if_bwn.c revision 300187
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 300187 2016-05-19 04:23:54Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include "opt_bwn.h"
38#include "opt_wlan.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/malloc.h>
44#include <sys/module.h>
45#include <sys/endian.h>
46#include <sys/errno.h>
47#include <sys/firmware.h>
48#include <sys/lock.h>
49#include <sys/mutex.h>
50#include <machine/bus.h>
51#include <machine/resource.h>
52#include <sys/bus.h>
53#include <sys/rman.h>
54#include <sys/socket.h>
55#include <sys/sockio.h>
56
57#include <net/ethernet.h>
58#include <net/if.h>
59#include <net/if_var.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_llc.h>
63#include <net/if_media.h>
64#include <net/if_types.h>
65
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcireg.h>
68#include <dev/siba/siba_ids.h>
69#include <dev/siba/sibareg.h>
70#include <dev/siba/sibavar.h>
71
72#include <net80211/ieee80211_var.h>
73#include <net80211/ieee80211_radiotap.h>
74#include <net80211/ieee80211_regdomain.h>
75#include <net80211/ieee80211_phy.h>
76#include <net80211/ieee80211_ratectl.h>
77
78#include <dev/bwn/if_bwnreg.h>
79#include <dev/bwn/if_bwnvar.h>
80
81#include <dev/bwn/if_bwn_debug.h>
82#include <dev/bwn/if_bwn_misc.h>
83#include <dev/bwn/if_bwn_util.h>
84#include <dev/bwn/if_bwn_phy_common.h>
85#include <dev/bwn/if_bwn_phy_g.h>
86#include <dev/bwn/if_bwn_phy_lp.h>
87#include <dev/bwn/if_bwn_phy_n.h>
88
89static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90    "Broadcom driver parameters");
91
92/*
93 * Tunable & sysctl variables.
94 */
95
96#ifdef BWN_DEBUG
97static	int bwn_debug = 0;
98SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99    "Broadcom debugging printfs");
100#endif
101
102static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104    "uses Bad Frames Preemption");
105static int	bwn_bluetooth = 1;
106SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107    "turns on Bluetooth Coexistence");
108static int	bwn_hwpctl = 0;
109SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110    "uses H/W power control");
111static int	bwn_msi_disable = 0;		/* MSI disabled  */
112TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113static int	bwn_usedma = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115    "uses DMA");
116TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117static int	bwn_wme = 1;
118SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119    "uses WME support");
120
121static void	bwn_attach_pre(struct bwn_softc *);
122static int	bwn_attach_post(struct bwn_softc *);
123static void	bwn_sprom_bugfixes(device_t);
124static int	bwn_init(struct bwn_softc *);
125static void	bwn_parent(struct ieee80211com *);
126static void	bwn_start(struct bwn_softc *);
127static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128static int	bwn_attach_core(struct bwn_mac *);
129static int	bwn_phy_getinfo(struct bwn_mac *, int);
130static int	bwn_chiptest(struct bwn_mac *);
131static int	bwn_setup_channels(struct bwn_mac *, int, int);
132static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133		    uint16_t);
134static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135		    const struct bwn_channelinfo *, const uint8_t []);
136static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137		    const struct ieee80211_bpf_params *);
138static void	bwn_updateslot(struct ieee80211com *);
139static void	bwn_update_promisc(struct ieee80211com *);
140static void	bwn_wme_init(struct bwn_mac *);
141static int	bwn_wme_update(struct ieee80211com *);
142static void	bwn_wme_clear(struct bwn_softc *);
143static void	bwn_wme_load(struct bwn_mac *);
144static void	bwn_wme_loadparams(struct bwn_mac *,
145		    const struct wmeParams *, uint16_t);
146static void	bwn_scan_start(struct ieee80211com *);
147static void	bwn_scan_end(struct ieee80211com *);
148static void	bwn_set_channel(struct ieee80211com *);
149static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151		    const uint8_t [IEEE80211_ADDR_LEN],
152		    const uint8_t [IEEE80211_ADDR_LEN]);
153static void	bwn_vap_delete(struct ieee80211vap *);
154static void	bwn_stop(struct bwn_softc *);
155static int	bwn_core_init(struct bwn_mac *);
156static void	bwn_core_start(struct bwn_mac *);
157static void	bwn_core_exit(struct bwn_mac *);
158static void	bwn_bt_disable(struct bwn_mac *);
159static int	bwn_chip_init(struct bwn_mac *);
160static void	bwn_set_txretry(struct bwn_mac *, int, int);
161static void	bwn_rate_init(struct bwn_mac *);
162static void	bwn_set_phytxctl(struct bwn_mac *);
163static void	bwn_spu_setdelay(struct bwn_mac *, int);
164static void	bwn_bt_enable(struct bwn_mac *);
165static void	bwn_set_macaddr(struct bwn_mac *);
166static void	bwn_crypt_init(struct bwn_mac *);
167static void	bwn_chip_exit(struct bwn_mac *);
168static int	bwn_fw_fillinfo(struct bwn_mac *);
169static int	bwn_fw_loaducode(struct bwn_mac *);
170static int	bwn_gpio_init(struct bwn_mac *);
171static int	bwn_fw_loadinitvals(struct bwn_mac *);
172static int	bwn_phy_init(struct bwn_mac *);
173static void	bwn_set_txantenna(struct bwn_mac *, int);
174static void	bwn_set_opmode(struct bwn_mac *);
175static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176static uint8_t	bwn_plcp_getcck(const uint8_t);
177static uint8_t	bwn_plcp_getofdm(const uint8_t);
178static void	bwn_pio_init(struct bwn_mac *);
179static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181		    int);
182static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183		    struct bwn_pio_rxqueue *, int);
184static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186		    uint16_t);
187static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190static void	bwn_pio_handle_txeof(struct bwn_mac *,
191		    const struct bwn_txstatus *);
192static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195		    uint16_t);
196static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197		    uint32_t);
198static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199		    struct mbuf *);
200static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204		    uint16_t, uint32_t);
205static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210		    uint16_t, struct bwn_pio_txpkt **);
211static void	bwn_dma_init(struct bwn_mac *);
212static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213static int	bwn_dma_mask2type(uint64_t);
214static uint64_t	bwn_dma_mask(struct bwn_mac *);
215static uint16_t	bwn_dma_base(int, int);
216static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218		    int, struct bwn_dmadesc_generic **,
219		    struct bwn_dmadesc_meta **);
220static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222		    int, int);
223static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229		    int, struct bwn_dmadesc_generic **,
230		    struct bwn_dmadesc_meta **);
231static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233		    int, int);
234static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240static void	bwn_dma_setup(struct bwn_dma_ring *);
241static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245static void	bwn_dma_rx(struct bwn_dma_ring *);
246static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248		    struct bwn_dmadesc_meta *);
249static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250static int	bwn_dma_gettype(struct bwn_mac *);
251static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257		    int);
258static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259		    bus_size_t, int);
260static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261static void	bwn_dma_handle_txeof(struct bwn_mac *,
262		    const struct bwn_txstatus *);
263static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264		    struct mbuf *);
265static int	bwn_dma_getslot(struct bwn_dma_ring *);
266static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267		    uint8_t);
268static int	bwn_dma_attach(struct bwn_mac *);
269static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270		    int, int, int);
271static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272		    const struct bwn_txstatus *, uint16_t, int *);
273static void	bwn_dma_free(struct bwn_mac *);
274static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276		    const char *, struct bwn_fwfile *);
277static void	bwn_release_firmware(struct bwn_mac *);
278static void	bwn_do_release_fw(struct bwn_fwfile *);
279static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280static int	bwn_fwinitvals_write(struct bwn_mac *,
281		    const struct bwn_fwinitvals *, size_t, size_t);
282static uint16_t	bwn_ant2phy(int);
283static void	bwn_mac_write_bssid(struct bwn_mac *);
284static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285		    const uint8_t *);
286static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *, size_t, const uint8_t *);
288static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289		    const uint8_t *);
290static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291		    const uint8_t *);
292static void	bwn_phy_exit(struct bwn_mac *);
293static void	bwn_core_stop(struct bwn_mac *);
294static int	bwn_switch_band(struct bwn_softc *,
295		    struct ieee80211_channel *);
296static void	bwn_phy_reset(struct bwn_mac *);
297static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298static void	bwn_set_pretbtt(struct bwn_mac *);
299static int	bwn_intr(void *);
300static void	bwn_intrtask(void *, int);
301static void	bwn_restart(struct bwn_mac *, const char *);
302static void	bwn_intr_ucode_debug(struct bwn_mac *);
303static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304static void	bwn_intr_atim_end(struct bwn_mac *);
305static void	bwn_intr_beacon(struct bwn_mac *);
306static void	bwn_intr_pmq(struct bwn_mac *);
307static void	bwn_intr_noise(struct bwn_mac *);
308static void	bwn_intr_txeof(struct bwn_mac *);
309static void	bwn_hwreset(void *, int);
310static void	bwn_handle_fwpanic(struct bwn_mac *);
311static void	bwn_load_beacon0(struct bwn_mac *);
312static void	bwn_load_beacon1(struct bwn_mac *);
313static uint32_t	bwn_jssi_read(struct bwn_mac *);
314static void	bwn_noise_gensample(struct bwn_mac *);
315static void	bwn_handle_txeof(struct bwn_mac *,
316		    const struct bwn_txstatus *);
317static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320		    struct mbuf *);
321static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322static int	bwn_set_txhdr(struct bwn_mac *,
323		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324		    uint16_t);
325static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326		    const uint8_t);
327static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328static uint8_t	bwn_get_fbrate(uint8_t);
329static void	bwn_txpwr(void *, int);
330static void	bwn_tasks(void *);
331static void	bwn_task_15s(struct bwn_mac *);
332static void	bwn_task_30s(struct bwn_mac *);
333static void	bwn_task_60s(struct bwn_mac *);
334static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335		    uint8_t);
336static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339		    int, int);
340static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342static void	bwn_watchdog(void *);
343static void	bwn_dma_stop(struct bwn_mac *);
344static void	bwn_pio_stop(struct bwn_mac *);
345static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346static void	bwn_led_attach(struct bwn_mac *);
347static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348static void	bwn_led_event(struct bwn_mac *, int);
349static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350static void	bwn_led_blink_next(void *);
351static void	bwn_led_blink_end(void *);
352static void	bwn_rfswitch(void *);
353static void	bwn_rf_turnon(struct bwn_mac *);
354static void	bwn_rf_turnoff(struct bwn_mac *);
355static void	bwn_sysctl_node(struct bwn_softc *);
356
357static struct resource_spec bwn_res_spec_legacy[] = {
358	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359	{ -1,			0,		0 }
360};
361
362static struct resource_spec bwn_res_spec_msi[] = {
363	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364	{ -1,			0,		0 }
365};
366
367static const struct bwn_channelinfo bwn_chantable_bg = {
368	.channels = {
369		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374	.nchannels = 14
375};
376
377static const struct bwn_channelinfo bwn_chantable_a = {
378	.channels = {
379		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391		{ 6080, 216, 30 } },
392	.nchannels = 37
393};
394
395#if 0
396static const struct bwn_channelinfo bwn_chantable_n = {
397	.channels = {
398		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435	.nchannels = 110
436};
437#endif
438
439#define	VENDOR_LED_ACT(vendor)				\
440{							\
441	.vid = PCI_VENDOR_##vendor,			\
442	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443}
444
445static const struct {
446	uint16_t	vid;
447	uint8_t		led_act[BWN_LED_MAX];
448} bwn_vendor_led_act[] = {
449	VENDOR_LED_ACT(COMPAQ),
450	VENDOR_LED_ACT(ASUSTEK)
451};
452
453static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454	{ BWN_VENDOR_LED_ACT_DEFAULT };
455
456#undef VENDOR_LED_ACT
457
458static const struct {
459	int		on_dur;
460	int		off_dur;
461} bwn_led_duration[109] = {
462	[0]	= { 400, 100 },
463	[2]	= { 150, 75 },
464	[4]	= { 90, 45 },
465	[11]	= { 66, 34 },
466	[12]	= { 53, 26 },
467	[18]	= { 42, 21 },
468	[22]	= { 35, 17 },
469	[24]	= { 32, 16 },
470	[36]	= { 21, 10 },
471	[48]	= { 16, 8 },
472	[72]	= { 11, 5 },
473	[96]	= { 9, 4 },
474	[108]	= { 7, 3 }
475};
476
477static const uint16_t bwn_wme_shm_offsets[] = {
478	[0] = BWN_WME_BESTEFFORT,
479	[1] = BWN_WME_BACKGROUND,
480	[2] = BWN_WME_VOICE,
481	[3] = BWN_WME_VIDEO,
482};
483
484static const struct siba_devid bwn_devs[] = {
485	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495};
496
497static int
498bwn_probe(device_t dev)
499{
500	int i;
501
502	for (i = 0; i < nitems(bwn_devs); i++) {
503		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506			return (BUS_PROBE_DEFAULT);
507	}
508
509	return (ENXIO);
510}
511
512static int
513bwn_attach(device_t dev)
514{
515	struct bwn_mac *mac;
516	struct bwn_softc *sc = device_get_softc(dev);
517	int error, i, msic, reg;
518
519	sc->sc_dev = dev;
520#ifdef BWN_DEBUG
521	sc->sc_debug = bwn_debug;
522#endif
523
524	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525		bwn_attach_pre(sc);
526		bwn_sprom_bugfixes(dev);
527		sc->sc_flags |= BWN_FLAG_ATTACHED;
528	}
529
530	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531		if (siba_get_pci_device(dev) != 0x4313 &&
532		    siba_get_pci_device(dev) != 0x431a &&
533		    siba_get_pci_device(dev) != 0x4321) {
534			device_printf(sc->sc_dev,
535			    "skip 802.11 cores\n");
536			return (ENODEV);
537		}
538	}
539
540	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541	mac->mac_sc = sc;
542	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543	if (bwn_bfp != 0)
544		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545
546	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549
550	error = bwn_attach_core(mac);
551	if (error)
552		goto fail0;
553	bwn_led_attach(mac);
554
555	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560	    mac->mac_phy.rf_rev);
561	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563		    mac->mac_method.dma.dmatype);
564	else
565		device_printf(sc->sc_dev, "PIO\n");
566
567#ifdef	BWN_GPL_PHY
568	device_printf(sc->sc_dev,
569	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570#endif
571
572	/*
573	 * setup PCI resources and interrupt.
