if_bwn.c revision 299773
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 299773 2016-05-14 23:10:47Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include <sys/param.h>
38#include <sys/systm.h>
39#include <sys/kernel.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/endian.h>
43#include <sys/errno.h>
44#include <sys/firmware.h>
45#include <sys/lock.h>
46#include <sys/mutex.h>
47#include <machine/bus.h>
48#include <machine/resource.h>
49#include <sys/bus.h>
50#include <sys/rman.h>
51#include <sys/socket.h>
52#include <sys/sockio.h>
53
54#include <net/ethernet.h>
55#include <net/if.h>
56#include <net/if_var.h>
57#include <net/if_arp.h>
58#include <net/if_dl.h>
59#include <net/if_llc.h>
60#include <net/if_media.h>
61#include <net/if_types.h>
62
63#include <dev/pci/pcivar.h>
64#include <dev/pci/pcireg.h>
65#include <dev/siba/siba_ids.h>
66#include <dev/siba/sibareg.h>
67#include <dev/siba/sibavar.h>
68
69#include <net80211/ieee80211_var.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_regdomain.h>
72#include <net80211/ieee80211_phy.h>
73#include <net80211/ieee80211_ratectl.h>
74
75#include <dev/bwn/if_bwnreg.h>
76#include <dev/bwn/if_bwnvar.h>
77
78#include <dev/bwn/if_bwn_debug.h>
79#include <dev/bwn/if_bwn_misc.h>
80#include <dev/bwn/if_bwn_phy_g.h>
81#include <dev/bwn/if_bwn_phy_lp.h>
82
83static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
84    "Broadcom driver parameters");
85
86/*
87 * Tunable & sysctl variables.
88 */
89
90#ifdef BWN_DEBUG
91static	int bwn_debug = 0;
92SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
93    "Broadcom debugging printfs");
94#endif
95
96static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
97SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
98    "uses Bad Frames Preemption");
99static int	bwn_bluetooth = 1;
100SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
101    "turns on Bluetooth Coexistence");
102static int	bwn_hwpctl = 0;
103SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
104    "uses H/W power control");
105static int	bwn_msi_disable = 0;		/* MSI disabled  */
106TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
107static int	bwn_usedma = 1;
108SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
109    "uses DMA");
110TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
111static int	bwn_wme = 1;
112SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
113    "uses WME support");
114
115static void	bwn_attach_pre(struct bwn_softc *);
116static int	bwn_attach_post(struct bwn_softc *);
117static void	bwn_sprom_bugfixes(device_t);
118static int	bwn_init(struct bwn_softc *);
119static void	bwn_parent(struct ieee80211com *);
120static void	bwn_start(struct bwn_softc *);
121static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
122static int	bwn_attach_core(struct bwn_mac *);
123static int	bwn_phy_getinfo(struct bwn_mac *, int);
124static int	bwn_chiptest(struct bwn_mac *);
125static int	bwn_setup_channels(struct bwn_mac *, int, int);
126static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
127		    uint16_t);
128static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
129		    const struct bwn_channelinfo *, int);
130static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
131		    const struct ieee80211_bpf_params *);
132static void	bwn_updateslot(struct ieee80211com *);
133static void	bwn_update_promisc(struct ieee80211com *);
134static void	bwn_wme_init(struct bwn_mac *);
135static int	bwn_wme_update(struct ieee80211com *);
136static void	bwn_wme_clear(struct bwn_softc *);
137static void	bwn_wme_load(struct bwn_mac *);
138static void	bwn_wme_loadparams(struct bwn_mac *,
139		    const struct wmeParams *, uint16_t);
140static void	bwn_scan_start(struct ieee80211com *);
141static void	bwn_scan_end(struct ieee80211com *);
142static void	bwn_set_channel(struct ieee80211com *);
143static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
144		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
145		    const uint8_t [IEEE80211_ADDR_LEN],
146		    const uint8_t [IEEE80211_ADDR_LEN]);
147static void	bwn_vap_delete(struct ieee80211vap *);
148static void	bwn_stop(struct bwn_softc *);
149static int	bwn_core_init(struct bwn_mac *);
150static void	bwn_core_start(struct bwn_mac *);
151static void	bwn_core_exit(struct bwn_mac *);
152static void	bwn_bt_disable(struct bwn_mac *);
153static int	bwn_chip_init(struct bwn_mac *);
154static void	bwn_set_txretry(struct bwn_mac *, int, int);
155static void	bwn_rate_init(struct bwn_mac *);
156static void	bwn_set_phytxctl(struct bwn_mac *);
157static void	bwn_spu_setdelay(struct bwn_mac *, int);
158static void	bwn_bt_enable(struct bwn_mac *);
159static void	bwn_set_macaddr(struct bwn_mac *);
160static void	bwn_crypt_init(struct bwn_mac *);
161static void	bwn_chip_exit(struct bwn_mac *);
162static int	bwn_fw_fillinfo(struct bwn_mac *);
163static int	bwn_fw_loaducode(struct bwn_mac *);
164static int	bwn_gpio_init(struct bwn_mac *);
165static int	bwn_fw_loadinitvals(struct bwn_mac *);
166static int	bwn_phy_init(struct bwn_mac *);
167static void	bwn_set_txantenna(struct bwn_mac *, int);
168static void	bwn_set_opmode(struct bwn_mac *);
169static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
170static uint8_t	bwn_plcp_getcck(const uint8_t);
171static uint8_t	bwn_plcp_getofdm(const uint8_t);
172static void	bwn_pio_init(struct bwn_mac *);
173static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
174static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
175		    int);
176static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
177		    struct bwn_pio_rxqueue *, int);
178static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
179static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
180		    uint16_t);
181static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
182static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
183static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
184static void	bwn_pio_handle_txeof(struct bwn_mac *,
185		    const struct bwn_txstatus *);
186static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
187static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
188static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
189		    uint16_t);
190static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
191		    uint32_t);
192static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
193		    struct mbuf *);
194static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
195static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
196		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
197static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
198		    uint16_t, uint32_t);
199static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
200		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
201static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
203static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
204		    uint16_t, struct bwn_pio_txpkt **);
205static void	bwn_dma_init(struct bwn_mac *);
206static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
207static int	bwn_dma_mask2type(uint64_t);
208static uint64_t	bwn_dma_mask(struct bwn_mac *);
209static uint16_t	bwn_dma_base(int, int);
210static void	bwn_dma_ringfree(struct bwn_dma_ring **);
211static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
212		    int, struct bwn_dmadesc_generic **,
213		    struct bwn_dmadesc_meta **);
214static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
215		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
216		    int, int);
217static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
218static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
219static void	bwn_dma_32_resume(struct bwn_dma_ring *);
220static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
221static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
222static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
223		    int, struct bwn_dmadesc_generic **,
224		    struct bwn_dmadesc_meta **);
225static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
226		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
227		    int, int);
228static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
229static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
230static void	bwn_dma_64_resume(struct bwn_dma_ring *);
231static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
232static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
233static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
234static void	bwn_dma_setup(struct bwn_dma_ring *);
235static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
236static void	bwn_dma_cleanup(struct bwn_dma_ring *);
237static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
238static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
239static void	bwn_dma_rx(struct bwn_dma_ring *);
240static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
241static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
242		    struct bwn_dmadesc_meta *);
243static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
244static int	bwn_dma_gettype(struct bwn_mac *);
245static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
246static int	bwn_dma_freeslot(struct bwn_dma_ring *);
247static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
248static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
249static int	bwn_dma_newbuf(struct bwn_dma_ring *,
250		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
251		    int);
252static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
253		    bus_size_t, int);
254static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
255static void	bwn_dma_handle_txeof(struct bwn_mac *,
256		    const struct bwn_txstatus *);
257static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
258		    struct mbuf *);
259static int	bwn_dma_getslot(struct bwn_dma_ring *);
260static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
261		    uint8_t);
262static int	bwn_dma_attach(struct bwn_mac *);
263static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
264		    int, int, int);
265static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
266		    const struct bwn_txstatus *, uint16_t, int *);
267static void	bwn_dma_free(struct bwn_mac *);
268static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
269static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
270		    const char *, struct bwn_fwfile *);
271static void	bwn_release_firmware(struct bwn_mac *);
272static void	bwn_do_release_fw(struct bwn_fwfile *);
273static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
274static int	bwn_fwinitvals_write(struct bwn_mac *,
275		    const struct bwn_fwinitvals *, size_t, size_t);
276static uint16_t	bwn_ant2phy(int);
277static void	bwn_mac_write_bssid(struct bwn_mac *);
278static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
279		    const uint8_t *);
280static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
281		    const uint8_t *, size_t, const uint8_t *);
282static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
283		    const uint8_t *);
284static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
285		    const uint8_t *);
286static void	bwn_phy_exit(struct bwn_mac *);
287static void	bwn_core_stop(struct bwn_mac *);
288static int	bwn_switch_band(struct bwn_softc *,
289		    struct ieee80211_channel *);
290static void	bwn_phy_reset(struct bwn_mac *);
291static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
292static void	bwn_set_pretbtt(struct bwn_mac *);
293static int	bwn_intr(void *);
294static void	bwn_intrtask(void *, int);
295static void	bwn_restart(struct bwn_mac *, const char *);
296static void	bwn_intr_ucode_debug(struct bwn_mac *);
297static void	bwn_intr_tbtt_indication(struct bwn_mac *);
298static void	bwn_intr_atim_end(struct bwn_mac *);
299static void	bwn_intr_beacon(struct bwn_mac *);
300static void	bwn_intr_pmq(struct bwn_mac *);
301static void	bwn_intr_noise(struct bwn_mac *);
302static void	bwn_intr_txeof(struct bwn_mac *);
303static void	bwn_hwreset(void *, int);
304static void	bwn_handle_fwpanic(struct bwn_mac *);
305static void	bwn_load_beacon0(struct bwn_mac *);
306static void	bwn_load_beacon1(struct bwn_mac *);
307static uint32_t	bwn_jssi_read(struct bwn_mac *);
308static void	bwn_noise_gensample(struct bwn_mac *);
309static void	bwn_handle_txeof(struct bwn_mac *,
310		    const struct bwn_txstatus *);
311static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
312static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
313static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
314		    struct mbuf *);
315static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
316static int	bwn_set_txhdr(struct bwn_mac *,
317		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
318		    uint16_t);
319static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
320		    const uint8_t);
321static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
322static uint8_t	bwn_get_fbrate(uint8_t);
323static void	bwn_txpwr(void *, int);
324static void	bwn_tasks(void *);
325static void	bwn_task_15s(struct bwn_mac *);
326static void	bwn_task_30s(struct bwn_mac *);
327static void	bwn_task_60s(struct bwn_mac *);
328static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
329		    uint8_t);
330static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
331static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
332		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
333		    int, int);
334static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
335static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
336static void	bwn_watchdog(void *);
337static void	bwn_dma_stop(struct bwn_mac *);
338static void	bwn_pio_stop(struct bwn_mac *);
339static void	bwn_dma_ringstop(struct bwn_dma_ring **);
340static void	bwn_led_attach(struct bwn_mac *);
341static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
342static void	bwn_led_event(struct bwn_mac *, int);
343static void	bwn_led_blink_start(struct bwn_mac *, int, int);
344static void	bwn_led_blink_next(void *);
345static void	bwn_led_blink_end(void *);
346static void	bwn_rfswitch(void *);
347static void	bwn_rf_turnon(struct bwn_mac *);
348static void	bwn_rf_turnoff(struct bwn_mac *);
349static void	bwn_sysctl_node(struct bwn_softc *);
350
351static struct resource_spec bwn_res_spec_legacy[] = {
352	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
353	{ -1,			0,		0 }
354};
355
356static struct resource_spec bwn_res_spec_msi[] = {
357	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
358	{ -1,			0,		0 }
359};
360
361static const struct bwn_channelinfo bwn_chantable_bg = {
362	.channels = {
363		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
364		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
365		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
366		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
367		{ 2472, 13, 30 }, { 2484, 14, 30 } },
368	.nchannels = 14
369};
370
371static const struct bwn_channelinfo bwn_chantable_a = {
372	.channels = {
373		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
374		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
375		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
376		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
377		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
378		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
379		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
380		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
381		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
382		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
383		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
384		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
385		{ 6080, 216, 30 } },
386	.nchannels = 37
387};
388
389static const struct bwn_channelinfo bwn_chantable_n = {
390	.channels = {
391		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
392		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
393		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
394		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
395		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
396		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
397		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
398		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
399		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
400		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
401		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
402		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
403		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
404		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
405		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
406		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
407		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
408		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
409		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
410		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
411		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
412		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
413		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
414		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
415		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
416		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
417		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
418		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
419		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
420		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
421		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
422		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
423		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
424		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
425		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
426		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
427		{ 6130, 226, 30 }, { 6140, 228, 30 } },
428	.nchannels = 110
429};
430
431#define	VENDOR_LED_ACT(vendor)				\
432{							\
433	.vid = PCI_VENDOR_##vendor,			\
434	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
435}
436
437static const struct {
438	uint16_t	vid;
439	uint8_t		led_act[BWN_LED_MAX];
440} bwn_vendor_led_act[] = {
441	VENDOR_LED_ACT(COMPAQ),
442	VENDOR_LED_ACT(ASUSTEK)
443};
444
445static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
446	{ BWN_VENDOR_LED_ACT_DEFAULT };
447
448#undef VENDOR_LED_ACT
449
450static const struct {
451	int		on_dur;
452	int		off_dur;
453} bwn_led_duration[109] = {
454	[0]	= { 400, 100 },
455	[2]	= { 150, 75 },
456	[4]	= { 90, 45 },
457	[11]	= { 66, 34 },
458	[12]	= { 53, 26 },
459	[18]	= { 42, 21 },
460	[22]	= { 35, 17 },
461	[24]	= { 32, 16 },
462	[36]	= { 21, 10 },
463	[48]	= { 16, 8 },
464	[72]	= { 11, 5 },
465	[96]	= { 9, 4 },
466	[108]	= { 7, 3 }
467};
468
469static const uint16_t bwn_wme_shm_offsets[] = {
470	[0] = BWN_WME_BESTEFFORT,
471	[1] = BWN_WME_BACKGROUND,
472	[2] = BWN_WME_VOICE,
473	[3] = BWN_WME_VIDEO,
474};
475
476static const struct siba_devid bwn_devs[] = {
477	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
478	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
479	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
480	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
481	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
482	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
483	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
484	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
485	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
486};
487
488static int
489bwn_probe(device_t dev)
490{
491	int i;
492
493	for (i = 0; i < nitems(bwn_devs); i++) {
494		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
495		    siba_get_device(dev) == bwn_devs[i].sd_device &&
496		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
497			return (BUS_PROBE_DEFAULT);
498	}
499
500	return (ENXIO);
501}
502
503static int
504bwn_attach(device_t dev)
505{
506	struct bwn_mac *mac;
507	struct bwn_softc *sc = device_get_softc(dev);
508	int error, i, msic, reg;
509
510	sc->sc_dev = dev;
511#ifdef BWN_DEBUG
512	sc->sc_debug = bwn_debug;
513#endif
514
515	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
516		bwn_attach_pre(sc);
517		bwn_sprom_bugfixes(dev);
518		sc->sc_flags |= BWN_FLAG_ATTACHED;
519	}
520
521	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
522		if (siba_get_pci_device(dev) != 0x4313 &&
523		    siba_get_pci_device(dev) != 0x431a &&
524		    siba_get_pci_device(dev) != 0x4321) {
525			device_printf(sc->sc_dev,
526			    "skip 802.11 cores\n");
527			return (ENODEV);
528		}
529	}
530
531	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
532	mac->mac_sc = sc;
533	mac->mac_status = BWN_MAC_STATUS_UNINIT;
534	if (bwn_bfp != 0)
535		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
536
537	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
538	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
539	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
540
541	error = bwn_attach_core(mac);
542	if (error)
543		goto fail0;
544	bwn_led_attach(mac);
545
546	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
547	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
548	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
549	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
550	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
551	    mac->mac_phy.rf_rev);
552	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
553		device_printf(sc->sc_dev, "DMA (%d bits)\n",
554		    mac->mac_method.dma.dmatype);
555	else
556		device_printf(sc->sc_dev, "PIO\n");
557
558	/*
559	 * setup PCI resources and interrupt.
560	 */
561	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
562		msic = pci_msi_count(dev);
563		if (bootverbose)
564			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
565	} else
566		msic = 0;
567
568	mac->mac_intr_spec = bwn_res_spec_legacy;
569	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
570		if (pci_alloc_msi(dev, &msic) == 0) {
571			device_printf(sc->sc_dev,
572			    "Using %d MSI messages\n", msic);
573			mac->mac_intr_spec = bwn_res_spec_msi;
574			mac->mac_msi = 1;
575		}
576	}
577
578	error = bus_alloc_resources(dev, mac->mac_intr_spec,
579	    mac->mac_res_irq);
580	if (error) {
581		device_printf(sc->sc_dev,
582		    "couldn't allocate IRQ resources (%d)\n", error);
583		goto fail1;
584	}
585
586	if (mac->mac_msi == 0)
587		error = bus_setup_intr(dev, mac->mac_res_irq[0],
588		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
589		    &mac->mac_intrhand[0]);
590	else {
591		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
592			error = bus_setup_intr(dev, mac->mac_res_irq[i],
593			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
594			    &mac->mac_intrhand[i]);
595			if (error != 0) {
596				device_printf(sc->sc_dev,
597				    "couldn't setup interrupt (%d)\n", error);
598				break;
599			}
600		}
601	}
602
603	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
604
605	/*
606	 * calls attach-post routine
607	 */
608	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
609		bwn_attach_post(sc);
610
611	return (0);
612fail1:
613	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
614		pci_release_msi(dev);
615fail0:
616	free(mac, M_DEVBUF);
617	return (error);
618}
619
620static int
621bwn_is_valid_ether_addr(uint8_t *addr)
622{
623	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
624
625	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
626		return (FALSE);
627
628	return (TRUE);
629}
630
631static int
632bwn_attach_post(struct bwn_softc *sc)
633{
634	struct ieee80211com *ic = &sc->sc_ic;
635
636	ic->ic_softc = sc;
637	ic->ic_name = device_get_nameunit(sc->sc_dev);
638	/* XXX not right but it's not used anywhere important */
639	ic->ic_phytype = IEEE80211_T_OFDM;
640	ic->ic_opmode = IEEE80211_M_STA;
641	ic->ic_caps =
642		  IEEE80211_C_STA		/* station mode supported */
643		| IEEE80211_C_MONITOR		/* monitor mode */
644		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
645		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
646		| IEEE80211_C_SHSLOT		/* short slot time supported */
647		| IEEE80211_C_WME		/* WME/WMM supported */
648		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
649#if 0
650		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
651#endif
652		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
653		;
654
655	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
656
657	IEEE80211_ADDR_COPY(ic->ic_macaddr,
658	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
659	    siba_sprom_get_mac_80211a(sc->sc_dev) :
660	    siba_sprom_get_mac_80211bg(sc->sc_dev));
661
662	/* call MI attach routine. */
663	ieee80211_ifattach(ic);
664
665	ic->ic_headroom = sizeof(struct bwn_txhdr);
666
667	/* override default methods */
668	ic->ic_raw_xmit = bwn_raw_xmit;
669	ic->ic_updateslot = bwn_updateslot;
670	ic->ic_update_promisc = bwn_update_promisc;
671	ic->ic_wme.wme_update = bwn_wme_update;
672	ic->ic_scan_start = bwn_scan_start;
673	ic->ic_scan_end = bwn_scan_end;
674	ic->ic_set_channel = bwn_set_channel;
675	ic->ic_vap_create = bwn_vap_create;
676	ic->ic_vap_delete = bwn_vap_delete;
677	ic->ic_transmit = bwn_transmit;
678	ic->ic_parent = bwn_parent;
679
680	ieee80211_radiotap_attach(ic,
681	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
682	    BWN_TX_RADIOTAP_PRESENT,
683	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
684	    BWN_RX_RADIOTAP_PRESENT);
685
686	bwn_sysctl_node(sc);
687
688	if (bootverbose)
689		ieee80211_announce(ic);
690	return (0);
691}
692
693static void
694bwn_phy_detach(struct bwn_mac *mac)
695{
696
697	if (mac->mac_phy.detach != NULL)
698		mac->mac_phy.detach(mac);
699}
700
701static int
702bwn_detach(device_t dev)
703{
704	struct bwn_softc *sc = device_get_softc(dev);
705	struct bwn_mac *mac = sc->sc_curmac;
706	struct ieee80211com *ic = &sc->sc_ic;
707	int i;
708
709	sc->sc_flags |= BWN_FLAG_INVALID;
710
711	if (device_is_attached(sc->sc_dev)) {
712		BWN_LOCK(sc);
713		bwn_stop(sc);
714		BWN_UNLOCK(sc);
715		bwn_dma_free(mac);
716		callout_drain(&sc->sc_led_blink_ch);
717		callout_drain(&sc->sc_rfswitch_ch);
718		callout_drain(&sc->sc_task_ch);
719		callout_drain(&sc->sc_watchdog_ch);
720		bwn_phy_detach(mac);
721		ieee80211_draintask(ic, &mac->mac_hwreset);
722		ieee80211_draintask(ic, &mac->mac_txpower);
723		ieee80211_ifdetach(ic);
724	}
725	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
726	taskqueue_free(sc->sc_tq);
727
728	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
729		if (mac->mac_intrhand[i] != NULL) {
730			bus_teardown_intr(dev, mac->mac_res_irq[i],
731			    mac->mac_intrhand[i]);
732			mac->mac_intrhand[i] = NULL;
733		}
734	}
735	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
736	if (mac->mac_msi != 0)
737		pci_release_msi(dev);
738	mbufq_drain(&sc->sc_snd);
739	BWN_LOCK_DESTROY(sc);
740	return (0);
741}
742
743static void
744bwn_attach_pre(struct bwn_softc *sc)
745{
746
747	BWN_LOCK_INIT(sc);
748	TAILQ_INIT(&sc->sc_maclist);
749	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
750	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
751	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
752	mbufq_init(&sc->sc_snd, ifqmaxlen);
753	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
754		taskqueue_thread_enqueue, &sc->sc_tq);
755	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
756		"%s taskq", device_get_nameunit(sc->sc_dev));
757}
758
759static void
760bwn_sprom_bugfixes(device_t dev)
761{
762#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
763	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
764	 (siba_get_pci_device(dev) == _device) &&			\
765	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
