t mask;
6034
6035	if (n == 0)
6036		return (0);
6037	if (mac->mac_phy.gmode)
6038		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6039	else
6040		mask = siba_sprom_get_ant_a(sc->sc_dev);
6041	if (!(mask & (1 << (n - 1))))
6042		return (0);
6043	return (n);
6044}
6045
6046/*
6047 * Return a fallback rate for the given rate.
6048 *
6049 * Note: Don't fall back from OFDM to CCK.
6050 */
6051static uint8_t
6052bwn_get_fbrate(uint8_t bitrate)
6053{
6054	switch (bitrate) {
6055	/* CCK */
6056	case BWN_CCK_RATE_1MB:
6057		return (BWN_CCK_RATE_1MB);
6058	case BWN_CCK_RATE_2MB:
6059		return (BWN_CCK_RATE_1MB);
6060	case BWN_CCK_RATE_5MB:
6061		return (BWN_CCK_RATE_2MB);
6062	case BWN_CCK_RATE_11MB:
6063		return (BWN_CCK_RATE_5MB);
6064
6065	/* OFDM */
6066	case BWN_OFDM_RATE_6MB:
6067		return (BWN_OFDM_RATE_6MB);
6068	case BWN_OFDM_RATE_9MB:
6069		return (BWN_OFDM_RATE_6MB);
6070	case BWN_OFDM_RATE_12MB:
6071		return (BWN_OFDM_RATE_9MB);
6072	case BWN_OFDM_RATE_18MB:
6073		return (BWN_OFDM_RATE_12MB);
6074	case BWN_OFDM_RATE_24MB:
6075		return (BWN_OFDM_RATE_18MB);
6076	case BWN_OFDM_RATE_36MB:
6077		return (BWN_OFDM_RATE_24MB);
6078	case BWN_OFDM_RATE_48MB:
6079		return (BWN_OFDM_RATE_36MB);
6080	case BWN_OFDM_RATE_54MB:
6081		return (BWN_OFDM_RATE_48MB);
6082	}
6083	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6084	return (0);
6085}
6086
6087static uint32_t
6088bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6089    uint32_t ctl, const void *_data, int len)
6090{
6091	struct bwn_softc *sc = mac->mac_sc;
6092	uint32_t value = 0;
6093	const uint8_t *data = _data;
6094
6095	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6096	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6097	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6098
6099	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6100	    tq->tq_base + BWN_PIO8_TXDATA);
6101	if (len & 3) {
6102		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6103		    BWN_PIO8_TXCTL_24_31);
6104		data = &(data[len - 1]);
6105		switch (len & 3) {
6106		case 3:
6107			ctl |= BWN_PIO8_TXCTL_16_23;
6108			value |= (uint32_t)(*data) << 16;
6109			data--;
6110		case 2:
6111			ctl |= BWN_PIO8_TXCTL_8_15;
6112			value |= (uint32_t)(*data) << 8;
6113			data--;
6114		case 1:
6115			value |= (uint32_t)(*data);
6116		}
6117		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6118		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6119	}
6120
6121	return (ctl);
6122}
6123
6124static void
6125bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6126    uint16_t offset, uint32_t value)
6127{
6128
6129	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6130}
6131
6132static uint16_t
6133bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6134    uint16_t ctl, const void *_data, int len)
6135{
6136	struct bwn_softc *sc = mac->mac_sc;
6137	const uint8_t *data = _data;
6138
6139	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6140	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6141
6142	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6143	    tq->tq_base + BWN_PIO_TXDATA);
6144	if (len & 1) {
6145		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6146		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6147		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6148	}
6149
6150	return (ctl);
6151}
6152
6153static uint16_t
6154bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6155    uint16_t ctl, struct mbuf *m0)
6156{
6157	int i, j = 0;
6158	uint16_t data = 0;
6159	const uint8_t *buf;
6160	struct mbuf *m = m0;
6161
6162	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6163	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6164
6165	for (; m != NULL; m = m->m_next) {
6166		buf = mtod(m, const uint8_t *);
6167		for (i = 0; i < m->m_len; i++) {
