if_bwn.c revision 299792
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 299792 2016-05-14 23:41:28Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include <sys/param.h>
38#include <sys/systm.h>
39#include <sys/kernel.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/endian.h>
43#include <sys/errno.h>
44#include <sys/firmware.h>
45#include <sys/lock.h>
46#include <sys/mutex.h>
47#include <machine/bus.h>
48#include <machine/resource.h>
49#include <sys/bus.h>
50#include <sys/rman.h>
51#include <sys/socket.h>
52#include <sys/sockio.h>
53
54#include <net/ethernet.h>
55#include <net/if.h>
56#include <net/if_var.h>
57#include <net/if_arp.h>
58#include <net/if_dl.h>
59#include <net/if_llc.h>
60#include <net/if_media.h>
61#include <net/if_types.h>
62
63#include <dev/pci/pcivar.h>
64#include <dev/pci/pcireg.h>
65#include <dev/siba/siba_ids.h>
66#include <dev/siba/sibareg.h>
67#include <dev/siba/sibavar.h>
68
69#include <net80211/ieee80211_var.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_regdomain.h>
72#include <net80211/ieee80211_phy.h>
73#include <net80211/ieee80211_ratectl.h>
74
75#include <dev/bwn/if_bwnreg.h>
76#include <dev/bwn/if_bwnvar.h>
77
78#include <dev/bwn/if_bwn_debug.h>
79#include <dev/bwn/if_bwn_misc.h>
80#include <dev/bwn/if_bwn_util.h>
81#include <dev/bwn/if_bwn_phy_common.h>
82#include <dev/bwn/if_bwn_phy_g.h>
83#include <dev/bwn/if_bwn_phy_lp.h>
84
85static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
86    "Broadcom driver parameters");
87
88/*
89 * Tunable & sysctl variables.
90 */
91
92#ifdef BWN_DEBUG
93static	int bwn_debug = 0;
94SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
95    "Broadcom debugging printfs");
96#endif
97
98static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
99SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
100    "uses Bad Frames Preemption");
101static int	bwn_bluetooth = 1;
102SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
103    "turns on Bluetooth Coexistence");
104static int	bwn_hwpctl = 0;
105SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
106    "uses H/W power control");
107static int	bwn_msi_disable = 0;		/* MSI disabled  */
108TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
109static int	bwn_usedma = 1;
110SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
111    "uses DMA");
112TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
113static int	bwn_wme = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
115    "uses WME support");
116
117static void	bwn_attach_pre(struct bwn_softc *);
118static int	bwn_attach_post(struct bwn_softc *);
119static void	bwn_sprom_bugfixes(device_t);
120static int	bwn_init(struct bwn_softc *);
121static void	bwn_parent(struct ieee80211com *);
122static void	bwn_start(struct bwn_softc *);
123static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
124static int	bwn_attach_core(struct bwn_mac *);
125static int	bwn_phy_getinfo(struct bwn_mac *, int);
126static int	bwn_chiptest(struct bwn_mac *);
127static int	bwn_setup_channels(struct bwn_mac *, int, int);
128static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
129		    uint16_t);
130static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
131		    const struct bwn_channelinfo *, int);
132static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
133		    const struct ieee80211_bpf_params *);
134static void	bwn_updateslot(struct ieee80211com *);
135static void	bwn_update_promisc(struct ieee80211com *);
136static void	bwn_wme_init(struct bwn_mac *);
137static int	bwn_wme_update(struct ieee80211com *);
138static void	bwn_wme_clear(struct bwn_softc *);
139static void	bwn_wme_load(struct bwn_mac *);
140static void	bwn_wme_loadparams(struct bwn_mac *,
141		    const struct wmeParams *, uint16_t);
142static void	bwn_scan_start(struct ieee80211com *);
143static void	bwn_scan_end(struct ieee80211com *);
144static void	bwn_set_channel(struct ieee80211com *);
145static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
146		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
147		    const uint8_t [IEEE80211_ADDR_LEN],
148		    const uint8_t [IEEE80211_ADDR_LEN]);
149static void	bwn_vap_delete(struct ieee80211vap *);
150static void	bwn_stop(struct bwn_softc *);
151static int	bwn_core_init(struct bwn_mac *);
152static void	bwn_core_start(struct bwn_mac *);
153static void	bwn_core_exit(struct bwn_mac *);
154static void	bwn_bt_disable(struct bwn_mac *);
155static int	bwn_chip_init(struct bwn_mac *);
156static void	bwn_set_txretry(struct bwn_mac *, int, int);
157static void	bwn_rate_init(struct bwn_mac *);
158static void	bwn_set_phytxctl(struct bwn_mac *);
159static void	bwn_spu_setdelay(struct bwn_mac *, int);
160static void	bwn_bt_enable(struct bwn_mac *);
161static void	bwn_set_macaddr(struct bwn_mac *);
162static void	bwn_crypt_init(struct bwn_mac *);
163static void	bwn_chip_exit(struct bwn_mac *);
164static int	bwn_fw_fillinfo(struct bwn_mac *);
165static int	bwn_fw_loaducode(struct bwn_mac *);
166static int	bwn_gpio_init(struct bwn_mac *);
167static int	bwn_fw_loadinitvals(struct bwn_mac *);
168static int	bwn_phy_init(struct bwn_mac *);
169static void	bwn_set_txantenna(struct bwn_mac *, int);
170static void	bwn_set_opmode(struct bwn_mac *);
171static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
172static uint8_t	bwn_plcp_getcck(const uint8_t);
173static uint8_t	bwn_plcp_getofdm(const uint8_t);
174static void	bwn_pio_init(struct bwn_mac *);
175static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
176static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
177		    int);
178static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
179		    struct bwn_pio_rxqueue *, int);
180static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
181static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
182		    uint16_t);
183static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
184static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
185static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
186static void	bwn_pio_handle_txeof(struct bwn_mac *,
187		    const struct bwn_txstatus *);
188static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
189static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
190static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
191		    uint16_t);
192static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
193		    uint32_t);
194static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
195		    struct mbuf *);
196static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
197static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
198		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
199static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
200		    uint16_t, uint32_t);
201static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
203static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
204		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
205static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
206		    uint16_t, struct bwn_pio_txpkt **);
207static void	bwn_dma_init(struct bwn_mac *);
208static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
209static int	bwn_dma_mask2type(uint64_t);
210static uint64_t	bwn_dma_mask(struct bwn_mac *);
211static uint16_t	bwn_dma_base(int, int);
212static void	bwn_dma_ringfree(struct bwn_dma_ring **);
213static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
214		    int, struct bwn_dmadesc_generic **,
215		    struct bwn_dmadesc_meta **);
216static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
217		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
218		    int, int);
219static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
220static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
221static void	bwn_dma_32_resume(struct bwn_dma_ring *);
222static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
223static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
224static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
225		    int, struct bwn_dmadesc_generic **,
226		    struct bwn_dmadesc_meta **);
227static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
228		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
229		    int, int);
230static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
231static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
232static void	bwn_dma_64_resume(struct bwn_dma_ring *);
233static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
234static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
235static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
236static void	bwn_dma_setup(struct bwn_dma_ring *);
237static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
238static void	bwn_dma_cleanup(struct bwn_dma_ring *);
239static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
240static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
241static void	bwn_dma_rx(struct bwn_dma_ring *);
242static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
243static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
244		    struct bwn_dmadesc_meta *);
245static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
246static int	bwn_dma_gettype(struct bwn_mac *);
247static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
248static int	bwn_dma_freeslot(struct bwn_dma_ring *);
249static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
250static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
251static int	bwn_dma_newbuf(struct bwn_dma_ring *,
252		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
253		    int);
254static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
255		    bus_size_t, int);
256static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
257static void	bwn_dma_handle_txeof(struct bwn_mac *,
258		    const struct bwn_txstatus *);
259static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
260		    struct mbuf *);
261static int	bwn_dma_getslot(struct bwn_dma_ring *);
262static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
263		    uint8_t);
264static int	bwn_dma_attach(struct bwn_mac *);
265static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
266		    int, int, int);
267static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
268		    const struct bwn_txstatus *, uint16_t, int *);
269static void	bwn_dma_free(struct bwn_mac *);
270static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
271static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
272		    const char *, struct bwn_fwfile *);
273static void	bwn_release_firmware(struct bwn_mac *);
274static void	bwn_do_release_fw(struct bwn_fwfile *);
275static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
276static int	bwn_fwinitvals_write(struct bwn_mac *,
277		    const struct bwn_fwinitvals *, size_t, size_t);
278static uint16_t	bwn_ant2phy(int);
279static void	bwn_mac_write_bssid(struct bwn_mac *);
280static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
281		    const uint8_t *);
282static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
283		    const uint8_t *, size_t, const uint8_t *);
284static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
285		    const uint8_t *);
286static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *);
288static void	bwn_phy_exit(struct bwn_mac *);
289static void	bwn_core_stop(struct bwn_mac *);
290static int	bwn_switch_band(struct bwn_softc *,
291		    struct ieee80211_channel *);
292static void	bwn_phy_reset(struct bwn_mac *);
293static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
294static void	bwn_set_pretbtt(struct bwn_mac *);
295static int	bwn_intr(void *);
296static void	bwn_intrtask(void *, int);
297static void	bwn_restart(struct bwn_mac *, const char *);
298static void	bwn_intr_ucode_debug(struct bwn_mac *);
299static void	bwn_intr_tbtt_indication(struct bwn_mac *);
300static void	bwn_intr_atim_end(struct bwn_mac *);
301static void	bwn_intr_beacon(struct bwn_mac *);
302static void	bwn_intr_pmq(struct bwn_mac *);
303static void	bwn_intr_noise(struct bwn_mac *);
304static void	bwn_intr_txeof(struct bwn_mac *);
305static void	bwn_hwreset(void *, int);
306static void	bwn_handle_fwpanic(struct bwn_mac *);
307static void	bwn_load_beacon0(struct bwn_mac *);
308static void	bwn_load_beacon1(struct bwn_mac *);
309static uint32_t	bwn_jssi_read(struct bwn_mac *);
310static void	bwn_noise_gensample(struct bwn_mac *);
311static void	bwn_handle_txeof(struct bwn_mac *,
312		    const struct bwn_txstatus *);
313static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
314static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
315static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
316		    struct mbuf *);
317static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
318static int	bwn_set_txhdr(struct bwn_mac *,
319		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
320		    uint16_t);
321static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
322		    const uint8_t);
323static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
324static uint8_t	bwn_get_fbrate(uint8_t);
325static void	bwn_txpwr(void *, int);
326static void	bwn_tasks(void *);
327static void	bwn_task_15s(struct bwn_mac *);
328static void	bwn_task_30s(struct bwn_mac *);
329static void	bwn_task_60s(struct bwn_mac *);
330static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
331		    uint8_t);
332static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
333static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
334		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
335		    int, int);
336static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
337static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
338static void	bwn_watchdog(void *);
339static void	bwn_dma_stop(struct bwn_mac *);
340static void	bwn_pio_stop(struct bwn_mac *);
341static void	bwn_dma_ringstop(struct bwn_dma_ring **);
342static void	bwn_led_attach(struct bwn_mac *);
343static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
344static void	bwn_led_event(struct bwn_mac *, int);
345static void	bwn_led_blink_start(struct bwn_mac *, int, int);
346static void	bwn_led_blink_next(void *);
347static void	bwn_led_blink_end(void *);
348static void	bwn_rfswitch(void *);
349static void	bwn_rf_turnon(struct bwn_mac *);
350static void	bwn_rf_turnoff(struct bwn_mac *);
351static void	bwn_sysctl_node(struct bwn_softc *);
352
353static struct resource_spec bwn_res_spec_legacy[] = {
354	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
355	{ -1,			0,		0 }
356};
357
358static struct resource_spec bwn_res_spec_msi[] = {
359	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
360	{ -1,			0,		0 }
361};
362
363static const struct bwn_channelinfo bwn_chantable_bg = {
364	.channels = {
365		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
366		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
367		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
368		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
369		{ 2472, 13, 30 }, { 2484, 14, 30 } },
370	.nchannels = 14
371};
372
373static const struct bwn_channelinfo bwn_chantable_a = {
374	.channels = {
375		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
376		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
377		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
378		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
379		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
380		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
381		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
382		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
383		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
384		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
385		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
386		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
387		{ 6080, 216, 30 } },
388	.nchannels = 37
389};
390
391static const struct bwn_channelinfo bwn_chantable_n = {
392	.channels = {
393		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
394		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
395		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
396		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
397		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
398		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
399		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
400		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
401		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
402		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
403		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
404		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
405		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
406		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
407		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
408		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
409		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
410		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
411		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
412		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
413		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
414		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
415		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
416		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
417		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
418		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
419		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
420		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
421		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
422		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
423		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
424		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
425		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
426		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
427		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
428		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
429		{ 6130, 226, 30 }, { 6140, 228, 30 } },
430	.nchannels = 110
431};
432
433#define	VENDOR_LED_ACT(vendor)				\
434{							\
435	.vid = PCI_VENDOR_##vendor,			\
436	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
437}
438
439static const struct {
440	uint16_t	vid;
441	uint8_t		led_act[BWN_LED_MAX];
442} bwn_vendor_led_act[] = {
443	VENDOR_LED_ACT(COMPAQ),
444	VENDOR_LED_ACT(ASUSTEK)
445};
446
447static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
448	{ BWN_VENDOR_LED_ACT_DEFAULT };
449
450#undef VENDOR_LED_ACT
451
452static const struct {
453	int		on_dur;
454	int		off_dur;
455} bwn_led_duration[109] = {
456	[0]	= { 400, 100 },
457	[2]	= { 150, 75 },
458	[4]	= { 90, 45 },
459	[11]	= { 66, 34 },
460	[12]	= { 53, 26 },
461	[18]	= { 42, 21 },
462	[22]	= { 35, 17 },
463	[24]	= { 32, 16 },
464	[36]	= { 21, 10 },
465	[48]	= { 16, 8 },
466	[72]	= { 11, 5 },
467	[96]	= { 9, 4 },
468	[108]	= { 7, 3 }
469};
470
471static const uint16_t bwn_wme_shm_offsets[] = {
472	[0] = BWN_WME_BESTEFFORT,
473	[1] = BWN_WME_BACKGROUND,
474	[2] = BWN_WME_VOICE,
475	[3] = BWN_WME_VIDEO,
476};
477
478static const struct siba_devid bwn_devs[] = {
479	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
480	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
481	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
482	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
483	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
484	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
485	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
486	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
487	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
488};
489
490static int
491bwn_probe(device_t dev)
492{
493	int i;
494
495	for (i = 0; i < nitems(bwn_devs); i++) {
496		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
497		    siba_get_device(dev) == bwn_devs[i].sd_device &&
498		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
499			return (BUS_PROBE_DEFAULT);
500	}
501
502	return (ENXIO);
503}
504
505static int
506bwn_attach(device_t dev)
507{
508	struct bwn_mac *mac;
509	struct bwn_softc *sc = device_get_softc(dev);
510	int error, i, msic, reg;
511
512	sc->sc_dev = dev;
513#ifdef BWN_DEBUG
514	sc->sc_debug = bwn_debug;
515#endif
516
517	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
518		bwn_attach_pre(sc);
519		bwn_sprom_bugfixes(dev);
520		sc->sc_flags |= BWN_FLAG_ATTACHED;
521	}
522
523	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
524		if (siba_get_pci_device(dev) != 0x4313 &&
525		    siba_get_pci_device(dev) != 0x431a &&
526		    siba_get_pci_device(dev) != 0x4321) {
527			device_printf(sc->sc_dev,
528			    "skip 802.11 cores\n");
529			return (ENODEV);
530		}
531	}
532
533	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
534	mac->mac_sc = sc;
535	mac->mac_status = BWN_MAC_STATUS_UNINIT;
536	if (bwn_bfp != 0)
537		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
538
539	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
540	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
541	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
542
543	error = bwn_attach_core(mac);
544	if (error)
545		goto fail0;
546	bwn_led_attach(mac);
547
548	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
549	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
550	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
551	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
552	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
553	    mac->mac_phy.rf_rev);
554	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
555		device_printf(sc->sc_dev, "DMA (%d bits)\n",
556		    mac->mac_method.dma.dmatype);
557	else
558		device_printf(sc->sc_dev, "PIO\n");
559
560	/*
561	 * setup PCI resources and interrupt.
562	 */
563	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
564		msic = pci_msi_count(dev);
565		if (bootverbose)
566			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
567	} else
568		msic = 0;
569
570	mac->mac_intr_spec = bwn_res_spec_legacy;
571	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
572		if (pci_alloc_msi(dev, &msic) == 0) {
573			device_printf(sc->sc_dev,
574			    "Using %d MSI messages\n", msic);
575			mac->mac_intr_spec = bwn_res_spec_msi;
576			mac->mac_msi = 1;
577		}
578	}
579
580	error = bus_alloc_resources(dev, mac->mac_intr_spec,
581	    mac->mac_res_irq);
582	if (error) {
583		device_printf(sc->sc_dev,
584		    "couldn't allocate IRQ resources (%d)\n", error);
585		goto fail1;
586	}
587
588	if (mac->mac_msi == 0)
589		error = bus_setup_intr(dev, mac->mac_res_irq[0],
590		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
591		    &mac->mac_intrhand[0]);
592	else {
593		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
594			error = bus_setup_intr(dev, mac->mac_res_irq[i],
595			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
596			    &mac->mac_intrhand[i]);
597			if (error != 0) {
598				device_printf(sc->sc_dev,
599				    "couldn't setup interrupt (%d)\n", error);
600				break;
601			}
602		}
603	}
604
605	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
606
607	/*
608	 * calls attach-post routine
609	 */
610	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
611		bwn_attach_post(sc);
612
613	return (0);
614fail1:
615	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
616		pci_release_msi(dev);
617fail0:
618	free(mac, M_DEVBUF);
619	return (error);
620}
621
622static int
623bwn_is_valid_ether_addr(uint8_t *addr)
624{
625	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
626
627	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
628		return (FALSE);
629
630	return (TRUE);
631}
632
633static int
634bwn_attach_post(struct bwn_softc *sc)
635{
636	struct ieee80211com *ic = &sc->sc_ic;
637
638	ic->ic_softc = sc;
639	ic->ic_name = device_get_nameunit(sc->sc_dev);
640	/* XXX not right but it's not used anywhere important */
641	ic->ic_phytype = IEEE80211_T_OFDM;
642	ic->ic_opmode = IEEE80211_M_STA;
643	ic->ic_caps =
644		  IEEE80211_C_STA		/* station mode supported */
645		| IEEE80211_C_MONITOR		/* monitor mode */
646		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
647		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
648		| IEEE80211_C_SHSLOT		/* short slot time supported */
649		| IEEE80211_C_WME		/* WME/WMM supported */
650		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
651#if 0
652		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
653#endif
654		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
655		;
656
657	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
658
659	IEEE80211_ADDR_COPY(ic->ic_macaddr,
660	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
661	    siba_sprom_get_mac_80211a(sc->sc_dev) :
662	    siba_sprom_get_mac_80211bg(sc->sc_dev));
663
664	/* call MI attach routine. */
665	ieee80211_ifattach(ic);
666
667	ic->ic_headroom = sizeof(struct bwn_txhdr);
668
669	/* override default methods */
670	ic->ic_raw_xmit = bwn_raw_xmit;
671	ic->ic_updateslot = bwn_updateslot;
672	ic->ic_update_promisc = bwn_update_promisc;
673	ic->ic_wme.wme_update = bwn_wme_update;
674	ic->ic_scan_start = bwn_scan_start;
675	ic->ic_scan_end = bwn_scan_end;
676	ic->ic_set_channel = bwn_set_channel;
677	ic->ic_vap_create = bwn_vap_create;
678	ic->ic_vap_delete = bwn_vap_delete;
679	ic->ic_transmit = bwn_transmit;
680	ic->ic_parent = bwn_parent;
681
682	ieee80211_radiotap_attach(ic,
683	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
684	    BWN_TX_RADIOTAP_PRESENT,
685	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
686	    BWN_RX_RADIOTAP_PRESENT);
687
688	bwn_sysctl_node(sc);
689
690	if (bootverbose)
691		ieee80211_announce(ic);
692	return (0);
693}
694
695static void
696bwn_phy_detach(struct bwn_mac *mac)
697{
698
699	if (mac->mac_phy.detach != NULL)
700		mac->mac_phy.detach(mac);
701}
702
703static int
704bwn_detach(device_t dev)
705{
706	struct bwn_softc *sc = device_get_softc(dev);
707	struct bwn_mac *mac = sc->sc_curmac;
708	struct ieee80211com *ic = &sc->sc_ic;
709	int i;
710
711	sc->sc_flags |= BWN_FLAG_INVALID;
712
713	if (device_is_attached(sc->sc_dev)) {
714		BWN_LOCK(sc);
715		bwn_stop(sc);
716		BWN_UNLOCK(sc);
717		bwn_dma_free(mac);
718		callout_drain(&sc->sc_led_blink_ch);
719		callout_drain(&sc->sc_rfswitch_ch);
720		callout_drain(&sc->sc_task_ch);
721		callout_drain(&sc->sc_watchdog_ch);
722		bwn_phy_detach(mac);
723		ieee80211_draintask(ic, &mac->mac_hwreset);
724		ieee80211_draintask(ic, &mac->mac_txpower);
725		ieee80211_ifdetach(ic);
726	}
727	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
728	taskqueue_free(sc->sc_tq);
729
730	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
731		if (mac->mac_intrhand[i] != NULL) {
732			bus_teardown_intr(dev, mac->mac_res_irq[i],
733			    mac->mac_intrhand[i]);
734			mac->mac_intrhand[i] = NULL;
735		}
736	}
737	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
738	if (mac->mac_msi != 0)
739		pci_release_msi(dev);
740	mbufq_drain(&sc->sc_snd);
741	BWN_LOCK_DESTROY(sc);
742	return (0);
743}
744
745static void
746bwn_attach_pre(struct bwn_softc *sc)
747{
748
749	BWN_LOCK_INIT(sc);
750	TAILQ_INIT(&sc->sc_maclist);
751	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
752	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
753	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
754	mbufq_init(&sc->sc_snd, ifqmaxlen);
755	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
756		taskqueue_thread_enqueue, &sc->sc_tq);
757	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
758		"%s taskq", device_get_nameunit(sc->sc_dev));
759}
760
761static void
762bwn_sprom_bugfixes(device_t dev)
763{
764#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
765	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
766	 (siba_get_pci_device(dev) == _device) &&			\
767	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
768	 (siba_get_pci_subdevice(dev) == _subdevice))
769
770	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
771	    siba_get_pci_subdevice(dev) == 0x4e &&
772	    siba_get_pci_revid(dev) > 0x40)
773		siba_sprom_set_bf_lo(dev,
774		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
775	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
776	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
777		siba_sprom_set_bf_lo(dev,
778		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