766	 (siba_get_pci_subdevice(dev) == _subdevice))
767
768	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
769	    siba_get_pci_subdevice(dev) == 0x4e &&
770	    siba_get_pci_revid(dev) > 0x40)
771		siba_sprom_set_bf_lo(dev,
772		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
773	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
774	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
775		siba_sprom_set_bf_lo(dev,
776		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
777	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
778		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
779		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
780		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
781		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
782		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
783		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
784		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
785			siba_sprom_set_bf_lo(dev,
786			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
787	}
788#undef	BWN_ISDEV
789}
790
791static void
792bwn_parent(struct ieee80211com *ic)
793{
794	struct bwn_softc *sc = ic->ic_softc;
795	int startall = 0;
796
797	BWN_LOCK(sc);
798	if (ic->ic_nrunning > 0) {
799		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
800			bwn_init(sc);
801			startall = 1;
802		} else
803			bwn_update_promisc(ic);
804	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
805		bwn_stop(sc);
806	BWN_UNLOCK(sc);
807
808	if (startall)
809		ieee80211_start_all(ic);
810}
811
812static int
813bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
814{
815	struct bwn_softc *sc = ic->ic_softc;
816	int error;
817
818	BWN_LOCK(sc);
819	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
820		BWN_UNLOCK(sc);
821		return (ENXIO);
822	}
823	error = mbufq_enqueue(&sc->sc_snd, m);
824	if (error) {
825		BWN_UNLOCK(sc);
826		return (error);
827	}
828	bwn_start(sc);
829	BWN_UNLOCK(sc);
830	return (0);
831}
832
833static void
834bwn_start(struct bwn_softc *sc)
835{
836	struct bwn_mac *mac = sc->sc_curmac;
837	struct ieee80211_frame *wh;
838	struct ieee80211_node *ni;
839	struct ieee80211_key *k;
840	struct mbuf *m;
841
842	BWN_ASSERT_LOCKED(sc);
843
844	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
845	    mac->mac_status < BWN_MAC_STATUS_STARTED)
846		return;
847
848	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
849		if (bwn_tx_isfull(sc, m))
850			break;
851		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
852		if (ni == NULL) {
853			device_printf(sc->sc_dev, "unexpected NULL ni\n");
854			m_freem(m);
855			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
856			continue;
857		}
858		wh = mtod(m, struct ieee80211_frame *);
859		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
860			k = ieee80211_crypto_encap(ni, m);
861			if (k == NULL) {
862				if_inc_counter(ni->ni_vap->iv_ifp,
863				    IFCOUNTER_OERRORS, 1);
864				ieee80211_free_node(ni);
865				m_freem(m);
866				continue;
867			}
868		}
869		wh = NULL;	/* Catch any invalid use */
870		if (bwn_tx_start(sc, ni, m) != 0) {
871			if (ni != NULL) {
872				if_inc_counter(ni->ni_vap->iv_ifp,
873				    IFCOUNTER_OERRORS, 1);
874				ieee80211_free_node(ni);
875			}
876			continue;
877		}
878		sc->sc_watchdog_timer = 5;
879	}
880}
881
882static int
883bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
884{
885	struct bwn_dma_ring *dr;
886	struct bwn_mac *mac = sc->sc_curmac;
887	struct bwn_pio_txqueue *tq;
888	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
889
890	BWN_ASSERT_LOCKED(sc);
891
892	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
893		dr = bwn_dma_select(mac, M_WME_GETAC(m));
894		if (dr->dr_stop == 1 ||
895		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
896			dr->dr_stop = 1;
897			goto full;
898		}
899	} else {
900		tq = bwn_pio_select(mac, M_WME_GETAC(m));
901		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
902		    pktlen > (tq->tq_size - tq->tq_used))
903			goto full;
904	}
905	return (0);
906full:
907	mbufq_prepend(&sc->sc_snd, m);
908	return (1);
909}
910
911static int
912bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
913{
914	struct bwn_mac *mac = sc->sc_curmac;
915	int error;
916
917	BWN_ASSERT_LOCKED(sc);
918
919	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
920		m_freem(m);
921		return (ENXIO);
922	}
923
924	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
925	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
926	if (error) {
927		m_freem(m);
928		return (error);
929	}
930	return (0);
931}
932
933static int
934bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
935{
936	struct bwn_pio_txpkt *tp;
937	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
938	struct bwn_softc *sc = mac->mac_sc;
939	struct bwn_txhdr txhdr;
940	struct mbuf *m_new;
941	uint32_t ctl32;
942	int error;
943	uint16_t ctl16;
944
945	BWN_ASSERT_LOCKED(sc);
946
947	/* XXX TODO send packets after DTIM */
948
949	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
950	tp = TAILQ_FIRST(&tq->tq_pktlist);
951	tp->tp_ni = ni;
952	tp->tp_m = m;
953
954	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
955	if (error) {
956		device_printf(sc->sc_dev, "tx fail\n");
957		return (error);
958	}
959
960	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
961	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
962	tq->tq_free--;
963
964	if (siba_get_revid(sc->sc_dev) >= 8) {
965		/*
966		 * XXX please removes m_defrag(9)
967		 */
968		m_new = m_defrag(m, M_NOWAIT);
969		if (m_new == NULL) {
970			device_printf(sc->sc_dev,
971			    "%s: can't defrag TX buffer\n",
972			    __func__);
973			return (ENOBUFS);
974		}
975		if (m_new->m_next != NULL)
976			device_printf(sc->sc_dev,
977			    "TODO: fragmented packets for PIO\n");
978		tp->tp_m = m_new;
979
980		/* send HEADER */
981		ctl32 = bwn_pio_write_multi_4(mac, tq,
982		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
983			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
984		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
985		/* send BODY */
986		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
987		    mtod(m_new, const void *), m_new->m_pkthdr.len);
988		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
989		    ctl32 | BWN_PIO8_TXCTL_EOF);
990	} else {
991		ctl16 = bwn_pio_write_multi_2(mac, tq,
992		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
993			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
994		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
995		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
996		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
997		    ctl16 | BWN_PIO_TXCTL_EOF);
998	}
999
1000	return (0);
1001}
1002
1003static struct bwn_pio_txqueue *
1004bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1005{
1006
1007	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1008		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1009
1010	switch (prio) {
1011	case 0:
1012		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1013	case 1:
1014		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1015	case 2:
1016		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1017	case 3:
1018		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1019	}
1020	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1021	return (NULL);
1022}
1023
1024static int
1025bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1026{
1027#define	BWN_GET_TXHDRCACHE(slot)					\
1028	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1029	struct bwn_dma *dma = &mac->mac_method.dma;
1030	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1031	struct bwn_dmadesc_generic *desc;
1032	struct bwn_dmadesc_meta *mt;
1033	struct bwn_softc *sc = mac->mac_sc;
1034	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1035	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1036
1037	BWN_ASSERT_LOCKED(sc);
1038	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1039
1040	/* XXX send after DTIM */
1041
1042	slot = bwn_dma_getslot(dr);
1043	dr->getdesc(dr, slot, &desc, &mt);
1044	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1045	    ("%s:%d: fail", __func__, __LINE__));
1046
1047	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1048	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1049	    BWN_DMA_COOKIE(dr, slot));
1050	if (error)
1051		goto fail;
1052	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1053	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1054	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1055	if (error) {
1056		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1057		    __func__, error);
1058		goto fail;
1059	}
1060	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1061	    BUS_DMASYNC_PREWRITE);
1062	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1063	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1064	    BUS_DMASYNC_PREWRITE);
1065
1066	slot = bwn_dma_getslot(dr);
1067	dr->getdesc(dr, slot, &desc, &mt);
1068	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1069	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1070	mt->mt_m = m;
1071	mt->mt_ni = ni;
1072
1073	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1074	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1075	if (error && error != EFBIG) {
1076		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1077		    __func__, error);
1078		goto fail;
1079	}
1080	if (error) {    /* error == EFBIG */
1081		struct mbuf *m_new;
1082
1083		m_new = m_defrag(m, M_NOWAIT);
1084		if (m_new == NULL) {
1085			device_printf(sc->sc_dev,
1086			    "%s: can't defrag TX buffer\n",
1087			    __func__);
1088			error = ENOBUFS;
1089			goto fail;
1090		} else {
1091			m = m_new;
1092		}
1093
1094		mt->mt_m = m;
1095		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1096		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1097		if (error) {
1098			device_printf(sc->sc_dev,
1099			    "%s: can't load TX buffer (2) %d\n",
1100			    __func__, error);
1101			goto fail;
1102		}
1103	}
1104	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1105	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1106	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1107	    BUS_DMASYNC_PREWRITE);
1108
1109	/* XXX send after DTIM */
1110
1111	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1112	return (0);
1113fail:
1114	dr->dr_curslot = backup[0];
1115	dr->dr_usedslot = backup[1];
1116	return (error);
1117#undef BWN_GET_TXHDRCACHE
1118}
1119
1120static void
1121bwn_watchdog(void *arg)
1122{
1123	struct bwn_softc *sc = arg;
1124
1125	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1126		device_printf(sc->sc_dev, "device timeout\n");
1127		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1128	}
1129	callout_schedule(&sc->sc_watchdog_ch, hz);
1130}
1131
1132static int
1133bwn_attach_core(struct bwn_mac *mac)
1134{
1135	struct bwn_softc *sc = mac->mac_sc;
1136	int error, have_bg = 0, have_a = 0;
1137	uint32_t high;
1138
1139	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1140	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1141
1142	siba_powerup(sc->sc_dev, 0);
1143
1144	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1145	bwn_reset_core(mac,
1146	    (high & BWN_TGSHIGH_HAVE_2GHZ) ? BWN_TGSLOW_SUPPORT_G : 0);
1147	error = bwn_phy_getinfo(mac, high);
1148	if (error)
1149		goto fail;
1150
1151	have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1152	have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1153	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1154	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1155	    siba_get_pci_device(sc->sc_dev) != 0x4324) {
1156		have_a = have_bg = 0;
1157		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1158			have_a = 1;
1159		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1160		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1161		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1162			have_bg = 1;
1163		else
1164			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1165			    mac->mac_phy.type));
1166	}
1167	/* XXX turns off PHY A because it's not supported */
1168	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1169	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1170		have_a = 0;
1171		have_bg = 1;
1172	}
1173
1174	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1175		mac->mac_phy.attach = bwn_phy_g_attach;
1176		mac->mac_phy.detach = bwn_phy_g_detach;
1177		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1178		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1179		mac->mac_phy.init = bwn_phy_g_init;
1180		mac->mac_phy.exit = bwn_phy_g_exit;
1181		mac->mac_phy.phy_read = bwn_phy_g_read;
1182		mac->mac_phy.phy_write = bwn_phy_g_write;
1183		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1184		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1185		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1186		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1187		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1188		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1189		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1190		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1191		mac->mac_phy.set_im = bwn_phy_g_im;
1192		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1193		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1194		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1195		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1196	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1197		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1198		mac->mac_phy.init = bwn_phy_lp_init;
1199		mac->mac_phy.phy_read = bwn_phy_lp_read;
1200		mac->mac_phy.phy_write = bwn_phy_lp_write;
1201		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1202		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1203		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1204		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1205		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1206		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1207		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1208		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1209		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1210	} else {
1211		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1212		    mac->mac_phy.type);
1213		error = ENXIO;
1214		goto fail;
1215	}
1216
1217	mac->mac_phy.gmode = have_bg;
1218	if (mac->mac_phy.attach != NULL) {
1219		error = mac->mac_phy.attach(mac);
1220		if (error) {
1221			device_printf(sc->sc_dev, "failed\n");
1222			goto fail;
1223		}
1224	}
1225
1226	bwn_reset_core(mac, have_bg ? BWN_TGSLOW_SUPPORT_G : 0);
1227
1228	error = bwn_chiptest(mac);
1229	if (error)
1230		goto fail;
1231	error = bwn_setup_channels(mac, have_bg, have_a);
1232	if (error) {
1233		device_printf(sc->sc_dev, "failed to setup channels\n");
1234		goto fail;
1235	}
1236
1237	if (sc->sc_curmac == NULL)
1238		sc->sc_curmac = mac;
1239
1240	error = bwn_dma_attach(mac);
1241	if (error != 0) {
1242		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1243		goto fail;
1244	}
1245
1246	mac->mac_phy.switch_analog(mac, 0);
1247
1248	siba_dev_down(sc->sc_dev, 0);
1249fail:
1250	siba_powerdown(sc->sc_dev);
1251	return (error);
1252}
1253
1254void
1255bwn_reset_core(struct bwn_mac *mac, uint32_t flags)
1256{
1257	struct bwn_softc *sc = mac->mac_sc;
1258	uint32_t low, ctl;
1259
1260	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1261
1262	siba_dev_up(sc->sc_dev, flags);
1263	DELAY(2000);
1264
1265	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1266	    ~BWN_TGSLOW_PHYRESET;
1267	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1268	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1269	DELAY(1000);
1270	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1271	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1272	DELAY(1000);
1273
1274	if (mac->mac_phy.switch_analog != NULL)
1275		mac->mac_phy.switch_analog(mac, 1);
1276
1277	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1278	if (flags & BWN_TGSLOW_SUPPORT_G)
1279		ctl |= BWN_MACCTL_GMODE;
1280	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1281}
1282
1283static int
1284bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1285{
1286	struct bwn_phy *phy = &mac->mac_phy;
1287	struct bwn_softc *sc = mac->mac_sc;
1288	uint32_t tmp;
1289
1290	/* PHY */
1291	tmp = BWN_READ_2(mac, BWN_PHYVER);
1292	phy->gmode = (tgshigh & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1293	phy->rf_on = 1;
1294	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1295	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1296	phy->rev = (tmp & BWN_PHYVER_VERSION);
1297	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1298	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1299		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1300	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1301	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1302	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1303		goto unsupphy;
1304
1305	/* RADIO */
1306	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1307		if (siba_get_chiprev(sc->sc_dev) == 0)
1308			tmp = 0x3205017f;
1309		else if (siba_get_chiprev(sc->sc_dev) == 1)
1310			tmp = 0x4205017f;
1311		else
1312			tmp = 0x5205017f;
1313	} else {
1314		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1315		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1316		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1317		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1318	}
1319	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1320	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1321	phy->rf_manuf = (tmp & 0x00000fff);
1322	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1323		goto unsupradio;
1324	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1325	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1326	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1327	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1328	    (phy->type == BWN_PHYTYPE_N &&
1329	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1330	    (phy->type == BWN_PHYTYPE_LP &&
1331	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1332		goto unsupradio;
1333
1334	return (0);
1335unsupphy:
1336	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1337	    "analog %#x)\n",
1338	    phy->type, phy->rev, phy->analog);
1339	return (ENXIO);
1340unsupradio:
1341	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1342	    "rev %#x)\n",
1343	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1344	return (ENXIO);
1345}
1346
1347static int
1348bwn_chiptest(struct bwn_mac *mac)
1349{
1350#define	TESTVAL0	0x55aaaa55
1351#define	TESTVAL1	0xaa5555aa
1352	struct bwn_softc *sc = mac->mac_sc;
1353	uint32_t v, backup;
1354
1355	BWN_LOCK(sc);
1356
1357	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1358
1359	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1360	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1361		goto error;
1362	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1363	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1364		goto error;
1365
1366	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1367
1368	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1369	    (siba_get_revid(sc->sc_dev) <= 10)) {
1370		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1371		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1372		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1373			goto error;
1374		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1375			goto error;
1376	}
1377	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1378
1379	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1380	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1381		goto error;
1382
1383	BWN_UNLOCK(sc);
1384	return (0);
1385error:
1386	BWN_UNLOCK(sc);
1387	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1388	return (ENODEV);
1389}
1390
1391#define	IEEE80211_CHAN_HTG	(IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1392#define	IEEE80211_CHAN_HTA	(IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1393
1394static int
1395bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1396{
1397	struct bwn_softc *sc = mac->mac_sc;
1398	struct ieee80211com *ic = &sc->sc_ic;
1399
1400	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1401	ic->ic_nchans = 0;
1402
1403	if (have_bg)
1404		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1405		    &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1406	if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1407		if (have_a)
1408			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1409			    &ic->ic_nchans, &bwn_chantable_n,
1410			    IEEE80211_CHAN_HTA);
1411	} else {
1412		if (have_a)
1413			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1414			    &ic->ic_nchans, &bwn_chantable_a,
1415			    IEEE80211_CHAN_A);
1416	}
1417
1418	mac->mac_phy.supports_2ghz = have_bg;
1419	mac->mac_phy.supports_5ghz = have_a;
1420
1421	return (ic->ic_nchans == 0 ? ENXIO : 0);
1422}
1423
1424uint32_t
1425bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1426{
1427	uint32_t ret;
1428
1429	BWN_ASSERT_LOCKED(mac->mac_sc);
1430
1431	if (way == BWN_SHARED) {
1432		KASSERT((offset & 0x0001) == 0,
1433		    ("%s:%d warn", __func__, __LINE__));
1434		if (offset & 0x0003) {
1435			bwn_shm_ctlword(mac, way, offset >> 2);
1436			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1437			ret <<= 16;
1438			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1439			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1440			goto out;
1441		}
1442		offset >>= 2;
1443	}
1444	bwn_shm_ctlword(mac, way, offset);
1445	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1446out:
1447	return (ret);
1448}
1449
1450uint16_t
1451bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1452{
1453	uint16_t ret;
1454
1455	BWN_ASSERT_LOCKED(mac->mac_sc);
1456
1457	if (way == BWN_SHARED) {
1458		KASSERT((offset & 0x0001) == 0,
1459		    ("%s:%d warn", __func__, __LINE__));
1460		if (offset & 0x0003) {
1461			bwn_shm_ctlword(mac, way, offset >> 2);
1462			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1463			goto out;
1464		}
1465		offset >>= 2;
1466	}
1467	bwn_shm_ctlword(mac, way, offset);
1468	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1469out:
1470
1471	return (ret);
1472}
1473
1474static void
1475bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1476    uint16_t offset)
1477{
1478	uint32_t control;
1479
1480	control = way;
1481	control <<= 16;
1482	control |= offset;
1483	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1484}
1485
1486void
1487bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1488    uint32_t value)
1489{
1490	BWN_ASSERT_LOCKED(mac->mac_sc);
1491
1492	if (way == BWN_SHARED) {
1493		KASSERT((offset & 0x0001) == 0,
1494		    ("%s:%d warn", __func__, __LINE__));
1495		if (offset & 0x0003) {
1496			bwn_shm_ctlword(mac, way, offset >> 2);
1497			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1498				    (value >> 16) & 0xffff);
1499			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1500			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1501			return;
1502		}
1503		offset >>= 2;
1504	}
1505	bwn_shm_ctlword(mac, way, offset);
1506	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1507}
1508
1509void
1510bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1511    uint16_t value)
1512{
1513	BWN_ASSERT_LOCKED(mac->mac_sc);
1514
1515	if (way == BWN_SHARED) {
1516		KASSERT((offset & 0x0001) == 0,
1517		    ("%s:%d warn", __func__, __LINE__));
1518		if (offset & 0x0003) {
1519			bwn_shm_ctlword(mac, way, offset >> 2);
1520			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1521			return;
1522		}
1523		offset >>= 2;
1524	}
1525	bwn_shm_ctlword(mac, way, offset);
1526	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1527}
1528
1529static void
1530bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1531    int txpow)
1532{
1533
1534	c->ic_freq = freq;
1535	c->ic_flags = flags;
1536	c->ic_ieee = ieee;
1537	c->ic_minpower = 0;
1538	c->ic_maxpower = 2 * txpow;
1539	c->ic_maxregpower = txpow;
1540}
1541
1542static void
1543bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1544    const struct bwn_channelinfo *ci, int flags)
1545{
1546	struct ieee80211_channel *c;
1547	int i;
1548
1549	c = &chans[*nchans];
1550
1551	for (i = 0; i < ci->nchannels; i++) {
1552		const struct bwn_channel *hc;
1553
1554		hc = &ci->channels[i];
1555		if (*nchans >= maxchans)
1556			break;
1557		bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1558		c++, (*nchans)++;
1559		if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1560			/* g channel have a separate b-only entry */
1561			if (*nchans >= maxchans)
1562				break;
1563			c[0] = c[-1];
1564			c[-1].ic_flags = IEEE80211_CHAN_B;
1565			c++, (*nchans)++;
1566		}
1567		if (flags == IEEE80211_CHAN_HTG) {
1568			/* HT g channel have a separate g-only entry */
1569			if (*nchans >= maxchans)
1570				break;
1571			c[-1].ic_flags = IEEE80211_CHAN_G;
1572			c[0] = c[-1];
1573			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1574			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1575			c++, (*nchans)++;
1576		}
1577		if (flags == IEEE80211_CHAN_HTA) {
1578			/* HT a channel have a separate a-only entry */
1579			if (*nchans >= maxchans)
1580				break;
1581			c[-1].ic_flags = IEEE80211_CHAN_A;
1582			c[0] = c[-1];
1583			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1584			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1585			c++, (*nchans)++;
1586		}
1587	}
1588}
1589
1590static int
1591bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1592	const struct ieee80211_bpf_params *params)
1593{
1594	struct ieee80211com *ic = ni->ni_ic;
1595	struct bwn_softc *sc = ic->ic_softc;
1596	struct bwn_mac *mac = sc->sc_curmac;
1597	int error;
1598
1599	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1600	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1601		m_freem(m);
1602		return (ENETDOWN);
1603	}
1604
1605	BWN_LOCK(sc);
1606	if (bwn_tx_isfull(sc, m)) {
1607		m_freem(m);
1608		BWN_UNLOCK(sc);
1609		return (ENOBUFS);
1610	}
1611
1612	error = bwn_tx_start(sc, ni, m);
1613	if (error == 0)
1614		sc->sc_watchdog_timer = 5;
1615	BWN_UNLOCK(sc);
1616	return (error);
1617}
1618
1619/*
1620 * Callback from the 802.11 layer to update the slot time
1621 * based on the current setting.  We use it to notify the
1622 * firmware of ERP changes and the f/w takes care of things
1623 * like slot time and preamble.
1624 */
1625static void
1626bwn_updateslot(struct ieee80211com *ic)
1627{
1628	struct bwn_softc *sc = ic->ic_softc;
1629	struct bwn_mac *mac;
1630
1631	BWN_LOCK(sc);
1632	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1633		mac = (struct bwn_mac *)sc->sc_curmac;
1634		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1635	}
1636	BWN_UNLOCK(sc);
1637}
1638
1639/*
1640 * Callback from the 802.11 layer after a promiscuous mode change.
1641 * Note this interface does not check the operating mode as this
1642 * is an internal callback and we are expected to honor the current
1643 * state (e.g. this is used for setting the interface in promiscuous
1644 * mode when operating in hostap mode to do ACS).
1645 */
1646static void
1647bwn_update_promisc(struct ieee80211com *ic)
1648{
1649	struct bwn_softc *sc = ic->ic_softc;
1650	struct bwn_mac *mac = sc->sc_curmac;
1651
1652	BWN_LOCK(sc);
1653	mac = sc->sc_curmac;
1654	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1655		if (ic->ic_promisc > 0)
1656			sc->sc_filters |= BWN_MACCTL_PROMISC;
1657		else
1658			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1659		bwn_set_opmode(mac);
1660	}
1661	BWN_UNLOCK(sc);
1662}
1663
1664/*
1665 * Callback from the 802.11 layer to update WME parameters.