6168			if (!((j++) % 2))
6169				data |= buf[i];
6170			else {
6171				data |= (buf[i] << 8);
6172				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6173				data = 0;
6174			}
6175		}
6176	}
6177	if (m0->m_pkthdr.len % 2) {
6178		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6179		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6180		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6181	}
6182
6183	return (ctl);
6184}
6185
6186static void
6187bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6188{
6189
6190	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6191		return;
6192	BWN_WRITE_2(mac, 0x684, 510 + time);
6193	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6194}
6195
6196static struct bwn_dma_ring *
6197bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6198{
6199
6200	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6201		return (mac->mac_method.dma.wme[WME_AC_BE]);
6202
6203	switch (prio) {
6204	case 3:
6205		return (mac->mac_method.dma.wme[WME_AC_VO]);
6206	case 2:
6207		return (mac->mac_method.dma.wme[WME_AC_VI]);
6208	case 0:
6209		return (mac->mac_method.dma.wme[WME_AC_BE]);
6210	case 1:
6211		return (mac->mac_method.dma.wme[WME_AC_BK]);
6212	}
6213	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6214	return (NULL);
6215}
6216
6217static int
6218bwn_dma_getslot(struct bwn_dma_ring *dr)
6219{
6220	int slot;
6221
6222	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6223
6224	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6225	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6226	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6227
6228	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6229	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6230	dr->dr_curslot = slot;
6231	dr->dr_usedslot++;
6232
6233	return (slot);
6234}
6235
6236static struct bwn_pio_txqueue *
6237bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6238    struct bwn_pio_txpkt **pack)
6239{
6240	struct bwn_pio *pio = &mac->mac_method.pio;
6241	struct bwn_pio_txqueue *tq = NULL;
6242	unsigned int index;
6243
6244	switch (cookie & 0xf000) {
6245	case 0x1000:
6246		tq = &pio->wme[WME_AC_BK];
6247		break;
6248	case 0x2000:
6249		tq = &pio->wme[WME_AC_BE];
6250		break;
6251	case 0x3000:
6252		tq = &pio->wme[WME_AC_VI];
6253		break;
6254	case 0x4000:
6255		tq = &pio->wme[WME_AC_VO];
6256		break;
6257	case 0x5000:
6258		tq = &pio->mcast;
6259		break;
6260	}
6261	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6262	if (tq == NULL)
6263		return (NULL);
6264	index = (cookie & 0x0fff);
6265	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6266	if (index >= N(tq->tq_pkts))
6267		return (NULL);
6268	*pack = &tq->tq_pkts[index];
6269	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6270	return (tq);
6271}
6272
6273static void
6274bwn_txpwr(void *arg, int npending)
6275{
6276	struct bwn_mac *mac = arg;
6277	struct bwn_softc *sc = mac->mac_sc;
6278
6279	BWN_LOCK(sc);
6280	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6281	    mac->mac_phy.set_txpwr != NULL)
6282		mac->mac_phy.set_txpwr(mac);
6283	BWN_UNLOCK(sc);
6284}
6285
6286static void
6287bwn_task_15s(struct bwn_mac *mac)
6288{
6289	uint16_t reg;
6290
6291	if (mac->mac_fw.opensource) {
6292		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6293		if (reg) {
6294			bwn_restart(mac, "fw watchdog");
6295			return;
6296		}
6297		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6298	}
6299	if (mac->mac_phy.task_15s)
6300		mac->mac_phy.task_15s(mac);
6301
6302	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6303}
6304
6305static void
6306bwn_task_30s(struct bwn_mac *mac)
6307{
6308
6309	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6310		return;
6311	mac->mac_noise.noi_running = 1;
6312	mac->mac_noise.noi_nsamples = 0;