574	 */
575	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576		msic = pci_msi_count(dev);
577		if (bootverbose)
578			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579	} else
580		msic = 0;
581
582	mac->mac_intr_spec = bwn_res_spec_legacy;
583	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584		if (pci_alloc_msi(dev, &msic) == 0) {
585			device_printf(sc->sc_dev,
586			    "Using %d MSI messages\n", msic);
587			mac->mac_intr_spec = bwn_res_spec_msi;
588			mac->mac_msi = 1;
589		}
590	}
591
592	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593	    mac->mac_res_irq);
594	if (error) {
595		device_printf(sc->sc_dev,
596		    "couldn't allocate IRQ resources (%d)\n", error);
597		goto fail1;
598	}
599
600	if (mac->mac_msi == 0)
601		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603		    &mac->mac_intrhand[0]);
604	else {
605		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608			    &mac->mac_intrhand[i]);
609			if (error != 0) {
610				device_printf(sc->sc_dev,
611				    "couldn't setup interrupt (%d)\n", error);
612				break;
613			}
614		}
615	}
616
617	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618
619	/*
620	 * calls attach-post routine
621	 */
622	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623		bwn_attach_post(sc);
624
625	return (0);
626fail1:
627	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628		pci_release_msi(dev);
629fail0:
630	free(mac, M_DEVBUF);
631	return (error);
632}
633
634static int
635bwn_is_valid_ether_addr(uint8_t *addr)
636{
637	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638
639	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640		return (FALSE);
641
642	return (TRUE);
643}
644
645static int
646bwn_attach_post(struct bwn_softc *sc)
647{
648	struct ieee80211com *ic = &sc->sc_ic;
649
650	ic->ic_softc = sc;
651	ic->ic_name = device_get_nameunit(sc->sc_dev);
652	/* XXX not right but it's not used anywhere important */
653	ic->ic_phytype = IEEE80211_T_OFDM;
654	ic->ic_opmode = IEEE80211_M_STA;
655	ic->ic_caps =
656		  IEEE80211_C_STA		/* station mode supported */
657		| IEEE80211_C_MONITOR		/* monitor mode */
658		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660		| IEEE80211_C_SHSLOT		/* short slot time supported */
661		| IEEE80211_C_WME		/* WME/WMM supported */
662		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663#if 0
664		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665#endif
666		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667		;
668
669	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670
671	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675
676	/* call MI attach routine. */
677	ieee80211_ifattach(ic);
678
679	ic->ic_headroom = sizeof(struct bwn_txhdr);
680
681	/* override default methods */
682	ic->ic_raw_xmit = bwn_raw_xmit;
683	ic->ic_updateslot = bwn_updateslot;
684	ic->ic_update_promisc = bwn_update_promisc;
685	ic->ic_wme.wme_update = bwn_wme_update;
686	ic->ic_scan_start = bwn_scan_start;
687	ic->ic_scan_end = bwn_scan_end;
688	ic->ic_set_channel = bwn_set_channel;
689	ic->ic_vap_create = bwn_vap_create;
690	ic->ic_vap_delete = bwn_vap_delete;
691	ic->ic_transmit = bwn_transmit;
692	ic->ic_parent = bwn_parent;
693
694	ieee80211_radiotap_attach(ic,
695	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696	    BWN_TX_RADIOTAP_PRESENT,
697	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698	    BWN_RX_RADIOTAP_PRESENT);
699
700	bwn_sysctl_node(sc);
701
702	if (bootverbose)
703		ieee80211_announce(ic);
704	return (0);
705}
706
707static void
708bwn_phy_detach(struct bwn_mac *mac)
709{
710
711	if (mac->mac_phy.detach != NULL)
712		mac->mac_phy.detach(mac);
713}
714
715static int
716bwn_detach(device_t dev)
717{
718	struct bwn_softc *sc = device_get_softc(dev);
719	struct bwn_mac *mac = sc->sc_curmac;
720	struct ieee80211com *ic = &sc->sc_ic;
721	int i;
722
723	sc->sc_flags |= BWN_FLAG_INVALID;
724
725	if (device_is_attached(sc->sc_dev)) {
726		BWN_LOCK(sc);
727		bwn_stop(sc);
728		BWN_UNLOCK(sc);
729		bwn_dma_free(mac);
730		callout_drain(&sc->sc_led_blink_ch);
731		callout_drain(&sc->sc_rfswitch_ch);
732		callout_drain(&sc->sc_task_ch);
733		callout_drain(&sc->sc_watchdog_ch);
734		bwn_phy_detach(mac);
735		ieee80211_draintask(ic, &mac->mac_hwreset);
736		ieee80211_draintask(ic, &mac->mac_txpower);
737		ieee80211_ifdetach(ic);
738	}
739	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740	taskqueue_free(sc->sc_tq);
741
742	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743		if (mac->mac_intrhand[i] != NULL) {
744			bus_teardown_intr(dev, mac->mac_res_irq[i],
745			    mac->mac_intrhand[i]);
746			mac->mac_intrhand[i] = NULL;
747		}
748	}
749	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750	if (mac->mac_msi != 0)
751		pci_release_msi(dev);
752	mbufq_drain(&sc->sc_snd);
753	BWN_LOCK_DESTROY(sc);
754	return (0);
755}
756
757static void
758bwn_attach_pre(struct bwn_softc *sc)
759{
760
761	BWN_LOCK_INIT(sc);
762	TAILQ_INIT(&sc->sc_maclist);
763	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
764	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
765	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
766	mbufq_init(&sc->sc_snd, ifqmaxlen);
767	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
768		taskqueue_thread_enqueue, &sc->sc_tq);
769	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
770		"%s taskq", device_get_nameunit(sc->sc_dev));
771}
772
773static void
774bwn_sprom_bugfixes(device_t dev)
775{
776#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
777	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
778	 (siba_get_pci_device(dev) == _device) &&			\
779	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
780	 (siba_get_pci_subdevice(dev) == _subdevice))
781
782	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
783	    siba_get_pci_subdevice(dev) == 0x4e &&
784	    siba_get_pci_revid(dev) > 0x40)
785		siba_sprom_set_bf_lo(dev,
786		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
787	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
788	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
789		siba_sprom_set_bf_lo(dev,
790		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
791	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
792		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
793		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
794		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
795		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
796		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
797		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
798		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
799			siba_sprom_set_bf_lo(dev,
800			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
801	}
802#undef	BWN_ISDEV
803}
804
805static void
806bwn_parent(struct ieee80211com *ic)
807{
808	struct bwn_softc *sc = ic->ic_softc;
809	int startall = 0;
810
811	BWN_LOCK(sc);
812	if (ic->ic_nrunning > 0) {
813		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
814			bwn_init(sc);
815			startall = 1;
816		} else
817			bwn_update_promisc(ic);
818	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
819		bwn_stop(sc);
820	BWN_UNLOCK(sc);
821
822	if (startall)
823		ieee80211_start_all(ic);
824}
825
826static int
827bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
828{
829	struct bwn_softc *sc = ic->ic_softc;
830	int error;
831
832	BWN_LOCK(sc);
833	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
834		BWN_UNLOCK(sc);
835		return (ENXIO);
836	}
837	error = mbufq_enqueue(&sc->sc_snd, m);
838	if (error) {
839		BWN_UNLOCK(sc);
840		return (error);
841	}
842	bwn_start(sc);
843	BWN_UNLOCK(sc);
844	return (0);
845}
846
847static void
848bwn_start(struct bwn_softc *sc)
849{
850	struct bwn_mac *mac = sc->sc_curmac;
851	struct ieee80211_frame *wh;
852	struct ieee80211_node *ni;
853	struct ieee80211_key *k;
854	struct mbuf *m;
855
856	BWN_ASSERT_LOCKED(sc);
857
858	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
859	    mac->mac_status < BWN_MAC_STATUS_STARTED)
860		return;
861
862	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
863		if (bwn_tx_isfull(sc, m))
864			break;
865		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
866		if (ni == NULL) {
867			device_printf(sc->sc_dev, "unexpected NULL ni\n");
868			m_freem(m);
869			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
870			continue;
871		}
872		wh = mtod(m, struct ieee80211_frame *);
873		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
874			k = ieee80211_crypto_encap(ni, m);
875			if (k == NULL) {
876				if_inc_counter(ni->ni_vap->iv_ifp,
877				    IFCOUNTER_OERRORS, 1);
878				ieee80211_free_node(ni);
879				m_freem(m);
880				continue;
881			}
882		}
883		wh = NULL;	/* Catch any invalid use */
884		if (bwn_tx_start(sc, ni, m) != 0) {
885			if (ni != NULL) {
886				if_inc_counter(ni->ni_vap->iv_ifp,
887				    IFCOUNTER_OERRORS, 1);
888				ieee80211_free_node(ni);
889			}
890			continue;
891		}
892		sc->sc_watchdog_timer = 5;
893	}
894}
895
896static int
897bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
898{
899	struct bwn_dma_ring *dr;
900	struct bwn_mac *mac = sc->sc_curmac;
901	struct bwn_pio_txqueue *tq;
902	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
903
904	BWN_ASSERT_LOCKED(sc);
905
906	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
907		dr = bwn_dma_select(mac, M_WME_GETAC(m));
908		if (dr->dr_stop == 1 ||
909		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
910			dr->dr_stop = 1;
911			goto full;
912		}
913	} else {
914		tq = bwn_pio_select(mac, M_WME_GETAC(m));
915		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
916		    pktlen > (tq->tq_size - tq->tq_used))
917			goto full;
918	}
919	return (0);
920full:
921	mbufq_prepend(&sc->sc_snd, m);
922	return (1);
923}
924
925static int
926bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
927{
928	struct bwn_mac *mac = sc->sc_curmac;
929	int error;
930
931	BWN_ASSERT_LOCKED(sc);
932
933	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
934		m_freem(m);
935		return (ENXIO);
936	}
937
938	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
939	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
940	if (error) {
941		m_freem(m);
942		return (error);
943	}
944	return (0);
945}
946
947static int
948bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
949{
950	struct bwn_pio_txpkt *tp;
951	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
952	struct bwn_softc *sc = mac->mac_sc;
953	struct bwn_txhdr txhdr;
954	struct mbuf *m_new;
955	uint32_t ctl32;
956	int error;
957	uint16_t ctl16;
958
959	BWN_ASSERT_LOCKED(sc);
960
961	/* XXX TODO send packets after DTIM */
962
963	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
964	tp = TAILQ_FIRST(&tq->tq_pktlist);
965	tp->tp_ni = ni;
966	tp->tp_m = m;
967
968	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
969	if (error) {
970		device_printf(sc->sc_dev, "tx fail\n");
971		return (error);
972	}
973
974	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
975	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
976	tq->tq_free--;
977
978	if (siba_get_revid(sc->sc_dev) >= 8) {
979		/*
980		 * XXX please removes m_defrag(9)
981		 */
982		m_new = m_defrag(m, M_NOWAIT);
983		if (m_new == NULL) {
984			device_printf(sc->sc_dev,
985			    "%s: can't defrag TX buffer\n",
986			    __func__);
987			return (ENOBUFS);
988		}
989		if (m_new->m_next != NULL)
990			device_printf(sc->sc_dev,
991			    "TODO: fragmented packets for PIO\n");
992		tp->tp_m = m_new;
993
994		/* send HEADER */
995		ctl32 = bwn_pio_write_multi_4(mac, tq,
996		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
997			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
998		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
999		/* send BODY */
1000		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1002		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003		    ctl32 | BWN_PIO8_TXCTL_EOF);
1004	} else {
1005		ctl16 = bwn_pio_write_multi_2(mac, tq,
1006		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011		    ctl16 | BWN_PIO_TXCTL_EOF);
1012	}
1013
1014	return (0);
1015}
1016
1017static struct bwn_pio_txqueue *
1018bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019{
1020
1021	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024	switch (prio) {
1025	case 0:
1026		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027	case 1:
1028		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029	case 2:
1030		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031	case 3:
1032		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033	}
1034	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035	return (NULL);
1036}
1037
1038static int
1039bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040{
1041#define	BWN_GET_TXHDRCACHE(slot)					\
1042	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043	struct bwn_dma *dma = &mac->mac_method.dma;
1044	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045	struct bwn_dmadesc_generic *desc;
1046	struct bwn_dmadesc_meta *mt;
1047	struct bwn_softc *sc = mac->mac_sc;
1048	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051	BWN_ASSERT_LOCKED(sc);
1052	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054	/* XXX send after DTIM */