779	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
780		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
781		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
782		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
783		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
784		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
785		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
786		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
787			siba_sprom_set_bf_lo(dev,
788			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
789	}
790#undef	BWN_ISDEV
791}
792
793static void
794bwn_parent(struct ieee80211com *ic)
795{
796	struct bwn_softc *sc = ic->ic_softc;
797	int startall = 0;
798
799	BWN_LOCK(sc);
800	if (ic->ic_nrunning > 0) {
801		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
802			bwn_init(sc);
803			startall = 1;
804		} else
805			bwn_update_promisc(ic);
806	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
807		bwn_stop(sc);
808	BWN_UNLOCK(sc);
809
810	if (startall)
811		ieee80211_start_all(ic);
812}
813
814static int
815bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
816{
817	struct bwn_softc *sc = ic->ic_softc;
818	int error;
819
820	BWN_LOCK(sc);
821	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
822		BWN_UNLOCK(sc);
823		return (ENXIO);
824	}
825	error = mbufq_enqueue(&sc->sc_snd, m);
826	if (error) {
827		BWN_UNLOCK(sc);
828		return (error);
829	}
830	bwn_start(sc);
831	BWN_UNLOCK(sc);
832	return (0);
833}
834
835static void
836bwn_start(struct bwn_softc *sc)
837{
838	struct bwn_mac *mac = sc->sc_curmac;
839	struct ieee80211_frame *wh;
840	struct ieee80211_node *ni;
841	struct ieee80211_key *k;
842	struct mbuf *m;
843
844	BWN_ASSERT_LOCKED(sc);
845
846	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
847	    mac->mac_status < BWN_MAC_STATUS_STARTED)
848		return;
849
850	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
851		if (bwn_tx_isfull(sc, m))
852			break;
853		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
854		if (ni == NULL) {
855			device_printf(sc->sc_dev, "unexpected NULL ni\n");
856			m_freem(m);
857			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
858			continue;
859		}
860		wh = mtod(m, struct ieee80211_frame *);
861		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
862			k = ieee80211_crypto_encap(ni, m);
863			if (k == NULL) {
864				if_inc_counter(ni->ni_vap->iv_ifp,
865				    IFCOUNTER_OERRORS, 1);
866				ieee80211_free_node(ni);
867				m_freem(m);
868				continue;
869			}
870		}
871		wh = NULL;	/* Catch any invalid use */
872		if (bwn_tx_start(sc, ni, m) != 0) {
873			if (ni != NULL) {
874				if_inc_counter(ni->ni_vap->iv_ifp,
875				    IFCOUNTER_OERRORS, 1);
876				ieee80211_free_node(ni);
877			}
878			continue;
879		}
880		sc->sc_watchdog_timer = 5;
881	}
882}
883
884static int
885bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
886{
887	struct bwn_dma_ring *dr;
888	struct bwn_mac *mac = sc->sc_curmac;
889	struct bwn_pio_txqueue *tq;
890	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
891
892	BWN_ASSERT_LOCKED(sc);
893
894	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
895		dr = bwn_dma_select(mac, M_WME_GETAC(m));
896		if (dr->dr_stop == 1 ||
897		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
898			dr->dr_stop = 1;
899			goto full;
900		}
901	} else {
902		tq = bwn_pio_select(mac, M_WME_GETAC(m));
903		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
904		    pktlen > (tq->tq_size - tq->tq_used))
905			goto full;
906	}
907	return (0);
908full:
909	mbufq_prepend(&sc->sc_snd, m);
910	return (1);
911}
912
913static int
914bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
915{
916	struct bwn_mac *mac = sc->sc_curmac;
917	int error;
918
919	BWN_ASSERT_LOCKED(sc);
920
921	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
922		m_freem(m);
923		return (ENXIO);
924	}
925
926	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
927	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
928	if (error) {
929		m_freem(m);
930		return (error);
931	}
932	return (0);
933}
934
935static int
936bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
937{
938	struct bwn_pio_txpkt *tp;
939	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
940	struct bwn_softc *sc = mac->mac_sc;
941	struct bwn_txhdr txhdr;
942	struct mbuf *m_new;
943	uint32_t ctl32;
944	int error;
945	uint16_t ctl16;
946
947	BWN_ASSERT_LOCKED(sc);
948
949	/* XXX TODO send packets after DTIM */
950
951	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
952	tp = TAILQ_FIRST(&tq->tq_pktlist);
953	tp->tp_ni = ni;
954	tp->tp_m = m;
955
956	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
957	if (error) {
958		device_printf(sc->sc_dev, "tx fail\n");
959		return (error);
960	}
961
962	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
963	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
964	tq->tq_free--;
965
966	if (siba_get_revid(sc->sc_dev) >= 8) {
967		/*
968		 * XXX please removes m_defrag(9)
969		 */
970		m_new = m_defrag(m, M_NOWAIT);
971		if (m_new == NULL) {
972			device_printf(sc->sc_dev,
973			    "%s: can't defrag TX buffer\n",
974			    __func__);
975			return (ENOBUFS);
976		}
977		if (m_new->m_next != NULL)
978			device_printf(sc->sc_dev,
979			    "TODO: fragmented packets for PIO\n");
980		tp->tp_m = m_new;
981
982		/* send HEADER */
983		ctl32 = bwn_pio_write_multi_4(mac, tq,
984		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
985			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
986		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
987		/* send BODY */
988		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
989		    mtod(m_new, const void *), m_new->m_pkthdr.len);
990		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
991		    ctl32 | BWN_PIO8_TXCTL_EOF);
992	} else {
993		ctl16 = bwn_pio_write_multi_2(mac, tq,
994		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
995			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
996		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
997		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
998		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
999		    ctl16 | BWN_PIO_TXCTL_EOF);
1000	}
1001
1002	return (0);
1003}
1004
1005static struct bwn_pio_txqueue *
1006bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1007{
1008
1009	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1010		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1011
1012	switch (prio) {
1013	case 0:
1014		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1015	case 1:
1016		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1017	case 2:
1018		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1019	case 3:
1020		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1021	}
1022	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1023	return (NULL);
1024}
1025
1026static int
1027bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1028{
1029#define	BWN_GET_TXHDRCACHE(slot)					\
1030	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1031	struct bwn_dma *dma = &mac->mac_method.dma;
1032	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1033	struct bwn_dmadesc_generic *desc;
1034	struct bwn_dmadesc_meta *mt;
1035	struct bwn_softc *sc = mac->mac_sc;
1036	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1037	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1038
1039	BWN_ASSERT_LOCKED(sc);
1040	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1041
1042	/* XXX send after DTIM */
1043
1044	slot = bwn_dma_getslot(dr);
1045	dr->getdesc(dr, slot, &desc, &mt);
1046	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1047	    ("%s:%d: fail", __func__, __LINE__));
1048
1049	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1050	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1051	    BWN_DMA_COOKIE(dr, slot));
1052	if (error)
1053		goto fail;
1054	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1055	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1056	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1057	if (error) {
1058		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1059		    __func__, error);
1060		goto fail;
1061	}
1062	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1063	    BUS_DMASYNC_PREWRITE);
1064	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1065	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1066	    BUS_DMASYNC_PREWRITE);
1067
1068	slot = bwn_dma_getslot(dr);
1069	dr->getdesc(dr, slot, &desc, &mt);
1070	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1071	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1072	mt->mt_m = m;
1073	mt->mt_ni = ni;
1074
1075	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1076	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1077	if (error && error != EFBIG) {
1078		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1079		    __func__, error);
1080		goto fail;
1081	}
1082	if (error) {    /* error == EFBIG */
1083		struct mbuf *m_new;
1084
1085		m_new = m_defrag(m, M_NOWAIT);
1086		if (m_new == NULL) {
1087			device_printf(sc->sc_dev,
1088			    "%s: can't defrag TX buffer\n",
1089			    __func__);
1090			error = ENOBUFS;
1091			goto fail;
1092		} else {
1093			m = m_new;
1094		}
1095
1096		mt->mt_m = m;
1097		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1098		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1099		if (error) {
1100			device_printf(sc->sc_dev,
1101			    "%s: can't load TX buffer (2) %d\n",
1102			    __func__, error);
1103			goto fail;
1104		}
1105	}
1106	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1107	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1108	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1109	    BUS_DMASYNC_PREWRITE);
1110
1111	/* XXX send after DTIM */
1112
1113	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1114	return (0);
1115fail:
1116	dr->dr_curslot = backup[0];
1117	dr->dr_usedslot = backup[1];
1118	return (error);
1119#undef BWN_GET_TXHDRCACHE
1120}
1121
1122static void
1123bwn_watchdog(void *arg)
1124{
1125	struct bwn_softc *sc = arg;
1126
1127	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1128		device_printf(sc->sc_dev, "device timeout\n");
1129		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1130	}
1131	callout_schedule(&sc->sc_watchdog_ch, hz);
1132}
1133
1134static int
1135bwn_attach_core(struct bwn_mac *mac)
1136{
1137	struct bwn_softc *sc = mac->mac_sc;
1138	int error, have_bg = 0, have_a = 0;
1139	uint32_t high;
1140
1141	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1142	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1143
1144	siba_powerup(sc->sc_dev, 0);
1145
1146	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1147	bwn_reset_core(mac, !!(high & BWN_TGSHIGH_HAVE_2GHZ));
1148	error = bwn_phy_getinfo(mac, high);
1149	if (error)
1150		goto fail;
1151
1152	/* XXX need bhnd */
1153	if (bwn_is_bus_siba(mac)) {
1154		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1155		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1156	} else {
1157		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1158		error = ENXIO;
1159		goto fail;
1160	}
1161
1162#if 0
1163	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1164	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1165	    __func__,
1166	    high,
1167	    have_a,
1168	    have_bg,
1169	    siba_get_pci_device(sc->sc_dev),
1170	    siba_get_chipid(sc->sc_dev));
1171#endif
1172
1173	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1174	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1175	    siba_get_pci_device(sc->sc_dev) != 0x4324) {
1176		have_a = have_bg = 0;
1177		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1178			have_a = 1;
1179		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1180		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1181		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1182			have_bg = 1;
1183		else
1184			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1185			    mac->mac_phy.type));
1186	}
1187	/* XXX turns off PHY A because it's not supported */
1188	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1189	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1190		have_a = 0;
1191		have_bg = 1;
1192	}
1193
1194	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1195		mac->mac_phy.attach = bwn_phy_g_attach;
1196		mac->mac_phy.detach = bwn_phy_g_detach;
1197		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1198		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1199		mac->mac_phy.init = bwn_phy_g_init;
1200		mac->mac_phy.exit = bwn_phy_g_exit;
1201		mac->mac_phy.phy_read = bwn_phy_g_read;
1202		mac->mac_phy.phy_write = bwn_phy_g_write;
1203		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1204		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1205		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1206		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1207		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1208		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1209		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1210		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1211		mac->mac_phy.set_im = bwn_phy_g_im;
1212		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1213		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1214		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1215		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1216	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1217		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1218		mac->mac_phy.init = bwn_phy_lp_init;
1219		mac->mac_phy.phy_read = bwn_phy_lp_read;
1220		mac->mac_phy.phy_write = bwn_phy_lp_write;
1221		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1222		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1223		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1224		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1225		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1226		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1227		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1228		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1229		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1230	} else {
1231		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1232		    mac->mac_phy.type);
1233		error = ENXIO;
1234		goto fail;
1235	}
1236
1237	mac->mac_phy.gmode = have_bg;
1238	if (mac->mac_phy.attach != NULL) {
1239		error = mac->mac_phy.attach(mac);
1240		if (error) {
1241			device_printf(sc->sc_dev, "failed\n");
1242			goto fail;
1243		}
1244	}
1245
1246	bwn_reset_core(mac, have_bg);
1247
1248	error = bwn_chiptest(mac);
1249	if (error)
1250		goto fail;
1251	error = bwn_setup_channels(mac, have_bg, have_a);
1252	if (error) {
1253		device_printf(sc->sc_dev, "failed to setup channels\n");
1254		goto fail;
1255	}
1256
1257	if (sc->sc_curmac == NULL)
1258		sc->sc_curmac = mac;
1259
1260	error = bwn_dma_attach(mac);
1261	if (error != 0) {
1262		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1263		goto fail;
1264	}
1265
1266	mac->mac_phy.switch_analog(mac, 0);
1267
1268	siba_dev_down(sc->sc_dev, 0);
1269fail:
1270	siba_powerdown(sc->sc_dev);
1271	return (error);
1272}
1273
1274/*
1275 * Reset - SIBA.
1276 *
1277 * XXX TODO: implement BCMA version!
1278 */
1279void
1280bwn_reset_core(struct bwn_mac *mac, int g_mode)
1281{
1282	struct bwn_softc *sc = mac->mac_sc;
1283	uint32_t low, ctl;
1284	uint32_t flags = 0;
1285
1286	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1287
1288	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1289	if (g_mode)
1290		flags |= BWN_TGSLOW_SUPPORT_G;
1291
1292	/* XXX N-PHY only; and hard-code to 20MHz for now */
1293	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1294		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1295
1296	siba_dev_up(sc->sc_dev, flags);
1297	DELAY(2000);
1298
1299	/* Take PHY out of reset */
1300	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1301	    ~BWN_TGSLOW_PHYRESET;
1302	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1303	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1304	DELAY(1000);
1305	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1306	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1307	DELAY(1000);
1308
1309	if (mac->mac_phy.switch_analog != NULL)
1310		mac->mac_phy.switch_analog(mac, 1);
1311
1312	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1313	if (g_mode)
1314		ctl |= BWN_MACCTL_GMODE;
1315	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1316}
1317
1318static int
1319bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1320{
1321	struct bwn_phy *phy = &mac->mac_phy;
1322	struct bwn_softc *sc = mac->mac_sc;
1323	uint32_t tmp;
1324
1325	/* PHY */
1326	tmp = BWN_READ_2(mac, BWN_PHYVER);
1327	phy->gmode = !! (tgshigh & BWN_TGSHIGH_HAVE_2GHZ);
1328	phy->rf_on = 1;
1329	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1330	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1331	phy->rev = (tmp & BWN_PHYVER_VERSION);
1332	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1333	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1334		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1335	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1336	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1337	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1338		goto unsupphy;
1339
1340	/* RADIO */
1341	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1342		if (siba_get_chiprev(sc->sc_dev) == 0)
1343			tmp = 0x3205017f;
1344		else if (siba_get_chiprev(sc->sc_dev) == 1)
1345			tmp = 0x4205017f;
1346		else
1347			tmp = 0x5205017f;
1348	} else {
1349		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1350		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1351		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1352		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1353	}
1354	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1355	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1356	phy->rf_manuf = (tmp & 0x00000fff);
1357
1358	/*
1359	 * For now, just always do full init (ie, what bwn has traditionally
1360	 * done)
1361	 */
1362	phy->phy_do_full_init = 1;
1363
1364	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1365		goto unsupradio;
1366	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1367	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1368	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1369	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1370	    (phy->type == BWN_PHYTYPE_N &&
1371	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1372	    (phy->type == BWN_PHYTYPE_LP &&
1373	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1374		goto unsupradio;
1375
1376	return (0);
1377unsupphy:
1378	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1379	    "analog %#x)\n",
1380	    phy->type, phy->rev, phy->analog);
1381	return (ENXIO);
1382unsupradio:
1383	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1384	    "rev %#x)\n",
1385	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1386	return (ENXIO);
1387}
1388
1389static int
1390bwn_chiptest(struct bwn_mac *mac)
1391{
1392#define	TESTVAL0	0x55aaaa55
1393#define	TESTVAL1	0xaa5555aa
1394	struct bwn_softc *sc = mac->mac_sc;
1395	uint32_t v, backup;
1396
1397	BWN_LOCK(sc);
1398
1399	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1400
1401	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1402	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1403		goto error;
1404	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1405	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1406		goto error;
1407
1408	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1409
1410	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1411	    (siba_get_revid(sc->sc_dev) <= 10)) {
1412		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1413		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1414		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1415			goto error;
1416		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1417			goto error;
1418	}
1419	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1420
1421	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1422	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1423		goto error;
1424
1425	BWN_UNLOCK(sc);
1426	return (0);
1427error:
1428	BWN_UNLOCK(sc);
1429	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1430	return (ENODEV);
1431}
1432
1433#define	IEEE80211_CHAN_HTG	(IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1434#define	IEEE80211_CHAN_HTA	(IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1435
1436static int
1437bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1438{
1439	struct bwn_softc *sc = mac->mac_sc;
1440	struct ieee80211com *ic = &sc->sc_ic;
1441
1442	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1443	ic->ic_nchans = 0;
1444
1445	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1446	    __func__,
1447	    have_bg,
1448	    have_a);
1449
1450	if (have_bg)
1451		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1452		    &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1453	if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1454		if (have_a)
1455			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1456			    &ic->ic_nchans, &bwn_chantable_n,
1457			    IEEE80211_CHAN_HTA);
1458	} else {
1459		if (have_a)
1460			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1461			    &ic->ic_nchans, &bwn_chantable_a,
1462			    IEEE80211_CHAN_A);
1463	}
1464
1465	mac->mac_phy.supports_2ghz = have_bg;
1466	mac->mac_phy.supports_5ghz = have_a;
1467
1468	return (ic->ic_nchans == 0 ? ENXIO : 0);
1469}
1470
1471uint32_t
1472bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1473{
1474	uint32_t ret;
1475
1476	BWN_ASSERT_LOCKED(mac->mac_sc);
1477
1478	if (way == BWN_SHARED) {
1479		KASSERT((offset & 0x0001) == 0,
1480		    ("%s:%d warn", __func__, __LINE__));
1481		if (offset & 0x0003) {
1482			bwn_shm_ctlword(mac, way, offset >> 2);
1483			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1484			ret <<= 16;
1485			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1486			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1487			goto out;
1488		}
1489		offset >>= 2;
1490	}
1491	bwn_shm_ctlword(mac, way, offset);
1492	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1493out:
1494	return (ret);
1495}
1496
1497uint16_t
1498bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1499{
1500	uint16_t ret;
1501
1502	BWN_ASSERT_LOCKED(mac->mac_sc);
1503
1504	if (way == BWN_SHARED) {
1505		KASSERT((offset & 0x0001) == 0,
1506		    ("%s:%d warn", __func__, __LINE__));
1507		if (offset & 0x0003) {
1508			bwn_shm_ctlword(mac, way, offset >> 2);
1509			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1510			goto out;
1511		}
1512		offset >>= 2;
1513	}
1514	bwn_shm_ctlword(mac, way, offset);
1515	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1516out:
1517
1518	return (ret);
1519}
1520
1521static void
1522bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1523    uint16_t offset)
1524{
1525	uint32_t control;
1526
1527	control = way;
1528	control <<= 16;
1529	control |= offset;
1530	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1531}
1532
1533void
1534bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1535    uint32_t value)
1536{
1537	BWN_ASSERT_LOCKED(mac->mac_sc);
1538
1539	if (way == BWN_SHARED) {
1540		KASSERT((offset & 0x0001) == 0,
1541		    ("%s:%d warn", __func__, __LINE__));
1542		if (offset & 0x0003) {
1543			bwn_shm_ctlword(mac, way, offset >> 2);
1544			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1545				    (value >> 16) & 0xffff);
1546			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1547			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1548			return;
1549		}
1550		offset >>= 2;
1551	}
1552	bwn_shm_ctlword(mac, way, offset);
1553	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1554}
1555
1556void
1557bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1558    uint16_t value)
1559{
1560	BWN_ASSERT_LOCKED(mac->mac_sc);
1561
1562	if (way == BWN_SHARED) {
1563		KASSERT((offset & 0x0001) == 0,
1564		    ("%s:%d warn", __func__, __LINE__));
1565		if (offset & 0x0003) {
1566			bwn_shm_ctlword(mac, way, offset >> 2);
1567			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1568			return;
1569		}
1570		offset >>= 2;
1571	}
1572	bwn_shm_ctlword(mac, way, offset);
1573	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1574}
1575
1576static void
1577bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1578    int txpow)
1579{
1580
1581	c->ic_freq = freq;
1582	c->ic_flags = flags;
1583	c->ic_ieee = ieee;
1584	c->ic_minpower = 0;
1585	c->ic_maxpower = 2 * txpow;
1586	c->ic_maxregpower = txpow;
1587}
1588
1589static void
1590bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1591    const struct bwn_channelinfo *ci, int flags)
1592{
1593	struct ieee80211_channel *c;
1594	int i;
1595
1596	c = &chans[*nchans];
1597
1598	for (i = 0; i < ci->nchannels; i++) {
1599		const struct bwn_channel *hc;
1600
1601		hc = &ci->channels[i];
1602		if (*nchans >= maxchans)
1603			break;
1604		bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1605		c++, (*nchans)++;
1606		if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1607			/* g channel have a separate b-only entry */
1608			if (*nchans >= maxchans)
1609				break;
1610			c[0] = c[-1];
1611			c[-1].ic_flags = IEEE80211_CHAN_B;
1612			c++, (*nchans)++;
1613		}
1614		if (flags == IEEE80211_CHAN_HTG) {
1615			/* HT g channel have a separate g-only entry */
1616			if (*nchans >= maxchans)
1617				break;
1618			c[-1].ic_flags = IEEE80211_CHAN_G;
1619			c[0] = c[-1];
1620			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1621			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1622			c++, (*nchans)++;
1623		}
1624		if (flags == IEEE80211_CHAN_HTA) {
1625			/* HT a channel have a separate a-only entry */
1626			if (*nchans >= maxchans)
1627				break;
1628			c[-1].ic_flags = IEEE80211_CHAN_A;
1629			c[0] = c[-1];
1630			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1631			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1632			c++, (*nchans)++;
1633		}
1634	}
1635}
1636
1637static int
1638bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1639	const struct ieee80211_bpf_params *params)
1640{
1641	struct ieee80211com *ic = ni->ni_ic;
1642	struct bwn_softc *sc = ic->ic_softc;
1643	struct bwn_mac *mac = sc->sc_curmac;
1644	int error;
1645
1646	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1647	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1648		m_freem(m);
1649		return (ENETDOWN);
1650	}
1651
1652	BWN_LOCK(sc);
1653	if (bwn_tx_isfull(sc, m)) {
1654		m_freem(m);
1655		BWN_UNLOCK(sc);
1656		return (ENOBUFS);
1657	}
1658
1659	error = bwn_tx_start(sc, ni, m);
1660	if (error == 0)
1661		sc->sc_watchdog_timer = 5;
1662	BWN_UNLOCK(sc);
1663	return (error);
1664}
1665
1666/*
1667 * Callback from the 802.11 layer to update the slot time
1668 * based on the current setting.  We use it to notify the
1669 * firmware of ERP changes and the f/w takes care of things
1670 * like slot time and preamble.
1671 */
1672static void
1673bwn_updateslot(struct ieee80211com *ic)
1674{
1675	struct bwn_softc *sc = ic->ic_softc;
1676	struct bwn_mac *mac;
1677
1678	BWN_LOCK(sc);
1679	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1680		mac = (struct bwn_mac *)sc->sc_curmac;
1681		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1682	}
1683	BWN_UNLOCK(sc);
1684}
1685
1686/*
1687 * Callback from the 802.11 layer after a promiscuous mode change.
1688 * Note this interface does not check the operating mode as this
1689 * is an internal callback and we are expected to honor the current
1690 * state (e.g. this is used for setting the interface in promiscuous
1691 * mode when operating in hostap mode to do ACS).
1692 */
1693static void
1694bwn_update_promisc(struct ieee80211com *ic)
1695{
1696	struct bwn_softc *sc = ic->ic_softc;
1697	struct bwn_mac *mac = sc->sc_curmac;
1698
1699	BWN_LOCK(sc);
1700	mac = sc->sc_curmac;
1701	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1702		if (ic->ic_promisc > 0)
1703			sc->sc_filters |= BWN_MACCTL_PROMISC;
1704		else
1705			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1706		bwn_set_opmode(mac);
1707	}
1708	BWN_UNLOCK(sc);
1709}
1710
1711/*
1712 * Callback from the 802.11 layer to update WME parameters.