1666 */
1667static int
1668bwn_wme_update(struct ieee80211com *ic)
1669{
1670	struct bwn_softc *sc = ic->ic_softc;
1671	struct bwn_mac *mac = sc->sc_curmac;
1672	struct wmeParams *wmep;
1673	int i;
1674
1675	BWN_LOCK(sc);
1676	mac = sc->sc_curmac;
1677	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1678		bwn_mac_suspend(mac);
1679		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1680			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1681			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1682		}
1683		bwn_mac_enable(mac);
1684	}
1685	BWN_UNLOCK(sc);
1686	return (0);
1687}
1688
1689static void
1690bwn_scan_start(struct ieee80211com *ic)
1691{
1692	struct bwn_softc *sc = ic->ic_softc;
1693	struct bwn_mac *mac;
1694
1695	BWN_LOCK(sc);
1696	mac = sc->sc_curmac;
1697	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1698		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1699		bwn_set_opmode(mac);
1700		/* disable CFP update during scan */
1701		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1702	}
1703	BWN_UNLOCK(sc);
1704}
1705
1706static void
1707bwn_scan_end(struct ieee80211com *ic)
1708{
1709	struct bwn_softc *sc = ic->ic_softc;
1710	struct bwn_mac *mac;
1711
1712	BWN_LOCK(sc);
1713	mac = sc->sc_curmac;
1714	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1715		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1716		bwn_set_opmode(mac);
1717		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1718	}
1719	BWN_UNLOCK(sc);
1720}
1721
1722static void
1723bwn_set_channel(struct ieee80211com *ic)
1724{
1725	struct bwn_softc *sc = ic->ic_softc;
1726	struct bwn_mac *mac = sc->sc_curmac;
1727	struct bwn_phy *phy = &mac->mac_phy;
1728	int chan, error;
1729
1730	BWN_LOCK(sc);
1731
1732	error = bwn_switch_band(sc, ic->ic_curchan);
1733	if (error)
1734		goto fail;
1735	bwn_mac_suspend(mac);
1736	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1737	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1738	if (chan != phy->chan)
1739		bwn_switch_channel(mac, chan);
1740
1741	/* TX power level */
1742	if (ic->ic_curchan->ic_maxpower != 0 &&
1743	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1744		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1745		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1746		    BWN_TXPWR_IGNORE_TSSI);
1747	}
1748
1749	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1750	if (phy->set_antenna)
1751		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1752
1753	if (sc->sc_rf_enabled != phy->rf_on) {
1754		if (sc->sc_rf_enabled) {
1755			bwn_rf_turnon(mac);
1756			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1757				device_printf(sc->sc_dev,
1758				    "please turn on the RF switch\n");
1759		} else
1760			bwn_rf_turnoff(mac);
1761	}
1762
1763	bwn_mac_enable(mac);
1764
1765fail:
1766	/*
1767	 * Setup radio tap channel freq and flags
1768	 */
1769	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1770		htole16(ic->ic_curchan->ic_freq);
1771	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1772		htole16(ic->ic_curchan->ic_flags & 0xffff);
1773
1774	BWN_UNLOCK(sc);
1775}
1776
1777static struct ieee80211vap *
1778bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1779    enum ieee80211_opmode opmode, int flags,
1780    const uint8_t bssid[IEEE80211_ADDR_LEN],
1781    const uint8_t mac[IEEE80211_ADDR_LEN])
1782{
1783	struct ieee80211vap *vap;
1784	struct bwn_vap *bvp;
1785
1786	switch (opmode) {
1787	case IEEE80211_M_HOSTAP:
1788	case IEEE80211_M_MBSS:
1789	case IEEE80211_M_STA:
1790	case IEEE80211_M_WDS:
1791	case IEEE80211_M_MONITOR:
1792	case IEEE80211_M_IBSS:
1793	case IEEE80211_M_AHDEMO:
1794		break;
1795	default:
1796		return (NULL);
1797	}
1798
1799	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1800	vap = &bvp->bv_vap;
1801	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1802	/* override with driver methods */
1803	bvp->bv_newstate = vap->iv_newstate;
1804	vap->iv_newstate = bwn_newstate;
1805
1806	/* override max aid so sta's cannot assoc when we're out of sta id's */
1807	vap->iv_max_aid = BWN_STAID_MAX;
1808
1809	ieee80211_ratectl_init(vap);
1810
1811	/* complete setup */
1812	ieee80211_vap_attach(vap, ieee80211_media_change,
1813	    ieee80211_media_status, mac);
1814	return (vap);
1815}
1816
1817static void
1818bwn_vap_delete(struct ieee80211vap *vap)
1819{
1820	struct bwn_vap *bvp = BWN_VAP(vap);
1821
1822	ieee80211_ratectl_deinit(vap);
1823	ieee80211_vap_detach(vap);
1824	free(bvp, M_80211_VAP);
1825}
1826
1827static int
1828bwn_init(struct bwn_softc *sc)
1829{
1830	struct bwn_mac *mac;
1831	int error;
1832
1833	BWN_ASSERT_LOCKED(sc);
1834
1835	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1836	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1837	sc->sc_filters = 0;
1838	bwn_wme_clear(sc);
1839	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1840	sc->sc_rf_enabled = 1;
1841
1842	mac = sc->sc_curmac;
1843	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1844		error = bwn_core_init(mac);
1845		if (error != 0)
1846			return (error);
1847	}
1848	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1849		bwn_core_start(mac);
1850
1851	bwn_set_opmode(mac);
1852	bwn_set_pretbtt(mac);
1853	bwn_spu_setdelay(mac, 0);
1854	bwn_set_macaddr(mac);
1855
1856	sc->sc_flags |= BWN_FLAG_RUNNING;
1857	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1858	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1859
1860	return (0);
1861}
1862
1863static void
1864bwn_stop(struct bwn_softc *sc)
1865{
1866	struct bwn_mac *mac = sc->sc_curmac;
1867
1868	BWN_ASSERT_LOCKED(sc);
1869
1870	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1871		/* XXX FIXME opmode not based on VAP */
1872		bwn_set_opmode(mac);
1873		bwn_set_macaddr(mac);
1874	}
1875
1876	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1877		bwn_core_stop(mac);
1878
1879	callout_stop(&sc->sc_led_blink_ch);
1880	sc->sc_led_blinking = 0;
1881
1882	bwn_core_exit(mac);
1883	sc->sc_rf_enabled = 0;
1884
1885	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1886}
1887
1888static void
1889bwn_wme_clear(struct bwn_softc *sc)
1890{
1891#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1892	struct wmeParams *p;
1893	unsigned int i;
1894
1895	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1896	    ("%s:%d: fail", __func__, __LINE__));
1897
1898	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1899		p = &(sc->sc_wmeParams[i]);
1900
1901		switch (bwn_wme_shm_offsets[i]) {
1902		case BWN_WME_VOICE:
1903			p->wmep_txopLimit = 0;
1904			p->wmep_aifsn = 2;
1905			/* XXX FIXME: log2(cwmin) */
1906			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1907			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1908			break;
1909		case BWN_WME_VIDEO:
1910			p->wmep_txopLimit = 0;
1911			p->wmep_aifsn = 2;
1912			/* XXX FIXME: log2(cwmin) */
1913			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1914			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1915			break;
1916		case BWN_WME_BESTEFFORT:
1917			p->wmep_txopLimit = 0;
1918			p->wmep_aifsn = 3;
1919			/* XXX FIXME: log2(cwmin) */
1920			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1921			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1922			break;
1923		case BWN_WME_BACKGROUND:
1924			p->wmep_txopLimit = 0;
1925			p->wmep_aifsn = 7;
1926			/* XXX FIXME: log2(cwmin) */
1927			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1928			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1929			break;
1930		default:
1931			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1932		}
1933	}
1934}
1935
1936static int
1937bwn_core_init(struct bwn_mac *mac)
1938{
1939	struct bwn_softc *sc = mac->mac_sc;
1940	uint64_t hf;
1941	int error;
1942
1943	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
1944	    ("%s:%d: fail", __func__, __LINE__));
1945
1946	siba_powerup(sc->sc_dev, 0);
1947	if (!siba_dev_isup(sc->sc_dev))
1948		bwn_reset_core(mac,
1949		    mac->mac_phy.gmode ? BWN_TGSLOW_SUPPORT_G : 0);
1950
1951	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
1952	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
1953	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
1954	BWN_GETTIME(mac->mac_phy.nexttime);
1955	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
1956	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
1957	mac->mac_stats.link_noise = -95;
1958	mac->mac_reason_intr = 0;
1959	bzero(mac->mac_reason, sizeof(mac->mac_reason));
1960	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
1961#ifdef BWN_DEBUG
1962	if (sc->sc_debug & BWN_DEBUG_XMIT)
1963		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
1964#endif
1965	mac->mac_suspended = 1;
1966	mac->mac_task_state = 0;
1967	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
1968
1969	mac->mac_phy.init_pre(mac);
1970
1971	siba_pcicore_intr(sc->sc_dev);
1972
1973	siba_fix_imcfglobug(sc->sc_dev);
1974	bwn_bt_disable(mac);
1975	if (mac->mac_phy.prepare_hw) {
1976		error = mac->mac_phy.prepare_hw(mac);
1977		if (error)
1978			goto fail0;
1979	}
1980	error = bwn_chip_init(mac);
1981	if (error)
1982		goto fail0;
1983	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
1984	    siba_get_revid(sc->sc_dev));
1985	hf = bwn_hf_read(mac);
1986	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1987		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
1988		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
1989			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
1990		if (mac->mac_phy.rev == 1)
1991			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
1992	}
1993	if (mac->mac_phy.rf_ver == 0x2050) {
1994		if (mac->mac_phy.rf_rev < 6)
1995			hf |= BWN_HF_FORCE_VCO_RECALC;
1996		if (mac->mac_phy.rf_rev == 6)
1997			hf |= BWN_HF_4318_TSSI;
1998	}
1999	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2000		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2001	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2002	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2003		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2004	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2005	bwn_hf_write(mac, hf);
2006
2007	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2008	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2009	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2010	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2011
2012	bwn_rate_init(mac);
2013	bwn_set_phytxctl(mac);
2014
2015	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2016	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2017	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2018
2019	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2020		bwn_pio_init(mac);
2021	else
2022		bwn_dma_init(mac);
2023	bwn_wme_init(mac);
2024	bwn_spu_setdelay(mac, 1);
2025	bwn_bt_enable(mac);
2026
2027	siba_powerup(sc->sc_dev,
2028	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2029	bwn_set_macaddr(mac);
2030	bwn_crypt_init(mac);
2031
2032	/* XXX LED initializatin */
2033
2034	mac->mac_status = BWN_MAC_STATUS_INITED;
2035
2036	return (error);
2037
2038fail0:
2039	siba_powerdown(sc->sc_dev);
2040	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2041	    ("%s:%d: fail", __func__, __LINE__));
2042	return (error);
2043}
2044
2045static void
2046bwn_core_start(struct bwn_mac *mac)
2047{
2048	struct bwn_softc *sc = mac->mac_sc;
2049	uint32_t tmp;
2050
2051	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2052	    ("%s:%d: fail", __func__, __LINE__));
2053
2054	if (siba_get_revid(sc->sc_dev) < 5)
2055		return;
2056
2057	while (1) {
2058		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2059		if (!(tmp & 0x00000001))
2060			break;
2061		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2062	}
2063
2064	bwn_mac_enable(mac);
2065	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2066	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2067
2068	mac->mac_status = BWN_MAC_STATUS_STARTED;
2069}
2070
2071static void
2072bwn_core_exit(struct bwn_mac *mac)
2073{
2074	struct bwn_softc *sc = mac->mac_sc;
2075	uint32_t macctl;
2076
2077	BWN_ASSERT_LOCKED(mac->mac_sc);
2078
2079	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2080	    ("%s:%d: fail", __func__, __LINE__));
2081
2082	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2083		return;
2084	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2085
2086	macctl = BWN_READ_4(mac, BWN_MACCTL);
2087	macctl &= ~BWN_MACCTL_MCODE_RUN;
2088	macctl |= BWN_MACCTL_MCODE_JMP0;
2089	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2090
2091	bwn_dma_stop(mac);
2092	bwn_pio_stop(mac);
2093	bwn_chip_exit(mac);
2094	mac->mac_phy.switch_analog(mac, 0);
2095	siba_dev_down(sc->sc_dev, 0);
2096	siba_powerdown(sc->sc_dev);
2097}
2098
2099static void
2100bwn_bt_disable(struct bwn_mac *mac)
2101{
2102	struct bwn_softc *sc = mac->mac_sc;
2103
2104	(void)sc;
2105	/* XXX do nothing yet */
2106}
2107
2108static int
2109bwn_chip_init(struct bwn_mac *mac)
2110{
2111	struct bwn_softc *sc = mac->mac_sc;
2112	struct bwn_phy *phy = &mac->mac_phy;
2113	uint32_t macctl;
2114	int error;
2115
2116	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2117	if (phy->gmode)
2118		macctl |= BWN_MACCTL_GMODE;
2119	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2120
2121	error = bwn_fw_fillinfo(mac);
2122	if (error)
2123		return (error);
2124	error = bwn_fw_loaducode(mac);
2125	if (error)
2126		return (error);
2127
2128	error = bwn_gpio_init(mac);
2129	if (error)
2130		return (error);
2131
2132	error = bwn_fw_loadinitvals(mac);
2133	if (error) {
2134		siba_gpio_set(sc->sc_dev, 0);
2135		return (error);
2136	}
2137	phy->switch_analog(mac, 1);
2138	error = bwn_phy_init(mac);
2139	if (error) {
2140		siba_gpio_set(sc->sc_dev, 0);
2141		return (error);
2142	}
2143	if (phy->set_im)
2144		phy->set_im(mac, BWN_IMMODE_NONE);
2145	if (phy->set_antenna)
2146		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2147	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2148
2149	if (phy->type == BWN_PHYTYPE_B)
2150		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2151	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2152	if (siba_get_revid(sc->sc_dev) < 5)
2153		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2154
2155	BWN_WRITE_4(mac, BWN_MACCTL,
2156	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2157	BWN_WRITE_4(mac, BWN_MACCTL,
2158	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2159	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2160
2161	bwn_set_opmode(mac);
2162	if (siba_get_revid(sc->sc_dev) < 3) {
2163		BWN_WRITE_2(mac, 0x060e, 0x0000);
2164		BWN_WRITE_2(mac, 0x0610, 0x8000);
2165		BWN_WRITE_2(mac, 0x0604, 0x0000);
2166		BWN_WRITE_2(mac, 0x0606, 0x0200);
2167	} else {
2168		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2169		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2170	}
2171	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2172	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2173	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2174	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2175	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2176	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2177	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2178	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
2179	    siba_read_4(sc->sc_dev, SIBA_TGSLOW) | 0x00100000);
2180	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2181	return (error);
2182}
2183
2184/* read hostflags */
2185uint64_t
2186bwn_hf_read(struct bwn_mac *mac)
2187{
2188	uint64_t ret;
2189
2190	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2191	ret <<= 16;
2192	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2193	ret <<= 16;
2194	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2195	return (ret);
2196}
2197
2198void
2199bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2200{
2201
2202	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2203	    (value & 0x00000000ffffull));
2204	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2205	    (value & 0x0000ffff0000ull) >> 16);
2206	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2207	    (value & 0xffff00000000ULL) >> 32);
2208}
2209
2210static void
2211bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2212{
2213
2214	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2215	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2216}
2217
2218static void
2219bwn_rate_init(struct bwn_mac *mac)
2220{
2221
2222	switch (mac->mac_phy.type) {
2223	case BWN_PHYTYPE_A:
2224	case BWN_PHYTYPE_G:
2225	case BWN_PHYTYPE_LP:
2226	case BWN_PHYTYPE_N:
2227		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2228		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2229		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2230		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2231		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2232		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2233		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2234		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2235			break;
2236		/* FALLTHROUGH */
2237	case BWN_PHYTYPE_B:
2238		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2239		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2240		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2241		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2242		break;
2243	default:
2244		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2245	}
2246}
2247
2248static void
2249bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2250{
2251	uint16_t offset;
2252
2253	if (ofdm) {
2254		offset = 0x480;
2255		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2256	} else {
2257		offset = 0x4c0;
2258		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2259	}
2260	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2261	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2262}
2263
2264static uint8_t
2265bwn_plcp_getcck(const uint8_t bitrate)
2266{
2267
2268	switch (bitrate) {
2269	case BWN_CCK_RATE_1MB:
2270		return (0x0a);
2271	case BWN_CCK_RATE_2MB:
2272		return (0x14);
2273	case BWN_CCK_RATE_5MB:
2274		return (0x37);
2275	case BWN_CCK_RATE_11MB:
2276		return (0x6e);
2277	}
2278	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2279	return (0);
2280}
2281
2282static uint8_t
2283bwn_plcp_getofdm(const uint8_t bitrate)
2284{
2285
2286	switch (bitrate) {
2287	case BWN_OFDM_RATE_6MB:
2288		return (0xb);
2289	case BWN_OFDM_RATE_9MB:
2290		return (0xf);
2291	case BWN_OFDM_RATE_12MB:
2292		return (0xa);
2293	case BWN_OFDM_RATE_18MB:
2294		return (0xe);
2295	case BWN_OFDM_RATE_24MB:
2296		return (0x9);
2297	case BWN_OFDM_RATE_36MB:
2298		return (0xd);
2299	case BWN_OFDM_RATE_48MB:
2300		return (0x8);
2301	case BWN_OFDM_RATE_54MB:
2302		return (0xc);
2303	}
2304	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2305	return (0);
2306}
2307
2308static void
2309bwn_set_phytxctl(struct bwn_mac *mac)
2310{
2311	uint16_t ctl;
2312
2313	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2314	    BWN_TX_PHY_TXPWR);
2315	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2316	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2317	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2318}
2319
2320static void
2321bwn_pio_init(struct bwn_mac *mac)
2322{
2323	struct bwn_pio *pio = &mac->mac_method.pio;
2324
2325	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2326	    & ~BWN_MACCTL_BIGENDIAN);
2327	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2328
2329	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2330	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2331	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2332	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2333	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2334	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2335}
2336
2337static void
2338bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2339    int index)
2340{
2341	struct bwn_pio_txpkt *tp;
2342	struct bwn_softc *sc = mac->mac_sc;
2343	unsigned int i;
2344
2345	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2346	tq->tq_index = index;
2347
2348	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2349	if (siba_get_revid(sc->sc_dev) >= 8)
2350		tq->tq_size = 1920;
2351	else {
2352		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2353		tq->tq_size -= 80;
2354	}
2355
2356	TAILQ_INIT(&tq->tq_pktlist);
2357	for (i = 0; i < N(tq->tq_pkts); i++) {
2358		tp = &(tq->tq_pkts[i]);
2359		tp->tp_index = i;
2360		tp->tp_queue = tq;
2361		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2362	}
2363}
2364
2365static uint16_t
2366bwn_pio_idx2base(struct bwn_mac *mac, int index)
2367{
2368	struct bwn_softc *sc = mac->mac_sc;
2369	static const uint16_t bases[] = {
2370		BWN_PIO_BASE0,
2371		BWN_PIO_BASE1,
2372		BWN_PIO_BASE2,
2373		BWN_PIO_BASE3,
2374		BWN_PIO_BASE4,
2375		BWN_PIO_BASE5,
2376		BWN_PIO_BASE6,
2377		BWN_PIO_BASE7,
2378	};
2379	static const uint16_t bases_rev11[] = {
2380		BWN_PIO11_BASE0,
2381		BWN_PIO11_BASE1,
2382		BWN_PIO11_BASE2,
2383		BWN_PIO11_BASE3,
2384		BWN_PIO11_BASE4,
2385		BWN_PIO11_BASE5,
2386	};
2387
2388	if (siba_get_revid(sc->sc_dev) >= 11) {
2389		if (index >= N(bases_rev11))
2390			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2391		return (bases_rev11[index]);
2392	}
2393	if (index >= N(bases))
2394		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2395	return (bases[index]);
2396}
2397
2398static void
2399bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2400    int index)
2401{
2402	struct bwn_softc *sc = mac->mac_sc;
2403
2404	prq->prq_mac = mac;
2405	prq->prq_rev = siba_get_revid(sc->sc_dev);
2406	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2407	bwn_dma_rxdirectfifo(mac, index, 1);
2408}
2409
2410static void
2411bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2412{
2413	if (tq == NULL)
2414		return;
2415	bwn_pio_cancel_tx_packets(tq);
2416}
2417
2418static void
2419bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2420{
2421
2422	bwn_destroy_pioqueue_tx(pio);
2423}
2424
2425static uint16_t
2426bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2427    uint16_t offset)
2428{
2429
2430	return (BWN_READ_2(mac, tq->tq_base + offset));
2431}
2432
2433static void
2434bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2435{
2436	uint32_t ctl;
2437	int type;
2438	uint16_t base;
2439
2440	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2441	base = bwn_dma_base(type, idx);
2442	if (type == BWN_DMA_64BIT) {
2443		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2444		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2445		if (enable)
2446			ctl |= BWN_DMA64_RXDIRECTFIFO;
2447		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2448	} else {
2449		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2450		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2451		if (enable)
2452			ctl |= BWN_DMA32_RXDIRECTFIFO;
2453		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2454	}
2455}
2456
2457static uint64_t
2458bwn_dma_mask(struct bwn_mac *mac)
2459{
2460	uint32_t tmp;
2461	uint16_t base;
2462
2463	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2464	if (tmp & SIBA_TGSHIGH_DMA64)
2465		return (BWN_DMA_BIT_MASK(64));
2466	base = bwn_dma_base(0, 0);
2467	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2468	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2469	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2470		return (BWN_DMA_BIT_MASK(32));
2471
2472	return (BWN_DMA_BIT_MASK(30));
2473}
2474
2475static int
2476bwn_dma_mask2type(uint64_t dmamask)
2477{
2478
2479	if (dmamask == BWN_DMA_BIT_MASK(30))
2480		return (BWN_DMA_30BIT);
2481	if (dmamask == BWN_DMA_BIT_MASK(32))
2482		return (BWN_DMA_32BIT);
2483	if (dmamask == BWN_DMA_BIT_MASK(64))
2484		return (BWN_DMA_64BIT);
2485	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2486	return (BWN_DMA_30BIT);
2487}
2488
2489static void
2490bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2491{
2492	struct bwn_pio_txpkt *tp;
2493	unsigned int i;
2494
2495	for (i = 0; i < N(tq->tq_pkts); i++) {
2496		tp = &(tq->tq_pkts[i]);
2497		if (tp->tp_m) {
2498			m_freem(tp->tp_m);
2499			tp->tp_m = NULL;
2500		}
2501	}
2502}
2503
2504static uint16_t
2505bwn_dma_base(int type, int controller_idx)
2506{
2507	static const uint16_t map64[] = {
2508		BWN_DMA64_BASE0,
2509		BWN_DMA64_BASE1,
2510		BWN_DMA64_BASE2,
2511		BWN_DMA64_BASE3,
2512		BWN_DMA64_BASE4,
2513		BWN_DMA64_BASE5,
2514	};
2515	static const uint16_t map32[] = {
2516		BWN_DMA32_BASE0,
2517		BWN_DMA32_BASE1,
2518		BWN_DMA32_BASE2,
2519		BWN_DMA32_BASE3,
2520		BWN_DMA32_BASE4,
2521		BWN_DMA32_BASE5,
2522	};
2523
2524	if (type == BWN_DMA_64BIT) {
2525		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2526		    ("%s:%d: fail", __func__, __LINE__));
2527		return (map64[controller_idx]);
2528	}
2529	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2530	    ("%s:%d: fail", __func__, __LINE__));
2531	return (map32[controller_idx]);
2532}
2533
2534static void
2535bwn_dma_init(struct bwn_mac *mac)
2536{
2537	struct bwn_dma *dma = &mac->mac_method.dma;
2538
2539	/* setup TX DMA channels. */
2540	bwn_dma_setup(dma->wme[WME_AC_BK]);
2541	bwn_dma_setup(dma->wme[WME_AC_BE]);
2542	bwn_dma_setup(dma->wme[WME_AC_VI]);
2543	bwn_dma_setup(dma->wme[WME_AC_VO]);
2544	bwn_dma_setup(dma->mcast);
2545	/* setup RX DMA channel. */
2546	bwn_dma_setup(dma->rx);
2547}
2548
2549static struct bwn_dma_ring *
2550bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2551    int for_tx, int type)
2552{
2553	struct bwn_dma *dma = &mac->mac_method.dma;
2554	struct bwn_dma_ring *dr;
2555	struct bwn_dmadesc_generic *desc;
2556	struct bwn_dmadesc_meta *mt;
2557	struct bwn_softc *sc = mac->mac_sc;
2558	int error, i;
2559
2560	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2561	if (dr == NULL)
2562		goto out;
2563	dr->dr_numslots = BWN_RXRING_SLOTS;
2564	if (for_tx)
2565		dr->dr_numslots = BWN_TXRING_SLOTS;
2566
2567	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2568	    M_DEVBUF, M_NOWAIT | M_ZERO);
2569	if (dr->dr_meta == NULL)
2570		goto fail0;
2571
2572	dr->dr_type = type;
2573	dr->dr_mac = mac;
2574	dr->dr_base = bwn_dma_base(type, controller_index);
2575	dr->dr_index = controller_index;
2576	if (type == BWN_DMA_64BIT) {
2577		dr->getdesc = bwn_dma_64_getdesc;
2578		dr->setdesc = bwn_dma_64_setdesc;
2579		dr->start_transfer = bwn_dma_64_start_transfer;
2580		dr->suspend = bwn_dma_64_suspend;
2581		dr->resume = bwn_dma_64_resume;
2582		dr->get_curslot = bwn_dma_64_get_curslot;
2583		dr->set_curslot = bwn_dma_64_set_curslot;
2584	} else {
2585		dr->getdesc = bwn_dma_32_getdesc;
2586		dr->setdesc = bwn_dma_32_setdesc;
2587		dr->start_transfer = bwn_dma_32_start_transfer;
2588		dr->suspend = bwn_dma_32_suspend;
2589		dr->resume = bwn_dma_32_resume;
2590		dr->get_curslot = bwn_dma_32_get_curslot;
2591		dr->set_curslot = bwn_dma_32_set_curslot;
2592	}
2593	if (for_tx) {
2594		dr->dr_tx = 1;
2595		dr->dr_curslot = -1;
2596	} else {
2597		if (dr->dr_index == 0) {
2598			dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2599			dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2600		} else
2601			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2602	}
2603
2604	error = bwn_dma_allocringmemory(dr);
2605	if (error)
2606		goto fail2;
2607
2608	if (for_tx) {
2609		/*
2610		 * Assumption: BWN_TXRING_SLOTS can be divided by
2611		 * BWN_TX_SLOTS_PER_FRAME
2612		 */
2613		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2614		    ("%s:%d: fail", __func__, __LINE__));
2615
2616		dr->dr_txhdr_cache =
2617		    malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2618			BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
2619		KASSERT(dr->dr_txhdr_cache != NULL,
2620		    ("%s:%d: fail", __func__, __LINE__));
2621
2622		/*
2623		 * Create TX ring DMA stuffs