6313
6314	bwn_noise_gensample(mac);
6315}
6316
6317static void
6318bwn_task_60s(struct bwn_mac *mac)
6319{
6320
6321	if (mac->mac_phy.task_60s)
6322		mac->mac_phy.task_60s(mac);
6323	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6324}
6325
6326static void
6327bwn_tasks(void *arg)
6328{
6329	struct bwn_mac *mac = arg;
6330	struct bwn_softc *sc = mac->mac_sc;
6331
6332	BWN_ASSERT_LOCKED(sc);
6333	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6334		return;
6335
6336	if (mac->mac_task_state % 4 == 0)
6337		bwn_task_60s(mac);
6338	if (mac->mac_task_state % 2 == 0)
6339		bwn_task_30s(mac);
6340	bwn_task_15s(mac);
6341
6342	mac->mac_task_state++;
6343	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6344}
6345
6346static int
6347bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6348{
6349	struct bwn_softc *sc = mac->mac_sc;
6350
6351	KASSERT(a == 0, ("not support APHY\n"));
6352
6353	switch (plcp->o.raw[0] & 0xf) {
6354	case 0xb:
6355		return (BWN_OFDM_RATE_6MB);
6356	case 0xf:
6357		return (BWN_OFDM_RATE_9MB);
6358	case 0xa:
6359		return (BWN_OFDM_RATE_12MB);
6360	case 0xe:
6361		return (BWN_OFDM_RATE_18MB);
6362	case 0x9:
6363		return (BWN_OFDM_RATE_24MB);
6364	case 0xd:
6365		return (BWN_OFDM_RATE_36MB);
6366	case 0x8:
6367		return (BWN_OFDM_RATE_48MB);
6368	case 0xc:
6369		return (BWN_OFDM_RATE_54MB);
6370	}
6371	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6372	    plcp->o.raw[0] & 0xf);
6373	return (-1);
6374}
6375
6376static int
6377bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6378{
6379	struct bwn_softc *sc = mac->mac_sc;
6380
6381	switch (plcp->o.raw[0]) {
6382	case 0x0a:
6383		return (BWN_CCK_RATE_1MB);
6384	case 0x14:
6385		return (BWN_CCK_RATE_2MB);
6386	case 0x37:
6387		return (BWN_CCK_RATE_5MB);
6388	case 0x6e:
6389		return (BWN_CCK_RATE_11MB);
6390	}
6391	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6392	return (-1);
6393}
6394
6395static void
6396bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6397    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6398    int rssi, int noise)
6399{
6400	struct bwn_softc *sc = mac->mac_sc;
6401	const struct ieee80211_frame_min *wh;
6402	uint64_t tsf;
6403	uint16_t low_mactime_now;
6404
6405	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6406		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6407
6408	wh = mtod(m, const struct ieee80211_frame_min *);
6409	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6410		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6411
6412	bwn_tsf_read(mac, &tsf);
6413	low_mactime_now = tsf;
6414	tsf = tsf & ~0xffffULL;
6415	tsf += le16toh(rxhdr->mac_time);
6416	if (low_mactime_now < le16toh(rxhdr->mac_time))
6417		tsf -= 0x10000;
6418
6419	sc->sc_rx_th.wr_tsf = tsf;
6420	sc->sc_rx_th.wr_rate = rate;
6421	sc->sc_rx_th.wr_antsignal = rssi;
6422	sc->sc_rx_th.wr_antnoise = noise;
6423}
6424
6425static void
6426bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6427{
6428	uint32_t low, high;
6429
6430	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6431	    ("%s:%d: fail", __func__, __LINE__));
6432
6433	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6434	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6435	*tsf = high;
6436	*tsf <<= 32;
6437	*tsf |= low;
6438}
6439
6440static int
6441bwn_dma_attach(struct bwn_mac *mac)
6442{
6443	struct bwn_dma *dma = &mac->mac_method.dma;
6444	struct bwn_softc *sc = mac->mac_sc;
6445	bus_addr_t lowaddr = 0;
6446	int error;
6447
6448	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6449		return (0);
6450
6451	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6452
6453	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6454
6455	dma->dmatype = bwn_dma_gettype(mac);
6456	if (dma->dmatype == BWN_DMA_30BIT)