1713 */
1714static int
1715bwn_wme_update(struct ieee80211com *ic)
1716{
1717	struct bwn_softc *sc = ic->ic_softc;
1718	struct bwn_mac *mac = sc->sc_curmac;
1719	struct wmeParams *wmep;
1720	int i;
1721
1722	BWN_LOCK(sc);
1723	mac = sc->sc_curmac;
1724	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1725		bwn_mac_suspend(mac);
1726		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1727			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1728			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1729		}
1730		bwn_mac_enable(mac);
1731	}
1732	BWN_UNLOCK(sc);
1733	return (0);
1734}
1735
1736static void
1737bwn_scan_start(struct ieee80211com *ic)
1738{
1739	struct bwn_softc *sc = ic->ic_softc;
1740	struct bwn_mac *mac;
1741
1742	BWN_LOCK(sc);
1743	mac = sc->sc_curmac;
1744	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1745		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1746		bwn_set_opmode(mac);
1747		/* disable CFP update during scan */
1748		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1749	}
1750	BWN_UNLOCK(sc);
1751}
1752
1753static void
1754bwn_scan_end(struct ieee80211com *ic)
1755{
1756	struct bwn_softc *sc = ic->ic_softc;
1757	struct bwn_mac *mac;
1758
1759	BWN_LOCK(sc);
1760	mac = sc->sc_curmac;
1761	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1762		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1763		bwn_set_opmode(mac);
1764		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1765	}
1766	BWN_UNLOCK(sc);
1767}
1768
1769static void
1770bwn_set_channel(struct ieee80211com *ic)
1771{
1772	struct bwn_softc *sc = ic->ic_softc;
1773	struct bwn_mac *mac = sc->sc_curmac;
1774	struct bwn_phy *phy = &mac->mac_phy;
1775	int chan, error;
1776
1777	BWN_LOCK(sc);
1778
1779	error = bwn_switch_band(sc, ic->ic_curchan);
1780	if (error)
1781		goto fail;
1782	bwn_mac_suspend(mac);
1783	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1784	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1785	if (chan != phy->chan)
1786		bwn_switch_channel(mac, chan);
1787
1788	/* TX power level */
1789	if (ic->ic_curchan->ic_maxpower != 0 &&
1790	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1791		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1792		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1793		    BWN_TXPWR_IGNORE_TSSI);
1794	}
1795
1796	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1797	if (phy->set_antenna)
1798		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1799
1800	if (sc->sc_rf_enabled != phy->rf_on) {
1801		if (sc->sc_rf_enabled) {
1802			bwn_rf_turnon(mac);
1803			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1804				device_printf(sc->sc_dev,
1805				    "please turn on the RF switch\n");
1806		} else
1807			bwn_rf_turnoff(mac);
1808	}
1809
1810	bwn_mac_enable(mac);
1811
1812fail:
1813	/*
1814	 * Setup radio tap channel freq and flags
1815	 */
1816	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1817		htole16(ic->ic_curchan->ic_freq);
1818	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1819		htole16(ic->ic_curchan->ic_flags & 0xffff);
1820
1821	BWN_UNLOCK(sc);
1822}
1823
1824static struct ieee80211vap *
1825bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1826    enum ieee80211_opmode opmode, int flags,
1827    const uint8_t bssid[IEEE80211_ADDR_LEN],
1828    const uint8_t mac[IEEE80211_ADDR_LEN])
1829{
1830	struct ieee80211vap *vap;
1831	struct bwn_vap *bvp;
1832
1833	switch (opmode) {
1834	case IEEE80211_M_HOSTAP:
1835	case IEEE80211_M_MBSS:
1836	case IEEE80211_M_STA:
1837	case IEEE80211_M_WDS:
1838	case IEEE80211_M_MONITOR:
1839	case IEEE80211_M_IBSS:
1840	case IEEE80211_M_AHDEMO:
1841		break;
1842	default:
1843		return (NULL);
1844	}
1845
1846	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1847	vap = &bvp->bv_vap;
1848	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1849	/* override with driver methods */
1850	bvp->bv_newstate = vap->iv_newstate;
1851	vap->iv_newstate = bwn_newstate;
1852
1853	/* override max aid so sta's cannot assoc when we're out of sta id's */
1854	vap->iv_max_aid = BWN_STAID_MAX;
1855
1856	ieee80211_ratectl_init(vap);
1857
1858	/* complete setup */
1859	ieee80211_vap_attach(vap, ieee80211_media_change,
1860	    ieee80211_media_status, mac);
1861	return (vap);
1862}
1863
1864static void
1865bwn_vap_delete(struct ieee80211vap *vap)
1866{
1867	struct bwn_vap *bvp = BWN_VAP(vap);
1868
1869	ieee80211_ratectl_deinit(vap);
1870	ieee80211_vap_detach(vap);
1871	free(bvp, M_80211_VAP);
1872}
1873
1874static int
1875bwn_init(struct bwn_softc *sc)
1876{
1877	struct bwn_mac *mac;
1878	int error;
1879
1880	BWN_ASSERT_LOCKED(sc);
1881
1882	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1883	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1884	sc->sc_filters = 0;
1885	bwn_wme_clear(sc);
1886	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1887	sc->sc_rf_enabled = 1;
1888
1889	mac = sc->sc_curmac;
1890	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1891		error = bwn_core_init(mac);
1892		if (error != 0)
1893			return (error);
1894	}
1895	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1896		bwn_core_start(mac);
1897
1898	bwn_set_opmode(mac);
1899	bwn_set_pretbtt(mac);
1900	bwn_spu_setdelay(mac, 0);
1901	bwn_set_macaddr(mac);
1902
1903	sc->sc_flags |= BWN_FLAG_RUNNING;
1904	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1905	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1906
1907	return (0);
1908}
1909
1910static void
1911bwn_stop(struct bwn_softc *sc)
1912{
1913	struct bwn_mac *mac = sc->sc_curmac;
1914
1915	BWN_ASSERT_LOCKED(sc);
1916
1917	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1918		/* XXX FIXME opmode not based on VAP */
1919		bwn_set_opmode(mac);
1920		bwn_set_macaddr(mac);
1921	}
1922
1923	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1924		bwn_core_stop(mac);
1925
1926	callout_stop(&sc->sc_led_blink_ch);
1927	sc->sc_led_blinking = 0;
1928
1929	bwn_core_exit(mac);
1930	sc->sc_rf_enabled = 0;
1931
1932	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1933}
1934
1935static void
1936bwn_wme_clear(struct bwn_softc *sc)
1937{
1938#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1939	struct wmeParams *p;
1940	unsigned int i;
1941
1942	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1943	    ("%s:%d: fail", __func__, __LINE__));
1944
1945	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1946		p = &(sc->sc_wmeParams[i]);
1947
1948		switch (bwn_wme_shm_offsets[i]) {
1949		case BWN_WME_VOICE:
1950			p->wmep_txopLimit = 0;
1951			p->wmep_aifsn = 2;
1952			/* XXX FIXME: log2(cwmin) */
1953			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1954			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1955			break;
1956		case BWN_WME_VIDEO:
1957			p->wmep_txopLimit = 0;
1958			p->wmep_aifsn = 2;
1959			/* XXX FIXME: log2(cwmin) */
1960			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1961			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1962			break;
1963		case BWN_WME_BESTEFFORT:
1964			p->wmep_txopLimit = 0;
1965			p->wmep_aifsn = 3;
1966			/* XXX FIXME: log2(cwmin) */
1967			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1968			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1969			break;
1970		case BWN_WME_BACKGROUND:
1971			p->wmep_txopLimit = 0;
1972			p->wmep_aifsn = 7;
1973			/* XXX FIXME: log2(cwmin) */
1974			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1975			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1976			break;
1977		default:
1978			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1979		}
1980	}
1981}
1982
1983static int
1984bwn_core_init(struct bwn_mac *mac)
1985{
1986	struct bwn_softc *sc = mac->mac_sc;
1987	uint64_t hf;
1988	int error;
1989
1990	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
1991	    ("%s:%d: fail", __func__, __LINE__));
1992
1993	siba_powerup(sc->sc_dev, 0);
1994	if (!siba_dev_isup(sc->sc_dev))
1995		bwn_reset_core(mac, mac->mac_phy.gmode);
1996
1997	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
1998	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
1999	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2000	BWN_GETTIME(mac->mac_phy.nexttime);
2001	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2002	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2003	mac->mac_stats.link_noise = -95;
2004	mac->mac_reason_intr = 0;
2005	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2006	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2007#ifdef BWN_DEBUG
2008	if (sc->sc_debug & BWN_DEBUG_XMIT)
2009		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2010#endif
2011	mac->mac_suspended = 1;
2012	mac->mac_task_state = 0;
2013	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2014
2015	mac->mac_phy.init_pre(mac);
2016
2017	siba_pcicore_intr(sc->sc_dev);
2018
2019	siba_fix_imcfglobug(sc->sc_dev);
2020	bwn_bt_disable(mac);
2021	if (mac->mac_phy.prepare_hw) {
2022		error = mac->mac_phy.prepare_hw(mac);
2023		if (error)
2024			goto fail0;
2025	}
2026	error = bwn_chip_init(mac);
2027	if (error)
2028		goto fail0;
2029	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2030	    siba_get_revid(sc->sc_dev));
2031	hf = bwn_hf_read(mac);
2032	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2033		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2034		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2035			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2036		if (mac->mac_phy.rev == 1)
2037			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2038	}
2039	if (mac->mac_phy.rf_ver == 0x2050) {
2040		if (mac->mac_phy.rf_rev < 6)
2041			hf |= BWN_HF_FORCE_VCO_RECALC;
2042		if (mac->mac_phy.rf_rev == 6)
2043			hf |= BWN_HF_4318_TSSI;
2044	}
2045	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2046		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2047	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2048	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2049		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2050	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2051	bwn_hf_write(mac, hf);
2052
2053	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2054	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2055	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2056	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2057
2058	bwn_rate_init(mac);
2059	bwn_set_phytxctl(mac);
2060
2061	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2062	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2063	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2064
2065	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2066		bwn_pio_init(mac);
2067	else
2068		bwn_dma_init(mac);
2069	bwn_wme_init(mac);
2070	bwn_spu_setdelay(mac, 1);
2071	bwn_bt_enable(mac);
2072
2073	siba_powerup(sc->sc_dev,
2074	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2075	bwn_set_macaddr(mac);
2076	bwn_crypt_init(mac);
2077
2078	/* XXX LED initializatin */
2079
2080	mac->mac_status = BWN_MAC_STATUS_INITED;
2081
2082	return (error);
2083
2084fail0:
2085	siba_powerdown(sc->sc_dev);
2086	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2087	    ("%s:%d: fail", __func__, __LINE__));
2088	return (error);
2089}
2090
2091static void
2092bwn_core_start(struct bwn_mac *mac)
2093{
2094	struct bwn_softc *sc = mac->mac_sc;
2095	uint32_t tmp;
2096
2097	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2098	    ("%s:%d: fail", __func__, __LINE__));
2099
2100	if (siba_get_revid(sc->sc_dev) < 5)
2101		return;
2102
2103	while (1) {
2104		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2105		if (!(tmp & 0x00000001))
2106			break;
2107		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2108	}
2109
2110	bwn_mac_enable(mac);
2111	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2112	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2113
2114	mac->mac_status = BWN_MAC_STATUS_STARTED;
2115}
2116
2117static void
2118bwn_core_exit(struct bwn_mac *mac)
2119{
2120	struct bwn_softc *sc = mac->mac_sc;
2121	uint32_t macctl;
2122
2123	BWN_ASSERT_LOCKED(mac->mac_sc);
2124
2125	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2126	    ("%s:%d: fail", __func__, __LINE__));
2127
2128	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2129		return;
2130	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2131
2132	macctl = BWN_READ_4(mac, BWN_MACCTL);
2133	macctl &= ~BWN_MACCTL_MCODE_RUN;
2134	macctl |= BWN_MACCTL_MCODE_JMP0;
2135	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2136
2137	bwn_dma_stop(mac);
2138	bwn_pio_stop(mac);
2139	bwn_chip_exit(mac);
2140	mac->mac_phy.switch_analog(mac, 0);
2141	siba_dev_down(sc->sc_dev, 0);
2142	siba_powerdown(sc->sc_dev);
2143}
2144
2145static void
2146bwn_bt_disable(struct bwn_mac *mac)
2147{
2148	struct bwn_softc *sc = mac->mac_sc;
2149
2150	(void)sc;
2151	/* XXX do nothing yet */
2152}
2153
2154static int
2155bwn_chip_init(struct bwn_mac *mac)
2156{
2157	struct bwn_softc *sc = mac->mac_sc;
2158	struct bwn_phy *phy = &mac->mac_phy;
2159	uint32_t macctl;
2160	int error;
2161
2162	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2163	if (phy->gmode)
2164		macctl |= BWN_MACCTL_GMODE;
2165	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2166
2167	error = bwn_fw_fillinfo(mac);
2168	if (error)
2169		return (error);
2170	error = bwn_fw_loaducode(mac);
2171	if (error)
2172		return (error);
2173
2174	error = bwn_gpio_init(mac);
2175	if (error)
2176		return (error);
2177
2178	error = bwn_fw_loadinitvals(mac);
2179	if (error) {
2180		siba_gpio_set(sc->sc_dev, 0);
2181		return (error);
2182	}
2183	phy->switch_analog(mac, 1);
2184	error = bwn_phy_init(mac);
2185	if (error) {
2186		siba_gpio_set(sc->sc_dev, 0);
2187		return (error);
2188	}
2189	if (phy->set_im)
2190		phy->set_im(mac, BWN_IMMODE_NONE);
2191	if (phy->set_antenna)
2192		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2193	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2194
2195	if (phy->type == BWN_PHYTYPE_B)
2196		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2197	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2198	if (siba_get_revid(sc->sc_dev) < 5)
2199		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2200
2201	BWN_WRITE_4(mac, BWN_MACCTL,
2202	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2203	BWN_WRITE_4(mac, BWN_MACCTL,
2204	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2205	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2206
2207	bwn_set_opmode(mac);
2208	if (siba_get_revid(sc->sc_dev) < 3) {
2209		BWN_WRITE_2(mac, 0x060e, 0x0000);
2210		BWN_WRITE_2(mac, 0x0610, 0x8000);
2211		BWN_WRITE_2(mac, 0x0604, 0x0000);
2212		BWN_WRITE_2(mac, 0x0606, 0x0200);
2213	} else {
2214		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2215		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2216	}
2217	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2218	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2219	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2220	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2221	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2222	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2223	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2224
2225	bwn_mac_phy_clock_set(mac, true);
2226
2227	/* SIBA powerup */
2228	/* XXX TODO: BCMA powerup */
2229	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2230	return (error);
2231}
2232
2233/* read hostflags */
2234uint64_t
2235bwn_hf_read(struct bwn_mac *mac)
2236{
2237	uint64_t ret;
2238
2239	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2240	ret <<= 16;
2241	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2242	ret <<= 16;
2243	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2244	return (ret);
2245}
2246
2247void
2248bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2249{
2250
2251	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2252	    (value & 0x00000000ffffull));
2253	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2254	    (value & 0x0000ffff0000ull) >> 16);
2255	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2256	    (value & 0xffff00000000ULL) >> 32);
2257}
2258
2259static void
2260bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2261{
2262
2263	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2264	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2265}
2266
2267static void
2268bwn_rate_init(struct bwn_mac *mac)
2269{
2270
2271	switch (mac->mac_phy.type) {
2272	case BWN_PHYTYPE_A:
2273	case BWN_PHYTYPE_G:
2274	case BWN_PHYTYPE_LP:
2275	case BWN_PHYTYPE_N:
2276		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2277		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2278		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2279		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2280		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2281		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2282		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2283		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2284			break;
2285		/* FALLTHROUGH */
2286	case BWN_PHYTYPE_B:
2287		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2288		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2289		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2290		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2291		break;
2292	default:
2293		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2294	}
2295}
2296
2297static void
2298bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2299{
2300	uint16_t offset;
2301
2302	if (ofdm) {
2303		offset = 0x480;
2304		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2305	} else {
2306		offset = 0x4c0;
2307		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2308	}
2309	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2310	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2311}
2312
2313static uint8_t
2314bwn_plcp_getcck(const uint8_t bitrate)
2315{
2316
2317	switch (bitrate) {
2318	case BWN_CCK_RATE_1MB:
2319		return (0x0a);
2320	case BWN_CCK_RATE_2MB:
2321		return (0x14);
2322	case BWN_CCK_RATE_5MB:
2323		return (0x37);
2324	case BWN_CCK_RATE_11MB:
2325		return (0x6e);
2326	}
2327	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2328	return (0);
2329}
2330
2331static uint8_t
2332bwn_plcp_getofdm(const uint8_t bitrate)
2333{
2334
2335	switch (bitrate) {
2336	case BWN_OFDM_RATE_6MB:
2337		return (0xb);
2338	case BWN_OFDM_RATE_9MB:
2339		return (0xf);
2340	case BWN_OFDM_RATE_12MB:
2341		return (0xa);
2342	case BWN_OFDM_RATE_18MB:
2343		return (0xe);
2344	case BWN_OFDM_RATE_24MB:
2345		return (0x9);
2346	case BWN_OFDM_RATE_36MB:
2347		return (0xd);
2348	case BWN_OFDM_RATE_48MB:
2349		return (0x8);
2350	case BWN_OFDM_RATE_54MB:
2351		return (0xc);
2352	}
2353	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2354	return (0);
2355}
2356
2357static void
2358bwn_set_phytxctl(struct bwn_mac *mac)
2359{
2360	uint16_t ctl;
2361
2362	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2363	    BWN_TX_PHY_TXPWR);
2364	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2365	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2366	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2367}
2368
2369static void
2370bwn_pio_init(struct bwn_mac *mac)
2371{
2372	struct bwn_pio *pio = &mac->mac_method.pio;
2373
2374	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2375	    & ~BWN_MACCTL_BIGENDIAN);
2376	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2377
2378	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2379	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2380	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2381	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2382	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2383	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2384}
2385
2386static void
2387bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2388    int index)
2389{
2390	struct bwn_pio_txpkt *tp;
2391	struct bwn_softc *sc = mac->mac_sc;
2392	unsigned int i;
2393
2394	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2395	tq->tq_index = index;
2396
2397	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2398	if (siba_get_revid(sc->sc_dev) >= 8)
2399		tq->tq_size = 1920;
2400	else {
2401		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2402		tq->tq_size -= 80;
2403	}
2404
2405	TAILQ_INIT(&tq->tq_pktlist);
2406	for (i = 0; i < N(tq->tq_pkts); i++) {
2407		tp = &(tq->tq_pkts[i]);
2408		tp->tp_index = i;
2409		tp->tp_queue = tq;
2410		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2411	}
2412}
2413
2414static uint16_t
2415bwn_pio_idx2base(struct bwn_mac *mac, int index)
2416{
2417	struct bwn_softc *sc = mac->mac_sc;
2418	static const uint16_t bases[] = {
2419		BWN_PIO_BASE0,
2420		BWN_PIO_BASE1,
2421		BWN_PIO_BASE2,
2422		BWN_PIO_BASE3,
2423		BWN_PIO_BASE4,
2424		BWN_PIO_BASE5,
2425		BWN_PIO_BASE6,
2426		BWN_PIO_BASE7,
2427	};
2428	static const uint16_t bases_rev11[] = {
2429		BWN_PIO11_BASE0,
2430		BWN_PIO11_BASE1,
2431		BWN_PIO11_BASE2,
2432		BWN_PIO11_BASE3,
2433		BWN_PIO11_BASE4,
2434		BWN_PIO11_BASE5,
2435	};
2436
2437	if (siba_get_revid(sc->sc_dev) >= 11) {
2438		if (index >= N(bases_rev11))
2439			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2440		return (bases_rev11[index]);
2441	}
2442	if (index >= N(bases))
2443		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2444	return (bases[index]);
2445}
2446
2447static void
2448bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2449    int index)
2450{
2451	struct bwn_softc *sc = mac->mac_sc;
2452
2453	prq->prq_mac = mac;
2454	prq->prq_rev = siba_get_revid(sc->sc_dev);
2455	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2456	bwn_dma_rxdirectfifo(mac, index, 1);
2457}
2458
2459static void
2460bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2461{
2462	if (tq == NULL)
2463		return;
2464	bwn_pio_cancel_tx_packets(tq);
2465}
2466
2467static void
2468bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2469{
2470
2471	bwn_destroy_pioqueue_tx(pio);
2472}
2473
2474static uint16_t
2475bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2476    uint16_t offset)
2477{
2478
2479	return (BWN_READ_2(mac, tq->tq_base + offset));
2480}
2481
2482static void
2483bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2484{
2485	uint32_t ctl;
2486	int type;
2487	uint16_t base;
2488
2489	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2490	base = bwn_dma_base(type, idx);
2491	if (type == BWN_DMA_64BIT) {
2492		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2493		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2494		if (enable)
2495			ctl |= BWN_DMA64_RXDIRECTFIFO;
2496		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2497	} else {
2498		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2499		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2500		if (enable)
2501			ctl |= BWN_DMA32_RXDIRECTFIFO;
2502		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2503	}
2504}
2505
2506static uint64_t
2507bwn_dma_mask(struct bwn_mac *mac)
2508{
2509	uint32_t tmp;
2510	uint16_t base;
2511
2512	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2513	if (tmp & SIBA_TGSHIGH_DMA64)
2514		return (BWN_DMA_BIT_MASK(64));
2515	base = bwn_dma_base(0, 0);
2516	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2517	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2518	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2519		return (BWN_DMA_BIT_MASK(32));
2520
2521	return (BWN_DMA_BIT_MASK(30));
2522}
2523
2524static int
2525bwn_dma_mask2type(uint64_t dmamask)
2526{
2527
2528	if (dmamask == BWN_DMA_BIT_MASK(30))
2529		return (BWN_DMA_30BIT);
2530	if (dmamask == BWN_DMA_BIT_MASK(32))
2531		return (BWN_DMA_32BIT);
2532	if (dmamask == BWN_DMA_BIT_MASK(64))
2533		return (BWN_DMA_64BIT);
2534	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2535	return (BWN_DMA_30BIT);
2536}
2537
2538static void
2539bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2540{
2541	struct bwn_pio_txpkt *tp;
2542	unsigned int i;
2543
2544	for (i = 0; i < N(tq->tq_pkts); i++) {
2545		tp = &(tq->tq_pkts[i]);
2546		if (tp->tp_m) {
2547			m_freem(tp->tp_m);
2548			tp->tp_m = NULL;
2549		}
2550	}
2551}
2552
2553static uint16_t
2554bwn_dma_base(int type, int controller_idx)
2555{
2556	static const uint16_t map64[] = {
2557		BWN_DMA64_BASE0,
2558		BWN_DMA64_BASE1,
2559		BWN_DMA64_BASE2,
2560		BWN_DMA64_BASE3,
2561		BWN_DMA64_BASE4,
2562		BWN_DMA64_BASE5,
2563	};
2564	static const uint16_t map32[] = {
2565		BWN_DMA32_BASE0,
2566		BWN_DMA32_BASE1,
2567		BWN_DMA32_BASE2,
2568		BWN_DMA32_BASE3,
2569		BWN_DMA32_BASE4,
2570		BWN_DMA32_BASE5,
2571	};
2572
2573	if (type == BWN_DMA_64BIT) {
2574		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2575		    ("%s:%d: fail", __func__, __LINE__));
2576		return (map64[controller_idx]);
2577	}
2578	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2579	    ("%s:%d: fail", __func__, __LINE__));
2580	return (map32[controller_idx]);
2581}
2582
2583static void
2584bwn_dma_init(struct bwn_mac *mac)
2585{
2586	struct bwn_dma *dma = &mac->mac_method.dma;
2587
2588	/* setup TX DMA channels. */
2589	bwn_dma_setup(dma->wme[WME_AC_BK]);
2590	bwn_dma_setup(dma->wme[WME_AC_BE]);
2591	bwn_dma_setup(dma->wme[WME_AC_VI]);
2592	bwn_dma_setup(dma->wme[WME_AC_VO]);
2593	bwn_dma_setup(dma->mcast);
2594	/* setup RX DMA channel. */
2595	bwn_dma_setup(dma->rx);
2596}
2597
2598static struct bwn_dma_ring *
2599bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2600    int for_tx, int type)
2601{
2602	struct bwn_dma *dma = &mac->mac_method.dma;
2603	struct bwn_dma_ring *dr;
2604	struct bwn_dmadesc_generic *desc;
2605	struct bwn_dmadesc_meta *mt;
2606	struct bwn_softc *sc = mac->mac_sc;
2607	int error, i;
2608
2609	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2610	if (dr == NULL)
2611		goto out;
2612	dr->dr_numslots = BWN_RXRING_SLOTS;
2613	if (for_tx)
2614		dr->dr_numslots = BWN_TXRING_SLOTS;
2615
2616	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2617	    M_DEVBUF, M_NOWAIT | M_ZERO);
2618	if (dr->dr_meta == NULL)
2619		goto fail0;
2620
2621	dr->dr_type = type;
2622	dr->dr_mac = mac;
2623	dr->dr_base = bwn_dma_base(type, controller_index);
2624	dr->dr_index = controller_index;
2625	if (type == BWN_DMA_64BIT) {
2626		dr->getdesc = bwn_dma_64_getdesc;
2627		dr->setdesc = bwn_dma_64_setdesc;
2628		dr->start_transfer = bwn_dma_64_start_transfer;
2629		dr->suspend = bwn_dma_64_suspend;
2630		dr->resume = bwn_dma_64_resume;
2631		dr->get_curslot = bwn_dma_64_get_curslot;
2632		dr->set_curslot = bwn_dma_64_set_curslot;
2633	} else {
2634		dr->getdesc = bwn_dma_32_getdesc;
2635		dr->setdesc = bwn_dma_32_setdesc;
2636		dr->start_transfer = bwn_dma_32_start_transfer;
2637		dr->suspend = bwn_dma_32_suspend;
2638		dr->resume = bwn_dma_32_resume;
2639		dr->get_curslot = bwn_dma_32_get_curslot;
2640		dr->set_curslot = bwn_dma_32_set_curslot;
2641	}
2642	if (for_tx) {
2643		dr->dr_tx = 1;
2644		dr->dr_curslot = -1;
2645	} else {
2646		if (dr->dr_index == 0) {
2647			dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2648			dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2649		} else
2650			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2651	}
2652
2653	error = bwn_dma_allocringmemory(dr);
2654	if (error)
2655		goto fail2;
2656
2657	if (for_tx) {
2658		/*
2659		 * Assumption: BWN_TXRING_SLOTS can be divided by
2660		 * BWN_TX_SLOTS_PER_FRAME
2661		 */
2662		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2663		    ("%s:%d: fail", __func__, __LINE__));
2664
2665		dr->dr_txhdr_cache =
2666		    malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2667			BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
2668		KASSERT(dr->dr_txhdr_cache != NULL,
2669		    ("%s:%d: fail", __func__, __LINE__));
2670
2671		/*
2672		 * Create TX ring DMA stuffs
2673		 */
2674		error = bus_dma_tag_create(dma->parent_dtag,
2675				    BWN_ALIGN, 0,
2676				    BUS_SPACE_MAXADDR,
2677				    BUS_SPACE_MAXADDR,
2678				    NULL, NULL,
2679				    BWN_HDRSIZE(mac),
2680				    1,
2681				    BUS_SPACE_MAXSIZE_32BIT,
2682				    0,
2683				    NULL, NULL,
2684				    &dr->dr_txring_dtag);
2685		if (error) {