2624		 */
2625		error = bus_dma_tag_create(dma->parent_dtag,
2626				    BWN_ALIGN, 0,
2627				    BUS_SPACE_MAXADDR,
2628				    BUS_SPACE_MAXADDR,
2629				    NULL, NULL,
2630				    BWN_HDRSIZE(mac),
2631				    1,
2632				    BUS_SPACE_MAXSIZE_32BIT,
2633				    0,
2634				    NULL, NULL,
2635				    &dr->dr_txring_dtag);
2636		if (error) {
2637			device_printf(sc->sc_dev,
2638			    "can't create TX ring DMA tag: TODO frees\n");
2639			goto fail1;
2640		}
2641
2642		for (i = 0; i < dr->dr_numslots; i += 2) {
2643			dr->getdesc(dr, i, &desc, &mt);
2644
2645			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2646			mt->mt_m = NULL;
2647			mt->mt_ni = NULL;
2648			mt->mt_islast = 0;
2649			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2650			    &mt->mt_dmap);
2651			if (error) {
2652				device_printf(sc->sc_dev,
2653				     "can't create RX buf DMA map\n");
2654				goto fail1;
2655			}
2656
2657			dr->getdesc(dr, i + 1, &desc, &mt);
2658
2659			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2660			mt->mt_m = NULL;
2661			mt->mt_ni = NULL;
2662			mt->mt_islast = 1;
2663			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2664			    &mt->mt_dmap);
2665			if (error) {
2666				device_printf(sc->sc_dev,
2667				     "can't create RX buf DMA map\n");
2668				goto fail1;
2669			}
2670		}
2671	} else {
2672		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2673		    &dr->dr_spare_dmap);
2674		if (error) {
2675			device_printf(sc->sc_dev,
2676			    "can't create RX buf DMA map\n");
2677			goto out;		/* XXX wrong! */
2678		}
2679
2680		for (i = 0; i < dr->dr_numslots; i++) {
2681			dr->getdesc(dr, i, &desc, &mt);
2682
2683			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2684			    &mt->mt_dmap);
2685			if (error) {
2686				device_printf(sc->sc_dev,
2687				    "can't create RX buf DMA map\n");
2688				goto out;	/* XXX wrong! */
2689			}
2690			error = bwn_dma_newbuf(dr, desc, mt, 1);
2691			if (error) {
2692				device_printf(sc->sc_dev,
2693				    "failed to allocate RX buf\n");
2694				goto out;	/* XXX wrong! */
2695			}
2696		}
2697
2698		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2699		    BUS_DMASYNC_PREWRITE);
2700
2701		dr->dr_usedslot = dr->dr_numslots;
2702	}
2703
2704      out:
2705	return (dr);
2706
2707fail2:
2708	free(dr->dr_txhdr_cache, M_DEVBUF);
2709fail1:
2710	free(dr->dr_meta, M_DEVBUF);
2711fail0:
2712	free(dr, M_DEVBUF);
2713	return (NULL);
2714}
2715
2716static void
2717bwn_dma_ringfree(struct bwn_dma_ring **dr)
2718{
2719
2720	if (dr == NULL)
2721		return;
2722
2723	bwn_dma_free_descbufs(*dr);
2724	bwn_dma_free_ringmemory(*dr);
2725
2726	free((*dr)->dr_txhdr_cache, M_DEVBUF);
2727	free((*dr)->dr_meta, M_DEVBUF);
2728	free(*dr, M_DEVBUF);
2729
2730	*dr = NULL;
2731}
2732
2733static void
2734bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2735    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2736{
2737	struct bwn_dmadesc32 *desc;
2738
2739	*meta = &(dr->dr_meta[slot]);
2740	desc = dr->dr_ring_descbase;
2741	desc = &(desc[slot]);
2742
2743	*gdesc = (struct bwn_dmadesc_generic *)desc;
2744}
2745
2746static void
2747bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2748    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2749    int start, int end, int irq)
2750{
2751	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2752	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2753	uint32_t addr, addrext, ctl;
2754	int slot;
2755
2756	slot = (int)(&(desc->dma.dma32) - descbase);
2757	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2758	    ("%s:%d: fail", __func__, __LINE__));
2759
2760	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2761	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2762	addr |= siba_dma_translation(sc->sc_dev);
2763	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2764	if (slot == dr->dr_numslots - 1)
2765		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2766	if (start)
2767		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2768	if (end)
2769		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2770	if (irq)
2771		ctl |= BWN_DMA32_DCTL_IRQ;
2772	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2773	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2774
2775	desc->dma.dma32.control = htole32(ctl);
2776	desc->dma.dma32.address = htole32(addr);
2777}
2778
2779static void
2780bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2781{
2782
2783	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2784	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2785}
2786
2787static void
2788bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2789{
2790
2791	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2792	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2793}
2794
2795static void
2796bwn_dma_32_resume(struct bwn_dma_ring *dr)
2797{
2798
2799	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2800	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2801}
2802
2803static int
2804bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2805{
2806	uint32_t val;
2807
2808	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2809	val &= BWN_DMA32_RXDPTR;
2810
2811	return (val / sizeof(struct bwn_dmadesc32));
2812}
2813
2814static void
2815bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2816{
2817
2818	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2819	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2820}
2821
2822static void
2823bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2824    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2825{
2826	struct bwn_dmadesc64 *desc;
2827
2828	*meta = &(dr->dr_meta[slot]);
2829	desc = dr->dr_ring_descbase;
2830	desc = &(desc[slot]);
2831
2832	*gdesc = (struct bwn_dmadesc_generic *)desc;
2833}
2834
2835static void
2836bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2837    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2838    int start, int end, int irq)
2839{
2840	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2841	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2842	int slot;
2843	uint32_t ctl0 = 0, ctl1 = 0;
2844	uint32_t addrlo, addrhi;
2845	uint32_t addrext;
2846
2847	slot = (int)(&(desc->dma.dma64) - descbase);
2848	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2849	    ("%s:%d: fail", __func__, __LINE__));
2850
2851	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2852	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2853	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2854	    30;
2855	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2856	if (slot == dr->dr_numslots - 1)
2857		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2858	if (start)
2859		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2860	if (end)
2861		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2862	if (irq)
2863		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2864	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2865	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2866	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2867
2868	desc->dma.dma64.control0 = htole32(ctl0);
2869	desc->dma.dma64.control1 = htole32(ctl1);
2870	desc->dma.dma64.address_low = htole32(addrlo);
2871	desc->dma.dma64.address_high = htole32(addrhi);
2872}
2873
2874static void
2875bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2876{
2877
2878	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2879	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2880}
2881
2882static void
2883bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2884{
2885
2886	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2887	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2888}
2889
2890static void
2891bwn_dma_64_resume(struct bwn_dma_ring *dr)
2892{
2893
2894	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2895	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2896}
2897
2898static int
2899bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2900{
2901	uint32_t val;
2902
2903	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2904	val &= BWN_DMA64_RXSTATDPTR;
2905
2906	return (val / sizeof(struct bwn_dmadesc64));
2907}
2908
2909static void
2910bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
2911{
2912
2913	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
2914	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2915}
2916
2917static int
2918bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
2919{
2920	struct bwn_mac *mac = dr->dr_mac;
2921	struct bwn_dma *dma = &mac->mac_method.dma;
2922	struct bwn_softc *sc = mac->mac_sc;
2923	int error;
2924
2925	error = bus_dma_tag_create(dma->parent_dtag,
2926			    BWN_ALIGN, 0,
2927			    BUS_SPACE_MAXADDR,
2928			    BUS_SPACE_MAXADDR,
2929			    NULL, NULL,
2930			    BWN_DMA_RINGMEMSIZE,
2931			    1,
2932			    BUS_SPACE_MAXSIZE_32BIT,
2933			    0,
2934			    NULL, NULL,
2935			    &dr->dr_ring_dtag);
2936	if (error) {
2937		device_printf(sc->sc_dev,
2938		    "can't create TX ring DMA tag: TODO frees\n");
2939		return (-1);
2940	}
2941
2942	error = bus_dmamem_alloc(dr->dr_ring_dtag,
2943	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
2944	    &dr->dr_ring_dmap);
2945	if (error) {
2946		device_printf(sc->sc_dev,
2947		    "can't allocate DMA mem: TODO frees\n");
2948		return (-1);
2949	}
2950	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
2951	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
2952	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
2953	if (error) {
2954		device_printf(sc->sc_dev,
2955		    "can't load DMA mem: TODO free\n");
2956		return (-1);
2957	}
2958
2959	return (0);
2960}
2961
2962static void
2963bwn_dma_setup(struct bwn_dma_ring *dr)
2964{
2965	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2966	uint64_t ring64;
2967	uint32_t addrext, ring32, value;
2968	uint32_t trans = siba_dma_translation(sc->sc_dev);
2969
2970	if (dr->dr_tx) {
2971		dr->dr_curslot = -1;
2972
2973		if (dr->dr_type == BWN_DMA_64BIT) {
2974			ring64 = (uint64_t)(dr->dr_ring_dmabase);
2975			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
2976			    >> 30;
2977			value = BWN_DMA64_TXENABLE;
2978			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
2979			    & BWN_DMA64_TXADDREXT_MASK;
2980			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
2981			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
2982			    (ring64 & 0xffffffff));
2983			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
2984			    ((ring64 >> 32) &
2985			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
2986		} else {
2987			ring32 = (uint32_t)(dr->dr_ring_dmabase);
2988			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
2989			value = BWN_DMA32_TXENABLE;
2990			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
2991			    & BWN_DMA32_TXADDREXT_MASK;
2992			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
2993			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
2994			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
2995		}
2996		return;
2997	}
2998
2999	/*
3000	 * set for RX
3001	 */
3002	dr->dr_usedslot = dr->dr_numslots;
3003
3004	if (dr->dr_type == BWN_DMA_64BIT) {
3005		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3006		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3007		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3008		value |= BWN_DMA64_RXENABLE;
3009		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3010		    & BWN_DMA64_RXADDREXT_MASK;
3011		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3012		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3013		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3014		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3015		    | (trans << 1));
3016		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3017		    sizeof(struct bwn_dmadesc64));
3018	} else {
3019		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3020		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3021		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3022		value |= BWN_DMA32_RXENABLE;
3023		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3024		    & BWN_DMA32_RXADDREXT_MASK;
3025		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3026		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3027		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3028		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3029		    sizeof(struct bwn_dmadesc32));
3030	}
3031}
3032
3033static void
3034bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3035{
3036
3037	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3038	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3039	    dr->dr_ring_dmap);
3040}
3041
3042static void
3043bwn_dma_cleanup(struct bwn_dma_ring *dr)
3044{
3045
3046	if (dr->dr_tx) {
3047		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3048		if (dr->dr_type == BWN_DMA_64BIT) {
3049			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3050			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3051		} else
3052			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3053	} else {
3054		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3055		if (dr->dr_type == BWN_DMA_64BIT) {
3056			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3057			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3058		} else
3059			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3060	}
3061}
3062
3063static void
3064bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3065{
3066	struct bwn_dmadesc_generic *desc;
3067	struct bwn_dmadesc_meta *meta;
3068	struct bwn_mac *mac = dr->dr_mac;
3069	struct bwn_dma *dma = &mac->mac_method.dma;
3070	struct bwn_softc *sc = mac->mac_sc;
3071	int i;
3072
3073	if (!dr->dr_usedslot)
3074		return;
3075	for (i = 0; i < dr->dr_numslots; i++) {
3076		dr->getdesc(dr, i, &desc, &meta);
3077
3078		if (meta->mt_m == NULL) {
3079			if (!dr->dr_tx)
3080				device_printf(sc->sc_dev, "%s: not TX?\n",
3081				    __func__);
3082			continue;
3083		}
3084		if (dr->dr_tx) {
3085			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3086				bus_dmamap_unload(dr->dr_txring_dtag,
3087				    meta->mt_dmap);
3088			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3089				bus_dmamap_unload(dma->txbuf_dtag,
3090				    meta->mt_dmap);
3091		} else
3092			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3093		bwn_dma_free_descbuf(dr, meta);
3094	}
3095}
3096
3097static int
3098bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3099    int type)
3100{
3101	struct bwn_softc *sc = mac->mac_sc;
3102	uint32_t value;
3103	int i;
3104	uint16_t offset;
3105
3106	for (i = 0; i < 10; i++) {
3107		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3108		    BWN_DMA32_TXSTATUS;
3109		value = BWN_READ_4(mac, base + offset);
3110		if (type == BWN_DMA_64BIT) {
3111			value &= BWN_DMA64_TXSTAT;
3112			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3113			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3114			    value == BWN_DMA64_TXSTAT_STOPPED)
3115				break;
3116		} else {
3117			value &= BWN_DMA32_TXSTATE;
3118			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3119			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3120			    value == BWN_DMA32_TXSTAT_STOPPED)
3121				break;
3122		}
3123		DELAY(1000);
3124	}
3125	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3126	BWN_WRITE_4(mac, base + offset, 0);
3127	for (i = 0; i < 10; i++) {
3128		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3129						   BWN_DMA32_TXSTATUS;
3130		value = BWN_READ_4(mac, base + offset);
3131		if (type == BWN_DMA_64BIT) {
3132			value &= BWN_DMA64_TXSTAT;
3133			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3134				i = -1;
3135				break;
3136			}
3137		} else {
3138			value &= BWN_DMA32_TXSTATE;
3139			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3140				i = -1;
3141				break;
3142			}
3143		}
3144		DELAY(1000);
3145	}
3146	if (i != -1) {
3147		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3148		return (ENODEV);
3149	}
3150	DELAY(1000);
3151
3152	return (0);
3153}
3154
3155static int
3156bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3157    int type)
3158{
3159	struct bwn_softc *sc = mac->mac_sc;
3160	uint32_t value;
3161	int i;
3162	uint16_t offset;
3163
3164	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3165	BWN_WRITE_4(mac, base + offset, 0);
3166	for (i = 0; i < 10; i++) {
3167		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3168		    BWN_DMA32_RXSTATUS;
3169		value = BWN_READ_4(mac, base + offset);
3170		if (type == BWN_DMA_64BIT) {
3171			value &= BWN_DMA64_RXSTAT;
3172			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3173				i = -1;
3174				break;
3175			}
3176		} else {
3177			value &= BWN_DMA32_RXSTATE;
3178			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3179				i = -1;
3180				break;
3181			}
3182		}
3183		DELAY(1000);
3184	}
3185	if (i != -1) {
3186		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3187		return (ENODEV);
3188	}
3189
3190	return (0);
3191}
3192
3193static void
3194bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3195    struct bwn_dmadesc_meta *meta)
3196{
3197
3198	if (meta->mt_m != NULL) {
3199		m_freem(meta->mt_m);
3200		meta->mt_m = NULL;
3201	}
3202	if (meta->mt_ni != NULL) {
3203		ieee80211_free_node(meta->mt_ni);
3204		meta->mt_ni = NULL;
3205	}
3206}
3207
3208static void
3209bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3210{
3211	struct bwn_rxhdr4 *rxhdr;
3212	unsigned char *frame;
3213
3214	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3215	rxhdr->frame_len = 0;
3216
3217	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3218	    sizeof(struct bwn_plcp6) + 2,
3219	    ("%s:%d: fail", __func__, __LINE__));
3220	frame = mtod(m, char *) + dr->dr_frameoffset;
3221	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3222}
3223
3224static uint8_t
3225bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3226{
3227	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3228
3229	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3230	    == 0xff);
3231}
3232
3233static void
3234bwn_wme_init(struct bwn_mac *mac)
3235{
3236
3237	bwn_wme_load(mac);
3238
3239	/* enable WME support. */
3240	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3241	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3242	    BWN_IFSCTL_USE_EDCF);
3243}
3244
3245static void
3246bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3247{
3248	struct bwn_softc *sc = mac->mac_sc;
3249	struct ieee80211com *ic = &sc->sc_ic;
3250	uint16_t delay;	/* microsec */
3251
3252	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3253	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3254		delay = 500;
3255	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3256		delay = max(delay, (uint16_t)2400);
3257
3258	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3259}
3260
3261static void
3262bwn_bt_enable(struct bwn_mac *mac)
3263{
3264	struct bwn_softc *sc = mac->mac_sc;
3265	uint64_t hf;
3266
3267	if (bwn_bluetooth == 0)
3268		return;
3269	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3270		return;
3271	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3272		return;
3273
3274	hf = bwn_hf_read(mac);
3275	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3276		hf |= BWN_HF_BT_COEXISTALT;
3277	else
3278		hf |= BWN_HF_BT_COEXIST;
3279	bwn_hf_write(mac, hf);
3280}
3281
3282static void
3283bwn_set_macaddr(struct bwn_mac *mac)
3284{
3285
3286	bwn_mac_write_bssid(mac);
3287	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3288	    mac->mac_sc->sc_ic.ic_macaddr);
3289}
3290
3291static void
3292bwn_clear_keys(struct bwn_mac *mac)
3293{
3294	int i;
3295
3296	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3297		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3298		    ("%s:%d: fail", __func__, __LINE__));
3299
3300		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3301		    NULL, BWN_SEC_KEYSIZE, NULL);
3302		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3303			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3304			    NULL, BWN_SEC_KEYSIZE, NULL);
3305		}
3306		mac->mac_key[i].keyconf = NULL;
3307	}
3308}
3309
3310static void
3311bwn_crypt_init(struct bwn_mac *mac)
3312{
3313	struct bwn_softc *sc = mac->mac_sc;
3314
3315	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3316	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3317	    ("%s:%d: fail", __func__, __LINE__));
3318	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3319	mac->mac_ktp *= 2;
3320	if (siba_get_revid(sc->sc_dev) >= 5)
3321		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3322	bwn_clear_keys(mac);
3323}
3324
3325static void
3326bwn_chip_exit(struct bwn_mac *mac)
3327{
3328	struct bwn_softc *sc = mac->mac_sc;
3329
3330	bwn_phy_exit(mac);
3331	siba_gpio_set(sc->sc_dev, 0);
3332}
3333
3334static int
3335bwn_fw_fillinfo(struct bwn_mac *mac)
3336{
3337	int error;
3338
3339	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3340	if (error == 0)
3341		return (0);
3342	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3343	if (error == 0)
3344		return (0);
3345	return (error);
3346}
3347
3348static int
3349bwn_gpio_init(struct bwn_mac *mac)
3350{
3351	struct bwn_softc *sc = mac->mac_sc;
3352	uint32_t mask = 0x1f, set = 0xf, value;
3353
3354	BWN_WRITE_4(mac, BWN_MACCTL,
3355	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3356	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3357	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3358
3359	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3360		mask |= 0x0060;
3361		set |= 0x0060;
3362	}
3363	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3364		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3365		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3366		mask |= 0x0200;
3367		set |= 0x0200;
3368	}
3369	if (siba_get_revid(sc->sc_dev) >= 2)
3370		mask |= 0x0010;
3371
3372	value = siba_gpio_get(sc->sc_dev);
3373	if (value == -1)
3374		return (0);
3375	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3376
3377	return (0);
3378}
3379
3380static int
3381bwn_fw_loadinitvals(struct bwn_mac *mac)
3382{
3383#define	GETFWOFFSET(fwp, offset)				\
3384	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3385	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3386	const struct bwn_fwhdr *hdr;
3387	struct bwn_fw *fw = &mac->mac_fw;
3388	int error;
3389
3390	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3391	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3392	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3393	if (error)
3394		return (error);
3395	if (fw->initvals_band.fw) {
3396		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3397		error = bwn_fwinitvals_write(mac,
3398		    GETFWOFFSET(fw->initvals_band, hdr_len),
3399		    be32toh(hdr->size),
3400		    fw->initvals_band.fw->datasize - hdr_len);
3401	}
3402	return (error);
3403#undef GETFWOFFSET
3404}
3405
3406static int
3407bwn_phy_init(struct bwn_mac *mac)
3408{
3409	struct bwn_softc *sc = mac->mac_sc;
3410	int error;
3411
3412	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3413	mac->mac_phy.rf_onoff(mac, 1);
3414	error = mac->mac_phy.init(mac);
3415	if (error) {
3416		device_printf(sc->sc_dev, "PHY init failed\n");
3417		goto fail0;
3418	}
3419	error = bwn_switch_channel(mac,
3420	    mac->mac_phy.get_default_chan(mac));
3421	if (error) {
3422		device_printf(sc->sc_dev,
3423		    "failed to switch default channel\n");
3424		goto fail1;
3425	}
3426	return (0);
3427fail1:
3428	if (mac->mac_phy.exit)
3429		mac->mac_phy.exit(mac);
3430fail0:
3431	mac->mac_phy.rf_onoff(mac, 0);
3432
3433	return (error);
3434}
3435
3436static void
3437bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3438{
3439	uint16_t ant;
3440	uint16_t tmp;
3441
3442	ant = bwn_ant2phy(antenna);
3443
3444	/* For ACK/CTS */
3445	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3446	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3447	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3448	/* For Probe Resposes */
3449	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3450	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3451	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3452}
3453
3454static void
3455bwn_set_opmode(struct bwn_mac *mac)
3456{
3457	struct bwn_softc *sc = mac->mac_sc;
3458	struct ieee80211com *ic = &sc->sc_ic;
3459	uint32_t ctl;
3460	uint16_t cfp_pretbtt;
3461
3462	ctl = BWN_READ_4(mac, BWN_MACCTL);
3463	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3464	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3465	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3466	ctl |= BWN_MACCTL_STA;
3467
3468	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3469	    ic->ic_opmode == IEEE80211_M_MBSS)
3470		ctl |= BWN_MACCTL_HOSTAP;
3471	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3472		ctl &= ~BWN_MACCTL_STA;
3473	ctl |= sc->sc_filters;
3474
3475	if (siba_get_revid(sc->sc_dev) <= 4)
3476		ctl |= BWN_MACCTL_PROMISC;
3477
3478	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3479
3480	cfp_pretbtt = 2;
3481	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3482		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3483		    siba_get_chiprev(sc->sc_dev) == 3)
3484			cfp_pretbtt = 100;
3485		else
3486			cfp_pretbtt = 50;
3487	}
3488	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3489}
3490
3491static int
3492bwn_dma_gettype(struct bwn_mac *mac)
3493{
3494	uint32_t tmp;
3495	uint16_t base;
3496
3497	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3498	if (tmp & SIBA_TGSHIGH_DMA64)
3499		return (BWN_DMA_64BIT);
3500	base = bwn_dma_base(0, 0);
3501	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3502	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3503	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3504		return (BWN_DMA_32BIT);
3505
3506	return (BWN_DMA_30BIT);
3507}
3508
3509static void
3510bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3511{
3512	if (!error) {
3513		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3514		*((bus_addr_t *)arg) = seg->ds_addr;
3515	}
3516}
3517
3518void
3519bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3520{
3521	struct bwn_phy *phy = &mac->mac_phy;
3522	struct bwn_softc *sc = mac->mac_sc;
3523	unsigned int i, max_loop;
3524	uint16_t value;
3525	uint32_t buffer[5] = {
3526		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3527	};
3528
3529	if (ofdm) {
3530		max_loop = 0x1e;
3531		buffer[0] = 0x000201cc;
3532	} else {
3533		max_loop = 0xfa;
3534		buffer[0] = 0x000b846e;
3535	}
3536
3537	BWN_ASSERT_LOCKED(mac->mac_sc);
3538
3539	for (i = 0; i < 5; i++)
3540		bwn_ram_write(mac, i * 4, buffer[i]);
3541
3542	BWN_WRITE_2(mac, 0x0568, 0x0000);
3543	BWN_WRITE_2(mac, 0x07c0,
3544	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3545
3546	value = (ofdm ? 0x41 : 0x40);
3547	BWN_WRITE_2(mac, 0x050c, value);
3548
3549	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3550	    phy->type == BWN_PHYTYPE_LCN)
3551		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3552	BWN_WRITE_2(mac, 0x0508, 0x0000);
3553	BWN_WRITE_2(mac, 0x050a, 0x0000);
3554	BWN_WRITE_2(mac, 0x054c, 0x0000);
3555	BWN_WRITE_2(mac, 0x056a, 0x0014);
3556	BWN_WRITE_2(mac, 0x0568, 0x0826);
3557	BWN_WRITE_2(mac, 0x0500, 0x0000);
3558
3559	/* XXX TODO: n phy pa override? */
3560
3561	switch (phy->type) {
3562	case BWN_PHYTYPE_N:
3563	case BWN_PHYTYPE_LCN:
3564		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3565		break;
3566	case BWN_PHYTYPE_LP:
3567		BWN_WRITE_2(mac, 0x0502, 0x0050);
3568		break;
3569	default:
3570		BWN_WRITE_2(mac, 0x0502, 0x0030);
3571		break;
3572	}
3573
3574	/* flush */
3575	BWN_READ_2(mac, 0x0502);
3576
3577	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3578		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3579	for (i = 0x00; i < max_loop; i++) {