6457		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6458	else if (dma->dmatype == BWN_DMA_32BIT)
6459		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6460	else
6461		lowaddr = BUS_SPACE_MAXADDR;
6462
6463	/*
6464	 * Create top level DMA tag
6465	 */
6466	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6467			       BWN_ALIGN, 0,		/* alignment, bounds */
6468			       lowaddr,			/* lowaddr */
6469			       BUS_SPACE_MAXADDR,	/* highaddr */
6470			       NULL, NULL,		/* filter, filterarg */
6471			       BUS_SPACE_MAXSIZE,	/* maxsize */
6472			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6473			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6474			       0,			/* flags */
6475			       NULL, NULL,		/* lockfunc, lockarg */
6476			       &dma->parent_dtag);
6477	if (error) {
6478		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6479		return (error);
6480	}
6481
6482	/*
6483	 * Create TX/RX mbuf DMA tag
6484	 */
6485	error = bus_dma_tag_create(dma->parent_dtag,
6486				1,
6487				0,
6488				BUS_SPACE_MAXADDR,
6489				BUS_SPACE_MAXADDR,
6490				NULL, NULL,
6491				MCLBYTES,
6492				1,
6493				BUS_SPACE_MAXSIZE_32BIT,
6494				0,
6495				NULL, NULL,
6496				&dma->rxbuf_dtag);
6497	if (error) {
6498		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6499		goto fail0;
6500	}
6501	error = bus_dma_tag_create(dma->parent_dtag,
6502				1,
6503				0,
6504				BUS_SPACE_MAXADDR,
6505				BUS_SPACE_MAXADDR,
6506				NULL, NULL,
6507				MCLBYTES,
6508				1,
6509				BUS_SPACE_MAXSIZE_32BIT,
6510				0,
6511				NULL, NULL,
6512				&dma->txbuf_dtag);
6513	if (error) {
6514		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6515		goto fail1;
6516	}
6517
6518	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6519	if (!dma->wme[WME_AC_BK])
6520		goto fail2;
6521
6522	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6523	if (!dma->wme[WME_AC_BE])
6524		goto fail3;
6525
6526	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6527	if (!dma->wme[WME_AC_VI])
6528		goto fail4;
6529
6530	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6531	if (!dma->wme[WME_AC_VO])
6532		goto fail5;
6533
6534	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6535	if (!dma->mcast)
6536		goto fail6;
6537	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6538	if (!dma->rx)
6539		goto fail7;
6540
6541	return (error);
6542
6543fail7:	bwn_dma_ringfree(&dma->mcast);
6544fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
6545fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
6546fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
6547fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
6548fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
6549fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
6550fail0:	bus_dma_tag_destroy(dma->parent_dtag);
6551	return (error);
6552}
6553
6554static struct bwn_dma_ring *
6555bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
6556    uint16_t cookie, int *slot)
6557{
6558	struct bwn_dma *dma = &mac->mac_method.dma;
6559	struct bwn_dma_ring *dr;
6560	struct bwn_softc *sc = mac->mac_sc;
6561
6562	BWN_ASSERT_LOCKED(mac->mac_sc);
6563
6564	switch (cookie & 0xf000) {
6565	case 0x1000:
6566		dr = dma->wme[WME_AC_BK];
6567		break;
6568	case 0x2000:
6569		dr = dma->wme[WME_AC_BE];
6570		break;
6571	case 0x3000:
6572		dr = dma->wme[WME_AC_VI];
6573		break;
6574	case 0x4000:
6575		dr = dma->wme[WME_AC_VO];
6576		break;
6577	case 0x5000:
6578		dr = dma->mcast;
6579		break;
6580	default:
6581		dr = NULL;
6582		KASSERT(0 == 1,
6583		    ("invalid cookie value %d", cookie & 0xf000));
6584	}
6585	*slot = (cookie & 0x0fff);
6586	if (*slot < 0 || *slot >= dr->dr_numslots) {
6587		/*
6588		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
6589		 * that it occurs events which have same H/W sequence numbers.