2686			device_printf(sc->sc_dev,
2687			    "can't create TX ring DMA tag: TODO frees\n");
2688			goto fail1;
2689		}
2690
2691		for (i = 0; i < dr->dr_numslots; i += 2) {
2692			dr->getdesc(dr, i, &desc, &mt);
2693
2694			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2695			mt->mt_m = NULL;
2696			mt->mt_ni = NULL;
2697			mt->mt_islast = 0;
2698			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2699			    &mt->mt_dmap);
2700			if (error) {
2701				device_printf(sc->sc_dev,
2702				     "can't create RX buf DMA map\n");
2703				goto fail1;
2704			}
2705
2706			dr->getdesc(dr, i + 1, &desc, &mt);
2707
2708			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2709			mt->mt_m = NULL;
2710			mt->mt_ni = NULL;
2711			mt->mt_islast = 1;
2712			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2713			    &mt->mt_dmap);
2714			if (error) {
2715				device_printf(sc->sc_dev,
2716				     "can't create RX buf DMA map\n");
2717				goto fail1;
2718			}
2719		}
2720	} else {
2721		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2722		    &dr->dr_spare_dmap);
2723		if (error) {
2724			device_printf(sc->sc_dev,
2725			    "can't create RX buf DMA map\n");
2726			goto out;		/* XXX wrong! */
2727		}
2728
2729		for (i = 0; i < dr->dr_numslots; i++) {
2730			dr->getdesc(dr, i, &desc, &mt);
2731
2732			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2733			    &mt->mt_dmap);
2734			if (error) {
2735				device_printf(sc->sc_dev,
2736				    "can't create RX buf DMA map\n");
2737				goto out;	/* XXX wrong! */
2738			}
2739			error = bwn_dma_newbuf(dr, desc, mt, 1);
2740			if (error) {
2741				device_printf(sc->sc_dev,
2742				    "failed to allocate RX buf\n");
2743				goto out;	/* XXX wrong! */
2744			}
2745		}
2746
2747		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2748		    BUS_DMASYNC_PREWRITE);
2749
2750		dr->dr_usedslot = dr->dr_numslots;
2751	}
2752
2753      out:
2754	return (dr);
2755
2756fail2:
2757	free(dr->dr_txhdr_cache, M_DEVBUF);
2758fail1:
2759	free(dr->dr_meta, M_DEVBUF);
2760fail0:
2761	free(dr, M_DEVBUF);
2762	return (NULL);
2763}
2764
2765static void
2766bwn_dma_ringfree(struct bwn_dma_ring **dr)
2767{
2768
2769	if (dr == NULL)
2770		return;
2771
2772	bwn_dma_free_descbufs(*dr);
2773	bwn_dma_free_ringmemory(*dr);
2774
2775	free((*dr)->dr_txhdr_cache, M_DEVBUF);
2776	free((*dr)->dr_meta, M_DEVBUF);
2777	free(*dr, M_DEVBUF);
2778
2779	*dr = NULL;
2780}
2781
2782static void
2783bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2784    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2785{
2786	struct bwn_dmadesc32 *desc;
2787
2788	*meta = &(dr->dr_meta[slot]);
2789	desc = dr->dr_ring_descbase;
2790	desc = &(desc[slot]);
2791
2792	*gdesc = (struct bwn_dmadesc_generic *)desc;
2793}
2794
2795static void
2796bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2797    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2798    int start, int end, int irq)
2799{
2800	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2801	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2802	uint32_t addr, addrext, ctl;
2803	int slot;
2804
2805	slot = (int)(&(desc->dma.dma32) - descbase);
2806	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2807	    ("%s:%d: fail", __func__, __LINE__));
2808
2809	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2810	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2811	addr |= siba_dma_translation(sc->sc_dev);
2812	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2813	if (slot == dr->dr_numslots - 1)
2814		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2815	if (start)
2816		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2817	if (end)
2818		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2819	if (irq)
2820		ctl |= BWN_DMA32_DCTL_IRQ;
2821	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2822	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2823
2824	desc->dma.dma32.control = htole32(ctl);
2825	desc->dma.dma32.address = htole32(addr);
2826}
2827
2828static void
2829bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2830{
2831
2832	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2833	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2834}
2835
2836static void
2837bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2838{
2839
2840	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2841	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2842}
2843
2844static void
2845bwn_dma_32_resume(struct bwn_dma_ring *dr)
2846{
2847
2848	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2849	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2850}
2851
2852static int
2853bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2854{
2855	uint32_t val;
2856
2857	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2858	val &= BWN_DMA32_RXDPTR;
2859
2860	return (val / sizeof(struct bwn_dmadesc32));
2861}
2862
2863static void
2864bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2865{
2866
2867	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2868	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2869}
2870
2871static void
2872bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2873    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2874{
2875	struct bwn_dmadesc64 *desc;
2876
2877	*meta = &(dr->dr_meta[slot]);
2878	desc = dr->dr_ring_descbase;
2879	desc = &(desc[slot]);
2880
2881	*gdesc = (struct bwn_dmadesc_generic *)desc;
2882}
2883
2884static void
2885bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2886    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2887    int start, int end, int irq)
2888{
2889	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2890	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2891	int slot;
2892	uint32_t ctl0 = 0, ctl1 = 0;
2893	uint32_t addrlo, addrhi;
2894	uint32_t addrext;
2895
2896	slot = (int)(&(desc->dma.dma64) - descbase);
2897	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2898	    ("%s:%d: fail", __func__, __LINE__));
2899
2900	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2901	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2902	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2903	    30;
2904	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2905	if (slot == dr->dr_numslots - 1)
2906		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2907	if (start)
2908		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2909	if (end)
2910		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2911	if (irq)
2912		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2913	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2914	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2915	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2916
2917	desc->dma.dma64.control0 = htole32(ctl0);
2918	desc->dma.dma64.control1 = htole32(ctl1);
2919	desc->dma.dma64.address_low = htole32(addrlo);
2920	desc->dma.dma64.address_high = htole32(addrhi);
2921}
2922
2923static void
2924bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2925{
2926
2927	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2928	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2929}
2930
2931static void
2932bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2933{
2934
2935	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2936	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2937}
2938
2939static void
2940bwn_dma_64_resume(struct bwn_dma_ring *dr)
2941{
2942
2943	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2944	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2945}
2946
2947static int
2948bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2949{
2950	uint32_t val;
2951
2952	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2953	val &= BWN_DMA64_RXSTATDPTR;
2954
2955	return (val / sizeof(struct bwn_dmadesc64));
2956}
2957
2958static void
2959bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
2960{
2961
2962	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
2963	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2964}
2965
2966static int
2967bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
2968{
2969	struct bwn_mac *mac = dr->dr_mac;
2970	struct bwn_dma *dma = &mac->mac_method.dma;
2971	struct bwn_softc *sc = mac->mac_sc;
2972	int error;
2973
2974	error = bus_dma_tag_create(dma->parent_dtag,
2975			    BWN_ALIGN, 0,
2976			    BUS_SPACE_MAXADDR,
2977			    BUS_SPACE_MAXADDR,
2978			    NULL, NULL,
2979			    BWN_DMA_RINGMEMSIZE,
2980			    1,
2981			    BUS_SPACE_MAXSIZE_32BIT,
2982			    0,
2983			    NULL, NULL,
2984			    &dr->dr_ring_dtag);
2985	if (error) {
2986		device_printf(sc->sc_dev,
2987		    "can't create TX ring DMA tag: TODO frees\n");
2988		return (-1);
2989	}
2990
2991	error = bus_dmamem_alloc(dr->dr_ring_dtag,
2992	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
2993	    &dr->dr_ring_dmap);
2994	if (error) {
2995		device_printf(sc->sc_dev,
2996		    "can't allocate DMA mem: TODO frees\n");
2997		return (-1);
2998	}
2999	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3000	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3001	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3002	if (error) {
3003		device_printf(sc->sc_dev,
3004		    "can't load DMA mem: TODO free\n");
3005		return (-1);
3006	}
3007
3008	return (0);
3009}
3010
3011static void
3012bwn_dma_setup(struct bwn_dma_ring *dr)
3013{
3014	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3015	uint64_t ring64;
3016	uint32_t addrext, ring32, value;
3017	uint32_t trans = siba_dma_translation(sc->sc_dev);
3018
3019	if (dr->dr_tx) {
3020		dr->dr_curslot = -1;
3021
3022		if (dr->dr_type == BWN_DMA_64BIT) {
3023			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3024			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3025			    >> 30;
3026			value = BWN_DMA64_TXENABLE;
3027			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3028			    & BWN_DMA64_TXADDREXT_MASK;
3029			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3030			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3031			    (ring64 & 0xffffffff));
3032			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3033			    ((ring64 >> 32) &
3034			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3035		} else {
3036			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3037			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3038			value = BWN_DMA32_TXENABLE;
3039			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3040			    & BWN_DMA32_TXADDREXT_MASK;
3041			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3042			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3043			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3044		}
3045		return;
3046	}
3047
3048	/*
3049	 * set for RX
3050	 */
3051	dr->dr_usedslot = dr->dr_numslots;
3052
3053	if (dr->dr_type == BWN_DMA_64BIT) {
3054		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3055		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3056		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3057		value |= BWN_DMA64_RXENABLE;
3058		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3059		    & BWN_DMA64_RXADDREXT_MASK;
3060		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3061		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3062		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3063		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3064		    | (trans << 1));
3065		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3066		    sizeof(struct bwn_dmadesc64));
3067	} else {
3068		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3069		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3070		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3071		value |= BWN_DMA32_RXENABLE;
3072		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3073		    & BWN_DMA32_RXADDREXT_MASK;
3074		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3075		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3076		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3077		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3078		    sizeof(struct bwn_dmadesc32));
3079	}
3080}
3081
3082static void
3083bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3084{
3085
3086	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3087	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3088	    dr->dr_ring_dmap);
3089}
3090
3091static void
3092bwn_dma_cleanup(struct bwn_dma_ring *dr)
3093{
3094
3095	if (dr->dr_tx) {
3096		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3097		if (dr->dr_type == BWN_DMA_64BIT) {
3098			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3099			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3100		} else
3101			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3102	} else {
3103		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3104		if (dr->dr_type == BWN_DMA_64BIT) {
3105			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3106			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3107		} else
3108			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3109	}
3110}
3111
3112static void
3113bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3114{
3115	struct bwn_dmadesc_generic *desc;
3116	struct bwn_dmadesc_meta *meta;
3117	struct bwn_mac *mac = dr->dr_mac;
3118	struct bwn_dma *dma = &mac->mac_method.dma;
3119	struct bwn_softc *sc = mac->mac_sc;
3120	int i;
3121
3122	if (!dr->dr_usedslot)
3123		return;
3124	for (i = 0; i < dr->dr_numslots; i++) {
3125		dr->getdesc(dr, i, &desc, &meta);
3126
3127		if (meta->mt_m == NULL) {
3128			if (!dr->dr_tx)
3129				device_printf(sc->sc_dev, "%s: not TX?\n",
3130				    __func__);
3131			continue;
3132		}
3133		if (dr->dr_tx) {
3134			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3135				bus_dmamap_unload(dr->dr_txring_dtag,
3136				    meta->mt_dmap);
3137			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3138				bus_dmamap_unload(dma->txbuf_dtag,
3139				    meta->mt_dmap);
3140		} else
3141			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3142		bwn_dma_free_descbuf(dr, meta);
3143	}
3144}
3145
3146static int
3147bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3148    int type)
3149{
3150	struct bwn_softc *sc = mac->mac_sc;
3151	uint32_t value;
3152	int i;
3153	uint16_t offset;
3154
3155	for (i = 0; i < 10; i++) {
3156		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3157		    BWN_DMA32_TXSTATUS;
3158		value = BWN_READ_4(mac, base + offset);
3159		if (type == BWN_DMA_64BIT) {
3160			value &= BWN_DMA64_TXSTAT;
3161			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3162			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3163			    value == BWN_DMA64_TXSTAT_STOPPED)
3164				break;
3165		} else {
3166			value &= BWN_DMA32_TXSTATE;
3167			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3168			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3169			    value == BWN_DMA32_TXSTAT_STOPPED)
3170				break;
3171		}
3172		DELAY(1000);
3173	}
3174	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3175	BWN_WRITE_4(mac, base + offset, 0);
3176	for (i = 0; i < 10; i++) {
3177		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3178						   BWN_DMA32_TXSTATUS;
3179		value = BWN_READ_4(mac, base + offset);
3180		if (type == BWN_DMA_64BIT) {
3181			value &= BWN_DMA64_TXSTAT;
3182			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3183				i = -1;
3184				break;
3185			}
3186		} else {
3187			value &= BWN_DMA32_TXSTATE;
3188			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3189				i = -1;
3190				break;
3191			}
3192		}
3193		DELAY(1000);
3194	}
3195	if (i != -1) {
3196		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3197		return (ENODEV);
3198	}
3199	DELAY(1000);
3200
3201	return (0);
3202}
3203
3204static int
3205bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3206    int type)
3207{
3208	struct bwn_softc *sc = mac->mac_sc;
3209	uint32_t value;
3210	int i;
3211	uint16_t offset;
3212
3213	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3214	BWN_WRITE_4(mac, base + offset, 0);
3215	for (i = 0; i < 10; i++) {
3216		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3217		    BWN_DMA32_RXSTATUS;
3218		value = BWN_READ_4(mac, base + offset);
3219		if (type == BWN_DMA_64BIT) {
3220			value &= BWN_DMA64_RXSTAT;
3221			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3222				i = -1;
3223				break;
3224			}
3225		} else {
3226			value &= BWN_DMA32_RXSTATE;
3227			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3228				i = -1;
3229				break;
3230			}
3231		}
3232		DELAY(1000);
3233	}
3234	if (i != -1) {
3235		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3236		return (ENODEV);
3237	}
3238
3239	return (0);
3240}
3241
3242static void
3243bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3244    struct bwn_dmadesc_meta *meta)
3245{
3246
3247	if (meta->mt_m != NULL) {
3248		m_freem(meta->mt_m);
3249		meta->mt_m = NULL;
3250	}
3251	if (meta->mt_ni != NULL) {
3252		ieee80211_free_node(meta->mt_ni);
3253		meta->mt_ni = NULL;
3254	}
3255}
3256
3257static void
3258bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3259{
3260	struct bwn_rxhdr4 *rxhdr;
3261	unsigned char *frame;
3262
3263	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3264	rxhdr->frame_len = 0;
3265
3266	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3267	    sizeof(struct bwn_plcp6) + 2,
3268	    ("%s:%d: fail", __func__, __LINE__));
3269	frame = mtod(m, char *) + dr->dr_frameoffset;
3270	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3271}
3272
3273static uint8_t
3274bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3275{
3276	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3277
3278	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3279	    == 0xff);
3280}
3281
3282static void
3283bwn_wme_init(struct bwn_mac *mac)
3284{
3285
3286	bwn_wme_load(mac);
3287
3288	/* enable WME support. */
3289	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3290	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3291	    BWN_IFSCTL_USE_EDCF);
3292}
3293
3294static void
3295bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3296{
3297	struct bwn_softc *sc = mac->mac_sc;
3298	struct ieee80211com *ic = &sc->sc_ic;
3299	uint16_t delay;	/* microsec */
3300
3301	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3302	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3303		delay = 500;
3304	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3305		delay = max(delay, (uint16_t)2400);
3306
3307	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3308}
3309
3310static void
3311bwn_bt_enable(struct bwn_mac *mac)
3312{
3313	struct bwn_softc *sc = mac->mac_sc;
3314	uint64_t hf;
3315
3316	if (bwn_bluetooth == 0)
3317		return;
3318	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3319		return;
3320	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3321		return;
3322
3323	hf = bwn_hf_read(mac);
3324	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3325		hf |= BWN_HF_BT_COEXISTALT;
3326	else
3327		hf |= BWN_HF_BT_COEXIST;
3328	bwn_hf_write(mac, hf);
3329}
3330
3331static void
3332bwn_set_macaddr(struct bwn_mac *mac)
3333{
3334
3335	bwn_mac_write_bssid(mac);
3336	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3337	    mac->mac_sc->sc_ic.ic_macaddr);
3338}
3339
3340static void
3341bwn_clear_keys(struct bwn_mac *mac)
3342{
3343	int i;
3344
3345	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3346		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3347		    ("%s:%d: fail", __func__, __LINE__));
3348
3349		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3350		    NULL, BWN_SEC_KEYSIZE, NULL);
3351		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3352			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3353			    NULL, BWN_SEC_KEYSIZE, NULL);
3354		}
3355		mac->mac_key[i].keyconf = NULL;
3356	}
3357}
3358
3359static void
3360bwn_crypt_init(struct bwn_mac *mac)
3361{
3362	struct bwn_softc *sc = mac->mac_sc;
3363
3364	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3365	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3366	    ("%s:%d: fail", __func__, __LINE__));
3367	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3368	mac->mac_ktp *= 2;
3369	if (siba_get_revid(sc->sc_dev) >= 5)
3370		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3371	bwn_clear_keys(mac);
3372}
3373
3374static void
3375bwn_chip_exit(struct bwn_mac *mac)
3376{
3377	struct bwn_softc *sc = mac->mac_sc;
3378
3379	bwn_phy_exit(mac);
3380	siba_gpio_set(sc->sc_dev, 0);
3381}
3382
3383static int
3384bwn_fw_fillinfo(struct bwn_mac *mac)
3385{
3386	int error;
3387
3388	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3389	if (error == 0)
3390		return (0);
3391	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3392	if (error == 0)
3393		return (0);
3394	return (error);
3395}
3396
3397static int
3398bwn_gpio_init(struct bwn_mac *mac)
3399{
3400	struct bwn_softc *sc = mac->mac_sc;
3401	uint32_t mask = 0x1f, set = 0xf, value;
3402
3403	BWN_WRITE_4(mac, BWN_MACCTL,
3404	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3405	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3406	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3407
3408	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3409		mask |= 0x0060;
3410		set |= 0x0060;
3411	}
3412	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3413		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3414		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3415		mask |= 0x0200;
3416		set |= 0x0200;
3417	}
3418	if (siba_get_revid(sc->sc_dev) >= 2)
3419		mask |= 0x0010;
3420
3421	value = siba_gpio_get(sc->sc_dev);
3422	if (value == -1)
3423		return (0);
3424	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3425
3426	return (0);
3427}
3428
3429static int
3430bwn_fw_loadinitvals(struct bwn_mac *mac)
3431{
3432#define	GETFWOFFSET(fwp, offset)				\
3433	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3434	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3435	const struct bwn_fwhdr *hdr;
3436	struct bwn_fw *fw = &mac->mac_fw;
3437	int error;
3438
3439	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3440	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3441	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3442	if (error)
3443		return (error);
3444	if (fw->initvals_band.fw) {
3445		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3446		error = bwn_fwinitvals_write(mac,
3447		    GETFWOFFSET(fw->initvals_band, hdr_len),
3448		    be32toh(hdr->size),
3449		    fw->initvals_band.fw->datasize - hdr_len);
3450	}
3451	return (error);
3452#undef GETFWOFFSET
3453}
3454
3455static int
3456bwn_phy_init(struct bwn_mac *mac)
3457{
3458	struct bwn_softc *sc = mac->mac_sc;
3459	int error;
3460
3461	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3462	mac->mac_phy.rf_onoff(mac, 1);
3463	error = mac->mac_phy.init(mac);
3464	if (error) {
3465		device_printf(sc->sc_dev, "PHY init failed\n");
3466		goto fail0;
3467	}
3468	error = bwn_switch_channel(mac,
3469	    mac->mac_phy.get_default_chan(mac));
3470	if (error) {
3471		device_printf(sc->sc_dev,
3472		    "failed to switch default channel\n");
3473		goto fail1;
3474	}
3475	return (0);
3476fail1:
3477	if (mac->mac_phy.exit)
3478		mac->mac_phy.exit(mac);
3479fail0:
3480	mac->mac_phy.rf_onoff(mac, 0);
3481
3482	return (error);
3483}
3484
3485static void
3486bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3487{
3488	uint16_t ant;
3489	uint16_t tmp;
3490
3491	ant = bwn_ant2phy(antenna);
3492
3493	/* For ACK/CTS */
3494	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3495	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3496	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3497	/* For Probe Resposes */
3498	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3499	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3500	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3501}
3502
3503static void
3504bwn_set_opmode(struct bwn_mac *mac)
3505{
3506	struct bwn_softc *sc = mac->mac_sc;
3507	struct ieee80211com *ic = &sc->sc_ic;
3508	uint32_t ctl;
3509	uint16_t cfp_pretbtt;
3510
3511	ctl = BWN_READ_4(mac, BWN_MACCTL);
3512	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3513	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3514	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3515	ctl |= BWN_MACCTL_STA;
3516
3517	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3518	    ic->ic_opmode == IEEE80211_M_MBSS)
3519		ctl |= BWN_MACCTL_HOSTAP;
3520	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3521		ctl &= ~BWN_MACCTL_STA;
3522	ctl |= sc->sc_filters;
3523
3524	if (siba_get_revid(sc->sc_dev) <= 4)
3525		ctl |= BWN_MACCTL_PROMISC;
3526
3527	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3528
3529	cfp_pretbtt = 2;
3530	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3531		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3532		    siba_get_chiprev(sc->sc_dev) == 3)
3533			cfp_pretbtt = 100;
3534		else
3535			cfp_pretbtt = 50;
3536	}
3537	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3538}
3539
3540static int
3541bwn_dma_gettype(struct bwn_mac *mac)
3542{
3543	uint32_t tmp;
3544	uint16_t base;
3545
3546	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3547	if (tmp & SIBA_TGSHIGH_DMA64)
3548		return (BWN_DMA_64BIT);
3549	base = bwn_dma_base(0, 0);
3550	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3551	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3552	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3553		return (BWN_DMA_32BIT);
3554
3555	return (BWN_DMA_30BIT);
3556}
3557
3558static void
3559bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3560{
3561	if (!error) {
3562		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3563		*((bus_addr_t *)arg) = seg->ds_addr;
3564	}
3565}
3566
3567void
3568bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3569{
3570	struct bwn_phy *phy = &mac->mac_phy;
3571	struct bwn_softc *sc = mac->mac_sc;
3572	unsigned int i, max_loop;
3573	uint16_t value;
3574	uint32_t buffer[5] = {
3575		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3576	};
3577
3578	if (ofdm) {
3579		max_loop = 0x1e;
3580		buffer[0] = 0x000201cc;
3581	} else {
3582		max_loop = 0xfa;
3583		buffer[0] = 0x000b846e;
3584	}
3585
3586	BWN_ASSERT_LOCKED(mac->mac_sc);
3587
3588	for (i = 0; i < 5; i++)
3589		bwn_ram_write(mac, i * 4, buffer[i]);
3590
3591	BWN_WRITE_2(mac, 0x0568, 0x0000);
3592	BWN_WRITE_2(mac, 0x07c0,
3593	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3594
3595	value = (ofdm ? 0x41 : 0x40);
3596	BWN_WRITE_2(mac, 0x050c, value);
3597
3598	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3599	    phy->type == BWN_PHYTYPE_LCN)
3600		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3601	BWN_WRITE_2(mac, 0x0508, 0x0000);
3602	BWN_WRITE_2(mac, 0x050a, 0x0000);
3603	BWN_WRITE_2(mac, 0x054c, 0x0000);
3604	BWN_WRITE_2(mac, 0x056a, 0x0014);
3605	BWN_WRITE_2(mac, 0x0568, 0x0826);
3606	BWN_WRITE_2(mac, 0x0500, 0x0000);
3607
3608	/* XXX TODO: n phy pa override? */
3609
3610	switch (phy->type) {
3611	case BWN_PHYTYPE_N:
3612	case BWN_PHYTYPE_LCN:
3613		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3614		break;
3615	case BWN_PHYTYPE_LP:
3616		BWN_WRITE_2(mac, 0x0502, 0x0050);
3617		break;
3618	default:
3619		BWN_WRITE_2(mac, 0x0502, 0x0030);
3620		break;
3621	}
3622
3623	/* flush */
3624	BWN_READ_2(mac, 0x0502);
3625
3626	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3627		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3628	for (i = 0x00; i < max_loop; i++) {
3629		value = BWN_READ_2(mac, 0x050e);
3630		if (value & 0x0080)
3631			break;
3632		DELAY(10);
3633	}
3634	for (i = 0x00; i < 0x0a; i++) {
3635		value = BWN_READ_2(mac, 0x050e);
3636		if (value & 0x0400)
3637			break;
3638		DELAY(10);
3639	}
3640	for (i = 0x00; i < 0x19; i++) {
3641		value = BWN_READ_2(mac, 0x0690);
3642		if (!(value & 0x0100))
3643			break;
3644		DELAY(10);
3645	}
3646	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3647		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3648}
3649
3650void
3651bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3652{
3653	uint32_t macctl;
3654
3655	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3656