3580		value = BWN_READ_2(mac, 0x050e);
3581		if (value & 0x0080)
3582			break;
3583		DELAY(10);
3584	}
3585	for (i = 0x00; i < 0x0a; i++) {
3586		value = BWN_READ_2(mac, 0x050e);
3587		if (value & 0x0400)
3588			break;
3589		DELAY(10);
3590	}
3591	for (i = 0x00; i < 0x19; i++) {
3592		value = BWN_READ_2(mac, 0x0690);
3593		if (!(value & 0x0100))
3594			break;
3595		DELAY(10);
3596	}
3597	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3598		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3599}
3600
3601void
3602bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3603{
3604	uint32_t macctl;
3605
3606	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3607
3608	macctl = BWN_READ_4(mac, BWN_MACCTL);
3609	if (macctl & BWN_MACCTL_BIGENDIAN)
3610		printf("TODO: need swap\n");
3611
3612	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3613	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3614	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3615}
3616
3617void
3618bwn_mac_suspend(struct bwn_mac *mac)
3619{
3620	struct bwn_softc *sc = mac->mac_sc;
3621	int i;
3622	uint32_t tmp;
3623
3624	KASSERT(mac->mac_suspended >= 0,
3625	    ("%s:%d: fail", __func__, __LINE__));
3626
3627	if (mac->mac_suspended == 0) {
3628		bwn_psctl(mac, BWN_PS_AWAKE);
3629		BWN_WRITE_4(mac, BWN_MACCTL,
3630			    BWN_READ_4(mac, BWN_MACCTL)
3631			    & ~BWN_MACCTL_ON);
3632		BWN_READ_4(mac, BWN_MACCTL);
3633		for (i = 35; i; i--) {
3634			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3635			if (tmp & BWN_INTR_MAC_SUSPENDED)
3636				goto out;
3637			DELAY(10);
3638		}
3639		for (i = 40; i; i--) {
3640			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3641			if (tmp & BWN_INTR_MAC_SUSPENDED)
3642				goto out;
3643			DELAY(1000);
3644		}
3645		device_printf(sc->sc_dev, "MAC suspend failed\n");
3646	}
3647out:
3648	mac->mac_suspended++;
3649}
3650
3651void
3652bwn_mac_enable(struct bwn_mac *mac)
3653{
3654	struct bwn_softc *sc = mac->mac_sc;
3655	uint16_t state;
3656
3657	state = bwn_shm_read_2(mac, BWN_SHARED,
3658	    BWN_SHARED_UCODESTAT);
3659	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3660	    state != BWN_SHARED_UCODESTAT_SLEEP)
3661		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3662
3663	mac->mac_suspended--;
3664	KASSERT(mac->mac_suspended >= 0,
3665	    ("%s:%d: fail", __func__, __LINE__));
3666	if (mac->mac_suspended == 0) {
3667		BWN_WRITE_4(mac, BWN_MACCTL,
3668		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3669		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3670		BWN_READ_4(mac, BWN_MACCTL);
3671		BWN_READ_4(mac, BWN_INTR_REASON);
3672		bwn_psctl(mac, 0);
3673	}
3674}
3675
3676void
3677bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3678{
3679	struct bwn_softc *sc = mac->mac_sc;
3680	int i;
3681	uint16_t ucstat;
3682
3683	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3684	    ("%s:%d: fail", __func__, __LINE__));
3685	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3686	    ("%s:%d: fail", __func__, __LINE__));
3687
3688	/* XXX forcibly awake and hwps-off */
3689
3690	BWN_WRITE_4(mac, BWN_MACCTL,
3691	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3692	    ~BWN_MACCTL_HWPS);
3693	BWN_READ_4(mac, BWN_MACCTL);
3694	if (siba_get_revid(sc->sc_dev) >= 5) {
3695		for (i = 0; i < 100; i++) {
3696			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3697			    BWN_SHARED_UCODESTAT);
3698			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3699				break;
3700			DELAY(10);
3701		}
3702	}
3703}
3704
3705static int
3706bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3707{
3708	struct bwn_softc *sc = mac->mac_sc;
3709	struct bwn_fw *fw = &mac->mac_fw;
3710	const uint8_t rev = siba_get_revid(sc->sc_dev);
3711	const char *filename;
3712	uint32_t high;
3713	int error;
3714
3715	/* microcode */
3716	if (rev >= 5 && rev <= 10)
3717		filename = "ucode5";
3718	else if (rev >= 11 && rev <= 12)
3719		filename = "ucode11";
3720	else if (rev == 13)
3721		filename = "ucode13";
3722	else if (rev == 14)
3723		filename = "ucode14";
3724	else if (rev >= 15)
3725		filename = "ucode15";
3726	else {
3727		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3728		bwn_release_firmware(mac);
3729		return (EOPNOTSUPP);
3730	}
3731	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3732	if (error) {
3733		bwn_release_firmware(mac);
3734		return (error);
3735	}
3736
3737	/* PCM */
3738	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3739	if (rev >= 5 && rev <= 10) {
3740		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3741		if (error == ENOENT)
3742			fw->no_pcmfile = 1;
3743		else if (error) {
3744			bwn_release_firmware(mac);
3745			return (error);
3746		}
3747	} else if (rev < 11) {
3748		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3749		return (EOPNOTSUPP);
3750	}
3751
3752	/* initvals */
3753	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3754	switch (mac->mac_phy.type) {
3755	case BWN_PHYTYPE_A:
3756		if (rev < 5 || rev > 10)
3757			goto fail1;
3758		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3759			filename = "a0g1initvals5";
3760		else
3761			filename = "a0g0initvals5";
3762		break;
3763	case BWN_PHYTYPE_G:
3764		if (rev >= 5 && rev <= 10)
3765			filename = "b0g0initvals5";
3766		else if (rev >= 13)
3767			filename = "b0g0initvals13";
3768		else
3769			goto fail1;
3770		break;
3771	case BWN_PHYTYPE_LP:
3772		if (rev == 13)
3773			filename = "lp0initvals13";
3774		else if (rev == 14)
3775			filename = "lp0initvals14";
3776		else if (rev >= 15)
3777			filename = "lp0initvals15";
3778		else
3779			goto fail1;
3780		break;
3781	case BWN_PHYTYPE_N:
3782		if (rev >= 11 && rev <= 12)
3783			filename = "n0initvals11";
3784		else
3785			goto fail1;
3786		break;
3787	default:
3788		goto fail1;
3789	}
3790	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3791	if (error) {
3792		bwn_release_firmware(mac);
3793		return (error);
3794	}
3795
3796	/* bandswitch initvals */
3797	switch (mac->mac_phy.type) {
3798	case BWN_PHYTYPE_A:
3799		if (rev >= 5 && rev <= 10) {
3800			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3801				filename = "a0g1bsinitvals5";
3802			else
3803				filename = "a0g0bsinitvals5";
3804		} else if (rev >= 11)
3805			filename = NULL;
3806		else
3807			goto fail1;
3808		break;
3809	case BWN_PHYTYPE_G:
3810		if (rev >= 5 && rev <= 10)
3811			filename = "b0g0bsinitvals5";
3812		else if (rev >= 11)
3813			filename = NULL;
3814		else
3815			goto fail1;
3816		break;
3817	case BWN_PHYTYPE_LP:
3818		if (rev == 13)
3819			filename = "lp0bsinitvals13";
3820		else if (rev == 14)
3821			filename = "lp0bsinitvals14";
3822		else if (rev >= 15)
3823			filename = "lp0bsinitvals15";
3824		else
3825			goto fail1;
3826		break;
3827	case BWN_PHYTYPE_N:
3828		if (rev >= 11 && rev <= 12)
3829			filename = "n0bsinitvals11";
3830		else
3831			goto fail1;
3832		break;
3833	default:
3834		goto fail1;
3835	}
3836	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
3837	if (error) {
3838		bwn_release_firmware(mac);
3839		return (error);
3840	}
3841	return (0);
3842fail1:
3843	device_printf(sc->sc_dev, "no INITVALS for rev %d\n", rev);
3844	bwn_release_firmware(mac);
3845	return (EOPNOTSUPP);
3846}
3847
3848static int
3849bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
3850    const char *name, struct bwn_fwfile *bfw)
3851{
3852	const struct bwn_fwhdr *hdr;
3853	struct bwn_softc *sc = mac->mac_sc;
3854	const struct firmware *fw;
3855	char namebuf[64];
3856
3857	if (name == NULL) {
3858		bwn_do_release_fw(bfw);
3859		return (0);
3860	}
3861	if (bfw->filename != NULL) {
3862		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
3863			return (0);
3864		bwn_do_release_fw(bfw);
3865	}
3866
3867	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
3868	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
3869	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
3870	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
3871	fw = firmware_get(namebuf);
3872	if (fw == NULL) {
3873		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
3874		    namebuf);
3875		return (ENOENT);
3876	}
3877	if (fw->datasize < sizeof(struct bwn_fwhdr))
3878		goto fail;
3879	hdr = (const struct bwn_fwhdr *)(fw->data);
3880	switch (hdr->type) {
3881	case BWN_FWTYPE_UCODE:
3882	case BWN_FWTYPE_PCM:
3883		if (be32toh(hdr->size) !=
3884		    (fw->datasize - sizeof(struct bwn_fwhdr)))
3885			goto fail;
3886		/* FALLTHROUGH */
3887	case BWN_FWTYPE_IV:
3888		if (hdr->ver != 1)
3889			goto fail;
3890		break;
3891	default:
3892		goto fail;
3893	}
3894	bfw->filename = name;
3895	bfw->fw = fw;
3896	bfw->type = type;
3897	return (0);
3898fail:
3899	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
3900	if (fw != NULL)
3901		firmware_put(fw, FIRMWARE_UNLOAD);
3902	return (EPROTO);
3903}
3904
3905static void
3906bwn_release_firmware(struct bwn_mac *mac)
3907{
3908
3909	bwn_do_release_fw(&mac->mac_fw.ucode);
3910	bwn_do_release_fw(&mac->mac_fw.pcm);
3911	bwn_do_release_fw(&mac->mac_fw.initvals);
3912	bwn_do_release_fw(&mac->mac_fw.initvals_band);
3913}
3914
3915static void
3916bwn_do_release_fw(struct bwn_fwfile *bfw)
3917{
3918
3919	if (bfw->fw != NULL)
3920		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
3921	bfw->fw = NULL;
3922	bfw->filename = NULL;
3923}
3924
3925static int
3926bwn_fw_loaducode(struct bwn_mac *mac)
3927{
3928#define	GETFWOFFSET(fwp, offset)	\
3929	((const uint32_t *)((const char *)fwp.fw->data + offset))
3930#define	GETFWSIZE(fwp, offset)	\
3931	((fwp.fw->datasize - offset) / sizeof(uint32_t))
3932	struct bwn_softc *sc = mac->mac_sc;
3933	const uint32_t *data;
3934	unsigned int i;
3935	uint32_t ctl;
3936	uint16_t date, fwcaps, time;
3937	int error = 0;
3938
3939	ctl = BWN_READ_4(mac, BWN_MACCTL);
3940	ctl |= BWN_MACCTL_MCODE_JMP0;
3941	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
3942	    __LINE__));
3943	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3944	for (i = 0; i < 64; i++)
3945		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
3946	for (i = 0; i < 4096; i += 2)
3947		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
3948
3949	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3950	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
3951	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3952	     i++) {
3953		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3954		DELAY(10);
3955	}
3956
3957	if (mac->mac_fw.pcm.fw) {
3958		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
3959		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
3960		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
3961		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
3962		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
3963		    sizeof(struct bwn_fwhdr)); i++) {
3964			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3965			DELAY(10);
3966		}
3967	}
3968
3969	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
3970	BWN_WRITE_4(mac, BWN_MACCTL,
3971	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
3972	    BWN_MACCTL_MCODE_RUN);
3973
3974	for (i = 0; i < 21; i++) {
3975		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
3976			break;
3977		if (i >= 20) {
3978			device_printf(sc->sc_dev, "ucode timeout\n");
3979			error = ENXIO;
3980			goto error;
3981		}
3982		DELAY(50000);
3983	}
3984	BWN_READ_4(mac, BWN_INTR_REASON);
3985
3986	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
3987	if (mac->mac_fw.rev <= 0x128) {
3988		device_printf(sc->sc_dev, "the firmware is too old\n");
3989		error = EOPNOTSUPP;
3990		goto error;
3991	}
3992
3993	/*
3994	 * Determine firmware header version; needed for TX/RX packet
3995	 * handling.
3996	 */
3997	if (mac->mac_fw.rev >= 598)
3998		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
3999	else if (mac->mac_fw.rev >= 410)
4000		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4001	else
4002		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4003
4004	/*
4005	 * We don't support rev 598 or later; that requires
4006	 * another round of changes to the TX/RX descriptor
4007	 * and status layout.
4008	 *
4009	 * So, complain this is the case and exit out, rather
4010	 * than attaching and then failing.
4011	 */
4012	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4013		device_printf(sc->sc_dev,
4014		    "firmware is too new (>=598); not supported\n");
4015		error = EOPNOTSUPP;
4016		goto error;
4017	}
4018
4019	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4020	    BWN_SHARED_UCODE_PATCH);
4021	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4022	mac->mac_fw.opensource = (date == 0xffff);
4023	if (bwn_wme != 0)
4024		mac->mac_flags |= BWN_MAC_FLAG_WME;
4025	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4026
4027	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4028	if (mac->mac_fw.opensource == 0) {
4029		device_printf(sc->sc_dev,
4030		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4031		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4032		if (mac->mac_fw.no_pcmfile)
4033			device_printf(sc->sc_dev,
4034			    "no HW crypto acceleration due to pcm5\n");
4035	} else {
4036		mac->mac_fw.patch = time;
4037		fwcaps = bwn_fwcaps_read(mac);
4038		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4039			device_printf(sc->sc_dev,
4040			    "disabling HW crypto acceleration\n");
4041			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4042		}
4043		if (!(fwcaps & BWN_FWCAPS_WME)) {
4044			device_printf(sc->sc_dev, "disabling WME support\n");
4045			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4046		}
4047	}
4048
4049	if (BWN_ISOLDFMT(mac))
4050		device_printf(sc->sc_dev, "using old firmware image\n");
4051
4052	return (0);
4053
4054error:
4055	BWN_WRITE_4(mac, BWN_MACCTL,
4056	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4057	    BWN_MACCTL_MCODE_JMP0);
4058
4059	return (error);
4060#undef GETFWSIZE
4061#undef GETFWOFFSET
4062}
4063
4064/* OpenFirmware only */
4065static uint16_t
4066bwn_fwcaps_read(struct bwn_mac *mac)
4067{
4068
4069	KASSERT(mac->mac_fw.opensource == 1,
4070	    ("%s:%d: fail", __func__, __LINE__));
4071	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4072}
4073
4074static int
4075bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4076    size_t count, size_t array_size)
4077{
4078#define	GET_NEXTIV16(iv)						\
4079	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4080	    sizeof(uint16_t) + sizeof(uint16_t)))
4081#define	GET_NEXTIV32(iv)						\
4082	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4083	    sizeof(uint16_t) + sizeof(uint32_t)))
4084	struct bwn_softc *sc = mac->mac_sc;
4085	const struct bwn_fwinitvals *iv;
4086	uint16_t offset;
4087	size_t i;
4088	uint8_t bit32;
4089
4090	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4091	    ("%s:%d: fail", __func__, __LINE__));
4092	iv = ivals;
4093	for (i = 0; i < count; i++) {
4094		if (array_size < sizeof(iv->offset_size))
4095			goto fail;
4096		array_size -= sizeof(iv->offset_size);
4097		offset = be16toh(iv->offset_size);
4098		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4099		offset &= BWN_FWINITVALS_OFFSET_MASK;
4100		if (offset >= 0x1000)
4101			goto fail;
4102		if (bit32) {
4103			if (array_size < sizeof(iv->data.d32))
4104				goto fail;
4105			array_size -= sizeof(iv->data.d32);
4106			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4107			iv = GET_NEXTIV32(iv);
4108		} else {
4109
4110			if (array_size < sizeof(iv->data.d16))
4111				goto fail;
4112			array_size -= sizeof(iv->data.d16);
4113			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4114
4115			iv = GET_NEXTIV16(iv);
4116		}
4117	}
4118	if (array_size != 0)
4119		goto fail;
4120	return (0);
4121fail:
4122	device_printf(sc->sc_dev, "initvals: invalid format\n");
4123	return (EPROTO);
4124#undef GET_NEXTIV16
4125#undef GET_NEXTIV32
4126}
4127
4128int
4129bwn_switch_channel(struct bwn_mac *mac, int chan)
4130{
4131	struct bwn_phy *phy = &(mac->mac_phy);
4132	struct bwn_softc *sc = mac->mac_sc;
4133	struct ieee80211com *ic = &sc->sc_ic;
4134	uint16_t channelcookie, savedcookie;
4135	int error;
4136
4137	if (chan == 0xffff)
4138		chan = phy->get_default_chan(mac);
4139
4140	channelcookie = chan;
4141	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4142		channelcookie |= 0x100;
4143	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4144	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4145	error = phy->switch_channel(mac, chan);
4146	if (error)
4147		goto fail;
4148
4149	mac->mac_phy.chan = chan;
4150	DELAY(8000);
4151	return (0);
4152fail:
4153	device_printf(sc->sc_dev, "failed to switch channel\n");
4154	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4155	return (error);
4156}
4157
4158static uint16_t
4159bwn_ant2phy(int antenna)
4160{
4161
4162	switch (antenna) {
4163	case BWN_ANT0:
4164		return (BWN_TX_PHY_ANT0);
4165	case BWN_ANT1:
4166		return (BWN_TX_PHY_ANT1);
4167	case BWN_ANT2:
4168		return (BWN_TX_PHY_ANT2);
4169	case BWN_ANT3:
4170		return (BWN_TX_PHY_ANT3);
4171	case BWN_ANTAUTO:
4172		return (BWN_TX_PHY_ANT01AUTO);
4173	}
4174	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4175	return (0);
4176}
4177
4178static void
4179bwn_wme_load(struct bwn_mac *mac)
4180{
4181	struct bwn_softc *sc = mac->mac_sc;
4182	int i;
4183
4184	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4185	    ("%s:%d: fail", __func__, __LINE__));
4186
4187	bwn_mac_suspend(mac);
4188	for (i = 0; i < N(sc->sc_wmeParams); i++)
4189		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4190		    bwn_wme_shm_offsets[i]);
4191	bwn_mac_enable(mac);
4192}
4193
4194static void
4195bwn_wme_loadparams(struct bwn_mac *mac,
4196    const struct wmeParams *p, uint16_t shm_offset)
4197{
4198#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4199	struct bwn_softc *sc = mac->mac_sc;
4200	uint16_t params[BWN_NR_WMEPARAMS];
4201	int slot, tmp;
4202	unsigned int i;
4203
4204	slot = BWN_READ_2(mac, BWN_RNG) &
4205	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4206
4207	memset(&params, 0, sizeof(params));
4208
4209	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4210	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4211	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4212
4213	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4214	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4215	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4216	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4217	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4218	params[BWN_WMEPARAM_BSLOTS] = slot;
4219	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4220
4221	for (i = 0; i < N(params); i++) {
4222		if (i == BWN_WMEPARAM_STATUS) {
4223			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4224			    shm_offset + (i * 2));
4225			tmp |= 0x100;
4226			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4227			    tmp);
4228		} else {
4229			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4230			    params[i]);
4231		}
4232	}
4233}
4234
4235static void
4236bwn_mac_write_bssid(struct bwn_mac *mac)
4237{
4238	struct bwn_softc *sc = mac->mac_sc;
4239	uint32_t tmp;
4240	int i;
4241	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4242
4243	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4244	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4245	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4246	    IEEE80211_ADDR_LEN);
4247
4248	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4249		tmp = (uint32_t) (mac_bssid[i + 0]);
4250		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4251		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4252		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4253		bwn_ram_write(mac, 0x20 + i, tmp);
4254	}
4255}
4256
4257static void
4258bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4259    const uint8_t *macaddr)
4260{
4261	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4262	uint16_t data;
4263
4264	if (!mac)
4265		macaddr = zero;
4266
4267	offset |= 0x0020;
4268	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4269
4270	data = macaddr[0];
4271	data |= macaddr[1] << 8;
4272	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4273	data = macaddr[2];
4274	data |= macaddr[3] << 8;
4275	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4276	data = macaddr[4];
4277	data |= macaddr[5] << 8;
4278	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4279}
4280
4281static void
4282bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4283    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4284{
4285	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4286	uint8_t per_sta_keys_start = 8;
4287
4288	if (BWN_SEC_NEWAPI(mac))
4289		per_sta_keys_start = 4;
4290
4291	KASSERT(index < mac->mac_max_nr_keys,
4292	    ("%s:%d: fail", __func__, __LINE__));
4293	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4294	    ("%s:%d: fail", __func__, __LINE__));
4295
4296	if (index >= per_sta_keys_start)
4297		bwn_key_macwrite(mac, index, NULL);
4298	if (key)
4299		memcpy(buf, key, key_len);
4300	bwn_key_write(mac, index, algorithm, buf);
4301	if (index >= per_sta_keys_start)
4302		bwn_key_macwrite(mac, index, mac_addr);
4303
4304	mac->mac_key[index].algorithm = algorithm;
4305}
4306
4307static void
4308bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4309{
4310	struct bwn_softc *sc = mac->mac_sc;
4311	uint32_t addrtmp[2] = { 0, 0 };
4312	uint8_t start = 8;
4313
4314	if (BWN_SEC_NEWAPI(mac))
4315		start = 4;
4316
4317	KASSERT(index >= start,
4318	    ("%s:%d: fail", __func__, __LINE__));
4319	index -= start;
4320
4321	if (addr) {
4322		addrtmp[0] = addr[0];
4323		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4324		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4325		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4326		addrtmp[1] = addr[4];
4327		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4328	}
4329
4330	if (siba_get_revid(sc->sc_dev) >= 5) {
4331		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4332		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4333	} else {
4334		if (index >= 8) {
4335			bwn_shm_write_4(mac, BWN_SHARED,
4336			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4337			bwn_shm_write_2(mac, BWN_SHARED,
4338			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4339		}
4340	}
4341}
4342
4343static void
4344bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4345    const uint8_t *key)
4346{
4347	unsigned int i;
4348	uint32_t offset;
4349	uint16_t kidx, value;
4350
4351	kidx = BWN_SEC_KEY2FW(mac, index);
4352	bwn_shm_write_2(mac, BWN_SHARED,
4353	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4354
4355	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4356	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4357		value = key[i];
4358		value |= (uint16_t)(key[i + 1]) << 8;
4359		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4360	}
4361}
4362
4363static void
4364bwn_phy_exit(struct bwn_mac *mac)
4365{
4366
4367	mac->mac_phy.rf_onoff(mac, 0);
4368	if (mac->mac_phy.exit != NULL)
4369		mac->mac_phy.exit(mac);
4370}
4371
4372static void
4373bwn_dma_free(struct bwn_mac *mac)
4374{
4375	struct bwn_dma *dma;
4376
4377	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4378		return;
4379	dma = &mac->mac_method.dma;
4380
4381	bwn_dma_ringfree(&dma->rx);
4382	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4383	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4384	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4385	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4386	bwn_dma_ringfree(&dma->mcast);
4387}
4388
4389static void
4390bwn_core_stop(struct bwn_mac *mac)
4391{
4392	struct bwn_softc *sc = mac->mac_sc;
4393
4394	BWN_ASSERT_LOCKED(sc);
4395
4396	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4397		return;
4398
4399	callout_stop(&sc->sc_rfswitch_ch);
4400	callout_stop(&sc->sc_task_ch);
4401	callout_stop(&sc->sc_watchdog_ch);
4402	sc->sc_watchdog_timer = 0;
4403	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4404	BWN_READ_4(mac, BWN_INTR_MASK);
4405	bwn_mac_suspend(mac);
4406
4407	mac->mac_status = BWN_MAC_STATUS_INITED;
4408}
4409
4410static int
4411bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4412{
4413	struct bwn_mac *up_dev = NULL;
4414	struct bwn_mac *down_dev;
4415	struct bwn_mac *mac;
4416	int err, status;
4417	uint8_t gmode;
4418
4419	BWN_ASSERT_LOCKED(sc);
4420
4421	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4422		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4423		    mac->mac_phy.supports_2ghz) {
4424			up_dev = mac;
4425			gmode = 1;
4426		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4427		    mac->mac_phy.supports_5ghz) {
4428			up_dev = mac;
4429			gmode = 0;
4430		} else {
4431			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4432			return (EINVAL);
4433		}
4434		if (up_dev != NULL)
4435			break;
4436	}
4437	if (up_dev == NULL) {
4438		device_printf(sc->sc_dev, "Could not find a device\n");
4439		return (ENODEV);
4440	}
4441	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4442		return (0);
4443
4444	device_printf(sc->sc_dev, "switching to %s-GHz band\n",
4445	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4446
4447	down_dev = sc->sc_curmac;
4448	status = down_dev->mac_status;
4449	if (status >= BWN_MAC_STATUS_STARTED)
4450		bwn_core_stop(down_dev);
4451	if (status >= BWN_MAC_STATUS_INITED)
4452		bwn_core_exit(down_dev);
4453
4454	if (down_dev != up_dev)
4455		bwn_phy_reset(down_dev);
4456
4457	up_dev->mac_phy.gmode = gmode;
4458	if (status >= BWN_MAC_STATUS_INITED) {
4459		err = bwn_core_init(up_dev);
4460		if (err) {
4461			device_printf(sc->sc_dev,
4462			    "fatal: failed to initialize for %s-GHz\n",
4463			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4464			goto fail;
4465		}
4466	}
4467	if (status >= BWN_MAC_STATUS_STARTED)
4468		bwn_core_start(up_dev);
4469	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4470	sc->sc_curmac = up_dev;
4471
4472	return (0);
4473fail:
4474	sc->sc_curmac = NULL;
4475	return (err);
4476}
4477
4478static void
4479bwn_rf_turnon(struct bwn_mac *mac)
4480{
4481
4482	bwn_mac_suspend(mac);
4483	mac->mac_phy.rf_onoff(mac, 1);
4484	mac->mac_phy.rf_on = 1;
4485	bwn_mac_enable(mac);
4486}
4487
4488static void
4489bwn_rf_turnoff(struct bwn_mac *mac)
4490{
4491
4492	bwn_mac_suspend(mac);
4493	mac->mac_phy.rf_onoff(mac, 0);
4494	mac->mac_phy.rf_on = 0;
4495	bwn_mac_enable(mac);
4496}
4497
4498static void
4499bwn_phy_reset(struct bwn_mac *mac)
4500{
4501	struct bwn_softc *sc = mac->mac_sc;
4502
4503	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4504	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4505	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4506	DELAY(1000);
4507	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4508	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC) |
4509	    BWN_TGSLOW_PHYRESET);
4510	DELAY(1000);
4511}
4512
4513static int
4514bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4515{
4516	struct bwn_vap *bvp = BWN_VAP(vap);
4517	struct ieee80211com *ic= vap->iv_ic;
4518	enum ieee80211_state ostate = vap->iv_state;
4519	struct bwn_softc *sc = ic->ic_softc;
4520	struct bwn_mac *mac = sc->sc_curmac;
4521	int error;
4522
4523	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4524	    ieee80211_state_name[vap->iv_state],
4525	    ieee80211_state_name[nstate]);
4526
4527	error = bvp->bv_newstate(vap, nstate, arg);
4528	if (error != 0)
4529		return (error);
4530
4531	BWN_LOCK(sc);
4532
4533	bwn_led_newstate(mac, nstate);
4534
4535	/*
4536	 * Clear the BSSID when we stop a STA
4537	 */
4538	if (vap->iv_opmode == IEEE80211_M_STA) {
4539		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4540			/*
4541			 * Clear out the BSSID.  If we reassociate to
4542			 * the same AP, this will reinialize things
4543			 * correctly...