6590		 * When it's occurred just prints a WARNING msgs and ignores.
6591		 */
6592		KASSERT(status->seq == dma->lastseq,
6593		    ("%s:%d: fail", __func__, __LINE__));
6594		device_printf(sc->sc_dev,
6595		    "out of slot ranges (0 < %d < %d)\n", *slot,
6596		    dr->dr_numslots);
6597		return (NULL);
6598	}
6599	dma->lastseq = status->seq;
6600	return (dr);
6601}
6602
6603static void
6604bwn_dma_stop(struct bwn_mac *mac)
6605{
6606	struct bwn_dma *dma;
6607
6608	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
6609		return;
6610	dma = &mac->mac_method.dma;
6611
6612	bwn_dma_ringstop(&dma->rx);
6613	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
6614	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
6615	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
6616	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
6617	bwn_dma_ringstop(&dma->mcast);
6618}
6619
6620static void
6621bwn_dma_ringstop(struct bwn_dma_ring **dr)
6622{
6623
6624	if (dr == NULL)
6625		return;
6626
6627	bwn_dma_cleanup(*dr);
6628}
6629
6630static void
6631bwn_pio_stop(struct bwn_mac *mac)
6632{
6633	struct bwn_pio *pio;
6634
6635	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
6636		return;
6637	pio = &mac->mac_method.pio;
6638
6639	bwn_destroy_queue_tx(&pio->mcast);
6640	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
6641	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
6642	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
6643	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
6644}
6645
6646static void
6647bwn_led_attach(struct bwn_mac *mac)
6648{
6649	struct bwn_softc *sc = mac->mac_sc;
6650	const uint8_t *led_act = NULL;
6651	uint16_t val[BWN_LED_MAX];
6652	int i;
6653
6654	sc->sc_led_idle = (2350 * hz) / 1000;
6655	sc->sc_led_blink = 1;
6656
6657	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
6658		if (siba_get_pci_subvendor(sc->sc_dev) ==
6659		    bwn_vendor_led_act[i].vid) {
6660			led_act = bwn_vendor_led_act[i].led_act;
6661			break;
6662		}
6663	}
6664	if (led_act == NULL)
6665		led_act = bwn_default_led_act;
6666
6667	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
6668	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
6669	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
6670	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
6671
6672	for (i = 0; i < BWN_LED_MAX; ++i) {
6673		struct bwn_led *led = &sc->sc_leds[i];
6674
6675		if (val[i] == 0xff) {
6676			led->led_act = led_act[i];
6677		} else {
6678			if (val[i] & BWN_LED_ACT_LOW)
6679				led->led_flags |= BWN_LED_F_ACTLOW;
6680			led->led_act = val[i] & BWN_LED_ACT_MASK;
6681		}
6682		led->led_mask = (1 << i);
6683
6684		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
6685		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
6686		    led->led_act == BWN_LED_ACT_BLINK) {
6687			led->led_flags |= BWN_LED_F_BLINK;
6688			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
6689				led->led_flags |= BWN_LED_F_POLLABLE;
6690			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
6691				led->led_flags |= BWN_LED_F_SLOW;
6692
6693			if (sc->sc_blink_led == NULL) {
6694				sc->sc_blink_led = led;
6695				if (led->led_flags & BWN_LED_F_SLOW)
6696					BWN_LED_SLOWDOWN(sc->sc_led_idle);
6697			}
6698		}
6699
6700		DPRINTF(sc, BWN_DEBUG_LED,
6701		    "%dth led, act %d, lowact %d\n", i,
6702		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
6703	}
6704	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
6705}
6706
6707static __inline uint16_t
6708bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
6709{
6710
6711	if (led->led_flags & BWN_LED_F_ACTLOW)