3657	macctl = BWN_READ_4(mac, BWN_MACCTL);
3658	if (macctl & BWN_MACCTL_BIGENDIAN)
3659		printf("TODO: need swap\n");
3660
3661	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3662	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3663	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3664}
3665
3666void
3667bwn_mac_suspend(struct bwn_mac *mac)
3668{
3669	struct bwn_softc *sc = mac->mac_sc;
3670	int i;
3671	uint32_t tmp;
3672
3673	KASSERT(mac->mac_suspended >= 0,
3674	    ("%s:%d: fail", __func__, __LINE__));
3675
3676	if (mac->mac_suspended == 0) {
3677		bwn_psctl(mac, BWN_PS_AWAKE);
3678		BWN_WRITE_4(mac, BWN_MACCTL,
3679			    BWN_READ_4(mac, BWN_MACCTL)
3680			    & ~BWN_MACCTL_ON);
3681		BWN_READ_4(mac, BWN_MACCTL);
3682		for (i = 35; i; i--) {
3683			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3684			if (tmp & BWN_INTR_MAC_SUSPENDED)
3685				goto out;
3686			DELAY(10);
3687		}
3688		for (i = 40; i; i--) {
3689			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3690			if (tmp & BWN_INTR_MAC_SUSPENDED)
3691				goto out;
3692			DELAY(1000);
3693		}
3694		device_printf(sc->sc_dev, "MAC suspend failed\n");
3695	}
3696out:
3697	mac->mac_suspended++;
3698}
3699
3700void
3701bwn_mac_enable(struct bwn_mac *mac)
3702{
3703	struct bwn_softc *sc = mac->mac_sc;
3704	uint16_t state;
3705
3706	state = bwn_shm_read_2(mac, BWN_SHARED,
3707	    BWN_SHARED_UCODESTAT);
3708	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3709	    state != BWN_SHARED_UCODESTAT_SLEEP)
3710		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3711
3712	mac->mac_suspended--;
3713	KASSERT(mac->mac_suspended >= 0,
3714	    ("%s:%d: fail", __func__, __LINE__));
3715	if (mac->mac_suspended == 0) {
3716		BWN_WRITE_4(mac, BWN_MACCTL,
3717		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3718		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3719		BWN_READ_4(mac, BWN_MACCTL);
3720		BWN_READ_4(mac, BWN_INTR_REASON);
3721		bwn_psctl(mac, 0);
3722	}
3723}
3724
3725void
3726bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3727{
3728	struct bwn_softc *sc = mac->mac_sc;
3729	int i;
3730	uint16_t ucstat;
3731
3732	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3733	    ("%s:%d: fail", __func__, __LINE__));
3734	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3735	    ("%s:%d: fail", __func__, __LINE__));
3736
3737	/* XXX forcibly awake and hwps-off */
3738
3739	BWN_WRITE_4(mac, BWN_MACCTL,
3740	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3741	    ~BWN_MACCTL_HWPS);
3742	BWN_READ_4(mac, BWN_MACCTL);
3743	if (siba_get_revid(sc->sc_dev) >= 5) {
3744		for (i = 0; i < 100; i++) {
3745			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3746			    BWN_SHARED_UCODESTAT);
3747			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3748				break;
3749			DELAY(10);
3750		}
3751	}
3752}
3753
3754static int
3755bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3756{
3757	struct bwn_softc *sc = mac->mac_sc;
3758	struct bwn_fw *fw = &mac->mac_fw;
3759	const uint8_t rev = siba_get_revid(sc->sc_dev);
3760	const char *filename;
3761	uint32_t high;
3762	int error;
3763
3764	/* microcode */
3765	filename = NULL;
3766	switch (rev) {
3767	case 42:
3768		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3769			filename = "ucode42";
3770		break;
3771	case 40:
3772		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3773			filename = "ucode40";
3774		break;
3775	case 33:
3776		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3777			filename = "ucode33_lcn40";
3778		break;
3779	case 30:
3780		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3781			filename = "ucode30_mimo";
3782		break;
3783	case 29:
3784		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3785			filename = "ucode29_mimo";
3786		break;
3787	case 26:
3788		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3789			filename = "ucode26_mimo";
3790		break;
3791	case 28:
3792	case 25:
3793		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3794			filename = "ucode25_mimo";
3795		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3796			filename = "ucode25_lcn";
3797		break;
3798	case 24:
3799		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3800			filename = "ucode24_lcn";
3801		break;
3802	case 23:
3803		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3804			filename = "ucode16_mimo";
3805		break;
3806	case 16:
3807	case 17:
3808	case 18:
3809	case 19:
3810		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3811			filename = "ucode16_mimo";
3812		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3813			filename = "ucode16_lp";
3814		break;
3815	case 15:
3816		filename = "ucode15";
3817		break;
3818	case 14:
3819		filename = "ucode14";
3820		break;
3821	case 13:
3822		filename = "ucode13";
3823		break;
3824	case 12:
3825	case 11:
3826		filename = "ucode11";
3827		break;
3828	case 10:
3829	case 9:
3830	case 8:
3831	case 7:
3832	case 6:
3833	case 5:
3834		filename = "ucode5";
3835		break;
3836	default:
3837		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3838		bwn_release_firmware(mac);
3839		return (EOPNOTSUPP);
3840	}
3841
3842	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3843	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3844	if (error) {
3845		bwn_release_firmware(mac);
3846		return (error);
3847	}
3848
3849	/* PCM */
3850	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3851	if (rev >= 5 && rev <= 10) {
3852		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3853		if (error == ENOENT)
3854			fw->no_pcmfile = 1;
3855		else if (error) {
3856			bwn_release_firmware(mac);
3857			return (error);
3858		}
3859	} else if (rev < 11) {
3860		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3861		return (EOPNOTSUPP);
3862	}
3863
3864	/* initvals */
3865	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3866	switch (mac->mac_phy.type) {
3867	case BWN_PHYTYPE_A:
3868		if (rev < 5 || rev > 10)
3869			goto fail1;
3870		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3871			filename = "a0g1initvals5";
3872		else
3873			filename = "a0g0initvals5";
3874		break;
3875	case BWN_PHYTYPE_G:
3876		if (rev >= 5 && rev <= 10)
3877			filename = "b0g0initvals5";
3878		else if (rev >= 13)
3879			filename = "b0g0initvals13";
3880		else
3881			goto fail1;
3882		break;
3883	case BWN_PHYTYPE_LP:
3884		if (rev == 13)
3885			filename = "lp0initvals13";
3886		else if (rev == 14)
3887			filename = "lp0initvals14";
3888		else if (rev >= 15)
3889			filename = "lp0initvals15";
3890		else
3891			goto fail1;
3892		break;
3893	case BWN_PHYTYPE_N:
3894		if (rev == 30)
3895			filename = "n16initvals30";
3896		else if (rev == 28 || rev == 25)
3897			filename = "n0initvals25";
3898		else if (rev == 24)
3899			filename = "n0initvals24";
3900		else if (rev == 23)
3901			filename = "n0initvals16";
3902		else if (rev >= 16 && rev <= 18)
3903			filename = "n0initvals16";
3904		else if (rev >= 11 && rev <= 12)
3905			filename = "n0initvals11";
3906		else
3907			goto fail1;
3908		break;
3909	default:
3910		goto fail1;
3911	}
3912	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3913	if (error) {
3914		bwn_release_firmware(mac);
3915		return (error);
3916	}
3917
3918	/* bandswitch initvals */
3919	switch (mac->mac_phy.type) {
3920	case BWN_PHYTYPE_A:
3921		if (rev >= 5 && rev <= 10) {
3922			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3923				filename = "a0g1bsinitvals5";
3924			else
3925				filename = "a0g0bsinitvals5";
3926		} else if (rev >= 11)
3927			filename = NULL;
3928		else
3929			goto fail1;
3930		break;
3931	case BWN_PHYTYPE_G:
3932		if (rev >= 5 && rev <= 10)
3933			filename = "b0g0bsinitvals5";
3934		else if (rev >= 11)
3935			filename = NULL;
3936		else
3937			goto fail1;
3938		break;
3939	case BWN_PHYTYPE_LP:
3940		if (rev == 13)
3941			filename = "lp0bsinitvals13";
3942		else if (rev == 14)
3943			filename = "lp0bsinitvals14";
3944		else if (rev >= 15)
3945			filename = "lp0bsinitvals15";
3946		else
3947			goto fail1;
3948		break;
3949	case BWN_PHYTYPE_N:
3950		if (rev == 30)
3951			filename = "n16bsinitvals30";
3952		else if (rev == 28 || rev == 25)
3953			filename = "n0bsinitvals25";
3954		else if (rev == 24)
3955			filename = "n0bsinitvals24";
3956		else if (rev == 23)
3957			filename = "n0bsinitvals16";
3958		else if (rev >= 16 && rev <= 18)
3959			filename = "n0bsinitvals16";
3960		else if (rev >= 11 && rev <= 12)
3961			filename = "n0bsinitvals11";
3962		else
3963			goto fail1;
3964		break;
3965	default:
3966		device_printf(sc->sc_dev, "unknown phy (%d)\n",
3967		    mac->mac_phy.type);
3968		goto fail1;
3969	}
3970	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
3971	if (error) {
3972		bwn_release_firmware(mac);
3973		return (error);
3974	}
3975	return (0);
3976fail1:
3977	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
3978	    rev, mac->mac_phy.type);
3979	bwn_release_firmware(mac);
3980	return (EOPNOTSUPP);
3981}
3982
3983static int
3984bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
3985    const char *name, struct bwn_fwfile *bfw)
3986{
3987	const struct bwn_fwhdr *hdr;
3988	struct bwn_softc *sc = mac->mac_sc;
3989	const struct firmware *fw;
3990	char namebuf[64];
3991
3992	if (name == NULL) {
3993		bwn_do_release_fw(bfw);
3994		return (0);
3995	}
3996	if (bfw->filename != NULL) {
3997		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
3998			return (0);
3999		bwn_do_release_fw(bfw);
4000	}
4001
4002	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4003	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4004	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4005	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4006	fw = firmware_get(namebuf);
4007	if (fw == NULL) {
4008		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4009		    namebuf);
4010		return (ENOENT);
4011	}
4012	if (fw->datasize < sizeof(struct bwn_fwhdr))
4013		goto fail;
4014	hdr = (const struct bwn_fwhdr *)(fw->data);
4015	switch (hdr->type) {
4016	case BWN_FWTYPE_UCODE:
4017	case BWN_FWTYPE_PCM:
4018		if (be32toh(hdr->size) !=
4019		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4020			goto fail;
4021		/* FALLTHROUGH */
4022	case BWN_FWTYPE_IV:
4023		if (hdr->ver != 1)
4024			goto fail;
4025		break;
4026	default:
4027		goto fail;
4028	}
4029	bfw->filename = name;
4030	bfw->fw = fw;
4031	bfw->type = type;
4032	return (0);
4033fail:
4034	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4035	if (fw != NULL)
4036		firmware_put(fw, FIRMWARE_UNLOAD);
4037	return (EPROTO);
4038}
4039
4040static void
4041bwn_release_firmware(struct bwn_mac *mac)
4042{
4043
4044	bwn_do_release_fw(&mac->mac_fw.ucode);
4045	bwn_do_release_fw(&mac->mac_fw.pcm);
4046	bwn_do_release_fw(&mac->mac_fw.initvals);
4047	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4048}
4049
4050static void
4051bwn_do_release_fw(struct bwn_fwfile *bfw)
4052{
4053
4054	if (bfw->fw != NULL)
4055		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4056	bfw->fw = NULL;
4057	bfw->filename = NULL;
4058}
4059
4060static int
4061bwn_fw_loaducode(struct bwn_mac *mac)
4062{
4063#define	GETFWOFFSET(fwp, offset)	\
4064	((const uint32_t *)((const char *)fwp.fw->data + offset))
4065#define	GETFWSIZE(fwp, offset)	\
4066	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4067	struct bwn_softc *sc = mac->mac_sc;
4068	const uint32_t *data;
4069	unsigned int i;
4070	uint32_t ctl;
4071	uint16_t date, fwcaps, time;
4072	int error = 0;
4073
4074	ctl = BWN_READ_4(mac, BWN_MACCTL);
4075	ctl |= BWN_MACCTL_MCODE_JMP0;
4076	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4077	    __LINE__));
4078	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4079	for (i = 0; i < 64; i++)
4080		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4081	for (i = 0; i < 4096; i += 2)
4082		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4083
4084	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4085	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4086	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4087	     i++) {
4088		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4089		DELAY(10);
4090	}
4091
4092	if (mac->mac_fw.pcm.fw) {
4093		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4094		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4095		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4096		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4097		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4098		    sizeof(struct bwn_fwhdr)); i++) {
4099			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4100			DELAY(10);
4101		}
4102	}
4103
4104	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4105	BWN_WRITE_4(mac, BWN_MACCTL,
4106	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4107	    BWN_MACCTL_MCODE_RUN);
4108
4109	for (i = 0; i < 21; i++) {
4110		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4111			break;
4112		if (i >= 20) {
4113			device_printf(sc->sc_dev, "ucode timeout\n");
4114			error = ENXIO;
4115			goto error;
4116		}
4117		DELAY(50000);
4118	}
4119	BWN_READ_4(mac, BWN_INTR_REASON);
4120
4121	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4122	if (mac->mac_fw.rev <= 0x128) {
4123		device_printf(sc->sc_dev, "the firmware is too old\n");
4124		error = EOPNOTSUPP;
4125		goto error;
4126	}
4127
4128	/*
4129	 * Determine firmware header version; needed for TX/RX packet
4130	 * handling.
4131	 */
4132	if (mac->mac_fw.rev >= 598)
4133		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4134	else if (mac->mac_fw.rev >= 410)
4135		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4136	else
4137		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4138
4139	/*
4140	 * We don't support rev 598 or later; that requires
4141	 * another round of changes to the TX/RX descriptor
4142	 * and status layout.
4143	 *
4144	 * So, complain this is the case and exit out, rather
4145	 * than attaching and then failing.
4146	 */
4147	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4148		device_printf(sc->sc_dev,
4149		    "firmware is too new (>=598); not supported\n");
4150		error = EOPNOTSUPP;
4151		goto error;
4152	}
4153
4154	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4155	    BWN_SHARED_UCODE_PATCH);
4156	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4157	mac->mac_fw.opensource = (date == 0xffff);
4158	if (bwn_wme != 0)
4159		mac->mac_flags |= BWN_MAC_FLAG_WME;
4160	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4161
4162	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4163	if (mac->mac_fw.opensource == 0) {
4164		device_printf(sc->sc_dev,
4165		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4166		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4167		if (mac->mac_fw.no_pcmfile)
4168			device_printf(sc->sc_dev,
4169			    "no HW crypto acceleration due to pcm5\n");
4170	} else {
4171		mac->mac_fw.patch = time;
4172		fwcaps = bwn_fwcaps_read(mac);
4173		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4174			device_printf(sc->sc_dev,
4175			    "disabling HW crypto acceleration\n");
4176			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4177		}
4178		if (!(fwcaps & BWN_FWCAPS_WME)) {
4179			device_printf(sc->sc_dev, "disabling WME support\n");
4180			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4181		}
4182	}
4183
4184	if (BWN_ISOLDFMT(mac))
4185		device_printf(sc->sc_dev, "using old firmware image\n");
4186
4187	return (0);
4188
4189error:
4190	BWN_WRITE_4(mac, BWN_MACCTL,
4191	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4192	    BWN_MACCTL_MCODE_JMP0);
4193
4194	return (error);
4195#undef GETFWSIZE
4196#undef GETFWOFFSET
4197}
4198
4199/* OpenFirmware only */
4200static uint16_t
4201bwn_fwcaps_read(struct bwn_mac *mac)
4202{
4203
4204	KASSERT(mac->mac_fw.opensource == 1,
4205	    ("%s:%d: fail", __func__, __LINE__));
4206	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4207}
4208
4209static int
4210bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4211    size_t count, size_t array_size)
4212{
4213#define	GET_NEXTIV16(iv)						\
4214	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4215	    sizeof(uint16_t) + sizeof(uint16_t)))
4216#define	GET_NEXTIV32(iv)						\
4217	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4218	    sizeof(uint16_t) + sizeof(uint32_t)))
4219	struct bwn_softc *sc = mac->mac_sc;
4220	const struct bwn_fwinitvals *iv;
4221	uint16_t offset;
4222	size_t i;
4223	uint8_t bit32;
4224
4225	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4226	    ("%s:%d: fail", __func__, __LINE__));
4227	iv = ivals;
4228	for (i = 0; i < count; i++) {
4229		if (array_size < sizeof(iv->offset_size))
4230			goto fail;
4231		array_size -= sizeof(iv->offset_size);
4232		offset = be16toh(iv->offset_size);
4233		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4234		offset &= BWN_FWINITVALS_OFFSET_MASK;
4235		if (offset >= 0x1000)
4236			goto fail;
4237		if (bit32) {
4238			if (array_size < sizeof(iv->data.d32))
4239				goto fail;
4240			array_size -= sizeof(iv->data.d32);
4241			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4242			iv = GET_NEXTIV32(iv);
4243		} else {
4244
4245			if (array_size < sizeof(iv->data.d16))
4246				goto fail;
4247			array_size -= sizeof(iv->data.d16);
4248			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4249
4250			iv = GET_NEXTIV16(iv);
4251		}
4252	}
4253	if (array_size != 0)
4254		goto fail;
4255	return (0);
4256fail:
4257	device_printf(sc->sc_dev, "initvals: invalid format\n");
4258	return (EPROTO);
4259#undef GET_NEXTIV16
4260#undef GET_NEXTIV32
4261}
4262
4263int
4264bwn_switch_channel(struct bwn_mac *mac, int chan)
4265{
4266	struct bwn_phy *phy = &(mac->mac_phy);
4267	struct bwn_softc *sc = mac->mac_sc;
4268	struct ieee80211com *ic = &sc->sc_ic;
4269	uint16_t channelcookie, savedcookie;
4270	int error;
4271
4272	if (chan == 0xffff)
4273		chan = phy->get_default_chan(mac);
4274
4275	channelcookie = chan;
4276	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4277		channelcookie |= 0x100;
4278	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4279	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4280	error = phy->switch_channel(mac, chan);
4281	if (error)
4282		goto fail;
4283
4284	mac->mac_phy.chan = chan;
4285	DELAY(8000);
4286	return (0);
4287fail:
4288	device_printf(sc->sc_dev, "failed to switch channel\n");
4289	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4290	return (error);
4291}
4292
4293static uint16_t
4294bwn_ant2phy(int antenna)
4295{
4296
4297	switch (antenna) {
4298	case BWN_ANT0:
4299		return (BWN_TX_PHY_ANT0);
4300	case BWN_ANT1:
4301		return (BWN_TX_PHY_ANT1);
4302	case BWN_ANT2:
4303		return (BWN_TX_PHY_ANT2);
4304	case BWN_ANT3:
4305		return (BWN_TX_PHY_ANT3);
4306	case BWN_ANTAUTO:
4307		return (BWN_TX_PHY_ANT01AUTO);
4308	}
4309	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4310	return (0);
4311}
4312
4313static void
4314bwn_wme_load(struct bwn_mac *mac)
4315{
4316	struct bwn_softc *sc = mac->mac_sc;
4317	int i;
4318
4319	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4320	    ("%s:%d: fail", __func__, __LINE__));
4321
4322	bwn_mac_suspend(mac);
4323	for (i = 0; i < N(sc->sc_wmeParams); i++)
4324		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4325		    bwn_wme_shm_offsets[i]);
4326	bwn_mac_enable(mac);
4327}
4328
4329static void
4330bwn_wme_loadparams(struct bwn_mac *mac,
4331    const struct wmeParams *p, uint16_t shm_offset)
4332{
4333#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4334	struct bwn_softc *sc = mac->mac_sc;
4335	uint16_t params[BWN_NR_WMEPARAMS];
4336	int slot, tmp;
4337	unsigned int i;
4338
4339	slot = BWN_READ_2(mac, BWN_RNG) &
4340	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4341
4342	memset(&params, 0, sizeof(params));
4343
4344	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4345	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4346	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4347
4348	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4349	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4350	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4351	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4352	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4353	params[BWN_WMEPARAM_BSLOTS] = slot;
4354	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4355
4356	for (i = 0; i < N(params); i++) {
4357		if (i == BWN_WMEPARAM_STATUS) {
4358			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4359			    shm_offset + (i * 2));
4360			tmp |= 0x100;
4361			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4362			    tmp);
4363		} else {
4364			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4365			    params[i]);
4366		}
4367	}
4368}
4369
4370static void
4371bwn_mac_write_bssid(struct bwn_mac *mac)
4372{
4373	struct bwn_softc *sc = mac->mac_sc;
4374	uint32_t tmp;
4375	int i;
4376	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4377
4378	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4379	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4380	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4381	    IEEE80211_ADDR_LEN);
4382
4383	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4384		tmp = (uint32_t) (mac_bssid[i + 0]);
4385		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4386		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4387		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4388		bwn_ram_write(mac, 0x20 + i, tmp);
4389	}
4390}
4391
4392static void
4393bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4394    const uint8_t *macaddr)
4395{
4396	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4397	uint16_t data;
4398
4399	if (!mac)
4400		macaddr = zero;
4401
4402	offset |= 0x0020;
4403	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4404
4405	data = macaddr[0];
4406	data |= macaddr[1] << 8;
4407	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4408	data = macaddr[2];
4409	data |= macaddr[3] << 8;
4410	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4411	data = macaddr[4];
4412	data |= macaddr[5] << 8;
4413	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4414}
4415
4416static void
4417bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4418    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4419{
4420	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4421	uint8_t per_sta_keys_start = 8;
4422
4423	if (BWN_SEC_NEWAPI(mac))
4424		per_sta_keys_start = 4;
4425
4426	KASSERT(index < mac->mac_max_nr_keys,
4427	    ("%s:%d: fail", __func__, __LINE__));
4428	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4429	    ("%s:%d: fail", __func__, __LINE__));
4430
4431	if (index >= per_sta_keys_start)
4432		bwn_key_macwrite(mac, index, NULL);
4433	if (key)
4434		memcpy(buf, key, key_len);
4435	bwn_key_write(mac, index, algorithm, buf);
4436	if (index >= per_sta_keys_start)
4437		bwn_key_macwrite(mac, index, mac_addr);
4438
4439	mac->mac_key[index].algorithm = algorithm;
4440}
4441
4442static void
4443bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4444{
4445	struct bwn_softc *sc = mac->mac_sc;
4446	uint32_t addrtmp[2] = { 0, 0 };
4447	uint8_t start = 8;
4448
4449	if (BWN_SEC_NEWAPI(mac))
4450		start = 4;
4451
4452	KASSERT(index >= start,
4453	    ("%s:%d: fail", __func__, __LINE__));
4454	index -= start;
4455
4456	if (addr) {
4457		addrtmp[0] = addr[0];
4458		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4459		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4460		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4461		addrtmp[1] = addr[4];
4462		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4463	}
4464
4465	if (siba_get_revid(sc->sc_dev) >= 5) {
4466		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4467		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4468	} else {
4469		if (index >= 8) {
4470			bwn_shm_write_4(mac, BWN_SHARED,
4471			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4472			bwn_shm_write_2(mac, BWN_SHARED,
4473			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4474		}
4475	}
4476}
4477
4478static void
4479bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4480    const uint8_t *key)
4481{
4482	unsigned int i;
4483	uint32_t offset;
4484	uint16_t kidx, value;
4485
4486	kidx = BWN_SEC_KEY2FW(mac, index);
4487	bwn_shm_write_2(mac, BWN_SHARED,
4488	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4489
4490	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4491	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4492		value = key[i];
4493		value |= (uint16_t)(key[i + 1]) << 8;
4494		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4495	}
4496}
4497
4498static void
4499bwn_phy_exit(struct bwn_mac *mac)
4500{
4501
4502	mac->mac_phy.rf_onoff(mac, 0);
4503	if (mac->mac_phy.exit != NULL)
4504		mac->mac_phy.exit(mac);
4505}
4506
4507static void
4508bwn_dma_free(struct bwn_mac *mac)
4509{
4510	struct bwn_dma *dma;
4511
4512	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4513		return;
4514	dma = &mac->mac_method.dma;
4515
4516	bwn_dma_ringfree(&dma->rx);
4517	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4518	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4519	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4520	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4521	bwn_dma_ringfree(&dma->mcast);
4522}
4523
4524static void
4525bwn_core_stop(struct bwn_mac *mac)
4526{
4527	struct bwn_softc *sc = mac->mac_sc;
4528
4529	BWN_ASSERT_LOCKED(sc);
4530
4531	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4532		return;
4533
4534	callout_stop(&sc->sc_rfswitch_ch);
4535	callout_stop(&sc->sc_task_ch);
4536	callout_stop(&sc->sc_watchdog_ch);
4537	sc->sc_watchdog_timer = 0;
4538	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4539	BWN_READ_4(mac, BWN_INTR_MASK);
4540	bwn_mac_suspend(mac);
4541
4542	mac->mac_status = BWN_MAC_STATUS_INITED;
4543}
4544
4545static int
4546bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4547{
4548	struct bwn_mac *up_dev = NULL;
4549	struct bwn_mac *down_dev;
4550	struct bwn_mac *mac;
4551	int err, status;
4552	uint8_t gmode;
4553
4554	BWN_ASSERT_LOCKED(sc);
4555
4556	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4557		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4558		    mac->mac_phy.supports_2ghz) {
4559			up_dev = mac;
4560			gmode = 1;
4561		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4562		    mac->mac_phy.supports_5ghz) {
4563			up_dev = mac;
4564			gmode = 0;
4565		} else {
4566			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4567			return (EINVAL);
4568		}
4569		if (up_dev != NULL)
4570			break;
4571	}
4572	if (up_dev == NULL) {
4573		device_printf(sc->sc_dev, "Could not find a device\n");
4574		return (ENODEV);
4575	}
4576	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4577		return (0);
4578
4579	device_printf(sc->sc_dev, "switching to %s-GHz band\n",
4580	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4581
4582	down_dev = sc->sc_curmac;
4583	status = down_dev->mac_status;
4584	if (status >= BWN_MAC_STATUS_STARTED)
4585		bwn_core_stop(down_dev);
4586	if (status >= BWN_MAC_STATUS_INITED)
4587		bwn_core_exit(down_dev);
4588
4589	if (down_dev != up_dev)
4590		bwn_phy_reset(down_dev);
4591
4592	up_dev->mac_phy.gmode = gmode;
4593	if (status >= BWN_MAC_STATUS_INITED) {
4594		err = bwn_core_init(up_dev);
4595		if (err) {
4596			device_printf(sc->sc_dev,
4597			    "fatal: failed to initialize for %s-GHz\n",
4598			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4599			goto fail;
4600		}
4601	}
4602	if (status >= BWN_MAC_STATUS_STARTED)
4603		bwn_core_start(up_dev);
4604	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4605	sc->sc_curmac = up_dev;
4606
4607	return (0);
4608fail:
4609	sc->sc_curmac = NULL;
4610	return (err);
4611}
4612
4613static void
4614bwn_rf_turnon(struct bwn_mac *mac)
4615{
4616
4617	bwn_mac_suspend(mac);
4618	mac->mac_phy.rf_onoff(mac, 1);
4619	mac->mac_phy.rf_on = 1;
4620	bwn_mac_enable(mac);
4621}
4622
4623static void
4624bwn_rf_turnoff(struct bwn_mac *mac)
4625{
4626
4627	bwn_mac_suspend(mac);
4628	mac->mac_phy.rf_onoff(mac, 0);
4629	mac->mac_phy.rf_on = 0;
4630	bwn_mac_enable(mac);
4631}
4632
4633/*
4634 * SSB PHY reset.