4544			 */
4545			if (ic->ic_opmode == IEEE80211_M_STA &&
4546			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4547				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4548				bwn_set_macaddr(mac);
4549			}
4550		}
4551	}
4552
4553	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4554	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4555		/* XXX nothing to do? */
4556	} else if (nstate == IEEE80211_S_RUN) {
4557		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4558		bwn_set_opmode(mac);
4559		bwn_set_pretbtt(mac);
4560		bwn_spu_setdelay(mac, 0);
4561		bwn_set_macaddr(mac);
4562	}
4563
4564	BWN_UNLOCK(sc);
4565
4566	return (error);
4567}
4568
4569static void
4570bwn_set_pretbtt(struct bwn_mac *mac)
4571{
4572	struct bwn_softc *sc = mac->mac_sc;
4573	struct ieee80211com *ic = &sc->sc_ic;
4574	uint16_t pretbtt;
4575
4576	if (ic->ic_opmode == IEEE80211_M_IBSS)
4577		pretbtt = 2;
4578	else
4579		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4580	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4581	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4582}
4583
4584static int
4585bwn_intr(void *arg)
4586{
4587	struct bwn_mac *mac = arg;
4588	struct bwn_softc *sc = mac->mac_sc;
4589	uint32_t reason;
4590
4591	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4592	    (sc->sc_flags & BWN_FLAG_INVALID))
4593		return (FILTER_STRAY);
4594
4595	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4596	if (reason == 0xffffffff)	/* shared IRQ */
4597		return (FILTER_STRAY);
4598	reason &= mac->mac_intr_mask;
4599	if (reason == 0)
4600		return (FILTER_HANDLED);
4601
4602	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4603	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4604	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4605	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4606	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4607	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4608	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4609	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4610	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4611	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4612	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4613
4614	/* Disable interrupts. */
4615	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4616
4617	mac->mac_reason_intr = reason;
4618
4619	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4620	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4621
4622	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4623	return (FILTER_HANDLED);
4624}
4625
4626static void
4627bwn_intrtask(void *arg, int npending)
4628{
4629	struct bwn_mac *mac = arg;
4630	struct bwn_softc *sc = mac->mac_sc;
4631	uint32_t merged = 0;
4632	int i, tx = 0, rx = 0;
4633
4634	BWN_LOCK(sc);
4635	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4636	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4637		BWN_UNLOCK(sc);
4638		return;
4639	}
4640
4641	for (i = 0; i < N(mac->mac_reason); i++)
4642		merged |= mac->mac_reason[i];
4643
4644	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4645		device_printf(sc->sc_dev, "MAC trans error\n");
4646
4647	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4648		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4649		mac->mac_phy.txerrors--;
4650		if (mac->mac_phy.txerrors == 0) {
4651			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4652			bwn_restart(mac, "PHY TX errors");
4653		}
4654	}
4655
4656	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4657		if (merged & BWN_DMAINTR_FATALMASK) {
4658			device_printf(sc->sc_dev,
4659			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4660			    mac->mac_reason[0], mac->mac_reason[1],
4661			    mac->mac_reason[2], mac->mac_reason[3],
4662			    mac->mac_reason[4], mac->mac_reason[5]);
4663			bwn_restart(mac, "DMA error");
4664			BWN_UNLOCK(sc);
4665			return;
4666		}
4667		if (merged & BWN_DMAINTR_NONFATALMASK) {
4668			device_printf(sc->sc_dev,
4669			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4670			    mac->mac_reason[0], mac->mac_reason[1],
4671			    mac->mac_reason[2], mac->mac_reason[3],
4672			    mac->mac_reason[4], mac->mac_reason[5]);
4673		}
4674	}
4675
4676	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4677		bwn_intr_ucode_debug(mac);
4678	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4679		bwn_intr_tbtt_indication(mac);
4680	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4681		bwn_intr_atim_end(mac);
4682	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4683		bwn_intr_beacon(mac);
4684	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4685		bwn_intr_pmq(mac);
4686	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4687		bwn_intr_noise(mac);
4688
4689	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4690		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4691			bwn_dma_rx(mac->mac_method.dma.rx);
4692			rx = 1;
4693		}
4694	} else
4695		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4696
4697	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4698	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4699	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4700	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4701	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4702
4703	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4704		bwn_intr_txeof(mac);
4705		tx = 1;
4706	}
4707
4708	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4709
4710	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4711		int evt = BWN_LED_EVENT_NONE;
4712
4713		if (tx && rx) {
4714			if (sc->sc_rx_rate > sc->sc_tx_rate)
4715				evt = BWN_LED_EVENT_RX;
4716			else
4717				evt = BWN_LED_EVENT_TX;
4718		} else if (tx) {
4719			evt = BWN_LED_EVENT_TX;
4720		} else if (rx) {
4721			evt = BWN_LED_EVENT_RX;
4722		} else if (rx == 0) {
4723			evt = BWN_LED_EVENT_POLL;
4724		}
4725
4726		if (evt != BWN_LED_EVENT_NONE)
4727			bwn_led_event(mac, evt);
4728       }
4729
4730	if (mbufq_first(&sc->sc_snd) != NULL)
4731		bwn_start(sc);
4732
4733	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4734	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4735
4736	BWN_UNLOCK(sc);
4737}
4738
4739static void
4740bwn_restart(struct bwn_mac *mac, const char *msg)
4741{
4742	struct bwn_softc *sc = mac->mac_sc;
4743	struct ieee80211com *ic = &sc->sc_ic;
4744
4745	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4746		return;
4747
4748	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4749	ieee80211_runtask(ic, &mac->mac_hwreset);
4750}
4751
4752static void
4753bwn_intr_ucode_debug(struct bwn_mac *mac)
4754{
4755	struct bwn_softc *sc = mac->mac_sc;
4756	uint16_t reason;
4757
4758	if (mac->mac_fw.opensource == 0)
4759		return;
4760
4761	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4762	switch (reason) {
4763	case BWN_DEBUGINTR_PANIC:
4764		bwn_handle_fwpanic(mac);
4765		break;
4766	case BWN_DEBUGINTR_DUMP_SHM:
4767		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4768		break;
4769	case BWN_DEBUGINTR_DUMP_REGS:
4770		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4771		break;
4772	case BWN_DEBUGINTR_MARKER:
4773		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4774		break;
4775	default:
4776		device_printf(sc->sc_dev,
4777		    "ucode debug unknown reason: %#x\n", reason);
4778	}
4779
4780	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4781	    BWN_DEBUGINTR_ACK);
4782}
4783
4784static void
4785bwn_intr_tbtt_indication(struct bwn_mac *mac)
4786{
4787	struct bwn_softc *sc = mac->mac_sc;
4788	struct ieee80211com *ic = &sc->sc_ic;
4789
4790	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4791		bwn_psctl(mac, 0);
4792	if (ic->ic_opmode == IEEE80211_M_IBSS)
4793		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4794}
4795
4796static void
4797bwn_intr_atim_end(struct bwn_mac *mac)
4798{
4799
4800	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4801		BWN_WRITE_4(mac, BWN_MACCMD,
4802		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4803		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4804	}
4805}
4806
4807static void
4808bwn_intr_beacon(struct bwn_mac *mac)
4809{
4810	struct bwn_softc *sc = mac->mac_sc;
4811	struct ieee80211com *ic = &sc->sc_ic;
4812	uint32_t cmd, beacon0, beacon1;
4813
4814	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4815	    ic->ic_opmode == IEEE80211_M_MBSS)
4816		return;
4817
4818	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
4819
4820	cmd = BWN_READ_4(mac, BWN_MACCMD);
4821	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
4822	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
4823
4824	if (beacon0 && beacon1) {
4825		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
4826		mac->mac_intr_mask |= BWN_INTR_BEACON;
4827		return;
4828	}
4829
4830	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
4831		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
4832		bwn_load_beacon0(mac);
4833		bwn_load_beacon1(mac);
4834		cmd = BWN_READ_4(mac, BWN_MACCMD);
4835		cmd |= BWN_MACCMD_BEACON0_VALID;
4836		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4837	} else {
4838		if (!beacon0) {
4839			bwn_load_beacon0(mac);
4840			cmd = BWN_READ_4(mac, BWN_MACCMD);
4841			cmd |= BWN_MACCMD_BEACON0_VALID;
4842			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4843		} else if (!beacon1) {
4844			bwn_load_beacon1(mac);
4845			cmd = BWN_READ_4(mac, BWN_MACCMD);
4846			cmd |= BWN_MACCMD_BEACON1_VALID;
4847			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4848		}
4849	}
4850}
4851
4852static void
4853bwn_intr_pmq(struct bwn_mac *mac)
4854{
4855	uint32_t tmp;
4856
4857	while (1) {
4858		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
4859		if (!(tmp & 0x00000008))
4860			break;
4861	}
4862	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
4863}
4864
4865static void
4866bwn_intr_noise(struct bwn_mac *mac)
4867{
4868	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
4869	uint16_t tmp;
4870	uint8_t noise[4];
4871	uint8_t i, j;
4872	int32_t average;
4873
4874	if (mac->mac_phy.type != BWN_PHYTYPE_G)
4875		return;
4876
4877	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
4878	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
4879	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
4880	    noise[3] == 0x7f)
4881		goto new;
4882
4883	KASSERT(mac->mac_noise.noi_nsamples < 8,
4884	    ("%s:%d: fail", __func__, __LINE__));
4885	i = mac->mac_noise.noi_nsamples;
4886	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
4887	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
4888	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
4889	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
4890	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
4891	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
4892	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
4893	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
4894	mac->mac_noise.noi_nsamples++;
4895	if (mac->mac_noise.noi_nsamples == 8) {
4896		average = 0;
4897		for (i = 0; i < 8; i++) {
4898			for (j = 0; j < 4; j++)
4899				average += mac->mac_noise.noi_samples[i][j];
4900		}
4901		average = (((average / 32) * 125) + 64) / 128;
4902		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
4903		if (tmp >= 8)
4904			average += 2;
4905		else
4906			average -= 25;
4907		average -= (tmp == 8) ? 72 : 48;
4908
4909		mac->mac_stats.link_noise = average;
4910		mac->mac_noise.noi_running = 0;
4911		return;
4912	}
4913new:
4914	bwn_noise_gensample(mac);
4915}
4916
4917static int
4918bwn_pio_rx(struct bwn_pio_rxqueue *prq)
4919{
4920	struct bwn_mac *mac = prq->prq_mac;
4921	struct bwn_softc *sc = mac->mac_sc;
4922	unsigned int i;
4923
4924	BWN_ASSERT_LOCKED(sc);
4925
4926	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4927		return (0);
4928
4929	for (i = 0; i < 5000; i++) {
4930		if (bwn_pio_rxeof(prq) == 0)
4931			break;
4932	}
4933	if (i >= 5000)
4934		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
4935	return ((i > 0) ? 1 : 0);
4936}
4937
4938static void
4939bwn_dma_rx(struct bwn_dma_ring *dr)
4940{
4941	int slot, curslot;
4942
4943	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
4944	curslot = dr->get_curslot(dr);
4945	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
4946	    ("%s:%d: fail", __func__, __LINE__));
4947
4948	slot = dr->dr_curslot;
4949	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
4950		bwn_dma_rxeof(dr, &slot);
4951
4952	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
4953	    BUS_DMASYNC_PREWRITE);
4954
4955	dr->set_curslot(dr, slot);
4956	dr->dr_curslot = slot;
4957}
4958
4959static void
4960bwn_intr_txeof(struct bwn_mac *mac)
4961{
4962	struct bwn_txstatus stat;
4963	uint32_t stat0, stat1;
4964	uint16_t tmp;
4965
4966	BWN_ASSERT_LOCKED(mac->mac_sc);
4967
4968	while (1) {
4969		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
4970		if (!(stat0 & 0x00000001))
4971			break;
4972		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
4973
4974		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
4975		    "%s: stat0=0x%08x, stat1=0x%08x\n",
4976		    __func__,
4977		    stat0,
4978		    stat1);
4979
4980		stat.cookie = (stat0 >> 16);
4981		stat.seq = (stat1 & 0x0000ffff);
4982		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
4983		tmp = (stat0 & 0x0000ffff);
4984		stat.framecnt = ((tmp & 0xf000) >> 12);
4985		stat.rtscnt = ((tmp & 0x0f00) >> 8);
4986		stat.sreason = ((tmp & 0x001c) >> 2);
4987		stat.pm = (tmp & 0x0080) ? 1 : 0;
4988		stat.im = (tmp & 0x0040) ? 1 : 0;
4989		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
4990		stat.ack = (tmp & 0x0002) ? 1 : 0;
4991
4992		bwn_handle_txeof(mac, &stat);
4993	}
4994}
4995
4996static void
4997bwn_hwreset(void *arg, int npending)
4998{
4999	struct bwn_mac *mac = arg;
5000	struct bwn_softc *sc = mac->mac_sc;
5001	int error = 0;
5002	int prev_status;
5003
5004	BWN_LOCK(sc);
5005
5006	prev_status = mac->mac_status;
5007	if (prev_status >= BWN_MAC_STATUS_STARTED)
5008		bwn_core_stop(mac);
5009	if (prev_status >= BWN_MAC_STATUS_INITED)
5010		bwn_core_exit(mac);
5011
5012	if (prev_status >= BWN_MAC_STATUS_INITED) {
5013		error = bwn_core_init(mac);
5014		if (error)
5015			goto out;
5016	}
5017	if (prev_status >= BWN_MAC_STATUS_STARTED)
5018		bwn_core_start(mac);
5019out:
5020	if (error) {
5021		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5022		sc->sc_curmac = NULL;
5023	}
5024	BWN_UNLOCK(sc);
5025}
5026
5027static void
5028bwn_handle_fwpanic(struct bwn_mac *mac)
5029{
5030	struct bwn_softc *sc = mac->mac_sc;
5031	uint16_t reason;
5032
5033	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5034	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5035
5036	if (reason == BWN_FWPANIC_RESTART)
5037		bwn_restart(mac, "ucode panic");
5038}
5039
5040static void
5041bwn_load_beacon0(struct bwn_mac *mac)
5042{
5043
5044	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5045}
5046
5047static void
5048bwn_load_beacon1(struct bwn_mac *mac)
5049{
5050
5051	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5052}
5053
5054static uint32_t
5055bwn_jssi_read(struct bwn_mac *mac)
5056{
5057	uint32_t val = 0;
5058
5059	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5060	val <<= 16;
5061	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5062
5063	return (val);
5064}
5065
5066static void
5067bwn_noise_gensample(struct bwn_mac *mac)
5068{
5069	uint32_t jssi = 0x7f7f7f7f;
5070
5071	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5072	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5073	BWN_WRITE_4(mac, BWN_MACCMD,
5074	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5075}
5076
5077static int
5078bwn_dma_freeslot(struct bwn_dma_ring *dr)
5079{
5080	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5081
5082	return (dr->dr_numslots - dr->dr_usedslot);
5083}
5084
5085static int
5086bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5087{
5088	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5089
5090	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5091	    ("%s:%d: fail", __func__, __LINE__));
5092	if (slot == dr->dr_numslots - 1)
5093		return (0);
5094	return (slot + 1);
5095}
5096
5097static void
5098bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5099{
5100	struct bwn_mac *mac = dr->dr_mac;
5101	struct bwn_softc *sc = mac->mac_sc;
5102	struct bwn_dma *dma = &mac->mac_method.dma;
5103	struct bwn_dmadesc_generic *desc;
5104	struct bwn_dmadesc_meta *meta;
5105	struct bwn_rxhdr4 *rxhdr;
5106	struct mbuf *m;
5107	uint32_t macstat;
5108	int32_t tmp;
5109	int cnt = 0;
5110	uint16_t len;
5111
5112	dr->getdesc(dr, *slot, &desc, &meta);
5113
5114	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5115	m = meta->mt_m;
5116
5117	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5118		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5119		return;
5120	}
5121
5122	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5123	len = le16toh(rxhdr->frame_len);
5124	if (len <= 0) {
5125		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5126		return;
5127	}
5128	if (bwn_dma_check_redzone(dr, m)) {
5129		device_printf(sc->sc_dev, "redzone error.\n");
5130		bwn_dma_set_redzone(dr, m);
5131		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5132		    BUS_DMASYNC_PREWRITE);
5133		return;
5134	}
5135	if (len > dr->dr_rx_bufsize) {
5136		tmp = len;
5137		while (1) {
5138			dr->getdesc(dr, *slot, &desc, &meta);
5139			bwn_dma_set_redzone(dr, meta->mt_m);
5140			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5141			    BUS_DMASYNC_PREWRITE);
5142			*slot = bwn_dma_nextslot(dr, *slot);
5143			cnt++;
5144			tmp -= dr->dr_rx_bufsize;
5145			if (tmp <= 0)
5146				break;
5147		}
5148		device_printf(sc->sc_dev, "too small buffer "
5149		       "(len %u buffer %u dropped %d)\n",
5150		       len, dr->dr_rx_bufsize, cnt);
5151		return;
5152	}
5153	macstat = le32toh(rxhdr->mac_status);
5154	if (macstat & BWN_RX_MAC_FCSERR) {
5155		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5156			device_printf(sc->sc_dev, "RX drop\n");
5157			return;
5158		}
5159	}
5160
5161	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5162	m_adj(m, dr->dr_frameoffset);
5163
5164	bwn_rxeof(dr->dr_mac, m, rxhdr);
5165}
5166
5167static void
5168bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5169{
5170	struct bwn_softc *sc = mac->mac_sc;
5171	struct bwn_stats *stats = &mac->mac_stats;
5172
5173	BWN_ASSERT_LOCKED(mac->mac_sc);
5174
5175	if (status->im)
5176		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5177	if (status->ampdu)
5178		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5179	if (status->rtscnt) {
5180		if (status->rtscnt == 0xf)
5181			stats->rtsfail++;
5182		else
5183			stats->rts++;
5184	}
5185
5186	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5187		bwn_dma_handle_txeof(mac, status);
5188	} else {
5189		bwn_pio_handle_txeof(mac, status);
5190	}
5191
5192	bwn_phy_txpower_check(mac, 0);
5193}
5194
5195static uint8_t
5196bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5197{
5198	struct bwn_mac *mac = prq->prq_mac;
5199	struct bwn_softc *sc = mac->mac_sc;
5200	struct bwn_rxhdr4 rxhdr;
5201	struct mbuf *m;
5202	uint32_t ctl32, macstat, v32;
5203	unsigned int i, padding;
5204	uint16_t ctl16, len, totlen, v16;
5205	unsigned char *mp;
5206	char *data;
5207
5208	memset(&rxhdr, 0, sizeof(rxhdr));
5209
5210	if (prq->prq_rev >= 8) {
5211		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5212		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5213			return (0);
5214		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5215		    BWN_PIO8_RXCTL_FRAMEREADY);
5216		for (i = 0; i < 10; i++) {
5217			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5218			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5219				goto ready;
5220			DELAY(10);
5221		}
5222	} else {
5223		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5224		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5225			return (0);
5226		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5227		    BWN_PIO_RXCTL_FRAMEREADY);
5228		for (i = 0; i < 10; i++) {
5229			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5230			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5231				goto ready;
5232			DELAY(10);
5233		}
5234	}
5235	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5236	return (1);
5237ready:
5238	if (prq->prq_rev >= 8)
5239		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5240		    prq->prq_base + BWN_PIO8_RXDATA);
5241	else
5242		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5243		    prq->prq_base + BWN_PIO_RXDATA);
5244	len = le16toh(rxhdr.frame_len);
5245	if (len > 0x700) {
5246		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5247		goto error;
5248	}
5249	if (len == 0) {
5250		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5251		goto error;
5252	}
5253
5254	macstat = le32toh(rxhdr.mac_status);
5255	if (macstat & BWN_RX_MAC_FCSERR) {
5256		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5257			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5258			goto error;
5259		}
5260	}
5261
5262	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5263	totlen = len + padding;
5264	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5265	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5266	if (m == NULL) {
5267		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5268		goto error;
5269	}
5270	mp = mtod(m, unsigned char *);
5271	if (prq->prq_rev >= 8) {
5272		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5273		    prq->prq_base + BWN_PIO8_RXDATA);
5274		if (totlen & 3) {
5275			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5276			data = &(mp[totlen - 1]);
5277			switch (totlen & 3) {
5278			case 3:
5279				*data = (v32 >> 16);
5280				data--;
5281			case 2:
5282				*data = (v32 >> 8);
5283				data--;
5284			case 1:
5285				*data = v32;
5286			}
5287		}
5288	} else {
5289		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5290		    prq->prq_base + BWN_PIO_RXDATA);
5291		if (totlen & 1) {
5292			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5293			mp[totlen - 1] = v16;
5294		}
5295	}
5296
5297	m->m_len = m->m_pkthdr.len = totlen;
5298
5299	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5300
5301	return (1);
5302error:
5303	if (prq->prq_rev >= 8)
5304		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5305		    BWN_PIO8_RXCTL_DATAREADY);
5306	else
5307		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5308	return (1);
5309}
5310
5311static int
5312bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5313    struct bwn_dmadesc_meta *meta, int init)
5314{
5315	struct bwn_mac *mac = dr->dr_mac;
5316	struct bwn_dma *dma = &mac->mac_method.dma;
5317	struct bwn_rxhdr4 *hdr;
5318	bus_dmamap_t map;
5319	bus_addr_t paddr;
5320	struct mbuf *m;
5321	int error;
5322
5323	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5324	if (m == NULL) {
5325		error = ENOBUFS;
5326
5327		/*
5328		 * If the NIC is up and running, we need to:
5329		 * - Clear RX buffer's header.