1055
1056	slot = bwn_dma_getslot(dr);
1057	dr->getdesc(dr, slot, &desc, &mt);
1058	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059	    ("%s:%d: fail", __func__, __LINE__));
1060
1061	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063	    BWN_DMA_COOKIE(dr, slot));
1064	if (error)
1065		goto fail;
1066	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1069	if (error) {
1070		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071		    __func__, error);
1072		goto fail;
1073	}
1074	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075	    BUS_DMASYNC_PREWRITE);
1076	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078	    BUS_DMASYNC_PREWRITE);
1079
1080	slot = bwn_dma_getslot(dr);
1081	dr->getdesc(dr, slot, &desc, &mt);
1082	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084	mt->mt_m = m;
1085	mt->mt_ni = ni;
1086
1087	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089	if (error && error != EFBIG) {
1090		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091		    __func__, error);
1092		goto fail;
1093	}
1094	if (error) {    /* error == EFBIG */
1095		struct mbuf *m_new;
1096
1097		m_new = m_defrag(m, M_NOWAIT);
1098		if (m_new == NULL) {
1099			device_printf(sc->sc_dev,
1100			    "%s: can't defrag TX buffer\n",
1101			    __func__);
1102			error = ENOBUFS;
1103			goto fail;
1104		} else {
1105			m = m_new;
1106		}
1107
1108		mt->mt_m = m;
1109		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111		if (error) {
1112			device_printf(sc->sc_dev,
1113			    "%s: can't load TX buffer (2) %d\n",
1114			    __func__, error);
1115			goto fail;
1116		}
1117	}
1118	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121	    BUS_DMASYNC_PREWRITE);
1122
1123	/* XXX send after DTIM */
1124
1125	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126	return (0);
1127fail:
1128	dr->dr_curslot = backup[0];
1129	dr->dr_usedslot = backup[1];
1130	return (error);
1131#undef BWN_GET_TXHDRCACHE
1132}
1133
1134static void
1135bwn_watchdog(void *arg)
1136{
1137	struct bwn_softc *sc = arg;
1138
1139	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140		device_printf(sc->sc_dev, "device timeout\n");
1141		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142	}
1143	callout_schedule(&sc->sc_watchdog_ch, hz);
1144}
1145
1146static int
1147bwn_attach_core(struct bwn_mac *mac)
1148{
1149	struct bwn_softc *sc = mac->mac_sc;
1150	int error, have_bg = 0, have_a = 0;
1151	uint32_t high;
1152
1153	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155
1156	siba_powerup(sc->sc_dev, 0);
1157
1158	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1159
1160	/*
1161	 * Guess at whether it has A-PHY or G-PHY.
1162	 * This is just used for resetting the core to probe things;
1163	 * we will re-guess once it's all up and working.
1164	 *
1165	 * XXX TODO: there's the TGSHIGH DUALPHY flag based on
1166	 * the PHY revision.
1167	 */
1168	bwn_reset_core(mac, !!(high & BWN_TGSHIGH_HAVE_2GHZ));
1169
1170	/*
1171	 * Get the PHY version.
1172	 */
1173	error = bwn_phy_getinfo(mac, high);
1174	if (error)
1175		goto fail;
1176
1177	/* XXX TODO need bhnd */
1178	if (bwn_is_bus_siba(mac)) {
1179		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1180		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1181		if (high & BWN_TGSHIGH_DUALPHY) {
1182			have_bg = 1;
1183			have_a = 1;
1184		}
1185	} else {
1186		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1187		error = ENXIO;
1188		goto fail;
1189	}
1190
1191#if 0
1192	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1193	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1194	    __func__,
1195	    high,
1196	    have_a,
1197	    have_bg,
1198	    siba_get_pci_device(sc->sc_dev),
1199	    siba_get_chipid(sc->sc_dev));
1200#endif
1201
1202	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1203	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207		have_a = have_bg = 0;
1208		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209			have_a = 1;
1210		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1212		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1213			have_bg = 1;
1214		else
1215			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216			    mac->mac_phy.type));
1217	}
1218
1219	/*
1220	 * XXX The PHY-G support doesn't do 5GHz operation.
1221	 */
1222	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1224		device_printf(sc->sc_dev,
1225		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226		    __func__);
1227		have_a = 0;
1228		have_bg = 1;
1229	}
1230
1231	mac->mac_phy.phy_n = NULL;
1232
1233	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234		mac->mac_phy.attach = bwn_phy_g_attach;
1235		mac->mac_phy.detach = bwn_phy_g_detach;
1236		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238		mac->mac_phy.init = bwn_phy_g_init;
1239		mac->mac_phy.exit = bwn_phy_g_exit;
1240		mac->mac_phy.phy_read = bwn_phy_g_read;
1241		mac->mac_phy.phy_write = bwn_phy_g_write;
1242		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250		mac->mac_phy.set_im = bwn_phy_g_im;
1251		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257		mac->mac_phy.init = bwn_phy_lp_init;
1258		mac->mac_phy.phy_read = bwn_phy_lp_read;
1259		mac->mac_phy.phy_write = bwn_phy_lp_write;
1260		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270		mac->mac_phy.attach = bwn_phy_n_attach;
1271		mac->mac_phy.detach = bwn_phy_n_detach;
1272		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274		mac->mac_phy.init = bwn_phy_n_init;
1275		mac->mac_phy.exit = bwn_phy_n_exit;
1276		mac->mac_phy.phy_read = bwn_phy_n_read;
1277		mac->mac_phy.phy_write = bwn_phy_n_write;
1278		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286		mac->mac_phy.set_im = bwn_phy_n_im;
1287		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291	} else {
1292		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293		    mac->mac_phy.type);
1294		error = ENXIO;
1295		goto fail;
1296	}
1297
1298	mac->mac_phy.gmode = have_bg;
1299	if (mac->mac_phy.attach != NULL) {
1300		error = mac->mac_phy.attach(mac);
1301		if (error) {
1302			device_printf(sc->sc_dev, "failed\n");
1303			goto fail;
1304		}
1305	}
1306
1307	bwn_reset_core(mac, have_bg);
1308
1309	error = bwn_chiptest(mac);
1310	if (error)
1311		goto fail;
1312	error = bwn_setup_channels(mac, have_bg, have_a);
1313	if (error) {
1314		device_printf(sc->sc_dev, "failed to setup channels\n");
1315		goto fail;
1316	}
1317
1318	if (sc->sc_curmac == NULL)
1319		sc->sc_curmac = mac;
1320
1321	error = bwn_dma_attach(mac);
1322	if (error != 0) {
1323		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324		goto fail;
1325	}
1326
1327	mac->mac_phy.switch_analog(mac, 0);
1328
1329	siba_dev_down(sc->sc_dev, 0);
1330fail:
1331	siba_powerdown(sc->sc_dev);
1332	return (error);
1333}
1334
1335/*
1336 * Reset - SIBA.
1337 *
1338 * XXX TODO: implement BCMA version!
1339 */
1340void
1341bwn_reset_core(struct bwn_mac *mac, int g_mode)
1342{
1343	struct bwn_softc *sc = mac->mac_sc;
1344	uint32_t low, ctl;
1345	uint32_t flags = 0;
1346
1347	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1348
1349	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1350	if (g_mode)
1351		flags |= BWN_TGSLOW_SUPPORT_G;
1352
1353	/* XXX N-PHY only; and hard-code to 20MHz for now */
1354	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1355		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1356
1357	siba_dev_up(sc->sc_dev, flags);
1358	DELAY(2000);
1359
1360	/* Take PHY out of reset */
1361	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1362	    ~BWN_TGSLOW_PHYRESET;
1363	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1364	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1365	DELAY(1000);
1366	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1367	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1368	DELAY(1000);
1369
1370	if (mac->mac_phy.switch_analog != NULL)
1371		mac->mac_phy.switch_analog(mac, 1);
1372
1373	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1374	if (g_mode)
1375		ctl |= BWN_MACCTL_GMODE;
1376	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1377}
1378
1379static int
1380bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1381{
1382	struct bwn_phy *phy = &mac->mac_phy;
1383	struct bwn_softc *sc = mac->mac_sc;
1384	uint32_t tmp;
1385
1386	/* PHY */
1387	tmp = BWN_READ_2(mac, BWN_PHYVER);
1388	phy->gmode = !! (tgshigh & BWN_TGSHIGH_HAVE_2GHZ);
1389	phy->rf_on = 1;
1390	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1391	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1392	phy->rev = (tmp & BWN_PHYVER_VERSION);
1393	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1394	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1395		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1396	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1397	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1398	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1399		goto unsupphy;
1400
1401	/* RADIO */
1402	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1403		if (siba_get_chiprev(sc->sc_dev) == 0)
1404			tmp = 0x3205017f;
1405		else if (siba_get_chiprev(sc->sc_dev) == 1)
1406			tmp = 0x4205017f;
1407		else
1408			tmp = 0x5205017f;
1409	} else {
1410		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1411		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1412		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1413		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1414	}
1415	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1416	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1417	phy->rf_manuf = (tmp & 0x00000fff);
1418
1419	/*
1420	 * For now, just always do full init (ie, what bwn has traditionally
1421	 * done)
1422	 */
1423	phy->phy_do_full_init = 1;
1424
1425	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1426		goto unsupradio;
1427	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1428	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1429	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1430	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1431	    (phy->type == BWN_PHYTYPE_N &&
1432	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1433	    (phy->type == BWN_PHYTYPE_LP &&
1434	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1435		goto unsupradio;
1436
1437	return (0);
1438unsupphy:
1439	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1440	    "analog %#x)\n",
1441	    phy->type, phy->rev, phy->analog);
1442	return (ENXIO);
1443unsupradio:
1444	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1445	    "rev %#x)\n",
1446	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1447	return (ENXIO);
1448}
1449
1450static int
1451bwn_chiptest(struct bwn_mac *mac)
1452{
1453#define	TESTVAL0	0x55aaaa55
1454#define	TESTVAL1	0xaa5555aa
1455	struct bwn_softc *sc = mac->mac_sc;
1456	uint32_t v, backup;
1457
1458	BWN_LOCK(sc);
1459
1460	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1461
1462	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1463	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1464		goto error;
1465	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1466	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1467		goto error;
1468
1469	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1470
1471	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1472	    (siba_get_revid(sc->sc_dev) <= 10)) {
1473		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1474		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1475		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1476			goto error;
1477		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1478			goto error;
1479	}
1480	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1481
1482	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1483	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1484		goto error;
1485
1486	BWN_UNLOCK(sc);
1487	return (0);
1488error:
1489	BWN_UNLOCK(sc);
1490	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1491	return (ENODEV);
1492}
1493
1494static int
1495bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1496{
1497	struct bwn_softc *sc = mac->mac_sc;
1498	struct ieee80211com *ic = &sc->sc_ic;
1499	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
1500
1501	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1502	ic->ic_nchans = 0;
1503
1504	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1505	    __func__,
1506	    have_bg,
1507	    have_a);
1508
1509	if (have_bg) {
1510		memset(bands, 0, sizeof(bands));
1511		setbit(bands, IEEE80211_MODE_11B);
1512		setbit(bands, IEEE80211_MODE_11G);
1513		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1514		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1515	}
1516
1517	if (have_a) {
1518		memset(bands, 0, sizeof(bands));
1519		setbit(bands, IEEE80211_MODE_11A);
1520		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1521		    &ic->ic_nchans, &bwn_chantable_a, bands);
1522	}
1523
1524	mac->mac_phy.supports_2ghz = have_bg;
1525	mac->mac_phy.supports_5ghz = have_a;
1526
1527	return (ic->ic_nchans == 0 ? ENXIO : 0);
1528}
1529
1530uint32_t
1531bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1532{
1533	uint32_t ret;
1534
1535	BWN_ASSERT_LOCKED(mac->mac_sc);
1536