4635 *
4636 * XXX TODO: BCMA PHY reset.
4637 */
4638static void
4639bwn_phy_reset(struct bwn_mac *mac)
4640{
4641	struct bwn_softc *sc = mac->mac_sc;
4642
4643	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4644	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4645	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4646	DELAY(1000);
4647	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4648	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4649	DELAY(1000);
4650}
4651
4652static int
4653bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4654{
4655	struct bwn_vap *bvp = BWN_VAP(vap);
4656	struct ieee80211com *ic= vap->iv_ic;
4657	enum ieee80211_state ostate = vap->iv_state;
4658	struct bwn_softc *sc = ic->ic_softc;
4659	struct bwn_mac *mac = sc->sc_curmac;
4660	int error;
4661
4662	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4663	    ieee80211_state_name[vap->iv_state],
4664	    ieee80211_state_name[nstate]);
4665
4666	error = bvp->bv_newstate(vap, nstate, arg);
4667	if (error != 0)
4668		return (error);
4669
4670	BWN_LOCK(sc);
4671
4672	bwn_led_newstate(mac, nstate);
4673
4674	/*
4675	 * Clear the BSSID when we stop a STA
4676	 */
4677	if (vap->iv_opmode == IEEE80211_M_STA) {
4678		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4679			/*
4680			 * Clear out the BSSID.  If we reassociate to
4681			 * the same AP, this will reinialize things
4682			 * correctly...
4683			 */
4684			if (ic->ic_opmode == IEEE80211_M_STA &&
4685			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4686				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4687				bwn_set_macaddr(mac);
4688			}
4689		}
4690	}
4691
4692	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4693	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4694		/* XXX nothing to do? */
4695	} else if (nstate == IEEE80211_S_RUN) {
4696		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4697		bwn_set_opmode(mac);
4698		bwn_set_pretbtt(mac);
4699		bwn_spu_setdelay(mac, 0);
4700		bwn_set_macaddr(mac);
4701	}
4702
4703	BWN_UNLOCK(sc);
4704
4705	return (error);
4706}
4707
4708static void
4709bwn_set_pretbtt(struct bwn_mac *mac)
4710{
4711	struct bwn_softc *sc = mac->mac_sc;
4712	struct ieee80211com *ic = &sc->sc_ic;
4713	uint16_t pretbtt;
4714
4715	if (ic->ic_opmode == IEEE80211_M_IBSS)
4716		pretbtt = 2;
4717	else
4718		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4719	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4720	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4721}
4722
4723static int
4724bwn_intr(void *arg)
4725{
4726	struct bwn_mac *mac = arg;
4727	struct bwn_softc *sc = mac->mac_sc;
4728	uint32_t reason;
4729
4730	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4731	    (sc->sc_flags & BWN_FLAG_INVALID))
4732		return (FILTER_STRAY);
4733
4734	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4735	if (reason == 0xffffffff)	/* shared IRQ */
4736		return (FILTER_STRAY);
4737	reason &= mac->mac_intr_mask;
4738	if (reason == 0)
4739		return (FILTER_HANDLED);
4740
4741	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4742	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4743	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4744	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4745	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4746	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4747	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4748	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4749	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4750	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4751	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4752
4753	/* Disable interrupts. */
4754	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4755
4756	mac->mac_reason_intr = reason;
4757
4758	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4759	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4760
4761	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4762	return (FILTER_HANDLED);
4763}
4764
4765static void
4766bwn_intrtask(void *arg, int npending)
4767{
4768	struct bwn_mac *mac = arg;
4769	struct bwn_softc *sc = mac->mac_sc;
4770	uint32_t merged = 0;
4771	int i, tx = 0, rx = 0;
4772
4773	BWN_LOCK(sc);
4774	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4775	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4776		BWN_UNLOCK(sc);
4777		return;
4778	}
4779
4780	for (i = 0; i < N(mac->mac_reason); i++)
4781		merged |= mac->mac_reason[i];
4782
4783	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4784		device_printf(sc->sc_dev, "MAC trans error\n");
4785
4786	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4787		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4788		mac->mac_phy.txerrors--;
4789		if (mac->mac_phy.txerrors == 0) {
4790			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4791			bwn_restart(mac, "PHY TX errors");
4792		}
4793	}
4794
4795	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4796		if (merged & BWN_DMAINTR_FATALMASK) {
4797			device_printf(sc->sc_dev,
4798			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4799			    mac->mac_reason[0], mac->mac_reason[1],
4800			    mac->mac_reason[2], mac->mac_reason[3],
4801			    mac->mac_reason[4], mac->mac_reason[5]);
4802			bwn_restart(mac, "DMA error");
4803			BWN_UNLOCK(sc);
4804			return;
4805		}
4806		if (merged & BWN_DMAINTR_NONFATALMASK) {
4807			device_printf(sc->sc_dev,
4808			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4809			    mac->mac_reason[0], mac->mac_reason[1],
4810			    mac->mac_reason[2], mac->mac_reason[3],
4811			    mac->mac_reason[4], mac->mac_reason[5]);
4812		}
4813	}
4814
4815	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4816		bwn_intr_ucode_debug(mac);
4817	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4818		bwn_intr_tbtt_indication(mac);
4819	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4820		bwn_intr_atim_end(mac);
4821	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4822		bwn_intr_beacon(mac);
4823	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4824		bwn_intr_pmq(mac);
4825	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4826		bwn_intr_noise(mac);
4827
4828	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4829		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4830			bwn_dma_rx(mac->mac_method.dma.rx);
4831			rx = 1;
4832		}
4833	} else
4834		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4835
4836	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4837	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4838	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4839	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4840	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4841
4842	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4843		bwn_intr_txeof(mac);
4844		tx = 1;
4845	}
4846
4847	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4848
4849	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4850		int evt = BWN_LED_EVENT_NONE;
4851
4852		if (tx && rx) {
4853			if (sc->sc_rx_rate > sc->sc_tx_rate)
4854				evt = BWN_LED_EVENT_RX;
4855			else
4856				evt = BWN_LED_EVENT_TX;
4857		} else if (tx) {
4858			evt = BWN_LED_EVENT_TX;
4859		} else if (rx) {
4860			evt = BWN_LED_EVENT_RX;
4861		} else if (rx == 0) {
4862			evt = BWN_LED_EVENT_POLL;
4863		}
4864
4865		if (evt != BWN_LED_EVENT_NONE)
4866			bwn_led_event(mac, evt);
4867       }
4868
4869	if (mbufq_first(&sc->sc_snd) != NULL)
4870		bwn_start(sc);
4871
4872	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4873	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4874
4875	BWN_UNLOCK(sc);
4876}
4877
4878static void
4879bwn_restart(struct bwn_mac *mac, const char *msg)
4880{
4881	struct bwn_softc *sc = mac->mac_sc;
4882	struct ieee80211com *ic = &sc->sc_ic;
4883
4884	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4885		return;
4886
4887	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4888	ieee80211_runtask(ic, &mac->mac_hwreset);
4889}
4890
4891static void
4892bwn_intr_ucode_debug(struct bwn_mac *mac)
4893{
4894	struct bwn_softc *sc = mac->mac_sc;
4895	uint16_t reason;
4896
4897	if (mac->mac_fw.opensource == 0)
4898		return;
4899
4900	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4901	switch (reason) {
4902	case BWN_DEBUGINTR_PANIC:
4903		bwn_handle_fwpanic(mac);
4904		break;
4905	case BWN_DEBUGINTR_DUMP_SHM:
4906		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4907		break;
4908	case BWN_DEBUGINTR_DUMP_REGS:
4909		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4910		break;
4911	case BWN_DEBUGINTR_MARKER:
4912		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4913		break;
4914	default:
4915		device_printf(sc->sc_dev,
4916		    "ucode debug unknown reason: %#x\n", reason);
4917	}
4918
4919	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4920	    BWN_DEBUGINTR_ACK);
4921}
4922
4923static void
4924bwn_intr_tbtt_indication(struct bwn_mac *mac)
4925{
4926	struct bwn_softc *sc = mac->mac_sc;
4927	struct ieee80211com *ic = &sc->sc_ic;
4928
4929	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4930		bwn_psctl(mac, 0);
4931	if (ic->ic_opmode == IEEE80211_M_IBSS)
4932		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4933}
4934
4935static void
4936bwn_intr_atim_end(struct bwn_mac *mac)
4937{
4938
4939	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4940		BWN_WRITE_4(mac, BWN_MACCMD,
4941		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4942		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4943	}
4944}
4945
4946static void
4947bwn_intr_beacon(struct bwn_mac *mac)
4948{
4949	struct bwn_softc *sc = mac->mac_sc;
4950	struct ieee80211com *ic = &sc->sc_ic;
4951	uint32_t cmd, beacon0, beacon1;
4952
4953	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4954	    ic->ic_opmode == IEEE80211_M_MBSS)
4955		return;
4956
4957	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
4958
4959	cmd = BWN_READ_4(mac, BWN_MACCMD);
4960	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
4961	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
4962
4963	if (beacon0 && beacon1) {
4964		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
4965		mac->mac_intr_mask |= BWN_INTR_BEACON;
4966		return;
4967	}
4968
4969	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
4970		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
4971		bwn_load_beacon0(mac);
4972		bwn_load_beacon1(mac);
4973		cmd = BWN_READ_4(mac, BWN_MACCMD);
4974		cmd |= BWN_MACCMD_BEACON0_VALID;
4975		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4976	} else {
4977		if (!beacon0) {
4978			bwn_load_beacon0(mac);
4979			cmd = BWN_READ_4(mac, BWN_MACCMD);
4980			cmd |= BWN_MACCMD_BEACON0_VALID;
4981			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4982		} else if (!beacon1) {
4983			bwn_load_beacon1(mac);
4984			cmd = BWN_READ_4(mac, BWN_MACCMD);
4985			cmd |= BWN_MACCMD_BEACON1_VALID;
4986			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4987		}
4988	}
4989}
4990
4991static void
4992bwn_intr_pmq(struct bwn_mac *mac)
4993{
4994	uint32_t tmp;
4995
4996	while (1) {
4997		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
4998		if (!(tmp & 0x00000008))
4999			break;
5000	}
5001	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5002}
5003
5004static void
5005bwn_intr_noise(struct bwn_mac *mac)
5006{
5007	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5008	uint16_t tmp;
5009	uint8_t noise[4];
5010	uint8_t i, j;
5011	int32_t average;
5012
5013	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5014		return;
5015
5016	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5017	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5018	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5019	    noise[3] == 0x7f)
5020		goto new;
5021
5022	KASSERT(mac->mac_noise.noi_nsamples < 8,
5023	    ("%s:%d: fail", __func__, __LINE__));
5024	i = mac->mac_noise.noi_nsamples;
5025	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5026	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5027	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5028	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5029	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5030	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5031	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5032	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5033	mac->mac_noise.noi_nsamples++;
5034	if (mac->mac_noise.noi_nsamples == 8) {
5035		average = 0;
5036		for (i = 0; i < 8; i++) {
5037			for (j = 0; j < 4; j++)
5038				average += mac->mac_noise.noi_samples[i][j];
5039		}
5040		average = (((average / 32) * 125) + 64) / 128;
5041		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5042		if (tmp >= 8)
5043			average += 2;
5044		else
5045			average -= 25;
5046		average -= (tmp == 8) ? 72 : 48;
5047
5048		mac->mac_stats.link_noise = average;
5049		mac->mac_noise.noi_running = 0;
5050		return;
5051	}
5052new:
5053	bwn_noise_gensample(mac);
5054}
5055
5056static int
5057bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5058{
5059	struct bwn_mac *mac = prq->prq_mac;
5060	struct bwn_softc *sc = mac->mac_sc;
5061	unsigned int i;
5062
5063	BWN_ASSERT_LOCKED(sc);
5064
5065	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5066		return (0);
5067
5068	for (i = 0; i < 5000; i++) {
5069		if (bwn_pio_rxeof(prq) == 0)
5070			break;
5071	}
5072	if (i >= 5000)
5073		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5074	return ((i > 0) ? 1 : 0);
5075}
5076
5077static void
5078bwn_dma_rx(struct bwn_dma_ring *dr)
5079{
5080	int slot, curslot;
5081
5082	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5083	curslot = dr->get_curslot(dr);
5084	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5085	    ("%s:%d: fail", __func__, __LINE__));
5086
5087	slot = dr->dr_curslot;
5088	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5089		bwn_dma_rxeof(dr, &slot);
5090
5091	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5092	    BUS_DMASYNC_PREWRITE);
5093
5094	dr->set_curslot(dr, slot);
5095	dr->dr_curslot = slot;
5096}
5097
5098static void
5099bwn_intr_txeof(struct bwn_mac *mac)
5100{
5101	struct bwn_txstatus stat;
5102	uint32_t stat0, stat1;
5103	uint16_t tmp;
5104
5105	BWN_ASSERT_LOCKED(mac->mac_sc);
5106
5107	while (1) {
5108		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5109		if (!(stat0 & 0x00000001))
5110			break;
5111		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5112
5113		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5114		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5115		    __func__,
5116		    stat0,
5117		    stat1);
5118
5119		stat.cookie = (stat0 >> 16);
5120		stat.seq = (stat1 & 0x0000ffff);
5121		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5122		tmp = (stat0 & 0x0000ffff);
5123		stat.framecnt = ((tmp & 0xf000) >> 12);
5124		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5125		stat.sreason = ((tmp & 0x001c) >> 2);
5126		stat.pm = (tmp & 0x0080) ? 1 : 0;
5127		stat.im = (tmp & 0x0040) ? 1 : 0;
5128		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5129		stat.ack = (tmp & 0x0002) ? 1 : 0;
5130
5131		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5132		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5133		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5134		    __func__,
5135		    stat.cookie,
5136		    stat.seq,
5137		    stat.phy_stat,
5138		    stat.framecnt,
5139		    stat.rtscnt,
5140		    stat.sreason,
5141		    stat.pm,
5142		    stat.im,
5143		    stat.ampdu,
5144		    stat.ack);
5145
5146		bwn_handle_txeof(mac, &stat);
5147	}
5148}
5149
5150static void
5151bwn_hwreset(void *arg, int npending)
5152{
5153	struct bwn_mac *mac = arg;
5154	struct bwn_softc *sc = mac->mac_sc;
5155	int error = 0;
5156	int prev_status;
5157
5158	BWN_LOCK(sc);
5159
5160	prev_status = mac->mac_status;
5161	if (prev_status >= BWN_MAC_STATUS_STARTED)
5162		bwn_core_stop(mac);
5163	if (prev_status >= BWN_MAC_STATUS_INITED)
5164		bwn_core_exit(mac);
5165
5166	if (prev_status >= BWN_MAC_STATUS_INITED) {
5167		error = bwn_core_init(mac);
5168		if (error)
5169			goto out;
5170	}
5171	if (prev_status >= BWN_MAC_STATUS_STARTED)
5172		bwn_core_start(mac);
5173out:
5174	if (error) {
5175		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5176		sc->sc_curmac = NULL;
5177	}
5178	BWN_UNLOCK(sc);
5179}
5180
5181static void
5182bwn_handle_fwpanic(struct bwn_mac *mac)
5183{
5184	struct bwn_softc *sc = mac->mac_sc;
5185	uint16_t reason;
5186
5187	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5188	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5189
5190	if (reason == BWN_FWPANIC_RESTART)
5191		bwn_restart(mac, "ucode panic");
5192}
5193
5194static void
5195bwn_load_beacon0(struct bwn_mac *mac)
5196{
5197
5198	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5199}
5200
5201static void
5202bwn_load_beacon1(struct bwn_mac *mac)
5203{
5204
5205	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5206}
5207
5208static uint32_t
5209bwn_jssi_read(struct bwn_mac *mac)
5210{
5211	uint32_t val = 0;
5212
5213	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5214	val <<= 16;
5215	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5216
5217	return (val);
5218}
5219
5220static void
5221bwn_noise_gensample(struct bwn_mac *mac)
5222{
5223	uint32_t jssi = 0x7f7f7f7f;
5224
5225	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5226	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5227	BWN_WRITE_4(mac, BWN_MACCMD,
5228	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5229}
5230
5231static int
5232bwn_dma_freeslot(struct bwn_dma_ring *dr)
5233{
5234	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5235
5236	return (dr->dr_numslots - dr->dr_usedslot);
5237}
5238
5239static int
5240bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5241{
5242	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5243
5244	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5245	    ("%s:%d: fail", __func__, __LINE__));
5246	if (slot == dr->dr_numslots - 1)
5247		return (0);
5248	return (slot + 1);
5249}
5250
5251static void
5252bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5253{
5254	struct bwn_mac *mac = dr->dr_mac;
5255	struct bwn_softc *sc = mac->mac_sc;
5256	struct bwn_dma *dma = &mac->mac_method.dma;
5257	struct bwn_dmadesc_generic *desc;
5258	struct bwn_dmadesc_meta *meta;
5259	struct bwn_rxhdr4 *rxhdr;
5260	struct mbuf *m;
5261	uint32_t macstat;
5262	int32_t tmp;
5263	int cnt = 0;
5264	uint16_t len;
5265
5266	dr->getdesc(dr, *slot, &desc, &meta);
5267
5268	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5269	m = meta->mt_m;
5270
5271	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5272		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5273		return;
5274	}
5275
5276	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5277	len = le16toh(rxhdr->frame_len);
5278	if (len <= 0) {
5279		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5280		return;
5281	}
5282	if (bwn_dma_check_redzone(dr, m)) {
5283		device_printf(sc->sc_dev, "redzone error.\n");
5284		bwn_dma_set_redzone(dr, m);
5285		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5286		    BUS_DMASYNC_PREWRITE);
5287		return;
5288	}
5289	if (len > dr->dr_rx_bufsize) {
5290		tmp = len;
5291		while (1) {
5292			dr->getdesc(dr, *slot, &desc, &meta);
5293			bwn_dma_set_redzone(dr, meta->mt_m);
5294			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5295			    BUS_DMASYNC_PREWRITE);
5296			*slot = bwn_dma_nextslot(dr, *slot);
5297			cnt++;
5298			tmp -= dr->dr_rx_bufsize;
5299			if (tmp <= 0)
5300				break;
5301		}
5302		device_printf(sc->sc_dev, "too small buffer "
5303		       "(len %u buffer %u dropped %d)\n",
5304		       len, dr->dr_rx_bufsize, cnt);
5305		return;
5306	}
5307	macstat = le32toh(rxhdr->mac_status);
5308	if (macstat & BWN_RX_MAC_FCSERR) {
5309		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5310			device_printf(sc->sc_dev, "RX drop\n");
5311			return;
5312		}
5313	}
5314
5315	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5316	m_adj(m, dr->dr_frameoffset);
5317
5318	bwn_rxeof(dr->dr_mac, m, rxhdr);
5319}
5320
5321static void
5322bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5323{
5324	struct bwn_softc *sc = mac->mac_sc;
5325	struct bwn_stats *stats = &mac->mac_stats;
5326
5327	BWN_ASSERT_LOCKED(mac->mac_sc);
5328
5329	if (status->im)
5330		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5331	if (status->ampdu)
5332		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5333	if (status->rtscnt) {
5334		if (status->rtscnt == 0xf)
5335			stats->rtsfail++;
5336		else
5337			stats->rts++;
5338	}
5339
5340	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5341		bwn_dma_handle_txeof(mac, status);
5342	} else {
5343		bwn_pio_handle_txeof(mac, status);
5344	}
5345
5346	bwn_phy_txpower_check(mac, 0);
5347}
5348
5349static uint8_t
5350bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5351{
5352	struct bwn_mac *mac = prq->prq_mac;
5353	struct bwn_softc *sc = mac->mac_sc;
5354	struct bwn_rxhdr4 rxhdr;
5355	struct mbuf *m;
5356	uint32_t ctl32, macstat, v32;
5357	unsigned int i, padding;
5358	uint16_t ctl16, len, totlen, v16;
5359	unsigned char *mp;
5360	char *data;
5361
5362	memset(&rxhdr, 0, sizeof(rxhdr));
5363
5364	if (prq->prq_rev >= 8) {
5365		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5366		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5367			return (0);
5368		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5369		    BWN_PIO8_RXCTL_FRAMEREADY);
5370		for (i = 0; i < 10; i++) {
5371			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5372			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5373				goto ready;
5374			DELAY(10);
5375		}
5376	} else {
5377		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5378		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5379			return (0);
5380		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5381		    BWN_PIO_RXCTL_FRAMEREADY);
5382		for (i = 0; i < 10; i++) {
5383			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5384			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5385				goto ready;
5386			DELAY(10);
5387		}
5388	}
5389	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5390	return (1);
5391ready:
5392	if (prq->prq_rev >= 8)
5393		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5394		    prq->prq_base + BWN_PIO8_RXDATA);
5395	else
5396		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5397		    prq->prq_base + BWN_PIO_RXDATA);
5398	len = le16toh(rxhdr.frame_len);
5399	if (len > 0x700) {
5400		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5401		goto error;
5402	}
5403	if (len == 0) {
5404		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5405		goto error;
5406	}
5407
5408	macstat = le32toh(rxhdr.mac_status);
5409	if (macstat & BWN_RX_MAC_FCSERR) {
5410		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5411			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5412			goto error;
5413		}
5414	}
5415
5416	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5417	totlen = len + padding;
5418	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5419	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5420	if (m == NULL) {
5421		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5422		goto error;
5423	}
5424	mp = mtod(m, unsigned char *);
5425	if (prq->prq_rev >= 8) {
5426		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5427		    prq->prq_base + BWN_PIO8_RXDATA);
5428		if (totlen & 3) {
5429			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5430			data = &(mp[totlen - 1]);
5431			switch (totlen & 3) {
5432			case 3:
5433				*data = (v32 >> 16);
5434				data--;
5435			case 2:
5436				*data = (v32 >> 8);
5437				data--;
5438			case 1:
5439				*data = v32;
5440			}
5441		}
5442	} else {
5443		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5444		    prq->prq_base + BWN_PIO_RXDATA);
5445		if (totlen & 1) {
5446			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5447			mp[totlen - 1] = v16;
5448		}
5449	}
5450
5451	m->m_len = m->m_pkthdr.len = totlen;
5452
5453	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5454
5455	return (1);
5456error:
5457	if (prq->prq_rev >= 8)
5458		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5459		    BWN_PIO8_RXCTL_DATAREADY);
5460	else
5461		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5462	return (1);
5463}
5464
5465static int
5466bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5467    struct bwn_dmadesc_meta *meta, int init)
5468{
5469	struct bwn_mac *mac = dr->dr_mac;
5470	struct bwn_dma *dma = &mac->mac_method.dma;
5471	struct bwn_rxhdr4 *hdr;
5472	bus_dmamap_t map;
5473	bus_addr_t paddr;
5474	struct mbuf *m;
5475	int error;
5476
5477	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5478	if (m == NULL) {
5479		error = ENOBUFS;
5480
5481		/*
5482		 * If the NIC is up and running, we need to:
5483		 * - Clear RX buffer's header.