5330		 * - Restore RX descriptor settings.
5331		 */
5332		if (init)
5333			return (error);
5334		else
5335			goto back;
5336	}
5337	m->m_len = m->m_pkthdr.len = MCLBYTES;
5338
5339	bwn_dma_set_redzone(dr, m);
5340
5341	/*
5342	 * Try to load RX buf into temporary DMA map
5343	 */
5344	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5345	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5346	if (error) {
5347		m_freem(m);
5348
5349		/*
5350		 * See the comment above
5351		 */
5352		if (init)
5353			return (error);
5354		else
5355			goto back;
5356	}
5357
5358	if (!init)
5359		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5360	meta->mt_m = m;
5361	meta->mt_paddr = paddr;
5362
5363	/*
5364	 * Swap RX buf's DMA map with the loaded temporary one
5365	 */
5366	map = meta->mt_dmap;
5367	meta->mt_dmap = dr->dr_spare_dmap;
5368	dr->dr_spare_dmap = map;
5369
5370back:
5371	/*
5372	 * Clear RX buf header
5373	 */
5374	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5375	bzero(hdr, sizeof(*hdr));
5376	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5377	    BUS_DMASYNC_PREWRITE);
5378
5379	/*
5380	 * Setup RX buf descriptor
5381	 */
5382	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5383	    sizeof(*hdr), 0, 0, 0);
5384	return (error);
5385}
5386
5387static void
5388bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5389		 bus_size_t mapsz __unused, int error)
5390{
5391
5392	if (!error) {
5393		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5394		*((bus_addr_t *)arg) = seg->ds_addr;
5395	}
5396}
5397
5398static int
5399bwn_hwrate2ieeerate(int rate)
5400{
5401
5402	switch (rate) {
5403	case BWN_CCK_RATE_1MB:
5404		return (2);
5405	case BWN_CCK_RATE_2MB:
5406		return (4);
5407	case BWN_CCK_RATE_5MB:
5408		return (11);
5409	case BWN_CCK_RATE_11MB:
5410		return (22);
5411	case BWN_OFDM_RATE_6MB:
5412		return (12);
5413	case BWN_OFDM_RATE_9MB:
5414		return (18);
5415	case BWN_OFDM_RATE_12MB:
5416		return (24);
5417	case BWN_OFDM_RATE_18MB:
5418		return (36);
5419	case BWN_OFDM_RATE_24MB:
5420		return (48);
5421	case BWN_OFDM_RATE_36MB:
5422		return (72);
5423	case BWN_OFDM_RATE_48MB:
5424		return (96);
5425	case BWN_OFDM_RATE_54MB:
5426		return (108);
5427	default:
5428		printf("Ooops\n");
5429		return (0);
5430	}
5431}
5432
5433/*
5434 * Post process the RX provided RSSI.
5435 *
5436 * Valid for A, B, G, LP PHYs.
5437 */
5438static int8_t
5439bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5440    int ofdm, int adjust_2053, int adjust_2050)
5441{
5442	struct bwn_phy *phy = &mac->mac_phy;
5443	struct bwn_phy_g *gphy = &phy->phy_g;
5444	int tmp;
5445
5446	switch (phy->rf_ver) {
5447	case 0x2050:
5448		if (ofdm) {
5449			tmp = in_rssi;
5450			if (tmp > 127)
5451				tmp -= 256;
5452			tmp = tmp * 73 / 64;
5453			if (adjust_2050)
5454				tmp += 25;
5455			else
5456				tmp -= 3;
5457		} else {
5458			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5459			    & BWN_BFL_RSSI) {
5460				if (in_rssi > 63)
5461					in_rssi = 63;
5462				tmp = gphy->pg_nrssi_lt[in_rssi];
5463				tmp = (31 - tmp) * -131 / 128 - 57;
5464			} else {
5465				tmp = in_rssi;
5466				tmp = (31 - tmp) * -149 / 128 - 68;
5467			}
5468			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5469				tmp += 25;
5470		}
5471		break;
5472	case 0x2060:
5473		if (in_rssi > 127)
5474			tmp = in_rssi - 256;
5475		else
5476			tmp = in_rssi;
5477		break;
5478	default:
5479		tmp = in_rssi;
5480		tmp = (tmp - 11) * 103 / 64;
5481		if (adjust_2053)
5482			tmp -= 109;
5483		else
5484			tmp -= 83;
5485	}
5486
5487	return (tmp);
5488}
5489
5490static void
5491bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5492{
5493	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5494	struct bwn_plcp6 *plcp;
5495	struct bwn_softc *sc = mac->mac_sc;
5496	struct ieee80211_frame_min *wh;
5497	struct ieee80211_node *ni;
5498	struct ieee80211com *ic = &sc->sc_ic;
5499	uint32_t macstat;
5500	int padding, rate, rssi = 0, noise = 0, type;
5501	uint16_t phytype, phystat0, phystat3, chanstat;
5502	unsigned char *mp = mtod(m, unsigned char *);
5503	static int rx_mac_dec_rpt = 0;
5504
5505	BWN_ASSERT_LOCKED(sc);
5506
5507	phystat0 = le16toh(rxhdr->phy_status0);
5508	phystat3 = le16toh(rxhdr->phy_status3);
5509
5510	/* XXX Note: mactime, macstat, chanstat need fixing for fw 598 */
5511	macstat = le32toh(rxhdr->mac_status);
5512	chanstat = le16toh(rxhdr->channel);
5513
5514	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5515
5516	if (macstat & BWN_RX_MAC_FCSERR)
5517		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5518	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5519		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5520	if (macstat & BWN_RX_MAC_DECERR)
5521		goto drop;
5522
5523	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5524	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5525		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5526		    m->m_pkthdr.len);
5527		goto drop;
5528	}
5529	plcp = (struct bwn_plcp6 *)(mp + padding);
5530	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5531	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5532		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5533		    m->m_pkthdr.len);
5534		goto drop;
5535	}
5536	wh = mtod(m, struct ieee80211_frame_min *);
5537
5538	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5539		device_printf(sc->sc_dev,
5540		    "RX decryption attempted (old %d keyidx %#x)\n",
5541		    BWN_ISOLDFMT(mac),
5542		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5543
5544	if (phystat0 & BWN_RX_PHYST0_OFDM)
5545		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5546		    phytype == BWN_PHYTYPE_A);
5547	else
5548		rate = bwn_plcp_get_cckrate(mac, plcp);
5549	if (rate == -1) {
5550		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5551			goto drop;
5552	}
5553	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5554
5555	/* rssi/noise */
5556	switch (phytype) {
5557	case BWN_PHYTYPE_A:
5558	case BWN_PHYTYPE_B:
5559	case BWN_PHYTYPE_G:
5560	case BWN_PHYTYPE_LP:
5561		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5562		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5563		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5564		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5565		break;
5566	default:
5567		/* XXX TODO: implement rssi for other PHYs */
5568		break;
5569	}
5570
5571	noise = mac->mac_stats.link_noise;
5572
5573	/* RX radio tap */
5574	if (ieee80211_radiotap_active(ic))
5575		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5576	m_adj(m, -IEEE80211_CRC_LEN);
5577
5578	BWN_UNLOCK(sc);
5579
5580	ni = ieee80211_find_rxnode(ic, wh);
5581	if (ni != NULL) {
5582		type = ieee80211_input(ni, m, rssi, noise);
5583		ieee80211_free_node(ni);
5584	} else
5585		type = ieee80211_input_all(ic, m, rssi, noise);
5586
5587	BWN_LOCK(sc);
5588	return;
5589drop:
5590	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5591}
5592
5593static void
5594bwn_dma_handle_txeof(struct bwn_mac *mac,
5595    const struct bwn_txstatus *status)
5596{
5597	struct bwn_dma *dma = &mac->mac_method.dma;
5598	struct bwn_dma_ring *dr;
5599	struct bwn_dmadesc_generic *desc;
5600	struct bwn_dmadesc_meta *meta;
5601	struct bwn_softc *sc = mac->mac_sc;
5602	int slot;
5603	int retrycnt = 0;
5604
5605	BWN_ASSERT_LOCKED(sc);
5606
5607	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5608	if (dr == NULL) {
5609		device_printf(sc->sc_dev, "failed to parse cookie\n");
5610		return;
5611	}
5612	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5613
5614	while (1) {
5615		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5616		    ("%s:%d: fail", __func__, __LINE__));
5617		dr->getdesc(dr, slot, &desc, &meta);
5618
5619		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5620			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5621		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5622			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5623
5624		if (meta->mt_islast) {
5625			KASSERT(meta->mt_m != NULL,
5626			    ("%s:%d: fail", __func__, __LINE__));
5627
5628			/* Just count full frame retries for now */
5629			retrycnt = status->framecnt - 1;
5630			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5631			    status->ack ?
5632			      IEEE80211_RATECTL_TX_SUCCESS :
5633			      IEEE80211_RATECTL_TX_FAILURE,
5634			    &retrycnt, 0);
5635			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5636			meta->mt_ni = NULL;
5637			meta->mt_m = NULL;
5638		} else
5639			KASSERT(meta->mt_m == NULL,
5640			    ("%s:%d: fail", __func__, __LINE__));
5641
5642		dr->dr_usedslot--;
5643		if (meta->mt_islast)
5644			break;
5645		slot = bwn_dma_nextslot(dr, slot);
5646	}
5647	sc->sc_watchdog_timer = 0;
5648	if (dr->dr_stop) {
5649		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5650		    ("%s:%d: fail", __func__, __LINE__));
5651		dr->dr_stop = 0;
5652	}
5653}
5654
5655static void
5656bwn_pio_handle_txeof(struct bwn_mac *mac,
5657    const struct bwn_txstatus *status)
5658{
5659	struct bwn_pio_txqueue *tq;
5660	struct bwn_pio_txpkt *tp = NULL;
5661	struct bwn_softc *sc = mac->mac_sc;
5662	int retrycnt = 0;
5663
5664	BWN_ASSERT_LOCKED(sc);
5665
5666	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5667	if (tq == NULL)
5668		return;
5669
5670	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5671	tq->tq_free++;
5672
5673	if (tp->tp_ni != NULL) {
5674		/*
5675		 * Do any tx complete callback.  Note this must
5676		 * be done before releasing the node reference.
5677		 */
5678
5679		/* Just count full frame retries for now */
5680		retrycnt = status->framecnt - 1;
5681		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5682		    status->ack ?
5683		      IEEE80211_RATECTL_TX_SUCCESS :
5684		      IEEE80211_RATECTL_TX_FAILURE,
5685		    &retrycnt, 0);
5686
5687		if (tp->tp_m->m_flags & M_TXCB)
5688			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5689		ieee80211_free_node(tp->tp_ni);
5690		tp->tp_ni = NULL;
5691	}
5692	m_freem(tp->tp_m);
5693	tp->tp_m = NULL;
5694	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5695
5696	sc->sc_watchdog_timer = 0;
5697}
5698
5699static void
5700bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5701{
5702	struct bwn_softc *sc = mac->mac_sc;
5703	struct bwn_phy *phy = &mac->mac_phy;
5704	struct ieee80211com *ic = &sc->sc_ic;
5705	unsigned long now;
5706	int result;
5707
5708	BWN_GETTIME(now);
5709
5710	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5711		return;
5712	phy->nexttime = now + 2 * 1000;
5713
5714	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5715	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5716		return;
5717
5718	if (phy->recalc_txpwr != NULL) {
5719		result = phy->recalc_txpwr(mac,
5720		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5721		if (result == BWN_TXPWR_RES_DONE)
5722			return;
5723		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
5724		    ("%s: fail", __func__));
5725		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
5726
5727		ieee80211_runtask(ic, &mac->mac_txpower);
5728	}
5729}
5730
5731static uint16_t
5732bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
5733{
5734
5735	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
5736}
5737
5738static uint32_t
5739bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
5740{
5741
5742	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
5743}
5744
5745static void
5746bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
5747{
5748
5749	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
5750}
5751
5752static void
5753bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
5754{
5755
5756	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
5757}
5758
5759static int
5760bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
5761{
5762
5763	switch (rate) {
5764	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
5765	case 12:
5766		return (BWN_OFDM_RATE_6MB);
5767	case 18:
5768		return (BWN_OFDM_RATE_9MB);
5769	case 24:
5770		return (BWN_OFDM_RATE_12MB);
5771	case 36:
5772		return (BWN_OFDM_RATE_18MB);
5773	case 48:
5774		return (BWN_OFDM_RATE_24MB);
5775	case 72:
5776		return (BWN_OFDM_RATE_36MB);
5777	case 96:
5778		return (BWN_OFDM_RATE_48MB);
5779	case 108:
5780		return (BWN_OFDM_RATE_54MB);
5781	/* CCK rates (NB: not IEEE std, device-specific) */
5782	case 2:
5783		return (BWN_CCK_RATE_1MB);
5784	case 4:
5785		return (BWN_CCK_RATE_2MB);
5786	case 11:
5787		return (BWN_CCK_RATE_5MB);
5788	case 22:
5789		return (BWN_CCK_RATE_11MB);
5790	}
5791
5792	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
5793	return (BWN_CCK_RATE_1MB);
5794}
5795
5796static int
5797bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
5798    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
5799{
5800	const struct bwn_phy *phy = &mac->mac_phy;
5801	struct bwn_softc *sc = mac->mac_sc;
5802	struct ieee80211_frame *wh;
5803	struct ieee80211_frame *protwh;
5804	struct ieee80211_frame_cts *cts;
5805	struct ieee80211_frame_rts *rts;
5806	const struct ieee80211_txparam *tp;
5807	struct ieee80211vap *vap = ni->ni_vap;
5808	struct ieee80211com *ic = &sc->sc_ic;
5809	struct mbuf *mprot;
5810	unsigned int len;
5811	uint32_t macctl = 0;
5812	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
5813	uint16_t phyctl = 0;
5814	uint8_t rate, rate_fb;
5815
5816	wh = mtod(m, struct ieee80211_frame *);
5817	memset(txhdr, 0, sizeof(*txhdr));
5818
5819	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
5820	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
5821	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
5822
5823	/*
5824	 * Find TX rate
5825	 */
5826	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
5827	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
5828		rate = rate_fb = tp->mgmtrate;
5829	else if (ismcast)
5830		rate = rate_fb = tp->mcastrate;
5831	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
5832		rate = rate_fb = tp->ucastrate;
5833	else {
5834		/* XXX TODO: don't fall back to CCK rates for OFDM */
5835		rix = ieee80211_ratectl_rate(ni, NULL, 0);
5836		rate = ni->ni_txrate;
5837
5838		if (rix > 0)
5839			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
5840			    IEEE80211_RATE_VAL;
5841		else
5842			rate_fb = rate;
5843	}
5844
5845	sc->sc_tx_rate = rate;
5846
5847	/* Note: this maps the select ieee80211 rate to hardware rate */
5848	rate = bwn_ieeerate2hwrate(sc, rate);
5849	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
5850
5851	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
5852	    bwn_plcp_getcck(rate);
5853	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
5854	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
5855
5856	/* XXX rate/rate_fb is the hardware rate */
5857	if ((rate_fb == rate) ||
5858	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
5859	    (*(u_int16_t *)wh->i_dur == htole16(0)))
5860		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
5861	else
5862		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
5863		    m->m_pkthdr.len, rate, isshort);
5864
5865	/* XXX TX encryption */
5866	bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
5867	    (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
5868	    (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
5869	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
5870	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
5871	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
5872
5873	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
5874	    BWN_TX_EFT_FB_CCK;
5875	txhdr->chan = phy->chan;
5876	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
5877	    BWN_TX_PHY_ENC_CCK;
5878	/* XXX preamble? obey net80211 */
5879	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5880	     rate == BWN_CCK_RATE_11MB))
5881		phyctl |= BWN_TX_PHY_SHORTPRMBL;
5882
5883	/* XXX TX antenna selection */
5884
5885	switch (bwn_antenna_sanitize(mac, 0)) {
5886	case 0:
5887		phyctl |= BWN_TX_PHY_ANT01AUTO;
5888		break;
5889	case 1:
5890		phyctl |= BWN_TX_PHY_ANT0;
5891		break;
5892	case 2:
5893		phyctl |= BWN_TX_PHY_ANT1;
5894		break;
5895	case 3:
5896		phyctl |= BWN_TX_PHY_ANT2;
5897		break;
5898	case 4:
5899		phyctl |= BWN_TX_PHY_ANT3;
5900		break;
5901	default:
5902		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5903	}
5904
5905	if (!ismcast)
5906		macctl |= BWN_TX_MAC_ACK;
5907
5908	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
5909	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
5910	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
5911		macctl |= BWN_TX_MAC_LONGFRAME;
5912
5913	if (ic->ic_flags & IEEE80211_F_USEPROT) {
5914		/* XXX RTS rate is always 1MB??? */
5915		/* XXX TODO: don't fall back to CCK rates for OFDM */
5916		rts_rate = BWN_CCK_RATE_1MB;
5917		rts_rate_fb = bwn_get_fbrate(rts_rate);
5918
5919		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
5920		protdur = ieee80211_compute_duration(ic->ic_rt,
5921		    m->m_pkthdr.len, rate, isshort) +
5922		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
5923
5924		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
5925			cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
5926			    (txhdr->body.old.rts_frame) :
5927			    (txhdr->body.new.rts_frame));
5928			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
5929			    protdur);
5930			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5931			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
5932			    mprot->m_pkthdr.len);
5933			m_freem(mprot);
5934			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
5935			len = sizeof(struct ieee80211_frame_cts);
5936		} else {
5937			rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
5938			    (txhdr->body.old.rts_frame) :
5939			    (txhdr->body.new.rts_frame));
5940			/* XXX rate/rate_fb is the hardware rate */
5941			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
5942			    isshort);
5943			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
5944			    wh->i_addr2, protdur);
5945			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5946			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
5947			    mprot->m_pkthdr.len);
5948			m_freem(mprot);
5949			macctl |= BWN_TX_MAC_SEND_RTSCTS;
5950			len = sizeof(struct ieee80211_frame_rts);
5951		}
5952		len += IEEE80211_CRC_LEN;
5953		bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
5954		    &txhdr->body.old.rts_plcp :
5955		    &txhdr->body.new.rts_plcp), len, rts_rate);
5956		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
5957		    rts_rate_fb);
5958
5959		protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
5960		    (&txhdr->body.old.rts_frame) :
5961		    (&txhdr->body.new.rts_frame));
5962		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
5963
5964		if (BWN_ISOFDMRATE(rts_rate)) {
5965			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
5966			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
5967		} else {
5968			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
5969			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
5970		}
5971		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
5972		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
5973	}
5974
5975	if (BWN_ISOLDFMT(mac))
5976		txhdr->body.old.cookie = htole16(cookie);
5977	else
5978		txhdr->body.new.cookie = htole16(cookie);
5979
5980	txhdr->macctl = htole32(macctl);
5981	txhdr->phyctl = htole16(phyctl);
5982
5983	/*
5984	 * TX radio tap
5985	 */
5986	if (ieee80211_radiotap_active_vap(vap)) {
5987		sc->sc_tx_th.wt_flags = 0;
5988		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
5989			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5990		if (isshort &&
5991		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5992		     rate == BWN_CCK_RATE_11MB))
5993			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
5994		sc->sc_tx_th.wt_rate = rate;
5995
5996		ieee80211_radiotap_tx(vap, m);
5997	}
5998
5999	return (0);
6000}
6001
6002static void
6003bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6004    const uint8_t rate)
6005{
6006	uint32_t d, plen;
6007	uint8_t *raw = plcp->o.raw;
6008
6009	if (BWN_ISOFDMRATE(rate)) {
6010		d = bwn_plcp_getofdm(rate);
6011		KASSERT(!(octets & 0xf000),
6012		    ("%s:%d: fail", __func__, __LINE__));
6013		d |= (octets << 5);
6014		plcp->o.data = htole32(d);
6015	} else {
6016		plen = octets * 16 / rate;
6017		if ((octets * 16 % rate) > 0) {
6018			plen++;
6019			if ((rate == BWN_CCK_RATE_11MB)
6020			    && ((octets * 8 % 11) < 4)) {
6021				raw[1] = 0x84;
6022			} else
6023				raw[1] = 0x04;
6024		} else
6025			raw[1] = 0x04;
6026		plcp->o.data |= htole32(plen << 16);
6027		raw[0] = bwn_plcp_getcck(rate);
6028	}
6029}
6030
6031static uint8_t
6032bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6033{
6034	struct bwn_softc *sc = mac->mac_sc;
6035	uint8_t mask;
6036
6037	if (n == 0)
6038		return (0);
6039	if (mac->mac_phy.gmode)
6040		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6041	else
6042		mask = siba_sprom_get_ant_a(sc->sc_dev);
6043	if (!(mask & (1 << (n - 1))))
6044		return (0);
6045	return (n);
6046}
6047
6048/*
6049 * Return a fallback rate for the given rate.
6050 *
6051 * Note: Don't fall back from OFDM to CCK.