1537	if (way == BWN_SHARED) {
1538		KASSERT((offset & 0x0001) == 0,
1539		    ("%s:%d warn", __func__, __LINE__));
1540		if (offset & 0x0003) {
1541			bwn_shm_ctlword(mac, way, offset >> 2);
1542			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1543			ret <<= 16;
1544			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1545			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1546			goto out;
1547		}
1548		offset >>= 2;
1549	}
1550	bwn_shm_ctlword(mac, way, offset);
1551	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1552out:
1553	return (ret);
1554}
1555
1556uint16_t
1557bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1558{
1559	uint16_t ret;
1560
1561	BWN_ASSERT_LOCKED(mac->mac_sc);
1562
1563	if (way == BWN_SHARED) {
1564		KASSERT((offset & 0x0001) == 0,
1565		    ("%s:%d warn", __func__, __LINE__));
1566		if (offset & 0x0003) {
1567			bwn_shm_ctlword(mac, way, offset >> 2);
1568			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1569			goto out;
1570		}
1571		offset >>= 2;
1572	}
1573	bwn_shm_ctlword(mac, way, offset);
1574	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1575out:
1576
1577	return (ret);
1578}
1579
1580static void
1581bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1582    uint16_t offset)
1583{
1584	uint32_t control;
1585
1586	control = way;
1587	control <<= 16;
1588	control |= offset;
1589	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1590}
1591
1592void
1593bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1594    uint32_t value)
1595{
1596	BWN_ASSERT_LOCKED(mac->mac_sc);
1597
1598	if (way == BWN_SHARED) {
1599		KASSERT((offset & 0x0001) == 0,
1600		    ("%s:%d warn", __func__, __LINE__));
1601		if (offset & 0x0003) {
1602			bwn_shm_ctlword(mac, way, offset >> 2);
1603			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1604				    (value >> 16) & 0xffff);
1605			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1606			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1607			return;
1608		}
1609		offset >>= 2;
1610	}
1611	bwn_shm_ctlword(mac, way, offset);
1612	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1613}
1614
1615void
1616bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1617    uint16_t value)
1618{
1619	BWN_ASSERT_LOCKED(mac->mac_sc);
1620
1621	if (way == BWN_SHARED) {
1622		KASSERT((offset & 0x0001) == 0,
1623		    ("%s:%d warn", __func__, __LINE__));
1624		if (offset & 0x0003) {
1625			bwn_shm_ctlword(mac, way, offset >> 2);
1626			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1627			return;
1628		}
1629		offset >>= 2;
1630	}
1631	bwn_shm_ctlword(mac, way, offset);
1632	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1633}
1634
1635static void
1636bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1637    const struct bwn_channelinfo *ci, const uint8_t bands[])
1638{
1639	int i, error;
1640
1641	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1642		const struct bwn_channel *hc = &ci->channels[i];
1643
1644		error = ieee80211_add_channel(chans, maxchans, nchans,
1645		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1646	}
1647}
1648
1649static int
1650bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1651	const struct ieee80211_bpf_params *params)
1652{
1653	struct ieee80211com *ic = ni->ni_ic;
1654	struct bwn_softc *sc = ic->ic_softc;
1655	struct bwn_mac *mac = sc->sc_curmac;
1656	int error;
1657
1658	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1659	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1660		m_freem(m);
1661		return (ENETDOWN);
1662	}
1663
1664	BWN_LOCK(sc);
1665	if (bwn_tx_isfull(sc, m)) {
1666		m_freem(m);
1667		BWN_UNLOCK(sc);
1668		return (ENOBUFS);
1669	}
1670
1671	error = bwn_tx_start(sc, ni, m);
1672	if (error == 0)
1673		sc->sc_watchdog_timer = 5;
1674	BWN_UNLOCK(sc);
1675	return (error);
1676}
1677
1678/*
1679 * Callback from the 802.11 layer to update the slot time
1680 * based on the current setting.  We use it to notify the
1681 * firmware of ERP changes and the f/w takes care of things
1682 * like slot time and preamble.
1683 */
1684static void
1685bwn_updateslot(struct ieee80211com *ic)
1686{
1687	struct bwn_softc *sc = ic->ic_softc;
1688	struct bwn_mac *mac;
1689
1690	BWN_LOCK(sc);
1691	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1692		mac = (struct bwn_mac *)sc->sc_curmac;
1693		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1694	}
1695	BWN_UNLOCK(sc);
1696}
1697
1698/*
1699 * Callback from the 802.11 layer after a promiscuous mode change.
1700 * Note this interface does not check the operating mode as this
1701 * is an internal callback and we are expected to honor the current
1702 * state (e.g. this is used for setting the interface in promiscuous
1703 * mode when operating in hostap mode to do ACS).
1704 */
1705static void
1706bwn_update_promisc(struct ieee80211com *ic)
1707{
1708	struct bwn_softc *sc = ic->ic_softc;
1709	struct bwn_mac *mac = sc->sc_curmac;
1710
1711	BWN_LOCK(sc);
1712	mac = sc->sc_curmac;
1713	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1714		if (ic->ic_promisc > 0)
1715			sc->sc_filters |= BWN_MACCTL_PROMISC;
1716		else
1717			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1718		bwn_set_opmode(mac);
1719	}
1720	BWN_UNLOCK(sc);
1721}
1722
1723/*
1724 * Callback from the 802.11 layer to update WME parameters.
1725 */
1726static int
1727bwn_wme_update(struct ieee80211com *ic)
1728{
1729	struct bwn_softc *sc = ic->ic_softc;
1730	struct bwn_mac *mac = sc->sc_curmac;
1731	struct wmeParams *wmep;
1732	int i;
1733
1734	BWN_LOCK(sc);
1735	mac = sc->sc_curmac;
1736	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1737		bwn_mac_suspend(mac);
1738		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1739			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1740			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1741		}
1742		bwn_mac_enable(mac);
1743	}
1744	BWN_UNLOCK(sc);
1745	return (0);
1746}
1747
1748static void
1749bwn_scan_start(struct ieee80211com *ic)
1750{
1751	struct bwn_softc *sc = ic->ic_softc;
1752	struct bwn_mac *mac;
1753
1754	BWN_LOCK(sc);
1755	mac = sc->sc_curmac;
1756	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1757		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1758		bwn_set_opmode(mac);
1759		/* disable CFP update during scan */
1760		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1761	}
1762	BWN_UNLOCK(sc);
1763}
1764
1765static void
1766bwn_scan_end(struct ieee80211com *ic)
1767{
1768	struct bwn_softc *sc = ic->ic_softc;
1769	struct bwn_mac *mac;
1770
1771	BWN_LOCK(sc);
1772	mac = sc->sc_curmac;
1773	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1774		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1775		bwn_set_opmode(mac);
1776		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1777	}
1778	BWN_UNLOCK(sc);
1779}
1780
1781static void
1782bwn_set_channel(struct ieee80211com *ic)
1783{
1784	struct bwn_softc *sc = ic->ic_softc;
1785	struct bwn_mac *mac = sc->sc_curmac;
1786	struct bwn_phy *phy = &mac->mac_phy;
1787	int chan, error;
1788
1789	BWN_LOCK(sc);
1790
1791	error = bwn_switch_band(sc, ic->ic_curchan);
1792	if (error)
1793		goto fail;
1794	bwn_mac_suspend(mac);
1795	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1796	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1797	if (chan != phy->chan)
1798		bwn_switch_channel(mac, chan);
1799
1800	/* TX power level */
1801	if (ic->ic_curchan->ic_maxpower != 0 &&
1802	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1803		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1804		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1805		    BWN_TXPWR_IGNORE_TSSI);
1806	}
1807
1808	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1809	if (phy->set_antenna)
1810		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1811
1812	if (sc->sc_rf_enabled != phy->rf_on) {
1813		if (sc->sc_rf_enabled) {
1814			bwn_rf_turnon(mac);
1815			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1816				device_printf(sc->sc_dev,
1817				    "please turn on the RF switch\n");
1818		} else
1819			bwn_rf_turnoff(mac);
1820	}
1821
1822	bwn_mac_enable(mac);
1823
1824fail:
1825	/*
1826	 * Setup radio tap channel freq and flags
1827	 */
1828	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1829		htole16(ic->ic_curchan->ic_freq);
1830	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1831		htole16(ic->ic_curchan->ic_flags & 0xffff);
1832
1833	BWN_UNLOCK(sc);
1834}
1835
1836static struct ieee80211vap *
1837bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1838    enum ieee80211_opmode opmode, int flags,
1839    const uint8_t bssid[IEEE80211_ADDR_LEN],
1840    const uint8_t mac[IEEE80211_ADDR_LEN])
1841{
1842	struct ieee80211vap *vap;
1843	struct bwn_vap *bvp;
1844
1845	switch (opmode) {
1846	case IEEE80211_M_HOSTAP:
1847	case IEEE80211_M_MBSS:
1848	case IEEE80211_M_STA:
1849	case IEEE80211_M_WDS:
1850	case IEEE80211_M_MONITOR:
1851	case IEEE80211_M_IBSS:
1852	case IEEE80211_M_AHDEMO:
1853		break;
1854	default:
1855		return (NULL);
1856	}
1857
1858	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1859	vap = &bvp->bv_vap;
1860	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1861	/* override with driver methods */
1862	bvp->bv_newstate = vap->iv_newstate;
1863	vap->iv_newstate = bwn_newstate;
1864
1865	/* override max aid so sta's cannot assoc when we're out of sta id's */
1866	vap->iv_max_aid = BWN_STAID_MAX;
1867
1868	ieee80211_ratectl_init(vap);
1869
1870	/* complete setup */
1871	ieee80211_vap_attach(vap, ieee80211_media_change,
1872	    ieee80211_media_status, mac);
1873	return (vap);
1874}
1875
1876static void
1877bwn_vap_delete(struct ieee80211vap *vap)
1878{
1879	struct bwn_vap *bvp = BWN_VAP(vap);
1880
1881	ieee80211_ratectl_deinit(vap);
1882	ieee80211_vap_detach(vap);
1883	free(bvp, M_80211_VAP);
1884}
1885
1886static int
1887bwn_init(struct bwn_softc *sc)
1888{
1889	struct bwn_mac *mac;
1890	int error;
1891
1892	BWN_ASSERT_LOCKED(sc);
1893
1894	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1895
1896	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1897	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1898	sc->sc_filters = 0;
1899	bwn_wme_clear(sc);
1900	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1901	sc->sc_rf_enabled = 1;
1902
1903	mac = sc->sc_curmac;
1904	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1905		error = bwn_core_init(mac);
1906		if (error != 0)
1907			return (error);
1908	}
1909	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1910		bwn_core_start(mac);
1911
1912	bwn_set_opmode(mac);
1913	bwn_set_pretbtt(mac);
1914	bwn_spu_setdelay(mac, 0);
1915	bwn_set_macaddr(mac);
1916
1917	sc->sc_flags |= BWN_FLAG_RUNNING;
1918	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1919	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1920
1921	return (0);
1922}
1923
1924static void
1925bwn_stop(struct bwn_softc *sc)
1926{
1927	struct bwn_mac *mac = sc->sc_curmac;
1928
1929	BWN_ASSERT_LOCKED(sc);
1930
1931	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1932
1933	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1934		/* XXX FIXME opmode not based on VAP */
1935		bwn_set_opmode(mac);
1936		bwn_set_macaddr(mac);
1937	}
1938
1939	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1940		bwn_core_stop(mac);
1941
1942	callout_stop(&sc->sc_led_blink_ch);
1943	sc->sc_led_blinking = 0;
1944
1945	bwn_core_exit(mac);
1946	sc->sc_rf_enabled = 0;
1947
1948	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1949}
1950
1951static void
1952bwn_wme_clear(struct bwn_softc *sc)
1953{
1954#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1955	struct wmeParams *p;
1956	unsigned int i;
1957
1958	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1959	    ("%s:%d: fail", __func__, __LINE__));
1960
1961	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1962		p = &(sc->sc_wmeParams[i]);
1963
1964		switch (bwn_wme_shm_offsets[i]) {
1965		case BWN_WME_VOICE:
1966			p->wmep_txopLimit = 0;
1967			p->wmep_aifsn = 2;
1968			/* XXX FIXME: log2(cwmin) */
1969			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1970			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1971			break;
1972		case BWN_WME_VIDEO:
1973			p->wmep_txopLimit = 0;
1974			p->wmep_aifsn = 2;
1975			/* XXX FIXME: log2(cwmin) */
1976			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1977			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1978			break;
1979		case BWN_WME_BESTEFFORT:
1980			p->wmep_txopLimit = 0;
1981			p->wmep_aifsn = 3;
1982			/* XXX FIXME: log2(cwmin) */
1983			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1984			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1985			break;
1986		case BWN_WME_BACKGROUND:
1987			p->wmep_txopLimit = 0;
1988			p->wmep_aifsn = 7;
1989			/* XXX FIXME: log2(cwmin) */
1990			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1991			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1992			break;
1993		default:
1994			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1995		}
1996	}
1997}
1998
1999static int
2000bwn_core_init(struct bwn_mac *mac)
2001{
2002	struct bwn_softc *sc = mac->mac_sc;
2003	uint64_t hf;
2004	int error;
2005
2006	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2007	    ("%s:%d: fail", __func__, __LINE__));