5484		 * - Restore RX descriptor settings.
5485		 */
5486		if (init)
5487			return (error);
5488		else
5489			goto back;
5490	}
5491	m->m_len = m->m_pkthdr.len = MCLBYTES;
5492
5493	bwn_dma_set_redzone(dr, m);
5494
5495	/*
5496	 * Try to load RX buf into temporary DMA map
5497	 */
5498	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5499	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5500	if (error) {
5501		m_freem(m);
5502
5503		/*
5504		 * See the comment above
5505		 */
5506		if (init)
5507			return (error);
5508		else
5509			goto back;
5510	}
5511
5512	if (!init)
5513		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5514	meta->mt_m = m;
5515	meta->mt_paddr = paddr;
5516
5517	/*
5518	 * Swap RX buf's DMA map with the loaded temporary one
5519	 */
5520	map = meta->mt_dmap;
5521	meta->mt_dmap = dr->dr_spare_dmap;
5522	dr->dr_spare_dmap = map;
5523
5524back:
5525	/*
5526	 * Clear RX buf header
5527	 */
5528	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5529	bzero(hdr, sizeof(*hdr));
5530	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5531	    BUS_DMASYNC_PREWRITE);
5532
5533	/*
5534	 * Setup RX buf descriptor
5535	 */
5536	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5537	    sizeof(*hdr), 0, 0, 0);
5538	return (error);
5539}
5540
5541static void
5542bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5543		 bus_size_t mapsz __unused, int error)
5544{
5545
5546	if (!error) {
5547		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5548		*((bus_addr_t *)arg) = seg->ds_addr;
5549	}
5550}
5551
5552static int
5553bwn_hwrate2ieeerate(int rate)
5554{
5555
5556	switch (rate) {
5557	case BWN_CCK_RATE_1MB:
5558		return (2);
5559	case BWN_CCK_RATE_2MB:
5560		return (4);
5561	case BWN_CCK_RATE_5MB:
5562		return (11);
5563	case BWN_CCK_RATE_11MB:
5564		return (22);
5565	case BWN_OFDM_RATE_6MB:
5566		return (12);
5567	case BWN_OFDM_RATE_9MB:
5568		return (18);
5569	case BWN_OFDM_RATE_12MB:
5570		return (24);
5571	case BWN_OFDM_RATE_18MB:
5572		return (36);
5573	case BWN_OFDM_RATE_24MB:
5574		return (48);
5575	case BWN_OFDM_RATE_36MB:
5576		return (72);
5577	case BWN_OFDM_RATE_48MB:
5578		return (96);
5579	case BWN_OFDM_RATE_54MB:
5580		return (108);
5581	default:
5582		printf("Ooops\n");
5583		return (0);
5584	}
5585}
5586
5587/*
5588 * Post process the RX provided RSSI.
5589 *
5590 * Valid for A, B, G, LP PHYs.
5591 */
5592static int8_t
5593bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5594    int ofdm, int adjust_2053, int adjust_2050)
5595{
5596	struct bwn_phy *phy = &mac->mac_phy;
5597	struct bwn_phy_g *gphy = &phy->phy_g;
5598	int tmp;
5599
5600	switch (phy->rf_ver) {
5601	case 0x2050:
5602		if (ofdm) {
5603			tmp = in_rssi;
5604			if (tmp > 127)
5605				tmp -= 256;
5606			tmp = tmp * 73 / 64;
5607			if (adjust_2050)
5608				tmp += 25;
5609			else
5610				tmp -= 3;
5611		} else {
5612			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5613			    & BWN_BFL_RSSI) {
5614				if (in_rssi > 63)
5615					in_rssi = 63;
5616				tmp = gphy->pg_nrssi_lt[in_rssi];
5617				tmp = (31 - tmp) * -131 / 128 - 57;
5618			} else {
5619				tmp = in_rssi;
5620				tmp = (31 - tmp) * -149 / 128 - 68;
5621			}
5622			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5623				tmp += 25;
5624		}
5625		break;
5626	case 0x2060:
5627		if (in_rssi > 127)
5628			tmp = in_rssi - 256;
5629		else
5630			tmp = in_rssi;
5631		break;
5632	default:
5633		tmp = in_rssi;
5634		tmp = (tmp - 11) * 103 / 64;
5635		if (adjust_2053)
5636			tmp -= 109;
5637		else
5638			tmp -= 83;
5639	}
5640
5641	return (tmp);
5642}
5643
5644static void
5645bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5646{
5647	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5648	struct bwn_plcp6 *plcp;
5649	struct bwn_softc *sc = mac->mac_sc;
5650	struct ieee80211_frame_min *wh;
5651	struct ieee80211_node *ni;
5652	struct ieee80211com *ic = &sc->sc_ic;
5653	uint32_t macstat;
5654	int padding, rate, rssi = 0, noise = 0, type;
5655	uint16_t phytype, phystat0, phystat3, chanstat;
5656	unsigned char *mp = mtod(m, unsigned char *);
5657	static int rx_mac_dec_rpt = 0;
5658
5659	BWN_ASSERT_LOCKED(sc);
5660
5661	phystat0 = le16toh(rxhdr->phy_status0);
5662	phystat3 = le16toh(rxhdr->phy_status3);
5663
5664	/* XXX Note: mactime, macstat, chanstat need fixing for fw 598 */
5665	macstat = le32toh(rxhdr->mac_status);
5666	chanstat = le16toh(rxhdr->channel);
5667
5668	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5669
5670	if (macstat & BWN_RX_MAC_FCSERR)
5671		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5672	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5673		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5674	if (macstat & BWN_RX_MAC_DECERR)
5675		goto drop;
5676
5677	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5678	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5679		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5680		    m->m_pkthdr.len);
5681		goto drop;
5682	}
5683	plcp = (struct bwn_plcp6 *)(mp + padding);
5684	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5685	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5686		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5687		    m->m_pkthdr.len);
5688		goto drop;
5689	}
5690	wh = mtod(m, struct ieee80211_frame_min *);
5691
5692	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5693		device_printf(sc->sc_dev,
5694		    "RX decryption attempted (old %d keyidx %#x)\n",
5695		    BWN_ISOLDFMT(mac),
5696		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5697
5698	if (phystat0 & BWN_RX_PHYST0_OFDM)
5699		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5700		    phytype == BWN_PHYTYPE_A);
5701	else
5702		rate = bwn_plcp_get_cckrate(mac, plcp);
5703	if (rate == -1) {
5704		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5705			goto drop;
5706	}
5707	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5708
5709	/* rssi/noise */
5710	switch (phytype) {
5711	case BWN_PHYTYPE_A:
5712	case BWN_PHYTYPE_B:
5713	case BWN_PHYTYPE_G:
5714	case BWN_PHYTYPE_LP:
5715		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5716		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5717		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5718		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5719		break;
5720	default:
5721		/* XXX TODO: implement rssi for other PHYs */
5722		break;
5723	}
5724
5725	noise = mac->mac_stats.link_noise;
5726
5727	/* RX radio tap */
5728	if (ieee80211_radiotap_active(ic))
5729		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5730	m_adj(m, -IEEE80211_CRC_LEN);
5731
5732	BWN_UNLOCK(sc);
5733
5734	ni = ieee80211_find_rxnode(ic, wh);
5735	if (ni != NULL) {
5736		type = ieee80211_input(ni, m, rssi, noise);
5737		ieee80211_free_node(ni);
5738	} else
5739		type = ieee80211_input_all(ic, m, rssi, noise);
5740
5741	BWN_LOCK(sc);
5742	return;
5743drop:
5744	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5745}
5746
5747static void
5748bwn_dma_handle_txeof(struct bwn_mac *mac,
5749    const struct bwn_txstatus *status)
5750{
5751	struct bwn_dma *dma = &mac->mac_method.dma;
5752	struct bwn_dma_ring *dr;
5753	struct bwn_dmadesc_generic *desc;
5754	struct bwn_dmadesc_meta *meta;
5755	struct bwn_softc *sc = mac->mac_sc;
5756	int slot;
5757	int retrycnt = 0;
5758
5759	BWN_ASSERT_LOCKED(sc);
5760
5761	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5762	if (dr == NULL) {
5763		device_printf(sc->sc_dev, "failed to parse cookie\n");
5764		return;
5765	}
5766	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5767
5768	while (1) {
5769		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5770		    ("%s:%d: fail", __func__, __LINE__));
5771		dr->getdesc(dr, slot, &desc, &meta);
5772
5773		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5774			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5775		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5776			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5777
5778		if (meta->mt_islast) {
5779			KASSERT(meta->mt_m != NULL,
5780			    ("%s:%d: fail", __func__, __LINE__));
5781
5782			/*
5783			 * If we don't get an ACK, then we should log the
5784			 * full framecnt.  That may be 0 if it's a PHY
5785			 * failure, so ensure that gets logged as some
5786			 * retry attempt.
5787			 */
5788			if (status->ack) {
5789				retrycnt = status->framecnt - 1;
5790			} else {
5791				retrycnt = status->framecnt;
5792				if (retrycnt == 0)
5793					retrycnt = 1;
5794			}
5795			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5796			    status->ack ?
5797			      IEEE80211_RATECTL_TX_SUCCESS :
5798			      IEEE80211_RATECTL_TX_FAILURE,
5799			    &retrycnt, 0);
5800			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5801			meta->mt_ni = NULL;
5802			meta->mt_m = NULL;
5803		} else
5804			KASSERT(meta->mt_m == NULL,
5805			    ("%s:%d: fail", __func__, __LINE__));
5806
5807		dr->dr_usedslot--;
5808		if (meta->mt_islast)
5809			break;
5810		slot = bwn_dma_nextslot(dr, slot);
5811	}
5812	sc->sc_watchdog_timer = 0;
5813	if (dr->dr_stop) {
5814		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5815		    ("%s:%d: fail", __func__, __LINE__));
5816		dr->dr_stop = 0;
5817	}
5818}
5819
5820static void
5821bwn_pio_handle_txeof(struct bwn_mac *mac,
5822    const struct bwn_txstatus *status)
5823{
5824	struct bwn_pio_txqueue *tq;
5825	struct bwn_pio_txpkt *tp = NULL;
5826	struct bwn_softc *sc = mac->mac_sc;
5827	int retrycnt = 0;
5828
5829	BWN_ASSERT_LOCKED(sc);
5830
5831	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5832	if (tq == NULL)
5833		return;
5834
5835	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5836	tq->tq_free++;
5837
5838	if (tp->tp_ni != NULL) {
5839		/*
5840		 * Do any tx complete callback.  Note this must
5841		 * be done before releasing the node reference.
5842		 */
5843
5844		/*
5845		 * If we don't get an ACK, then we should log the
5846		 * full framecnt.  That may be 0 if it's a PHY
5847		 * failure, so ensure that gets logged as some
5848		 * retry attempt.
5849		 */
5850		if (status->ack) {
5851			retrycnt = status->framecnt - 1;
5852		} else {
5853			retrycnt = status->framecnt;
5854			if (retrycnt == 0)
5855				retrycnt = 1;
5856		}
5857		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5858		    status->ack ?
5859		      IEEE80211_RATECTL_TX_SUCCESS :
5860		      IEEE80211_RATECTL_TX_FAILURE,
5861		    &retrycnt, 0);
5862
5863		if (tp->tp_m->m_flags & M_TXCB)
5864			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5865		ieee80211_free_node(tp->tp_ni);
5866		tp->tp_ni = NULL;
5867	}
5868	m_freem(tp->tp_m);
5869	tp->tp_m = NULL;
5870	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5871
5872	sc->sc_watchdog_timer = 0;
5873}
5874
5875static void
5876bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5877{
5878	struct bwn_softc *sc = mac->mac_sc;
5879	struct bwn_phy *phy = &mac->mac_phy;
5880	struct ieee80211com *ic = &sc->sc_ic;
5881	unsigned long now;
5882	int result;
5883
5884	BWN_GETTIME(now);
5885
5886	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5887		return;
5888	phy->nexttime = now + 2 * 1000;
5889
5890	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5891	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5892		return;
5893
5894	if (phy->recalc_txpwr != NULL) {
5895		result = phy->recalc_txpwr(mac,
5896		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5897		if (result == BWN_TXPWR_RES_DONE)
5898			return;
5899		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
5900		    ("%s: fail", __func__));
5901		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
5902
5903		ieee80211_runtask(ic, &mac->mac_txpower);
5904	}
5905}
5906
5907static uint16_t
5908bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
5909{
5910
5911	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
5912}
5913
5914static uint32_t
5915bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
5916{
5917
5918	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
5919}
5920
5921static void
5922bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
5923{
5924
5925	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
5926}
5927
5928static void
5929bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
5930{
5931
5932	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
5933}
5934
5935static int
5936bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
5937{
5938
5939	switch (rate) {
5940	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
5941	case 12:
5942		return (BWN_OFDM_RATE_6MB);
5943	case 18:
5944		return (BWN_OFDM_RATE_9MB);
5945	case 24:
5946		return (BWN_OFDM_RATE_12MB);
5947	case 36:
5948		return (BWN_OFDM_RATE_18MB);
5949	case 48:
5950		return (BWN_OFDM_RATE_24MB);
5951	case 72:
5952		return (BWN_OFDM_RATE_36MB);
5953	case 96:
5954		return (BWN_OFDM_RATE_48MB);
5955	case 108:
5956		return (BWN_OFDM_RATE_54MB);
5957	/* CCK rates (NB: not IEEE std, device-specific) */
5958	case 2:
5959		return (BWN_CCK_RATE_1MB);
5960	case 4:
5961		return (BWN_CCK_RATE_2MB);
5962	case 11:
5963		return (BWN_CCK_RATE_5MB);
5964	case 22:
5965		return (BWN_CCK_RATE_11MB);
5966	}
5967
5968	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
5969	return (BWN_CCK_RATE_1MB);
5970}
5971
5972static int
5973bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
5974    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
5975{
5976	const struct bwn_phy *phy = &mac->mac_phy;
5977	struct bwn_softc *sc = mac->mac_sc;
5978	struct ieee80211_frame *wh;
5979	struct ieee80211_frame *protwh;
5980	struct ieee80211_frame_cts *cts;
5981	struct ieee80211_frame_rts *rts;
5982	const struct ieee80211_txparam *tp;
5983	struct ieee80211vap *vap = ni->ni_vap;
5984	struct ieee80211com *ic = &sc->sc_ic;
5985	struct mbuf *mprot;
5986	unsigned int len;
5987	uint32_t macctl = 0;
5988	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
5989	uint16_t phyctl = 0;
5990	uint8_t rate, rate_fb;
5991
5992	wh = mtod(m, struct ieee80211_frame *);
5993	memset(txhdr, 0, sizeof(*txhdr));
5994
5995	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
5996	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
5997	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
5998
5999	/*
6000	 * Find TX rate
6001	 */
6002	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6003	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6004		rate = rate_fb = tp->mgmtrate;
6005	else if (ismcast)
6006		rate = rate_fb = tp->mcastrate;
6007	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6008		rate = rate_fb = tp->ucastrate;
6009	else {
6010		/* XXX TODO: don't fall back to CCK rates for OFDM */
6011		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6012		rate = ni->ni_txrate;
6013
6014		if (rix > 0)
6015			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6016			    IEEE80211_RATE_VAL;
6017		else
6018			rate_fb = rate;
6019	}
6020
6021	sc->sc_tx_rate = rate;
6022
6023	/* Note: this maps the select ieee80211 rate to hardware rate */
6024	rate = bwn_ieeerate2hwrate(sc, rate);
6025	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6026
6027	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6028	    bwn_plcp_getcck(rate);
6029	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6030	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6031
6032	/* XXX rate/rate_fb is the hardware rate */
6033	if ((rate_fb == rate) ||
6034	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6035	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6036		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6037	else
6038		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6039		    m->m_pkthdr.len, rate, isshort);
6040
6041	/* XXX TX encryption */
6042	bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
6043	    (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
6044	    (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
6045	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6046	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6047	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6048
6049	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6050	    BWN_TX_EFT_FB_CCK;
6051	txhdr->chan = phy->chan;
6052	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6053	    BWN_TX_PHY_ENC_CCK;
6054	/* XXX preamble? obey net80211 */
6055	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6056	     rate == BWN_CCK_RATE_11MB))
6057		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6058
6059	/* XXX TX antenna selection */
6060
6061	switch (bwn_antenna_sanitize(mac, 0)) {
6062	case 0:
6063		phyctl |= BWN_TX_PHY_ANT01AUTO;
6064		break;
6065	case 1:
6066		phyctl |= BWN_TX_PHY_ANT0;
6067		break;
6068	case 2:
6069		phyctl |= BWN_TX_PHY_ANT1;
6070		break;
6071	case 3:
6072		phyctl |= BWN_TX_PHY_ANT2;
6073		break;
6074	case 4:
6075		phyctl |= BWN_TX_PHY_ANT3;
6076		break;
6077	default:
6078		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6079	}
6080
6081	if (!ismcast)
6082		macctl |= BWN_TX_MAC_ACK;
6083
6084	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6085	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6086	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6087		macctl |= BWN_TX_MAC_LONGFRAME;
6088
6089	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6090		/* XXX RTS rate is always 1MB??? */
6091		/* XXX TODO: don't fall back to CCK rates for OFDM */
6092		rts_rate = BWN_CCK_RATE_1MB;
6093		rts_rate_fb = bwn_get_fbrate(rts_rate);
6094
6095		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6096		protdur = ieee80211_compute_duration(ic->ic_rt,
6097		    m->m_pkthdr.len, rate, isshort) +
6098		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6099
6100		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6101			cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
6102			    (txhdr->body.old.rts_frame) :
6103			    (txhdr->body.new.rts_frame));
6104			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6105			    protdur);
6106			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6107			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6108			    mprot->m_pkthdr.len);
6109			m_freem(mprot);
6110			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6111			len = sizeof(struct ieee80211_frame_cts);
6112		} else {
6113			rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
6114			    (txhdr->body.old.rts_frame) :
6115			    (txhdr->body.new.rts_frame));
6116			/* XXX rate/rate_fb is the hardware rate */
6117			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6118			    isshort);
6119			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6120			    wh->i_addr2, protdur);
6121			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6122			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6123			    mprot->m_pkthdr.len);
6124			m_freem(mprot);
6125			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6126			len = sizeof(struct ieee80211_frame_rts);
6127		}
6128		len += IEEE80211_CRC_LEN;
6129		bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
6130		    &txhdr->body.old.rts_plcp :
6131		    &txhdr->body.new.rts_plcp), len, rts_rate);
6132		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6133		    rts_rate_fb);
6134
6135		protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
6136		    (&txhdr->body.old.rts_frame) :
6137		    (&txhdr->body.new.rts_frame));
6138		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6139
6140		if (BWN_ISOFDMRATE(rts_rate)) {
6141			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6142			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6143		} else {
6144			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6145			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6146		}
6147		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6148		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6149	}
6150
6151	if (BWN_ISOLDFMT(mac))
6152		txhdr->body.old.cookie = htole16(cookie);
6153	else
6154		txhdr->body.new.cookie = htole16(cookie);
6155
6156	txhdr->macctl = htole32(macctl);
6157	txhdr->phyctl = htole16(phyctl);
6158
6159	/*
6160	 * TX radio tap
6161	 */
6162	if (ieee80211_radiotap_active_vap(vap)) {
6163		sc->sc_tx_th.wt_flags = 0;
6164		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6165			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6166		if (isshort &&
6167		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6168		     rate == BWN_CCK_RATE_11MB))
6169			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6170		sc->sc_tx_th.wt_rate = rate;
6171
6172		ieee80211_radiotap_tx(vap, m);
6173	}
6174
6175	return (0);
6176}
6177
6178static void
6179bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6180    const uint8_t rate)
6181{
6182	uint32_t d, plen;
6183	uint8_t *raw = plcp->o.raw;
6184
6185	if (BWN_ISOFDMRATE(rate)) {
6186		d = bwn_plcp_getofdm(rate);
6187		KASSERT(!(octets & 0xf000),
6188		    ("%s:%d: fail", __func__, __LINE__));
6189		d |= (octets << 5);
6190		plcp->o.data = htole32(d);
6191	} else {
6192		plen = octets * 16 / rate;
6193		if ((octets * 16 % rate) > 0) {
6194			plen++;
6195			if ((rate == BWN_CCK_RATE_11MB)
6196			    && ((octets * 8 % 11) < 4)) {
6197				raw[1] = 0x84;
6198			} else
6199				raw[1] = 0x04;
6200		} else
6201			raw[1] = 0x04;
6202		plcp->o.data |= htole32(plen << 16);
6203		raw[0] = bwn_plcp_getcck(rate);
6204	}
6205}
6206
6207static uint8_t
6208bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6209{
6210	struct bwn_softc *sc = mac->mac_sc;
6211	uint8_t mask;
6212
6213	if (n == 0)
6214		return (0);
6215	if (mac->mac_phy.gmode)
6216		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6217	else
6218		mask = siba_sprom_get_ant_a(sc->sc_dev);
6219	if (!(mask & (1 << (n - 1))))
6220		return (0);
6221	return (n);
6222}
6223
6224/*
6225 * Return a fallback rate for the given rate.
6226 *
6227 * Note: Don't fall back from OFDM to CCK.