6052 */
6053static uint8_t
6054bwn_get_fbrate(uint8_t bitrate)
6055{
6056	switch (bitrate) {
6057	/* CCK */
6058	case BWN_CCK_RATE_1MB:
6059		return (BWN_CCK_RATE_1MB);
6060	case BWN_CCK_RATE_2MB:
6061		return (BWN_CCK_RATE_1MB);
6062	case BWN_CCK_RATE_5MB:
6063		return (BWN_CCK_RATE_2MB);
6064	case BWN_CCK_RATE_11MB:
6065		return (BWN_CCK_RATE_5MB);
6066
6067	/* OFDM */
6068	case BWN_OFDM_RATE_6MB:
6069		return (BWN_OFDM_RATE_6MB);
6070	case BWN_OFDM_RATE_9MB:
6071		return (BWN_OFDM_RATE_6MB);
6072	case BWN_OFDM_RATE_12MB:
6073		return (BWN_OFDM_RATE_9MB);
6074	case BWN_OFDM_RATE_18MB:
6075		return (BWN_OFDM_RATE_12MB);
6076	case BWN_OFDM_RATE_24MB:
6077		return (BWN_OFDM_RATE_18MB);
6078	case BWN_OFDM_RATE_36MB:
6079		return (BWN_OFDM_RATE_24MB);
6080	case BWN_OFDM_RATE_48MB:
6081		return (BWN_OFDM_RATE_36MB);
6082	case BWN_OFDM_RATE_54MB:
6083		return (BWN_OFDM_RATE_48MB);
6084	}
6085	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6086	return (0);
6087}
6088
6089static uint32_t
6090bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6091    uint32_t ctl, const void *_data, int len)
6092{
6093	struct bwn_softc *sc = mac->mac_sc;
6094	uint32_t value = 0;
6095	const uint8_t *data = _data;
6096
6097	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6098	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6099	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6100
6101	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6102	    tq->tq_base + BWN_PIO8_TXDATA);
6103	if (len & 3) {
6104		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6105		    BWN_PIO8_TXCTL_24_31);
6106		data = &(data[len - 1]);
6107		switch (len & 3) {
6108		case 3:
6109			ctl |= BWN_PIO8_TXCTL_16_23;
6110			value |= (uint32_t)(*data) << 16;
6111			data--;
6112		case 2:
6113			ctl |= BWN_PIO8_TXCTL_8_15;
6114			value |= (uint32_t)(*data) << 8;
6115			data--;
6116		case 1:
6117			value |= (uint32_t)(*data);
6118		}
6119		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6120		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6121	}
6122
6123	return (ctl);
6124}
6125
6126static void
6127bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6128    uint16_t offset, uint32_t value)
6129{
6130
6131	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6132}
6133
6134static uint16_t
6135bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6136    uint16_t ctl, const void *_data, int len)
6137{
6138	struct bwn_softc *sc = mac->mac_sc;
6139	const uint8_t *data = _data;
6140
6141	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6142	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6143
6144	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6145	    tq->tq_base + BWN_PIO_TXDATA);
6146	if (len & 1) {
6147		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6148		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6149		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6150	}
6151
6152	return (ctl);
6153}
6154
6155static uint16_t
6156bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6157    uint16_t ctl, struct mbuf *m0)
6158{
6159	int i, j = 0;
6160	uint16_t data = 0;
6161	const uint8_t *buf;
6162	struct mbuf *m = m0;
6163
6164	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6165	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6166
6167	for (; m != NULL; m = m->m_next) {
6168		buf = mtod(m, const uint8_t *);
6169		for (i = 0; i < m->m_len; i++) {
6170			if (!((j++) % 2))
6171				data |= buf[i];
6172			else {
6173				data |= (buf[i] << 8);
6174				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6175				data = 0;
6176			}
6177		}
6178	}
6179	if (m0->m_pkthdr.len % 2) {
6180		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6181		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6182		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6183	}
6184
6185	return (ctl);
6186}
6187
6188static void
6189bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6190{
6191
6192	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6193		return;
6194	BWN_WRITE_2(mac, 0x684, 510 + time);
6195	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6196}
6197
6198static struct bwn_dma_ring *
6199bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6200{
6201
6202	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6203		return (mac->mac_method.dma.wme[WME_AC_BE]);
6204
6205	switch (prio) {
6206	case 3:
6207		return (mac->mac_method.dma.wme[WME_AC_VO]);
6208	case 2:
6209		return (mac->mac_method.dma.wme[WME_AC_VI]);
6210	case 0:
6211		return (mac->mac_method.dma.wme[WME_AC_BE]);
6212	case 1:
6213		return (mac->mac_method.dma.wme[WME_AC_BK]);
6214	}
6215	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6216	return (NULL);
6217}
6218
6219static int
6220bwn_dma_getslot(struct bwn_dma_ring *dr)
6221{
6222	int slot;
6223
6224	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6225
6226	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6227	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6228	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6229
6230	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6231	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6232	dr->dr_curslot = slot;
6233	dr->dr_usedslot++;
6234
6235	return (slot);
6236}
6237
6238static struct bwn_pio_txqueue *
6239bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6240    struct bwn_pio_txpkt **pack)
6241{
6242	struct bwn_pio *pio = &mac->mac_method.pio;
6243	struct bwn_pio_txqueue *tq = NULL;
6244	unsigned int index;
6245
6246	switch (cookie & 0xf000) {
6247	case 0x1000:
6248		tq = &pio->wme[WME_AC_BK];
6249		break;
6250	case 0x2000:
6251		tq = &pio->wme[WME_AC_BE];
6252		break;
6253	case 0x3000:
6254		tq = &pio->wme[WME_AC_VI];
6255		break;
6256	case 0x4000:
6257		tq = &pio->wme[WME_AC_VO];
6258		break;
6259	case 0x5000:
6260		tq = &pio->mcast;
6261		break;
6262	}
6263	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6264	if (tq == NULL)
6265		return (NULL);
6266	index = (cookie & 0x0fff);
6267	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6268	if (index >= N(tq->tq_pkts))
6269		return (NULL);
6270	*pack = &tq->tq_pkts[index];
6271	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6272	return (tq);
6273}
6274
6275static void
6276bwn_txpwr(void *arg, int npending)
6277{
6278	struct bwn_mac *mac = arg;
6279	struct bwn_softc *sc = mac->mac_sc;
6280
6281	BWN_LOCK(sc);
6282	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6283	    mac->mac_phy.set_txpwr != NULL)
6284		mac->mac_phy.set_txpwr(mac);
6285	BWN_UNLOCK(sc);
6286}
6287
6288static void
6289bwn_task_15s(struct bwn_mac *mac)
6290{
6291	uint16_t reg;
6292
6293	if (mac->mac_fw.opensource) {
6294		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6295		if (reg) {
6296			bwn_restart(mac, "fw watchdog");
6297			return;
6298		}
6299		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6300	}
6301	if (mac->mac_phy.task_15s)
6302		mac->mac_phy.task_15s(mac);
6303
6304	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6305}
6306
6307static void
6308bwn_task_30s(struct bwn_mac *mac)
6309{
6310
6311	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6312		return;
6313	mac->mac_noise.noi_running = 1;
6314	mac->mac_noise.noi_nsamples = 0;
6315
6316	bwn_noise_gensample(mac);
6317}
6318
6319static void
6320bwn_task_60s(struct bwn_mac *mac)
6321{
6322
6323	if (mac->mac_phy.task_60s)
6324		mac->mac_phy.task_60s(mac);
6325	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6326}
6327
6328static void
6329bwn_tasks(void *arg)
6330{
6331	struct bwn_mac *mac = arg;
6332	struct bwn_softc *sc = mac->mac_sc;
6333
6334	BWN_ASSERT_LOCKED(sc);
6335	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6336		return;
6337
6338	if (mac->mac_task_state % 4 == 0)
6339		bwn_task_60s(mac);
6340	if (mac->mac_task_state % 2 == 0)
6341		bwn_task_30s(mac);
6342	bwn_task_15s(mac);
6343
6344	mac->mac_task_state++;
6345	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6346}
6347
6348static int
6349bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6350{
6351	struct bwn_softc *sc = mac->mac_sc;
6352
6353	KASSERT(a == 0, ("not support APHY\n"));
6354
6355	switch (plcp->o.raw[0] & 0xf) {
6356	case 0xb:
6357		return (BWN_OFDM_RATE_6MB);
6358	case 0xf:
6359		return (BWN_OFDM_RATE_9MB);
6360	case 0xa:
6361		return (BWN_OFDM_RATE_12MB);
6362	case 0xe:
6363		return (BWN_OFDM_RATE_18MB);
6364	case 0x9:
6365		return (BWN_OFDM_RATE_24MB);
6366	case 0xd:
6367		return (BWN_OFDM_RATE_36MB);
6368	case 0x8:
6369		return (BWN_OFDM_RATE_48MB);
6370	case 0xc:
6371		return (BWN_OFDM_RATE_54MB);
6372	}
6373	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6374	    plcp->o.raw[0] & 0xf);
6375	return (-1);
6376}
6377
6378static int
6379bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6380{
6381	struct bwn_softc *sc = mac->mac_sc;
6382
6383	switch (plcp->o.raw[0]) {
6384	case 0x0a:
6385		return (BWN_CCK_RATE_1MB);
6386	case 0x14:
6387		return (BWN_CCK_RATE_2MB);
6388	case 0x37:
6389		return (BWN_CCK_RATE_5MB);
6390	case 0x6e:
6391		return (BWN_CCK_RATE_11MB);
6392	}
6393	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6394	return (-1);
6395}
6396
6397static void
6398bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6399    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6400    int rssi, int noise)
6401{
6402	struct bwn_softc *sc = mac->mac_sc;
6403	const struct ieee80211_frame_min *wh;
6404	uint64_t tsf;
6405	uint16_t low_mactime_now;
6406
6407	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6408		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6409
6410	wh = mtod(m, const struct ieee80211_frame_min *);
6411	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6412		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6413
6414	bwn_tsf_read(mac, &tsf);
6415	low_mactime_now = tsf;
6416	tsf = tsf & ~0xffffULL;
6417	tsf += le16toh(rxhdr->mac_time);
6418	if (low_mactime_now < le16toh(rxhdr->mac_time))
6419		tsf -= 0x10000;
6420
6421	sc->sc_rx_th.wr_tsf = tsf;
6422	sc->sc_rx_th.wr_rate = rate;
6423	sc->sc_rx_th.wr_antsignal = rssi;
6424	sc->sc_rx_th.wr_antnoise = noise;
6425}
6426
6427static void
6428bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6429{
6430	uint32_t low, high;
6431
6432	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6433	    ("%s:%d: fail", __func__, __LINE__));
6434
6435	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6436	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6437	*tsf = high;
6438	*tsf <<= 32;
6439	*tsf |= low;
6440}
6441
6442static int
6443bwn_dma_attach(struct bwn_mac *mac)
6444{
6445	struct bwn_dma *dma = &mac->mac_method.dma;
6446	struct bwn_softc *sc = mac->mac_sc;
6447	bus_addr_t lowaddr = 0;
6448	int error;
6449
6450	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6451		return (0);
6452
6453	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6454
6455	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6456
6457	dma->dmatype = bwn_dma_gettype(mac);
6458	if (dma->dmatype == BWN_DMA_30BIT)
6459		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6460	else if (dma->dmatype == BWN_DMA_32BIT)
6461		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6462	else
6463		lowaddr = BUS_SPACE_MAXADDR;
6464
6465	/*
6466	 * Create top level DMA tag
6467	 */
6468	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6469			       BWN_ALIGN, 0,		/* alignment, bounds */
6470			       lowaddr,			/* lowaddr */
6471			       BUS_SPACE_MAXADDR,	/* highaddr */
6472			       NULL, NULL,		/* filter, filterarg */
6473			       BUS_SPACE_MAXSIZE,	/* maxsize */
6474			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6475			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6476			       0,			/* flags */
6477			       NULL, NULL,		/* lockfunc, lockarg */
6478			       &dma->parent_dtag);
6479	if (error) {
6480		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6481		return (error);
6482	}
6483
6484	/*
6485	 * Create TX/RX mbuf DMA tag
6486	 */
6487	error = bus_dma_tag_create(dma->parent_dtag,
6488				1,
6489				0,
6490				BUS_SPACE_MAXADDR,
6491				BUS_SPACE_MAXADDR,
6492				NULL, NULL,
6493				MCLBYTES,
6494				1,
6495				BUS_SPACE_MAXSIZE_32BIT,
6496				0,
6497				NULL, NULL,
6498				&dma->rxbuf_dtag);
6499	if (error) {
6500		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6501		goto fail0;
6502	}
6503	error = bus_dma_tag_create(dma->parent_dtag,
6504				1,
6505				0,
6506				BUS_SPACE_MAXADDR,
6507				BUS_SPACE_MAXADDR,
6508				NULL, NULL,
6509				MCLBYTES,
6510				1,
6511				BUS_SPACE_MAXSIZE_32BIT,
6512				0,
6513				NULL, NULL,
6514				&dma->txbuf_dtag);
6515	if (error) {
6516		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6517		goto fail1;
6518	}
6519
6520	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6521	if (!dma->wme[WME_AC_BK])
6522		goto fail2;
6523
6524	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6525	if (!dma->wme[WME_AC_BE])
6526		goto fail3;
6527
6528	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6529	if (!dma->wme[WME_AC_VI])
6530		goto fail4;
6531
6532	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6533	if (!dma->wme[WME_AC_VO])
6534		goto fail5;
6535
6536	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6537	if (!dma->mcast)
6538		goto fail6;
6539	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6540	if (!dma->rx)
6541		goto fail7;
6542
6543	return (error);
6544
6545fail7:	bwn_dma_ringfree(&dma->mcast);
6546fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
6547fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
6548fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
6549fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
6550fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
6551fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
6552fail0:	bus_dma_tag_destroy(dma->parent_dtag);
6553	return (error);
6554}
6555
6556static struct bwn_dma_ring *
6557bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
6558    uint16_t cookie, int *slot)
6559{
6560	struct bwn_dma *dma = &mac->mac_method.dma;
6561	struct bwn_dma_ring *dr;
6562	struct bwn_softc *sc = mac->mac_sc;
6563
6564	BWN_ASSERT_LOCKED(mac->mac_sc);
6565
6566	switch (cookie & 0xf000) {
6567	case 0x1000:
6568		dr = dma->wme[WME_AC_BK];
6569		break;
6570	case 0x2000:
6571		dr = dma->wme[WME_AC_BE];
6572		break;
6573	case 0x3000:
6574		dr = dma->wme[WME_AC_VI];
6575		break;
6576	case 0x4000:
6577		dr = dma->wme[WME_AC_VO];
6578		break;
6579	case 0x5000:
6580		dr = dma->mcast;
6581		break;
6582	default:
6583		dr = NULL;
6584		KASSERT(0 == 1,
6585		    ("invalid cookie value %d", cookie & 0xf000));
6586	}
6587	*slot = (cookie & 0x0fff);
6588	if (*slot < 0 || *slot >= dr->dr_numslots) {
6589		/*
6590		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
6591		 * that it occurs events which have same H/W sequence numbers.
6592		 * When it's occurred just prints a WARNING msgs and ignores.
6593		 */
6594		KASSERT(status->seq == dma->lastseq,
6595		    ("%s:%d: fail", __func__, __LINE__));
6596		device_printf(sc->sc_dev,
6597		    "out of slot ranges (0 < %d < %d)\n", *slot,
6598		    dr->dr_numslots);
6599		return (NULL);
6600	}
6601	dma->lastseq = status->seq;
6602	return (dr);
6603}
6604
6605static void
6606bwn_dma_stop(struct bwn_mac *mac)
6607{
6608	struct bwn_dma *dma;
6609
6610	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
6611		return;
6612	dma = &mac->mac_method.dma;
6613
6614	bwn_dma_ringstop(&dma->rx);
6615	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
6616	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
6617	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
6618	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
6619	bwn_dma_ringstop(&dma->mcast);
6620}
6621
6622static void
6623bwn_dma_ringstop(struct bwn_dma_ring **dr)
6624{
6625
6626	if (dr == NULL)
6627		return;
6628
6629	bwn_dma_cleanup(*dr);
6630}
6631
6632static void
6633bwn_pio_stop(struct bwn_mac *mac)
6634{
6635	struct bwn_pio *pio;
6636
6637	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
6638		return;
6639	pio = &mac->mac_method.pio;
6640
6641	bwn_destroy_queue_tx(&pio->mcast);
6642	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
6643	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
6644	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
6645	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
6646}
6647
6648static void
6649bwn_led_attach(struct bwn_mac *mac)
6650{
6651	struct bwn_softc *sc = mac->mac_sc;
6652	const uint8_t *led_act = NULL;
6653	uint16_t val[BWN_LED_MAX];
6654	int i;
6655
6656	sc->sc_led_idle = (2350 * hz) / 1000;
6657	sc->sc_led_blink = 1;
6658
6659	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
6660		if (siba_get_pci_subvendor(sc->sc_dev) ==
6661		    bwn_vendor_led_act[i].vid) {
6662			led_act = bwn_vendor_led_act[i].led_act;
6663			break;
6664		}
6665	}
6666	if (led_act == NULL)
6667		led_act = bwn_default_led_act;
6668
6669	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
6670	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
6671	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
6672	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
6673
6674	for (i = 0; i < BWN_LED_MAX; ++i) {
6675		struct bwn_led *led = &sc->sc_leds[i];
6676
6677		if (val[i] == 0xff) {
6678			led->led_act = led_act[i];
6679		} else {
6680			if (val[i] & BWN_LED_ACT_LOW)
6681				led->led_flags |= BWN_LED_F_ACTLOW;
6682			led->led_act = val[i] & BWN_LED_ACT_MASK;
6683		}
6684		led->led_mask = (1 << i);
6685
6686		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
6687		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
6688		    led->led_act == BWN_LED_ACT_BLINK) {
6689			led->led_flags |= BWN_LED_F_BLINK;
6690			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
6691				led->led_flags |= BWN_LED_F_POLLABLE;
6692			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
6693				led->led_flags |= BWN_LED_F_SLOW;
6694
6695			if (sc->sc_blink_led == NULL) {
6696				sc->sc_blink_led = led;
6697				if (led->led_flags & BWN_LED_F_SLOW)
6698					BWN_LED_SLOWDOWN(sc->sc_led_idle);
6699			}
6700		}
6701
6702		DPRINTF(sc, BWN_DEBUG_LED,
6703		    "%dth led, act %d, lowact %d\n", i,
6704		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
6705	}
6706	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
6707}
6708
6709static __inline uint16_t
6710bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
6711{
6712
6713	if (led->led_flags & BWN_LED_F_ACTLOW)
6714		on = !on;
6715	if (on)
6716		val |= led->led_mask;
6717	else
6718		val &= ~led->led_mask;
6719	return val;
6720}
6721
6722static void
6723bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
6724{
6725	struct bwn_softc *sc = mac->mac_sc;
6726	struct ieee80211com *ic = &sc->sc_ic;
6727	uint16_t val;
6728	int i;
6729
6730	if (nstate == IEEE80211_S_INIT) {
6731		callout_stop(&sc->sc_led_blink_ch);
6732		sc->sc_led_blinking = 0;
6733	}
6734
6735	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
6736		return;
6737
6738	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6739	for (i = 0; i < BWN_LED_MAX; ++i) {
6740		struct bwn_led *led = &sc->sc_leds[i];
6741		int on;
6742
6743		if (led->led_act == BWN_LED_ACT_UNKN ||
6744		    led->led_act == BWN_LED_ACT_NULL)
6745			continue;
6746
6747		if ((led->led_flags & BWN_LED_F_BLINK) &&
6748		    nstate != IEEE80211_S_INIT)
6749			continue;
6750
6751		switch (led->led_act) {
6752		case BWN_LED_ACT_ON:    /* Always on */
6753			on = 1;
6754			break;
6755		case BWN_LED_ACT_OFF:   /* Always off */
6756		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
6757			on = 0;
6758			break;
6759		default:
6760			on = 1;
6761			switch (nstate) {
6762			case IEEE80211_S_INIT:
6763				on = 0;
6764				break;
6765			case IEEE80211_S_RUN:
6766				if (led->led_act == BWN_LED_ACT_11G &&
6767				    ic->ic_curmode != IEEE80211_MODE_11G)
6768					on = 0;
6769				break;
6770			default:
6771				if (led->led_act == BWN_LED_ACT_ASSOC)
6772					on = 0;
6773				break;
6774			}
6775			break;
6776		}
6777
6778		val = bwn_led_onoff(led, val, on);
6779	}
6780	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6781}
6782
6783static void
6784bwn_led_event(struct bwn_mac *mac, int event)
6785{
6786	struct bwn_softc *sc = mac->mac_sc;
6787	struct bwn_led *led = sc->sc_blink_led;
6788	int rate;
6789
6790	if (event == BWN_LED_EVENT_POLL) {
6791		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
6792			return;
6793		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6794			return;
6795	}
6796
6797	sc->sc_led_ticks = ticks;
6798	if (sc->sc_led_blinking)
6799		return;
6800
6801	switch (event) {
6802	case BWN_LED_EVENT_RX:
6803		rate = sc->sc_rx_rate;
6804		break;
6805	case BWN_LED_EVENT_TX:
6806		rate = sc->sc_tx_rate;
6807		break;
6808	case BWN_LED_EVENT_POLL:
6809		rate = 0;
6810		break;
6811	default:
6812		panic("unknown LED event %d\n", event);
6813		break;
6814	}
6815	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
6816	    bwn_led_duration[rate].off_dur);
6817}
6818
6819static void
6820bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
6821{
6822	struct bwn_softc *sc = mac->mac_sc;
6823	struct bwn_led *led = sc->sc_blink_led;
6824	uint16_t val;
6825
6826	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6827	val = bwn_led_onoff(led, val, 1);
6828	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6829
6830	if (led->led_flags & BWN_LED_F_SLOW) {
6831		BWN_LED_SLOWDOWN(on_dur);
6832		BWN_LED_SLOWDOWN(off_dur);
6833	}
6834
6835	sc->sc_led_blinking = 1;
6836	sc->sc_led_blink_offdur = off_dur;
6837
6838	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
6839}
6840
6841static void
6842bwn_led_blink_next(void *arg)
6843{
6844	struct bwn_mac *mac = arg;
6845	struct bwn_softc *sc = mac->mac_sc;
6846	uint16_t val;
6847
6848	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6849	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
6850	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6851
6852	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
6853	    bwn_led_blink_end, mac);
6854}
6855
6856static void
6857bwn_led_blink_end(void *arg)
6858{
6859	struct bwn_mac *mac = arg;
6860	struct bwn_softc *sc = mac->mac_sc;
6861
6862	sc->sc_led_blinking = 0;
6863}
6864
6865static int
6866bwn_suspend(device_t dev)
6867{
6868	struct bwn_softc *sc = device_get_softc(dev);
6869
6870	BWN_LOCK(sc);
6871	bwn_stop(sc);
6872	BWN_UNLOCK(sc);
6873	return (0);
6874}
6875
6876static int
6877bwn_resume(device_t dev)
6878{
6879	struct bwn_softc *sc = device_get_softc(dev);
6880	int error = EDOOFUS;
6881
6882	BWN_LOCK(sc);
6883	if (sc->sc_ic.ic_nrunning > 0)
6884		error = bwn_init(sc);
6885	BWN_UNLOCK(sc);
6886	if (error == 0)
6887		ieee80211_start_all(&sc->sc_ic);
6888	return (0);
6889}
6890
6891static void
6892bwn_rfswitch(void *arg)
6893{
6894	struct bwn_softc *sc = arg;
6895	struct bwn_mac *mac = sc->sc_curmac;
6896	int cur = 0, prev = 0;
6897
6898	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
6899	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
6900
6901	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
6902		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
6903			& BWN_RF_HWENABLED_HI_MASK))
6904			cur = 1;
6905	} else {
6906		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
6907		    & BWN_RF_HWENABLED_LO_MASK)
6908			cur = 1;
6909	}
6910
6911	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
6912		prev = 1;
6913
6914	if (cur != prev) {
6915		if (cur)
6916			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
6917		else
6918			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
6919
6920		device_printf(sc->sc_dev,
6921		    "status of RF switch is changed to %s\n",
6922		    cur ? "ON" : "OFF");
6923		if (cur != mac->mac_phy.rf_on) {
6924			if (cur)
6925				bwn_rf_turnon(mac);
6926			else
6927				bwn_rf_turnoff(mac);
6928		}
6929	}
6930
6931	callout_schedule(&sc->sc_rfswitch_ch, hz);
6932}
6933
6934static void
6935bwn_sysctl_node(struct bwn_softc *sc)
6936{
6937	device_t dev = sc->sc_dev;
6938	struct bwn_mac *mac;
6939	struct bwn_stats *stats;
6940
6941	/* XXX assume that count of MAC is only 1. */
6942
6943	if ((mac = sc->sc_curmac) == NULL)
6944		return;
6945	stats = &mac->mac_stats;
6946
6947	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6948	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6949	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
6950	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6951	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6952	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
6953	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6954	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6955	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
6956
6957#ifdef BWN_DEBUG
6958	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
6959	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6960	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
6961#endif
6962}
6963
6964static device_method_t bwn_methods[] = {
6965	/* Device interface */
6966	DEVMETHOD(device_probe,		bwn_probe),
6967	DEVMETHOD(device_attach,	bwn_attach),
6968	DEVMETHOD(device_detach,	bwn_detach),
6969	DEVMETHOD(device_suspend,	bwn_suspend),
6970	DEVMETHOD(device_resume,	bwn_resume),
6971	DEVMETHOD_END
6972};
6973static driver_t bwn_driver = {
6974	"bwn",
6975	bwn_methods,
6976	sizeof(struct bwn_softc)
6977};
6978static devclass_t bwn_devclass;
6979DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
6980MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
6981MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
6982MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
6983MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
6984MODULE_VERSION(bwn, 1);
6985