2008
2009	siba_powerup(sc->sc_dev, 0);
2010	if (!siba_dev_isup(sc->sc_dev))
2011		bwn_reset_core(mac, mac->mac_phy.gmode);
2012
2013	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2014	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2015	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2016	BWN_GETTIME(mac->mac_phy.nexttime);
2017	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2018	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2019	mac->mac_stats.link_noise = -95;
2020	mac->mac_reason_intr = 0;
2021	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2022	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2023#ifdef BWN_DEBUG
2024	if (sc->sc_debug & BWN_DEBUG_XMIT)
2025		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2026#endif
2027	mac->mac_suspended = 1;
2028	mac->mac_task_state = 0;
2029	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2030
2031	mac->mac_phy.init_pre(mac);
2032
2033	siba_pcicore_intr(sc->sc_dev);
2034
2035	siba_fix_imcfglobug(sc->sc_dev);
2036	bwn_bt_disable(mac);
2037	if (mac->mac_phy.prepare_hw) {
2038		error = mac->mac_phy.prepare_hw(mac);
2039		if (error)
2040			goto fail0;
2041	}
2042	error = bwn_chip_init(mac);
2043	if (error)
2044		goto fail0;
2045	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2046	    siba_get_revid(sc->sc_dev));
2047	hf = bwn_hf_read(mac);
2048	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2049		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2050		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2051			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2052		if (mac->mac_phy.rev == 1)
2053			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2054	}
2055	if (mac->mac_phy.rf_ver == 0x2050) {
2056		if (mac->mac_phy.rf_rev < 6)
2057			hf |= BWN_HF_FORCE_VCO_RECALC;
2058		if (mac->mac_phy.rf_rev == 6)
2059			hf |= BWN_HF_4318_TSSI;
2060	}
2061	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2062		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2063	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2064	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2065		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2066	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2067	bwn_hf_write(mac, hf);
2068
2069	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2070	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2071	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2072	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2073
2074	bwn_rate_init(mac);
2075	bwn_set_phytxctl(mac);
2076
2077	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2078	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2079	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2080
2081	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2082		bwn_pio_init(mac);
2083	else
2084		bwn_dma_init(mac);
2085	bwn_wme_init(mac);
2086	bwn_spu_setdelay(mac, 1);
2087	bwn_bt_enable(mac);
2088
2089	siba_powerup(sc->sc_dev,
2090	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2091	bwn_set_macaddr(mac);
2092	bwn_crypt_init(mac);
2093
2094	/* XXX LED initializatin */
2095
2096	mac->mac_status = BWN_MAC_STATUS_INITED;
2097
2098	return (error);
2099
2100fail0:
2101	siba_powerdown(sc->sc_dev);
2102	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2103	    ("%s:%d: fail", __func__, __LINE__));
2104	return (error);
2105}
2106
2107static void
2108bwn_core_start(struct bwn_mac *mac)
2109{
2110	struct bwn_softc *sc = mac->mac_sc;
2111	uint32_t tmp;
2112
2113	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2114	    ("%s:%d: fail", __func__, __LINE__));
2115
2116	if (siba_get_revid(sc->sc_dev) < 5)
2117		return;
2118
2119	while (1) {
2120		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2121		if (!(tmp & 0x00000001))
2122			break;
2123		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2124	}
2125
2126	bwn_mac_enable(mac);
2127	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2128	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2129
2130	mac->mac_status = BWN_MAC_STATUS_STARTED;
2131}
2132
2133static void
2134bwn_core_exit(struct bwn_mac *mac)
2135{
2136	struct bwn_softc *sc = mac->mac_sc;
2137	uint32_t macctl;
2138
2139	BWN_ASSERT_LOCKED(mac->mac_sc);
2140
2141	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2142	    ("%s:%d: fail", __func__, __LINE__));
2143
2144	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2145		return;
2146	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2147
2148	macctl = BWN_READ_4(mac, BWN_MACCTL);
2149	macctl &= ~BWN_MACCTL_MCODE_RUN;
2150	macctl |= BWN_MACCTL_MCODE_JMP0;
2151	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2152
2153	bwn_dma_stop(mac);
2154	bwn_pio_stop(mac);
2155	bwn_chip_exit(mac);
2156	mac->mac_phy.switch_analog(mac, 0);
2157	siba_dev_down(sc->sc_dev, 0);
2158	siba_powerdown(sc->sc_dev);
2159}
2160
2161static void
2162bwn_bt_disable(struct bwn_mac *mac)
2163{
2164	struct bwn_softc *sc = mac->mac_sc;
2165
2166	(void)sc;
2167	/* XXX do nothing yet */
2168}
2169
2170static int
2171bwn_chip_init(struct bwn_mac *mac)
2172{
2173	struct bwn_softc *sc = mac->mac_sc;
2174	struct bwn_phy *phy = &mac->mac_phy;
2175	uint32_t macctl;
2176	int error;
2177
2178	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2179	if (phy->gmode)
2180		macctl |= BWN_MACCTL_GMODE;
2181	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2182
2183	error = bwn_fw_fillinfo(mac);
2184	if (error)
2185		return (error);
2186	error = bwn_fw_loaducode(mac);
2187	if (error)
2188		return (error);
2189
2190	error = bwn_gpio_init(mac);
2191	if (error)
2192		return (error);
2193
2194	error = bwn_fw_loadinitvals(mac);
2195	if (error) {
2196		siba_gpio_set(sc->sc_dev, 0);
2197		return (error);
2198	}
2199	phy->switch_analog(mac, 1);
2200	error = bwn_phy_init(mac);
2201	if (error) {
2202		siba_gpio_set(sc->sc_dev, 0);
2203		return (error);
2204	}
2205	if (phy->set_im)
2206		phy->set_im(mac, BWN_IMMODE_NONE);
2207	if (phy->set_antenna)
2208		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2209	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2210
2211	if (phy->type == BWN_PHYTYPE_B)
2212		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2213	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2214	if (siba_get_revid(sc->sc_dev) < 5)
2215		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2216
2217	BWN_WRITE_4(mac, BWN_MACCTL,
2218	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2219	BWN_WRITE_4(mac, BWN_MACCTL,
2220	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2221	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2222
2223	bwn_set_opmode(mac);
2224	if (siba_get_revid(sc->sc_dev) < 3) {
2225		BWN_WRITE_2(mac, 0x060e, 0x0000);
2226		BWN_WRITE_2(mac, 0x0610, 0x8000);
2227		BWN_WRITE_2(mac, 0x0604, 0x0000);
2228		BWN_WRITE_2(mac, 0x0606, 0x0200);
2229	} else {
2230		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2231		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2232	}
2233	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2234	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2235	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2236	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2237	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2238	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2239	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2240
2241	bwn_mac_phy_clock_set(mac, true);
2242
2243	/* SIBA powerup */
2244	/* XXX TODO: BCMA powerup */
2245	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2246	return (error);
2247}
2248
2249/* read hostflags */
2250uint64_t
2251bwn_hf_read(struct bwn_mac *mac)
2252{
2253	uint64_t ret;
2254
2255	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2256	ret <<= 16;
2257	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2258	ret <<= 16;
2259	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2260	return (ret);
2261}
2262
2263void
2264bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2265{
2266
2267	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2268	    (value & 0x00000000ffffull));
2269	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2270	    (value & 0x0000ffff0000ull) >> 16);
2271	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2272	    (value & 0xffff00000000ULL) >> 32);
2273}
2274
2275static void
2276bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2277{
2278
2279	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2280	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2281}
2282
2283static void
2284bwn_rate_init(struct bwn_mac *mac)
2285{
2286
2287	switch (mac->mac_phy.type) {
2288	case BWN_PHYTYPE_A:
2289	case BWN_PHYTYPE_G:
2290	case BWN_PHYTYPE_LP:
2291	case BWN_PHYTYPE_N:
2292		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2293		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2294		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2295		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2296		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2297		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2298		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2299		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2300			break;
2301		/* FALLTHROUGH */
2302	case BWN_PHYTYPE_B:
2303		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2304		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2305		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2306		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2307		break;
2308	default:
2309		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2310	}
2311}
2312
2313static void
2314bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2315{
2316	uint16_t offset;
2317
2318	if (ofdm) {
2319		offset = 0x480;
2320		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2321	} else {
2322		offset = 0x4c0;
2323		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2324	}
2325	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2326	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2327}
2328
2329static uint8_t
2330bwn_plcp_getcck(const uint8_t bitrate)
2331{
2332
2333	switch (bitrate) {
2334	case BWN_CCK_RATE_1MB:
2335		return (0x0a);
2336	case BWN_CCK_RATE_2MB:
2337		return (0x14);
2338	case BWN_CCK_RATE_5MB:
2339		return (0x37);
2340	case BWN_CCK_RATE_11MB:
2341		return (0x6e);
2342	}
2343	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2344	return (0);
2345}
2346
2347static uint8_t
2348bwn_plcp_getofdm(const uint8_t bitrate)
2349{
2350
2351	switch (bitrate) {
2352	case BWN_OFDM_RATE_6MB:
2353		return (0xb);
2354	case BWN_OFDM_RATE_9MB:
2355		return (0xf);
2356	case BWN_OFDM_RATE_12MB:
2357		return (0xa);
2358	case BWN_OFDM_RATE_18MB:
2359		return (0xe);
2360	case BWN_OFDM_RATE_24MB:
2361		return (0x9);
2362	case BWN_OFDM_RATE_36MB:
2363		return (0xd);
2364	case BWN_OFDM_RATE_48MB:
2365		return (0x8);
2366	case BWN_OFDM_RATE_54MB:
2367		return (0xc);
2368	}
2369	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2370	return (0);
2371}
2372
2373static void
2374bwn_set_phytxctl(struct bwn_mac *mac)
2375{
2376	uint16_t ctl;
2377
2378	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2379	    BWN_TX_PHY_TXPWR);
2380	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2381	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2382	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2383}
2384
2385static void
2386bwn_pio_init(struct bwn_mac *mac)
2387{
2388	struct bwn_pio *pio = &mac->mac_method.pio;
2389
2390	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2391	    & ~BWN_MACCTL_BIGENDIAN);
2392	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2393
2394	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2395	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2396	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2397	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2398	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2399	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2400}
2401
2402static void
2403bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2404    int index)
2405{
2406	struct bwn_pio_txpkt *tp;
2407	struct bwn_softc *sc = mac->mac_sc;
2408	unsigned int i;
2409
2410	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2411	tq->tq_index = index;
2412
2413	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2414	if (siba_get_revid(sc->sc_dev) >= 8)
2415		tq->tq_size = 1920;
2416	else {
2417		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2418		tq->tq_size -= 80;
2419	}
2420
2421	TAILQ_INIT(&tq->tq_pktlist);
2422	for (i = 0; i < N(tq->tq_pkts); i++) {
2423		tp = &(tq->tq_pkts[i]);
2424		tp->tp_index = i;
2425		tp->tp_queue = tq;
2426		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2427	}
2428}
2429
2430static uint16_t
2431bwn_pio_idx2base(struct bwn_mac *mac, int index)
2432{
2433	struct bwn_softc *sc = mac->mac_sc;
2434	static const uint16_t bases[] = {
2435		BWN_PIO_BASE0,
2436		BWN_PIO_BASE1,
2437		BWN_PIO_BASE2,
2438		BWN_PIO_BASE3,
2439		BWN_PIO_BASE4,
2440		BWN_PIO_BASE5,
2441		BWN_PIO_BASE6,
2442		BWN_PIO_BASE7,
2443	};
2444	static const uint16_t bases_rev11[] = {
2445		BWN_PIO11_BASE0,
2446		BWN_PIO11_BASE1,
2447		BWN_PIO11_BASE2,
2448		BWN_PIO11_BASE3,
2449		BWN_PIO11_BASE4,
2450		BWN_PIO11_BASE5,
2451	};
2452