6712		on = !on;
6713	if (on)
6714		val |= led->led_mask;
6715	else
6716		val &= ~led->led_mask;
6717	return val;
6718}
6719
6720static void
6721bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
6722{
6723	struct bwn_softc *sc = mac->mac_sc;
6724	struct ieee80211com *ic = &sc->sc_ic;
6725	uint16_t val;
6726	int i;
6727
6728	if (nstate == IEEE80211_S_INIT) {
6729		callout_stop(&sc->sc_led_blink_ch);
6730		sc->sc_led_blinking = 0;
6731	}
6732
6733	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
6734		return;
6735
6736	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6737	for (i = 0; i < BWN_LED_MAX; ++i) {
6738		struct bwn_led *led = &sc->sc_leds[i];
6739		int on;
6740
6741		if (led->led_act == BWN_LED_ACT_UNKN ||
6742		    led->led_act == BWN_LED_ACT_NULL)
6743			continue;
6744
6745		if ((led->led_flags & BWN_LED_F_BLINK) &&
6746		    nstate != IEEE80211_S_INIT)
6747			continue;
6748
6749		switch (led->led_act) {
6750		case BWN_LED_ACT_ON:    /* Always on */
6751			on = 1;
6752			break;
6753		case BWN_LED_ACT_OFF:   /* Always off */
6754		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
6755			on = 0;
6756			break;
6757		default:
6758			on = 1;
6759			switch (nstate) {
6760			case IEEE80211_S_INIT:
6761				on = 0;
6762				break;
6763			case IEEE80211_S_RUN:
6764				if (led->led_act == BWN_LED_ACT_11G &&
6765				    ic->ic_curmode != IEEE80211_MODE_11G)
6766					on = 0;
6767				break;
6768			default:
6769				if (led->led_act == BWN_LED_ACT_ASSOC)
6770					on = 0;
6771				break;
6772			}
6773			break;
6774		}
6775
6776		val = bwn_led_onoff(led, val, on);
6777	}
6778	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6779}
6780
6781static void
6782bwn_led_event(struct bwn_mac *mac, int event)
6783{
6784	struct bwn_softc *sc = mac->mac_sc;
6785	struct bwn_led *led = sc->sc_blink_led;
6786	int rate;
6787
6788	if (event == BWN_LED_EVENT_POLL) {
6789		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
6790			return;
6791		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6792			return;
6793	}
6794
6795	sc->sc_led_ticks = ticks;
6796	if (sc->sc_led_blinking)
6797		return;
6798
6799	switch (event) {
6800	case BWN_LED_EVENT_RX:
6801		rate = sc->sc_rx_rate;
6802		break;
6803	case BWN_LED_EVENT_TX:
6804		rate = sc->sc_tx_rate;
6805		break;
6806	case BWN_LED_EVENT_POLL:
6807		rate = 0;
6808		break;
6809	default:
6810		panic("unknown LED event %d\n", event);
6811		break;
6812	}
6813	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
6814	    bwn_led_duration[rate].off_dur);
6815}
6816
6817static void
6818bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
6819{
6820	struct bwn_softc *sc = mac->mac_sc;
6821	struct bwn_led *led = sc->sc_blink_led;
6822	uint16_t val;
6823
6824	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6825	val = bwn_led_onoff(led, val, 1);
6826	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6827
6828	if (led->led_flags & BWN_LED_F_SLOW) {
6829		BWN_LED_SLOWDOWN(on_dur);
6830		BWN_LED_SLOWDOWN(off_dur);
6831	}
6832
6833	sc->sc_led_blinking = 1;
6834	sc->sc_led_blink_offdur = off_dur;
6835
6836	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
6837}
6838
6839static void
6840bwn_led_blink_next(void *arg)
6841{
6842	struct bwn_mac *mac = arg;
6843	struct bwn_softc *sc = mac->mac_sc;
6844	uint16_t val;
6845
6846	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6847	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
6848	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6849
6850	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
6851	    bwn_led_blink_end, mac);
6852}
6853
6854static void
6855bwn_led_blink_end(void *arg)