6228 */
6229static uint8_t
6230bwn_get_fbrate(uint8_t bitrate)
6231{
6232	switch (bitrate) {
6233	/* CCK */
6234	case BWN_CCK_RATE_1MB:
6235		return (BWN_CCK_RATE_1MB);
6236	case BWN_CCK_RATE_2MB:
6237		return (BWN_CCK_RATE_1MB);
6238	case BWN_CCK_RATE_5MB:
6239		return (BWN_CCK_RATE_2MB);
6240	case BWN_CCK_RATE_11MB:
6241		return (BWN_CCK_RATE_5MB);
6242
6243	/* OFDM */
6244	case BWN_OFDM_RATE_6MB:
6245		return (BWN_OFDM_RATE_6MB);
6246	case BWN_OFDM_RATE_9MB:
6247		return (BWN_OFDM_RATE_6MB);
6248	case BWN_OFDM_RATE_12MB:
6249		return (BWN_OFDM_RATE_9MB);
6250	case BWN_OFDM_RATE_18MB:
6251		return (BWN_OFDM_RATE_12MB);
6252	case BWN_OFDM_RATE_24MB:
6253		return (BWN_OFDM_RATE_18MB);
6254	case BWN_OFDM_RATE_36MB:
6255		return (BWN_OFDM_RATE_24MB);
6256	case BWN_OFDM_RATE_48MB:
6257		return (BWN_OFDM_RATE_36MB);
6258	case BWN_OFDM_RATE_54MB:
6259		return (BWN_OFDM_RATE_48MB);
6260	}
6261	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6262	return (0);
6263}
6264
6265static uint32_t
6266bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6267    uint32_t ctl, const void *_data, int len)
6268{
6269	struct bwn_softc *sc = mac->mac_sc;
6270	uint32_t value = 0;
6271	const uint8_t *data = _data;
6272
6273	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6274	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6275	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6276
6277	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6278	    tq->tq_base + BWN_PIO8_TXDATA);
6279	if (len & 3) {
6280		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6281		    BWN_PIO8_TXCTL_24_31);
6282		data = &(data[len - 1]);
6283		switch (len & 3) {
6284		case 3:
6285			ctl |= BWN_PIO8_TXCTL_16_23;
6286			value |= (uint32_t)(*data) << 16;
6287			data--;
6288		case 2:
6289			ctl |= BWN_PIO8_TXCTL_8_15;
6290			value |= (uint32_t)(*data) << 8;
6291			data--;
6292		case 1:
6293			value |= (uint32_t)(*data);
6294		}
6295		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6296		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6297	}
6298
6299	return (ctl);
6300}
6301
6302static void
6303bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6304    uint16_t offset, uint32_t value)
6305{
6306
6307	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6308}
6309
6310static uint16_t
6311bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6312    uint16_t ctl, const void *_data, int len)
6313{
6314	struct bwn_softc *sc = mac->mac_sc;
6315	const uint8_t *data = _data;
6316
6317	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6318	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6319
6320	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6321	    tq->tq_base + BWN_PIO_TXDATA);
6322	if (len & 1) {
6323		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6324		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6325		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6326	}
6327
6328	return (ctl);
6329}
6330
6331static uint16_t
6332bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6333    uint16_t ctl, struct mbuf *m0)
6334{
6335	int i, j = 0;
6336	uint16_t data = 0;
6337	const uint8_t *buf;
6338	struct mbuf *m = m0;
6339
6340	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6341	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6342
6343	for (; m != NULL; m = m->m_next) {
6344		buf = mtod(m, const uint8_t *);
6345		for (i = 0; i < m->m_len; i++) {
6346			if (!((j++) % 2))
6347				data |= buf[i];
6348			else {
6349				data |= (buf[i] << 8);
6350				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6351				data = 0;
6352			}
6353		}
6354	}
6355	if (m0->m_pkthdr.len % 2) {
6356		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6357		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6358		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6359	}
6360
6361	return (ctl);
6362}
6363
6364static void
6365bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6366{
6367
6368	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6369		return;
6370	BWN_WRITE_2(mac, 0x684, 510 + time);
6371	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6372}
6373
6374static struct bwn_dma_ring *
6375bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6376{
6377
6378	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6379		return (mac->mac_method.dma.wme[WME_AC_BE]);
6380
6381	switch (prio) {
6382	case 3:
6383		return (mac->mac_method.dma.wme[WME_AC_VO]);
6384	case 2:
6385		return (mac->mac_method.dma.wme[WME_AC_VI]);
6386	case 0:
6387		return (mac->mac_method.dma.wme[WME_AC_BE]);
6388	case 1:
6389		return (mac->mac_method.dma.wme[WME_AC_BK]);
6390	}
6391	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6392	return (NULL);
6393}
6394
6395static int
6396bwn_dma_getslot(struct bwn_dma_ring *dr)
6397{
6398	int slot;
6399
6400	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6401
6402	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6403	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6404	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6405
6406	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6407	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6408	dr->dr_curslot = slot;
6409	dr->dr_usedslot++;
6410
6411	return (slot);
6412}
6413
6414static struct bwn_pio_txqueue *
6415bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6416    struct bwn_pio_txpkt **pack)
6417{
6418	struct bwn_pio *pio = &mac->mac_method.pio;
6419	struct bwn_pio_txqueue *tq = NULL;
6420	unsigned int index;
6421
6422	switch (cookie & 0xf000) {
6423	case 0x1000:
6424		tq = &pio->wme[WME_AC_BK];
6425		break;
6426	case 0x2000:
6427		tq = &pio->wme[WME_AC_BE];
6428		break;
6429	case 0x3000:
6430		tq = &pio->wme[WME_AC_VI];
6431		break;
6432	case 0x4000:
6433		tq = &pio->wme[WME_AC_VO];
6434		break;
6435	case 0x5000:
6436		tq = &pio->mcast;
6437		break;
6438	}
6439	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6440	if (tq == NULL)
6441		return (NULL);
6442	index = (cookie & 0x0fff);
6443	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6444	if (index >= N(tq->tq_pkts))
6445		return (NULL);
6446	*pack = &tq->tq_pkts[index];
6447	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6448	return (tq);
6449}
6450
6451static void
6452bwn_txpwr(void *arg, int npending)
6453{
6454	struct bwn_mac *mac = arg;
6455	struct bwn_softc *sc = mac->mac_sc;
6456
6457	BWN_LOCK(sc);
6458	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6459	    mac->mac_phy.set_txpwr != NULL)
6460		mac->mac_phy.set_txpwr(mac);
6461	BWN_UNLOCK(sc);
6462}
6463
6464static void
6465bwn_task_15s(struct bwn_mac *mac)
6466{
6467	uint16_t reg;
6468
6469	if (mac->mac_fw.opensource) {
6470		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6471		if (reg) {
6472			bwn_restart(mac, "fw watchdog");
6473			return;
6474		}
6475		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6476	}
6477	if (mac->mac_phy.task_15s)
6478		mac->mac_phy.task_15s(mac);
6479
6480	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6481}
6482
6483static void
6484bwn_task_30s(struct bwn_mac *mac)
6485{
6486
6487	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6488		return;
6489	mac->mac_noise.noi_running = 1;
6490	mac->mac_noise.noi_nsamples = 0;
6491
6492	bwn_noise_gensample(mac);
6493}
6494
6495static void
6496bwn_task_60s(struct bwn_mac *mac)
6497{
6498
6499	if (mac->mac_phy.task_60s)
6500		mac->mac_phy.task_60s(mac);
6501	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6502}
6503
6504static void
6505bwn_tasks(void *arg)
6506{
6507	struct bwn_mac *mac = arg;
6508	struct bwn_softc *sc = mac->mac_sc;
6509
6510	BWN_ASSERT_LOCKED(sc);
6511	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6512		return;
6513
6514	if (mac->mac_task_state % 4 == 0)
6515		bwn_task_60s(mac);
6516	if (mac->mac_task_state % 2 == 0)
6517		bwn_task_30s(mac);
6518	bwn_task_15s(mac);
6519
6520	mac->mac_task_state++;
6521	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6522}
6523
6524static int
6525bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6526{
6527	struct bwn_softc *sc = mac->mac_sc;
6528
6529	KASSERT(a == 0, ("not support APHY\n"));
6530
6531	switch (plcp->o.raw[0] & 0xf) {
6532	case 0xb:
6533		return (BWN_OFDM_RATE_6MB);
6534	case 0xf:
6535		return (BWN_OFDM_RATE_9MB);
6536	case 0xa:
6537		return (BWN_OFDM_RATE_12MB);
6538	case 0xe:
6539		return (BWN_OFDM_RATE_18MB);
6540	case 0x9:
6541		return (BWN_OFDM_RATE_24MB);
6542	case 0xd:
6543		return (BWN_OFDM_RATE_36MB);
6544	case 0x8:
6545		return (BWN_OFDM_RATE_48MB);
6546	case 0xc:
6547		return (BWN_OFDM_RATE_54MB);
6548	}
6549	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6550	    plcp->o.raw[0] & 0xf);
6551	return (-1);
6552}
6553
6554static int
6555bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6556{
6557	struct bwn_softc *sc = mac->mac_sc;
6558
6559	switch (plcp->o.raw[0]) {
6560	case 0x0a:
6561		return (BWN_CCK_RATE_1MB);
6562	case 0x14:
6563		return (BWN_CCK_RATE_2MB);
6564	case 0x37:
6565		return (BWN_CCK_RATE_5MB);
6566	case 0x6e:
6567		return (BWN_CCK_RATE_11MB);
6568	}
6569	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6570	return (-1);
6571}
6572
6573static void
6574bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6575    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6576    int rssi, int noise)
6577{
6578	struct bwn_softc *sc = mac->mac_sc;
6579	const struct ieee80211_frame_min *wh;
6580	uint64_t tsf;
6581	uint16_t low_mactime_now;
6582
6583	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6584		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6585
6586	wh = mtod(m, const struct ieee80211_frame_min *);
6587	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6588		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6589
6590	bwn_tsf_read(mac, &tsf);
6591	low_mactime_now = tsf;
6592	tsf = tsf & ~0xffffULL;
6593	tsf += le16toh(rxhdr->mac_time);
6594	if (low_mactime_now < le16toh(rxhdr->mac_time))
6595		tsf -= 0x10000;
6596
6597	sc->sc_rx_th.wr_tsf = tsf;
6598	sc->sc_rx_th.wr_rate = rate;
6599	sc->sc_rx_th.wr_antsignal = rssi;
6600	sc->sc_rx_th.wr_antnoise = noise;
6601}
6602
6603static void
6604bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6605{
6606	uint32_t low, high;
6607
6608	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6609	    ("%s:%d: fail", __func__, __LINE__));
6610
6611	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6612	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6613	*tsf = high;
6614	*tsf <<= 32;
6615	*tsf |= low;
6616}
6617
6618static int
6619bwn_dma_attach(struct bwn_mac *mac)
6620{
6621	struct bwn_dma *dma = &mac->mac_method.dma;
6622	struct bwn_softc *sc = mac->mac_sc;
6623	bus_addr_t lowaddr = 0;
6624	int error;
6625
6626	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6627		return (0);
6628
6629	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6630
6631	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6632
6633	dma->dmatype = bwn_dma_gettype(mac);
6634	if (dma->dmatype == BWN_DMA_30BIT)
6635		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6636	else if (dma->dmatype == BWN_DMA_32BIT)
6637		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6638	else
6639		lowaddr = BUS_SPACE_MAXADDR;
6640
6641	/*
6642	 * Create top level DMA tag
6643	 */
6644	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6645			       BWN_ALIGN, 0,		/* alignment, bounds */
6646			       lowaddr,			/* lowaddr */
6647			       BUS_SPACE_MAXADDR,	/* highaddr */
6648			       NULL, NULL,		/* filter, filterarg */
6649			       BUS_SPACE_MAXSIZE,	/* maxsize */
6650			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6651			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6652			       0,			/* flags */
6653			       NULL, NULL,		/* lockfunc, lockarg */
6654			       &dma->parent_dtag);
6655	if (error) {
6656		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6657		return (error);
6658	}
6659
6660	/*
6661	 * Create TX/RX mbuf DMA tag
6662	 */
6663	error = bus_dma_tag_create(dma->parent_dtag,
6664				1,
6665				0,
6666				BUS_SPACE_MAXADDR,
6667				BUS_SPACE_MAXADDR,
6668				NULL, NULL,
6669				MCLBYTES,
6670				1,
6671				BUS_SPACE_MAXSIZE_32BIT,
6672				0,
6673				NULL, NULL,
6674				&dma->rxbuf_dtag);
6675	if (error) {
6676		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6677		goto fail0;
6678	}
6679	error = bus_dma_tag_create(dma->parent_dtag,
6680				1,
6681				0,
6682				BUS_SPACE_MAXADDR,
6683				BUS_SPACE_MAXADDR,
6684				NULL, NULL,
6685				MCLBYTES,
6686				1,
6687				BUS_SPACE_MAXSIZE_32BIT,
6688				0,
6689				NULL, NULL,
6690				&dma->txbuf_dtag);
6691	if (error) {
6692		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6693		goto fail1;
6694	}
6695
6696	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6697	if (!dma->wme[WME_AC_BK])
6698		goto fail2;
6699
6700	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6701	if (!dma->wme[WME_AC_BE])
6702		goto fail3;
6703
6704	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6705	if (!dma->wme[WME_AC_VI])
6706		goto fail4;
6707
6708	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6709	if (!dma->wme[WME_AC_VO])
6710		goto fail5;
6711
6712	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6713	if (!dma->mcast)
6714		goto fail6;
6715	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6716	if (!dma->rx)
6717		goto fail7;
6718
6719	return (error);
6720
6721fail7:	bwn_dma_ringfree(&dma->mcast);
6722fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
6723fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
6724fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
6725fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
6726fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
6727fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
6728fail0:	bus_dma_tag_destroy(dma->parent_dtag);
6729	return (error);
6730}
6731
6732static struct bwn_dma_ring *
6733bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
6734    uint16_t cookie, int *slot)
6735{
6736	struct bwn_dma *dma = &mac->mac_method.dma;
6737	struct bwn_dma_ring *dr;
6738	struct bwn_softc *sc = mac->mac_sc;
6739
6740	BWN_ASSERT_LOCKED(mac->mac_sc);
6741
6742	switch (cookie & 0xf000) {
6743	case 0x1000:
6744		dr = dma->wme[WME_AC_BK];
6745		break;
6746	case 0x2000:
6747		dr = dma->wme[WME_AC_BE];
6748		break;
6749	case 0x3000:
6750		dr = dma->wme[WME_AC_VI];
6751		break;
6752	case 0x4000:
6753		dr = dma->wme[WME_AC_VO];
6754		break;
6755	case 0x5000:
6756		dr = dma->mcast;
6757		break;
6758	default:
6759		dr = NULL;
6760		KASSERT(0 == 1,
6761		    ("invalid cookie value %d", cookie & 0xf000));
6762	}
6763	*slot = (cookie & 0x0fff);
6764	if (*slot < 0 || *slot >= dr->dr_numslots) {
6765		/*
6766		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
6767		 * that it occurs events which have same H/W sequence numbers.
6768		 * When it's occurred just prints a WARNING msgs and ignores.
6769		 */
6770		KASSERT(status->seq == dma->lastseq,
6771		    ("%s:%d: fail", __func__, __LINE__));
6772		device_printf(sc->sc_dev,
6773		    "out of slot ranges (0 < %d < %d)\n", *slot,
6774		    dr->dr_numslots);
6775		return (NULL);
6776	}
6777	dma->lastseq = status->seq;
6778	return (dr);
6779}
6780
6781static void
6782bwn_dma_stop(struct bwn_mac *mac)
6783{
6784	struct bwn_dma *dma;
6785
6786	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
6787		return;
6788	dma = &mac->mac_method.dma;
6789
6790	bwn_dma_ringstop(&dma->rx);
6791	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
6792	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
6793	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
6794	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
6795	bwn_dma_ringstop(&dma->mcast);
6796}
6797
6798static void
6799bwn_dma_ringstop(struct bwn_dma_ring **dr)
6800{
6801
6802	if (dr == NULL)
6803		return;
6804
6805	bwn_dma_cleanup(*dr);
6806}
6807
6808static void
6809bwn_pio_stop(struct bwn_mac *mac)
6810{
6811	struct bwn_pio *pio;
6812
6813	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
6814		return;
6815	pio = &mac->mac_method.pio;
6816
6817	bwn_destroy_queue_tx(&pio->mcast);
6818	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
6819	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
6820	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
6821	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
6822}
6823
6824static void
6825bwn_led_attach(struct bwn_mac *mac)
6826{
6827	struct bwn_softc *sc = mac->mac_sc;
6828	const uint8_t *led_act = NULL;
6829	uint16_t val[BWN_LED_MAX];
6830	int i;
6831
6832	sc->sc_led_idle = (2350 * hz) / 1000;
6833	sc->sc_led_blink = 1;
6834
6835	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
6836		if (siba_get_pci_subvendor(sc->sc_dev) ==
6837		    bwn_vendor_led_act[i].vid) {
6838			led_act = bwn_vendor_led_act[i].led_act;
6839			break;
6840		}
6841	}
6842	if (led_act == NULL)
6843		led_act = bwn_default_led_act;
6844
6845	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
6846	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
6847	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
6848	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
6849
6850	for (i = 0; i < BWN_LED_MAX; ++i) {
6851		struct bwn_led *led = &sc->sc_leds[i];
6852
6853		if (val[i] == 0xff) {
6854			led->led_act = led_act[i];
6855		} else {
6856			if (val[i] & BWN_LED_ACT_LOW)
6857				led->led_flags |= BWN_LED_F_ACTLOW;
6858			led->led_act = val[i] & BWN_LED_ACT_MASK;
6859		}
6860		led->led_mask = (1 << i);
6861
6862		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
6863		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
6864		    led->led_act == BWN_LED_ACT_BLINK) {
6865			led->led_flags |= BWN_LED_F_BLINK;
6866			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
6867				led->led_flags |= BWN_LED_F_POLLABLE;
6868			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
6869				led->led_flags |= BWN_LED_F_SLOW;
6870
6871			if (sc->sc_blink_led == NULL) {
6872				sc->sc_blink_led = led;
6873				if (led->led_flags & BWN_LED_F_SLOW)
6874					BWN_LED_SLOWDOWN(sc->sc_led_idle);
6875			}
6876		}
6877
6878		DPRINTF(sc, BWN_DEBUG_LED,
6879		    "%dth led, act %d, lowact %d\n", i,
6880		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
6881	}
6882	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
6883}
6884
6885static __inline uint16_t
6886bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
6887{
6888
6889	if (led->led_flags & BWN_LED_F_ACTLOW)
6890		on = !on;
6891	if (on)
6892		val |= led->led_mask;
6893	else
6894		val &= ~led->led_mask;
6895	return val;
6896}
6897
6898static void
6899bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
6900{
6901	struct bwn_softc *sc = mac->mac_sc;
6902	struct ieee80211com *ic = &sc->sc_ic;
6903	uint16_t val;
6904	int i;
6905
6906	if (nstate == IEEE80211_S_INIT) {
6907		callout_stop(&sc->sc_led_blink_ch);
6908		sc->sc_led_blinking = 0;
6909	}
6910
6911	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
6912		return;
6913
6914	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6915	for (i = 0; i < BWN_LED_MAX; ++i) {
6916		struct bwn_led *led = &sc->sc_leds[i];
6917		int on;
6918
6919		if (led->led_act == BWN_LED_ACT_UNKN ||
6920		    led->led_act == BWN_LED_ACT_NULL)
6921			continue;
6922
6923		if ((led->led_flags & BWN_LED_F_BLINK) &&
6924		    nstate != IEEE80211_S_INIT)
6925			continue;
6926
6927		switch (led->led_act) {
6928		case BWN_LED_ACT_ON:    /* Always on */
6929			on = 1;
6930			break;
6931		case BWN_LED_ACT_OFF:   /* Always off */
6932		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
6933			on = 0;
6934			break;
6935		default:
6936			on = 1;
6937			switch (nstate) {
6938			case IEEE80211_S_INIT:
6939				on = 0;
6940				break;
6941			case IEEE80211_S_RUN:
6942				if (led->led_act == BWN_LED_ACT_11G &&
6943				    ic->ic_curmode != IEEE80211_MODE_11G)
6944					on = 0;
6945				break;
6946			default:
6947				if (led->led_act == BWN_LED_ACT_ASSOC)
6948					on = 0;
6949				break;
6950			}
6951			break;
6952		}
6953
6954		val = bwn_led_onoff(led, val, on);
6955	}
6956	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6957}
6958
6959static void
6960bwn_led_event(struct bwn_mac *mac, int event)
6961{
6962	struct bwn_softc *sc = mac->mac_sc;
6963	struct bwn_led *led = sc->sc_blink_led;
6964	int rate;
6965
6966	if (event == BWN_LED_EVENT_POLL) {
6967		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
6968			return;
6969		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6970			return;
6971	}
6972
6973	sc->sc_led_ticks = ticks;
6974	if (sc->sc_led_blinking)
6975		return;
6976
6977	switch (event) {
6978	case BWN_LED_EVENT_RX:
6979		rate = sc->sc_rx_rate;
6980		break;
6981	case BWN_LED_EVENT_TX:
6982		rate = sc->sc_tx_rate;
6983		break;
6984	case BWN_LED_EVENT_POLL:
6985		rate = 0;
6986		break;
6987	default:
6988		panic("unknown LED event %d\n", event);
6989		break;
6990	}
6991	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
6992	    bwn_led_duration[rate].off_dur);
6993}
6994
6995static void
6996bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
6997{
6998	struct bwn_softc *sc = mac->mac_sc;
6999	struct bwn_led *led = sc->sc_blink_led;
7000	uint16_t val;
7001
7002	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7003	val = bwn_led_onoff(led, val, 1);
7004	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7005
7006	if (led->led_flags & BWN_LED_F_SLOW) {
7007		BWN_LED_SLOWDOWN(on_dur);
7008		BWN_LED_SLOWDOWN(off_dur);
7009	}
7010
7011	sc->sc_led_blinking = 1;
7012	sc->sc_led_blink_offdur = off_dur;
7013
7014	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7015}
7016
7017static void
7018bwn_led_blink_next(void *arg)
7019{
7020	struct bwn_mac *mac = arg;
7021	struct bwn_softc *sc = mac->mac_sc;
7022	uint16_t val;
7023
7024	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7025	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7026	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7027
7028	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7029	    bwn_led_blink_end, mac);
7030}
7031
7032static void
7033bwn_led_blink_end(void *arg)
7034{
7035	struct bwn_mac *mac = arg;
7036	struct bwn_softc *sc = mac->mac_sc;
7037
7038	sc->sc_led_blinking = 0;
7039}
7040
7041static int
7042bwn_suspend(device_t dev)
7043{
7044	struct bwn_softc *sc = device_get_softc(dev);
7045
7046	BWN_LOCK(sc);
7047	bwn_stop(sc);
7048	BWN_UNLOCK(sc);
7049	return (0);
7050}
7051
7052static int
7053bwn_resume(device_t dev)
7054{
7055	struct bwn_softc *sc = device_get_softc(dev);
7056	int error = EDOOFUS;
7057
7058	BWN_LOCK(sc);
7059	if (sc->sc_ic.ic_nrunning > 0)
7060		error = bwn_init(sc);
7061	BWN_UNLOCK(sc);
7062	if (error == 0)
7063		ieee80211_start_all(&sc->sc_ic);
7064	return (0);
7065}
7066
7067static void
7068bwn_rfswitch(void *arg)
7069{
7070	struct bwn_softc *sc = arg;
7071	struct bwn_mac *mac = sc->sc_curmac;
7072	int cur = 0, prev = 0;
7073
7074	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7075	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7076
7077	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
7078		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7079			& BWN_RF_HWENABLED_HI_MASK))
7080			cur = 1;
7081	} else {
7082		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7083		    & BWN_RF_HWENABLED_LO_MASK)
7084			cur = 1;
7085	}
7086
7087	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7088		prev = 1;
7089
7090	if (cur != prev) {
7091		if (cur)
7092			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7093		else
7094			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7095
7096		device_printf(sc->sc_dev,
7097		    "status of RF switch is changed to %s\n",
7098		    cur ? "ON" : "OFF");
7099		if (cur != mac->mac_phy.rf_on) {
7100			if (cur)
7101				bwn_rf_turnon(mac);
7102			else
7103				bwn_rf_turnoff(mac);
7104		}
7105	}
7106
7107	callout_schedule(&sc->sc_rfswitch_ch, hz);
7108}
7109
7110static void
7111bwn_sysctl_node(struct bwn_softc *sc)
7112{
7113	device_t dev = sc->sc_dev;
7114	struct bwn_mac *mac;
7115	struct bwn_stats *stats;
7116
7117	/* XXX assume that count of MAC is only 1. */
7118
7119	if ((mac = sc->sc_curmac) == NULL)
7120		return;
7121	stats = &mac->mac_stats;
7122
7123	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7124	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7125	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7126	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7127	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7128	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7129	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7130	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7131	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7132
7133#ifdef BWN_DEBUG
7134	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7135	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7136	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7137#endif
7138}
7139
7140static device_method_t bwn_methods[] = {
7141	/* Device interface */
7142	DEVMETHOD(device_probe,		bwn_probe),
7143	DEVMETHOD(device_attach,	bwn_attach),
7144	DEVMETHOD(device_detach,	bwn_detach),
7145	DEVMETHOD(device_suspend,	bwn_suspend),
7146	DEVMETHOD(device_resume,	bwn_resume),
7147	DEVMETHOD_END
7148};
7149static driver_t bwn_driver = {
7150	"bwn",
7151	bwn_methods,
7152	sizeof(struct bwn_softc)
7153};
7154static devclass_t bwn_devclass;
7155DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7156MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7157MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7158MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7159MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7160MODULE_VERSION(bwn, 1);
7161