2453	if (siba_get_revid(sc->sc_dev) >= 11) {
2454		if (index >= N(bases_rev11))
2455			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2456		return (bases_rev11[index]);
2457	}
2458	if (index >= N(bases))
2459		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2460	return (bases[index]);
2461}
2462
2463static void
2464bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2465    int index)
2466{
2467	struct bwn_softc *sc = mac->mac_sc;
2468
2469	prq->prq_mac = mac;
2470	prq->prq_rev = siba_get_revid(sc->sc_dev);
2471	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2472	bwn_dma_rxdirectfifo(mac, index, 1);
2473}
2474
2475static void
2476bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2477{
2478	if (tq == NULL)
2479		return;
2480	bwn_pio_cancel_tx_packets(tq);
2481}
2482
2483static void
2484bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2485{
2486
2487	bwn_destroy_pioqueue_tx(pio);
2488}
2489
2490static uint16_t
2491bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2492    uint16_t offset)
2493{
2494
2495	return (BWN_READ_2(mac, tq->tq_base + offset));
2496}
2497
2498static void
2499bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2500{
2501	uint32_t ctl;
2502	int type;
2503	uint16_t base;
2504
2505	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2506	base = bwn_dma_base(type, idx);
2507	if (type == BWN_DMA_64BIT) {
2508		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2509		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2510		if (enable)
2511			ctl |= BWN_DMA64_RXDIRECTFIFO;
2512		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2513	} else {
2514		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2515		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2516		if (enable)
2517			ctl |= BWN_DMA32_RXDIRECTFIFO;
2518		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2519	}
2520}
2521
2522static uint64_t
2523bwn_dma_mask(struct bwn_mac *mac)
2524{
2525	uint32_t tmp;
2526	uint16_t base;
2527
2528	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2529	if (tmp & SIBA_TGSHIGH_DMA64)
2530		return (BWN_DMA_BIT_MASK(64));
2531	base = bwn_dma_base(0, 0);
2532	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2533	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2534	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2535		return (BWN_DMA_BIT_MASK(32));
2536
2537	return (BWN_DMA_BIT_MASK(30));
2538}
2539
2540static int
2541bwn_dma_mask2type(uint64_t dmamask)
2542{
2543
2544	if (dmamask == BWN_DMA_BIT_MASK(30))
2545		return (BWN_DMA_30BIT);
2546	if (dmamask == BWN_DMA_BIT_MASK(32))
2547		return (BWN_DMA_32BIT);
2548	if (dmamask == BWN_DMA_BIT_MASK(64))
2549		return (BWN_DMA_64BIT);
2550	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2551	return (BWN_DMA_30BIT);
2552}
2553
2554static void
2555bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2556{
2557	struct bwn_pio_txpkt *tp;
2558	unsigned int i;
2559
2560	for (i = 0; i < N(tq->tq_pkts); i++) {
2561		tp = &(tq->tq_pkts[i]);
2562		if (tp->tp_m) {
2563			m_freem(tp->tp_m);
2564			tp->tp_m = NULL;
2565		}
2566	}
2567}
2568
2569static uint16_t
2570bwn_dma_base(int type, int controller_idx)
2571{
2572	static const uint16_t map64[] = {
2573		BWN_DMA64_BASE0,
2574		BWN_DMA64_BASE1,
2575		BWN_DMA64_BASE2,
2576		BWN_DMA64_BASE3,
2577		BWN_DMA64_BASE4,
2578		BWN_DMA64_BASE5,
2579	};
2580	static const uint16_t map32[] = {
2581		BWN_DMA32_BASE0,
2582		BWN_DMA32_BASE1,
2583		BWN_DMA32_BASE2,
2584		BWN_DMA32_BASE3,
2585		BWN_DMA32_BASE4,
2586		BWN_DMA32_BASE5,
2587	};
2588
2589	if (type == BWN_DMA_64BIT) {
2590		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2591		    ("%s:%d: fail", __func__, __LINE__));
2592		return (map64[controller_idx]);
2593	}
2594	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2595	    ("%s:%d: fail", __func__, __LINE__));
2596	return (map32[controller_idx]);
2597}
2598
2599static void
2600bwn_dma_init(struct bwn_mac *mac)
2601{
2602	struct bwn_dma *dma = &mac->mac_method.dma;
2603
2604	/* setup TX DMA channels. */
2605	bwn_dma_setup(dma->wme[WME_AC_BK]);
2606	bwn_dma_setup(dma->wme[WME_AC_BE]);
2607	bwn_dma_setup(dma->wme[WME_AC_VI]);
2608	bwn_dma_setup(dma->wme[WME_AC_VO]);
2609	bwn_dma_setup(dma->mcast);
2610	/* setup RX DMA channel. */
2611	bwn_dma_setup(dma->rx);
2612}
2613
2614static struct bwn_dma_ring *
2615bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2616    int for_tx, int type)
2617{
2618	struct bwn_dma *dma = &mac->mac_method.dma;
2619	struct bwn_dma_ring *dr;
2620	struct bwn_dmadesc_generic *desc;
2621	struct bwn_dmadesc_meta *mt;
2622	struct bwn_softc *sc = mac->mac_sc;
2623	int error, i;
2624
2625	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2626	if (dr == NULL)
2627		goto out;
2628	dr->dr_numslots = BWN_RXRING_SLOTS;
2629	if (for_tx)
2630		dr->dr_numslots = BWN_TXRING_SLOTS;
2631
2632	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2633	    M_DEVBUF, M_NOWAIT | M_ZERO);
2634	if (dr->dr_meta == NULL)
2635		goto fail0;
2636
2637	dr->dr_type = type;
2638	dr->dr_mac = mac;
2639	dr->dr_base = bwn_dma_base(type, controller_index);
2640	dr->dr_index = controller_index;
2641	if (type == BWN_DMA_64BIT) {
2642		dr->getdesc = bwn_dma_64_getdesc;
2643		dr->setdesc = bwn_dma_64_setdesc;
2644		dr->start_transfer = bwn_dma_64_start_transfer;
2645		dr->suspend = bwn_dma_64_suspend;
2646		dr->resume = bwn_dma_64_resume;
2647		dr->get_curslot = bwn_dma_64_get_curslot;
2648		dr->set_curslot = bwn_dma_64_set_curslot;
2649	} else {
2650		dr->getdesc = bwn_dma_32_getdesc;
2651		dr->setdesc = bwn_dma_32_setdesc;
2652		dr->start_transfer = bwn_dma_32_start_transfer;
2653		dr->suspend = bwn_dma_32_suspend;
2654		dr->resume = bwn_dma_32_resume;
2655		dr->get_curslot = bwn_dma_32_get_curslot;
2656		dr->set_curslot = bwn_dma_32_set_curslot;
2657	}
2658	if (for_tx) {
2659		dr->dr_tx = 1;
2660		dr->dr_curslot = -1;
2661	} else {
2662		if (dr->dr_index == 0) {
2663			switch (mac->mac_fw.fw_hdr_format) {
2664			case BWN_FW_HDR_351:
2665			case BWN_FW_HDR_410:
2666				dr->dr_rx_bufsize =
2667				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2668				dr->dr_frameoffset =
2669				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2670				break;
2671			case BWN_FW_HDR_598:
2672				dr->dr_rx_bufsize =
2673				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2674				dr->dr_frameoffset =
2675				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2676				break;
2677			}
2678		} else
2679			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2680	}
2681
2682	error = bwn_dma_allocringmemory(dr);
2683	if (error)
2684		goto fail2;
2685
2686	if (for_tx) {
2687		/*
2688		 * Assumption: BWN_TXRING_SLOTS can be divided by
2689		 * BWN_TX_SLOTS_PER_FRAME
2690		 */
2691		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2692		    ("%s:%d: fail", __func__, __LINE__));
2693
2694		dr->dr_txhdr_cache = contigmalloc(
2695		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2696		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2697		    0, BUS_SPACE_MAXADDR, 8, 0);
2698		if (dr->dr_txhdr_cache == NULL) {
2699			device_printf(sc->sc_dev,
2700			    "can't allocate TX header DMA memory\n");
2701			goto fail1;
2702		}
2703
2704		/*
2705		 * Create TX ring DMA stuffs
2706		 */
2707		error = bus_dma_tag_create(dma->parent_dtag,
2708				    BWN_ALIGN, 0,
2709				    BUS_SPACE_MAXADDR,
2710				    BUS_SPACE_MAXADDR,
2711				    NULL, NULL,
2712				    BWN_HDRSIZE(mac),
2713				    1,
2714				    BUS_SPACE_MAXSIZE_32BIT,
2715				    0,
2716				    NULL, NULL,
2717				    &dr->dr_txring_dtag);
2718		if (error) {
2719			device_printf(sc->sc_dev,
2720			    "can't create TX ring DMA tag: TODO frees\n");
2721			goto fail2;
2722		}
2723
2724		for (i = 0; i < dr->dr_numslots; i += 2) {
2725			dr->getdesc(dr, i, &desc, &mt);
2726
2727			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2728			mt->mt_m = NULL;
2729			mt->mt_ni = NULL;
2730			mt->mt_islast = 0;
2731			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2732			    &mt->mt_dmap);
2733			if (error) {
2734				device_printf(sc->sc_dev,
2735				     "can't create RX buf DMA map\n");
2736				goto fail2;
2737			}
2738
2739			dr->getdesc(dr, i + 1, &desc, &mt);
2740
2741			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2742			mt->mt_m = NULL;
2743			mt->mt_ni = NULL;
2744			mt->mt_islast = 1;
2745			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2746			    &mt->mt_dmap);
2747			if (error) {
2748				device_printf(sc->sc_dev,
2749				     "can't create RX buf DMA map\n");
2750				goto fail2;
2751			}
2752		}
2753	} else {
2754		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2755		    &dr->dr_spare_dmap);
2756		if (error) {
2757			device_printf(sc->sc_dev,
2758			    "can't create RX buf DMA map\n");
2759			goto out;		/* XXX wrong! */
2760		}
2761
2762		for (i = 0; i < dr->dr_numslots; i++) {
2763			dr->getdesc(dr, i, &desc, &mt);
2764
2765			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2766			    &mt->mt_dmap);
2767			if (error) {
2768				device_printf(sc->sc_dev,
2769				    "can't create RX buf DMA map\n");
2770				goto out;	/* XXX wrong! */
2771			}
2772			error = bwn_dma_newbuf(dr, desc, mt, 1);
2773			if (error) {
2774				device_printf(sc->sc_dev,
2775				    "failed to allocate RX buf\n");
2776				goto out;	/* XXX wrong! */
2777			}
2778		}
2779
2780		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2781		    BUS_DMASYNC_PREWRITE);
2782
2783		dr->dr_usedslot = dr->dr_numslots;
2784	}
2785
2786      out:
2787	return (dr);
2788
2789fail2:
2790	if (dr->dr_txhdr_cache != NULL) {
2791		contigfree(dr->dr_txhdr_cache,
2792		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2793		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2794	}
2795fail1:
2796	free(dr->dr_meta, M_DEVBUF);
2797fail0:
2798	free(dr, M_DEVBUF);
2799	return (NULL);
2800}
2801
2802static void
2803bwn_dma_ringfree(struct bwn_dma_ring **dr)
2804{
2805
2806	if (dr == NULL)
2807		return;
2808
2809	bwn_dma_free_descbufs(*dr);
2810	bwn_dma_free_ringmemory(*dr);
2811
2812	if ((*dr)->dr_txhdr_cache != NULL) {
2813		contigfree((*dr)->dr_txhdr_cache,
2814		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2815		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2816	}
2817	free((*dr)->dr_meta, M_DEVBUF);
2818	free(*dr, M_DEVBUF);
2819
2820	*dr = NULL;
2821}
2822
2823static void
2824bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2825    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2826{
2827	struct bwn_dmadesc32 *desc;
2828
2829	*meta = &(dr->dr_meta[slot]);
2830	desc = dr->dr_ring_descbase;
2831	desc = &(desc[slot]);
2832
2833	*gdesc = (struct bwn_dmadesc_generic *)desc;
2834}
2835
2836static void
2837bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2838    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2839    int start, int end, int irq)
2840{
2841	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2842	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2843	uint32_t addr, addrext, ctl;
2844	int slot;
2845
2846	slot = (int)(&(desc->dma.dma32) - descbase);
2847	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2848	    ("%s:%d: fail", __func__, __LINE__));
2849
2850	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2851	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2852	addr |= siba_dma_translation(sc->sc_dev);
2853	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2854	if (slot == dr->dr_numslots - 1)
2855		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2856	if (start)
2857		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2858	if (end)
2859		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2860	if (irq)
2861		ctl |= BWN_DMA32_DCTL_IRQ;
2862	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2863	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2864
2865	desc->dma.dma32.control = htole32(ctl);
2866	desc->dma.dma32.address = htole32(addr);
2867}
2868
2869static void
2870bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2871{
2872
2873	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2874	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2875}
2876
2877static void
2878bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2879{
2880
2881	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2882	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2883}
2884
2885static void
2886bwn_dma_32_resume(struct bwn_dma_ring *dr)
2887{
2888
2889	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2890	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2891}
2892
2893static int
2894bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2895{
2896	uint32_t val;
2897
2898	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2899	val &= BWN_DMA32_RXDPTR;
2900
2901	return (val / sizeof(struct bwn_dmadesc32));
2902}
2903
2904static void
2905bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2906{
2907
2908	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2909	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2910}
2911
2912static void
2913bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2914    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2915{
2916	struct bwn_dmadesc64 *desc;
2917
2918	*meta = &(dr->dr_meta[slot]);
2919	desc = dr->dr_ring_descbase;
2920	desc = &(desc[slot]);
2921