6856{
6857	struct bwn_mac *mac = arg;
6858	struct bwn_softc *sc = mac->mac_sc;
6859
6860	sc->sc_led_blinking = 0;
6861}
6862
6863static int
6864bwn_suspend(device_t dev)
6865{
6866	struct bwn_softc *sc = device_get_softc(dev);
6867
6868	BWN_LOCK(sc);
6869	bwn_stop(sc);
6870	BWN_UNLOCK(sc);
6871	return (0);
6872}
6873
6874static int
6875bwn_resume(device_t dev)
6876{
6877	struct bwn_softc *sc = device_get_softc(dev);
6878	int error = EDOOFUS;
6879
6880	BWN_LOCK(sc);
6881	if (sc->sc_ic.ic_nrunning > 0)
6882		error = bwn_init(sc);
6883	BWN_UNLOCK(sc);
6884	if (error == 0)
6885		ieee80211_start_all(&sc->sc_ic);
6886	return (0);
6887}
6888
6889static void
6890bwn_rfswitch(void *arg)
6891{
6892	struct bwn_softc *sc = arg;
6893	struct bwn_mac *mac = sc->sc_curmac;
6894	int cur = 0, prev = 0;
6895
6896	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
6897	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
6898
6899	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
6900		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
6901			& BWN_RF_HWENABLED_HI_MASK))
6902			cur = 1;
6903	} else {
6904		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
6905		    & BWN_RF_HWENABLED_LO_MASK)
6906			cur = 1;
6907	}
6908
6909	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
6910		prev = 1;
6911
6912	if (cur != prev) {
6913		if (cur)
6914			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
6915		else
6916			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
6917
6918		device_printf(sc->sc_dev,
6919		    "status of RF switch is changed to %s\n",
6920		    cur ? "ON" : "OFF");
6921		if (cur != mac->mac_phy.rf_on) {
6922			if (cur)
6923				bwn_rf_turnon(mac);
6924			else
6925				bwn_rf_turnoff(mac);
6926		}
6927	}
6928
6929	callout_schedule(&sc->sc_rfswitch_ch, hz);
6930}
6931
6932static void
6933bwn_sysctl_node(struct bwn_softc *sc)
6934{
6935	device_t dev = sc->sc_dev;
6936	struct bwn_mac *mac;
6937	struct bwn_stats *stats;
6938
6939	/* XXX assume that count of MAC is only 1. */
6940
6941	if ((mac = sc->sc_curmac) == NULL)
6942		return;
6943	stats = &mac->mac_stats;
6944
6945	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6946	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6947	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
6948	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6949	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6950	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
6951	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6952	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6953	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
6954
6955#ifdef BWN_DEBUG
6956	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
6957	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6958	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
6959#endif
6960}
6961
6962static device_method_t bwn_methods[] = {
6963	/* Device interface */
6964	DEVMETHOD(device_probe,		bwn_probe),
6965	DEVMETHOD(device_attach,	bwn_attach),
6966	DEVMETHOD(device_detach,	bwn_detach),
6967	DEVMETHOD(device_suspend,	bwn_suspend),
6968	DEVMETHOD(device_resume,	bwn_resume),
6969	DEVMETHOD_END
6970};
6971static driver_t bwn_driver = {
6972	"bwn",
6973	bwn_methods,
6974	sizeof(struct bwn_softc)
6975};
6976static devclass_t bwn_devclass;
6977DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
6978MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
6979MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
6980MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
6981MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
6982MODULE_VERSION(bwn, 1);
6983