2922	*gdesc = (struct bwn_dmadesc_generic *)desc;
2923}
2924
2925static void
2926bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2927    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2928    int start, int end, int irq)
2929{
2930	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2931	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2932	int slot;
2933	uint32_t ctl0 = 0, ctl1 = 0;
2934	uint32_t addrlo, addrhi;
2935	uint32_t addrext;
2936
2937	slot = (int)(&(desc->dma.dma64) - descbase);
2938	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2939	    ("%s:%d: fail", __func__, __LINE__));
2940
2941	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2942	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2943	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2944	    30;
2945	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2946	if (slot == dr->dr_numslots - 1)
2947		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2948	if (start)
2949		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2950	if (end)
2951		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2952	if (irq)
2953		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2954	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2955	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2956	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2957
2958	desc->dma.dma64.control0 = htole32(ctl0);
2959	desc->dma.dma64.control1 = htole32(ctl1);
2960	desc->dma.dma64.address_low = htole32(addrlo);
2961	desc->dma.dma64.address_high = htole32(addrhi);
2962}
2963
2964static void
2965bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2966{
2967
2968	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2969	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2970}
2971
2972static void
2973bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2974{
2975
2976	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2977	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2978}
2979
2980static void
2981bwn_dma_64_resume(struct bwn_dma_ring *dr)
2982{
2983
2984	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2985	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2986}
2987
2988static int
2989bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2990{
2991	uint32_t val;
2992
2993	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2994	val &= BWN_DMA64_RXSTATDPTR;
2995
2996	return (val / sizeof(struct bwn_dmadesc64));
2997}
2998
2999static void
3000bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3001{
3002
3003	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3004	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3005}
3006
3007static int
3008bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3009{
3010	struct bwn_mac *mac = dr->dr_mac;
3011	struct bwn_dma *dma = &mac->mac_method.dma;
3012	struct bwn_softc *sc = mac->mac_sc;
3013	int error;
3014
3015	error = bus_dma_tag_create(dma->parent_dtag,
3016			    BWN_ALIGN, 0,
3017			    BUS_SPACE_MAXADDR,
3018			    BUS_SPACE_MAXADDR,
3019			    NULL, NULL,
3020			    BWN_DMA_RINGMEMSIZE,
3021			    1,
3022			    BUS_SPACE_MAXSIZE_32BIT,
3023			    0,
3024			    NULL, NULL,
3025			    &dr->dr_ring_dtag);
3026	if (error) {
3027		device_printf(sc->sc_dev,
3028		    "can't create TX ring DMA tag: TODO frees\n");
3029		return (-1);
3030	}
3031
3032	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3033	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3034	    &dr->dr_ring_dmap);
3035	if (error) {
3036		device_printf(sc->sc_dev,
3037		    "can't allocate DMA mem: TODO frees\n");
3038		return (-1);
3039	}
3040	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3041	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3042	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3043	if (error) {
3044		device_printf(sc->sc_dev,
3045		    "can't load DMA mem: TODO free\n");
3046		return (-1);
3047	}
3048
3049	return (0);
3050}
3051
3052static void
3053bwn_dma_setup(struct bwn_dma_ring *dr)
3054{
3055	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3056	uint64_t ring64;
3057	uint32_t addrext, ring32, value;
3058	uint32_t trans = siba_dma_translation(sc->sc_dev);
3059
3060	if (dr->dr_tx) {
3061		dr->dr_curslot = -1;
3062
3063		if (dr->dr_type == BWN_DMA_64BIT) {
3064			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3065			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3066			    >> 30;
3067			value = BWN_DMA64_TXENABLE;
3068			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3069			    & BWN_DMA64_TXADDREXT_MASK;
3070			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3071			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3072			    (ring64 & 0xffffffff));
3073			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3074			    ((ring64 >> 32) &
3075			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3076		} else {
3077			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3078			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3079			value = BWN_DMA32_TXENABLE;
3080			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3081			    & BWN_DMA32_TXADDREXT_MASK;
3082			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3083			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3084			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3085		}
3086		return;
3087	}
3088
3089	/*
3090	 * set for RX
3091	 */
3092	dr->dr_usedslot = dr->dr_numslots;
3093
3094	if (dr->dr_type == BWN_DMA_64BIT) {
3095		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3096		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3097		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3098		value |= BWN_DMA64_RXENABLE;
3099		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3100		    & BWN_DMA64_RXADDREXT_MASK;
3101		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3102		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3103		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3104		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3105		    | (trans << 1));
3106		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3107		    sizeof(struct bwn_dmadesc64));
3108	} else {
3109		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3110		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3111		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3112		value |= BWN_DMA32_RXENABLE;
3113		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3114		    & BWN_DMA32_RXADDREXT_MASK;
3115		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3116		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3117		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3118		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3119		    sizeof(struct bwn_dmadesc32));
3120	}
3121}
3122
3123static void
3124bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3125{
3126
3127	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3128	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3129	    dr->dr_ring_dmap);
3130}
3131
3132static void
3133bwn_dma_cleanup(struct bwn_dma_ring *dr)
3134{
3135
3136	if (dr->dr_tx) {
3137		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3138		if (dr->dr_type == BWN_DMA_64BIT) {
3139			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3140			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3141		} else
3142			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3143	} else {
3144		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3145		if (dr->dr_type == BWN_DMA_64BIT) {
3146			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3147			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3148		} else
3149			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3150	}
3151}
3152
3153static void
3154bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3155{
3156	struct bwn_dmadesc_generic *desc;
3157	struct bwn_dmadesc_meta *meta;
3158	struct bwn_mac *mac = dr->dr_mac;
3159	struct bwn_dma *dma = &mac->mac_method.dma;
3160	struct bwn_softc *sc = mac->mac_sc;
3161	int i;
3162
3163	if (!dr->dr_usedslot)
3164		return;
3165	for (i = 0; i < dr->dr_numslots; i++) {
3166		dr->getdesc(dr, i, &desc, &meta);
3167
3168		if (meta->mt_m == NULL) {
3169			if (!dr->dr_tx)
3170				device_printf(sc->sc_dev, "%s: not TX?\n",
3171				    __func__);
3172			continue;
3173		}
3174		if (dr->dr_tx) {
3175			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3176				bus_dmamap_unload(dr->dr_txring_dtag,
3177				    meta->mt_dmap);
3178			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3179				bus_dmamap_unload(dma->txbuf_dtag,
3180				    meta->mt_dmap);
3181		} else
3182			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3183		bwn_dma_free_descbuf(dr, meta);
3184	}
3185}
3186
3187static int
3188bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3189    int type)
3190{
3191	struct bwn_softc *sc = mac->mac_sc;
3192	uint32_t value;
3193	int i;
3194	uint16_t offset;
3195
3196	for (i = 0; i < 10; i++) {
3197		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3198		    BWN_DMA32_TXSTATUS;
3199		value = BWN_READ_4(mac, base + offset);
3200		if (type == BWN_DMA_64BIT) {
3201			value &= BWN_DMA64_TXSTAT;
3202			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3203			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3204			    value == BWN_DMA64_TXSTAT_STOPPED)
3205				break;
3206		} else {
3207			value &= BWN_DMA32_TXSTATE;
3208			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3209			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3210			    value == BWN_DMA32_TXSTAT_STOPPED)
3211				break;
3212		}
3213		DELAY(1000);
3214	}
3215	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3216	BWN_WRITE_4(mac, base + offset, 0);
3217	for (i = 0; i < 10; i++) {
3218		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3219						   BWN_DMA32_TXSTATUS;
3220		value = BWN_READ_4(mac, base + offset);
3221		if (type == BWN_DMA_64BIT) {
3222			value &= BWN_DMA64_TXSTAT;
3223			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3224				i = -1;
3225				break;
3226			}
3227		} else {
3228			value &= BWN_DMA32_TXSTATE;
3229			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3230				i = -1;
3231				break;
3232			}
3233		}
3234		DELAY(1000);
3235	}
3236	if (i != -1) {
3237		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3238		return (ENODEV);
3239	}
3240	DELAY(1000);
3241
3242	return (0);
3243}
3244
3245static int
3246bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3247    int type)
3248{
3249	struct bwn_softc *sc = mac->mac_sc;
3250	uint32_t value;
3251	int i;
3252	uint16_t offset;
3253
3254	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3255	BWN_WRITE_4(mac, base + offset, 0);
3256	for (i = 0; i < 10; i++) {
3257		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3258		    BWN_DMA32_RXSTATUS;
3259		value = BWN_READ_4(mac, base + offset);
3260		if (type == BWN_DMA_64BIT) {
3261			value &= BWN_DMA64_RXSTAT;
3262			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3263				i = -1;
3264				break;
3265			}
3266		} else {
3267			value &= BWN_DMA32_RXSTATE;
3268			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3269				i = -1;
3270				break;
3271			}
3272		}
3273		DELAY(1000);
3274	}
3275	if (i != -1) {
3276		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3277		return (ENODEV);
3278	}
3279
3280	return (0);
3281}
3282
3283static void
3284bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3285    struct bwn_dmadesc_meta *meta)
3286{
3287
3288	if (meta->mt_m != NULL) {
3289		m_freem(meta->mt_m);
3290		meta->mt_m = NULL;
3291	}
3292	if (meta->mt_ni != NULL) {
3293		ieee80211_free_node(meta->mt_ni);
3294		meta->mt_ni = NULL;
3295	}
3296}
3297
3298static void
3299bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3300{
3301	struct bwn_rxhdr4 *rxhdr;
3302	unsigned char *frame;
3303
3304	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3305	rxhdr->frame_len = 0;
3306
3307	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3308	    sizeof(struct bwn_plcp6) + 2,
3309	    ("%s:%d: fail", __func__, __LINE__));
3310	frame = mtod(m, char *) + dr->dr_frameoffset;
3311	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3312}
3313
3314static uint8_t
3315bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3316{
3317	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3318
3319	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3320	    == 0xff);
3321}
3322
3323static void
3324bwn_wme_init(struct bwn_mac *mac)
3325{
3326
3327	bwn_wme_load(mac);
3328
3329	/* enable WME support. */
3330	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3331	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3332	    BWN_IFSCTL_USE_EDCF);
3333}
3334
3335static void
3336bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3337{
3338	struct bwn_softc *sc = mac->mac_sc;
3339	struct ieee80211com *ic = &sc->sc_ic;
3340	uint16_t delay;	/* microsec */
3341
3342	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3343	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3344		delay = 500;
3345	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3346		delay = max(delay, (uint16_t)2400);
3347
3348	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3349}
3350
3351static void
3352bwn_bt_enable(struct bwn_mac *mac)
3353{
3354	struct bwn_softc *sc = mac->mac_sc;
3355	uint64_t hf;
3356
3357	if (bwn_bluetooth == 0)
3358		return;
3359	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3360		return;
3361	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3362		return;
3363
3364	hf = bwn_hf_read(mac);
3365	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3366		hf |= BWN_HF_BT_COEXISTALT;
3367	else
3368		hf |= BWN_HF_BT_COEXIST;
3369	bwn_hf_write(mac, hf);
3370}
3371
3372static void
3373bwn_set_macaddr(struct bwn_mac *mac)
3374{
3375
3376	bwn_mac_write_bssid(mac);
3377	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3378	    mac->mac_sc->sc_ic.ic_macaddr);
3379}
3380
3381static void
3382bwn_clear_keys(struct bwn_mac *mac)
3383{
3384	int i;
3385
3386	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3387		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3388		    ("%s:%d: fail", __func__, __LINE__));
3389
3390		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3391		    NULL, BWN_SEC_KEYSIZE, NULL);
3392		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3393			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3394			    NULL, BWN_SEC_KEYSIZE, NULL);
3395		}
3396		mac->mac_key[i].keyconf = NULL;
3397	}
3398}
3399
3400static void
3401bwn_crypt_init(struct bwn_mac *mac)
3402{
3403	struct bwn_softc *sc = mac->mac_sc;
3404
3405	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3406	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3407	    ("%s:%d: fail", __func__, __LINE__));
3408	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3409	mac->mac_ktp *= 2;
3410	if (siba_get_revid(sc->sc_dev) >= 5)
3411		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3412	bwn_clear_keys(mac);
3413}
3414
3415static void
3416bwn_chip_exit(struct bwn_mac *mac)
3417{
3418	struct bwn_softc *sc = mac->mac_sc;
3419
3420	bwn_phy_exit(mac);
3421	siba_gpio_set(sc->sc_dev, 0);
3422}
3423
3424static int
3425bwn_fw_fillinfo(struct bwn_mac *mac)
3426{
3427	int error;
3428
3429	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3430	if (error == 0)
3431		return (0);
3432	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3433	if (error == 0)
3434		return (0);
3435	return (error);
3436}
3437
3438static int
3439bwn_gpio_init(struct bwn_mac *mac)
3440{
3441	struct bwn_softc *sc = mac->mac_sc;
3442	uint32_t mask = 0x1f, set = 0xf, value;
3443
3444	BWN_WRITE_4(mac, BWN_MACCTL,
3445	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3446	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3447	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3448
3449	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3450		mask |= 0x0060;
3451		set |= 0x0060;
3452	}
3453	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3454		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3455		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3456		mask |= 0x0200;
3457		set |= 0x0200;
3458	}
3459	if (siba_get_revid(sc->sc_dev) >= 2)
3460		mask |= 0x0010;
3461
3462	value = siba_gpio_get(sc->sc_dev);
3463	if (value == -1)
3464		return (0);
3465	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3466
3467	return (0);
3468}
3469
3470static int
3471bwn_fw_loadinitvals(struct bwn_mac *mac)
3472{
3473#define	GETFWOFFSET(fwp, offset)				\
3474	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3475	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3476	const struct bwn_fwhdr *hdr;
3477	struct bwn_fw *fw = &mac->mac_fw;
3478	int error;
3479
3480	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3481	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3482	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3483	if (error)
3484		return (error);
3485	if (fw->initvals_band.fw) {
3486		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3487		error = bwn_fwinitvals_write(mac,
3488		    GETFWOFFSET(fw->initvals_band, hdr_len),
3489		    be32toh(hdr->size),
3490		    fw->initvals_band.fw->datasize - hdr_len);
3491	}
3492	return (error);
3493#undef GETFWOFFSET
3494}
3495
3496static int
3497bwn_phy_init(struct bwn_mac *mac)
3498{
3499	struct bwn_softc *sc = mac->mac_sc;
3500	int error;
3501
3502	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3503	mac->mac_phy.rf_onoff(mac, 1);
3504	error = mac->mac_phy.init(mac);
3505	if (error) {
3506		device_printf(sc->sc_dev, "PHY init failed\n");
3507		goto fail0;
3508	}
3509	error = bwn_switch_channel(mac,
3510	    mac->mac_phy.get_default_chan(mac));
3511	if (error) {
3512		device_printf(sc->sc_dev,
3513		    "failed to switch default channel\n");
3514		goto fail1;
3515	}
3516	return (0);
3517fail1:
3518	if (mac->mac_phy.exit)
3519		mac->mac_phy.exit(mac);
3520fail0:
3521	mac->mac_phy.rf_onoff(mac, 0);
3522
3523	return (error);
3524}
3525
3526static void
3527bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3528{
3529	uint16_t ant;
3530	uint16_t tmp;
3531
3532	ant = bwn_ant2phy(antenna);
3533
3534	/* For ACK/CTS */
3535	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3536	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3537	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3538	/* For Probe Resposes */
3539	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3540	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3541	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3542}
3543
3544static void
3545bwn_set_opmode(struct bwn_mac *mac)
3546{
3547	struct bwn_softc *sc = mac->mac_sc;
3548	struct ieee80211com *ic = &sc->sc_ic;
3549	uint32_t ctl;
3550	uint16_t cfp_pretbtt;
3551
3552	ctl = BWN_READ_4(mac, BWN_MACCTL);
3553	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3554	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3555	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3556	ctl |= BWN_MACCTL_STA;
3557
3558	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3559	    ic->ic_opmode == IEEE80211_M_MBSS)
3560		ctl |= BWN_MACCTL_HOSTAP;
3561	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3562		ctl &= ~BWN_MACCTL_STA;
3563	ctl |= sc->sc_filters;
3564
3565	if (siba_get_revid(sc->sc_dev) <= 4)
3566		ctl |= BWN_MACCTL_PROMISC;
3567
3568	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3569
3570	cfp_pretbtt = 2;
3571	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3572		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3573		    siba_get_chiprev(sc->sc_dev) == 3)
3574			cfp_pretbtt = 100;
3575		else
3576			cfp_pretbtt = 50;
3577	}
3578	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3579}
3580
3581static int
3582bwn_dma_gettype(struct bwn_mac *mac)
3583{
3584	uint32_t tmp;
3585	uint16_t base;
3586
3587	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3588	if (tmp & SIBA_TGSHIGH_DMA64)
3589		return (BWN_DMA_64BIT);
3590	base = bwn_dma_base(0, 0);
3591	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3592	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3593	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3594		return (BWN_DMA_32BIT);
3595
3596	return (BWN_DMA_30BIT);
3597}
3598
3599static void
3600bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3601{
3602	if (!error) {
3603		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3604		*((bus_addr_t *)arg) = seg->ds_addr;
3605	}
3606}
3607
3608void
3609bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3610{
3611	struct bwn_phy *phy = &mac->mac_phy;
3612	struct bwn_softc *sc = mac->mac_sc;
3613	unsigned int i, max_loop;
3614	uint16_t value;
3615	uint32_t buffer[5] = {
3616		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3617	};
3618
3619	if (ofdm) {
3620		max_loop = 0x1e;
3621		buffer[0] = 0x000201cc;
3622	} else {
3623		max_loop = 0xfa;
3624		buffer[0] = 0x000b846e;
3625	}
3626
3627	BWN_ASSERT_LOCKED(mac->mac_sc);
3628
3629	for (i = 0; i < 5; i++)
3630		bwn_ram_write(mac, i * 4, buffer[i]);
3631
3632	BWN_WRITE_2(mac, 0x0568, 0x0000);
3633	BWN_WRITE_2(mac, 0x07c0,
3634	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3635
3636	value = (ofdm ? 0x41 : 0x40);
3637	BWN_WRITE_2(mac, 0x050c, value);
3638
3639	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3640	    phy->type == BWN_PHYTYPE_LCN)
3641		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3642	BWN_WRITE_2(mac, 0x0508, 0x0000);
3643	BWN_WRITE_2(mac, 0x050a, 0x0000);
3644	BWN_WRITE_2(mac, 0x054c, 0x0000);
3645	BWN_WRITE_2(mac, 0x056a, 0x0014);
3646	BWN_WRITE_2(mac, 0x0568, 0x0826);
3647	BWN_WRITE_2(mac, 0x0500, 0x0000);
3648
3649	/* XXX TODO: n phy pa override? */
3650
3651	switch (phy->type) {
3652	case BWN_PHYTYPE_N:
3653	case BWN_PHYTYPE_LCN:
3654		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3655		break;
3656	case BWN_PHYTYPE_LP:
3657		BWN_WRITE_2(mac, 0x0502, 0x0050);
3658		break;
3659	default:
3660		BWN_WRITE_2(mac, 0x0502, 0x0030);
3661		break;
3662	}
3663
3664	/* flush */
3665	BWN_READ_2(mac, 0x0502);
3666
3667	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3668		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3669	for (i = 0x00; i < max_loop; i++) {
3670		value = BWN_READ_2(mac, 0x050e);
3671		if (value & 0x0080)
3672			break;
3673		DELAY(10);
3674	}
3675	for (i = 0x00; i < 0x0a; i++) {
3676		value = BWN_READ_2(mac, 0x050e);
3677		if (value & 0x0400)
3678			break;
3679		DELAY(10);
3680	}
3681	for (i = 0x00; i < 0x19; i++) {
3682		value = BWN_READ_2(mac, 0x0690);
3683		if (!(value & 0x0100))
3684			break;
3685		DELAY(10);
3686	}
3687	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3688		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3689}
3690
3691void
3692bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3693{
3694	uint32_t macctl;
3695
3696	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3697
3698	macctl = BWN_READ_4(mac, BWN_MACCTL);
3699	if (macctl & BWN_MACCTL_BIGENDIAN)
3700		printf("TODO: need swap\n");
3701
3702	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3703	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3704	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3705}
3706
3707void
3708bwn_mac_suspend(struct bwn_mac *mac)
3709{
3710	struct bwn_softc *sc = mac->mac_sc;
3711	int i;
3712	uint32_t tmp;
3713
3714	KASSERT(mac->mac_suspended >= 0,
3715	    ("%s:%d: fail", __func__, __LINE__));
3716
3717	if (mac->mac_suspended == 0) {
3718		bwn_psctl(mac, BWN_PS_AWAKE);
3719		BWN_WRITE_4(mac, BWN_MACCTL,
3720			    BWN_READ_4(mac, BWN_MACCTL)
3721			    & ~BWN_MACCTL_ON);
3722		BWN_READ_4(mac, BWN_MACCTL);
3723		for (i = 35; i; i--) {
3724			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3725			if (tmp & BWN_INTR_MAC_SUSPENDED)
3726				goto out;
3727			DELAY(10);
3728		}
3729		for (i = 40; i; i--) {
3730			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3731			if (tmp & BWN_INTR_MAC_SUSPENDED)
3732				goto out;
3733			DELAY(1000);
3734		}
3735		device_printf(sc->sc_dev, "MAC suspend failed\n");
3736	}
3737out:
3738	mac->mac_suspended++;
3739}
3740
3741void
3742bwn_mac_enable(struct bwn_mac *mac)
3743{
3744	struct bwn_softc *sc = mac->mac_sc;
3745	uint16_t state;
3746
3747	state = bwn_shm_read_2(mac, BWN_SHARED,
3748	    BWN_SHARED_UCODESTAT);
3749	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3750	    state != BWN_SHARED_UCODESTAT_SLEEP)
3751		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3752
3753	mac->mac_suspended--;
3754	KASSERT(mac->mac_suspended >= 0,
3755	    ("%s:%d: fail", __func__, __LINE__));
3756	if (mac->mac_suspended == 0) {
3757		BWN_WRITE_4(mac, BWN_MACCTL,
3758		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3759		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3760		BWN_READ_4(mac, BWN_MACCTL);
3761		BWN_READ_4(mac, BWN_INTR_REASON);
3762		bwn_psctl(mac, 0);
3763	}
3764}
3765
3766void
3767bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3768{
3769	struct bwn_softc *sc = mac->mac_sc;
3770	int i;
3771	uint16_t ucstat;
3772
3773	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3774	    ("%s:%d: fail", __func__, __LINE__));
3775	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3776	    ("%s:%d: fail", __func__, __LINE__));
3777
3778	/* XXX forcibly awake and hwps-off */
3779
3780	BWN_WRITE_4(mac, BWN_MACCTL,
3781	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3782	    ~BWN_MACCTL_HWPS);
3783	BWN_READ_4(mac, BWN_MACCTL);
3784	if (siba_get_revid(sc->sc_dev) >= 5) {
3785		for (i = 0; i < 100; i++) {
3786			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3787			    BWN_SHARED_UCODESTAT);
3788			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3789				break;
3790			DELAY(10);
3791		}
3792	}
3793	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3794	    ucstat);
3795}
3796
3797static int
3798bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3799{
3800	struct bwn_softc *sc = mac->mac_sc;
3801	struct bwn_fw *fw = &mac->mac_fw;
3802	const uint8_t rev = siba_get_revid(sc->sc_dev);
3803	const char *filename;
3804	uint32_t high;
3805	int error;
3806
3807	/* microcode */
3808	filename = NULL;
3809	switch (rev) {
3810	case 42:
3811		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3812			filename = "ucode42";
3813		break;
3814	case 40:
3815		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3816			filename = "ucode40";
3817		break;
3818	case 33:
3819		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3820			filename = "ucode33_lcn40";
3821		break;
3822	case 30:
3823		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3824			filename = "ucode30_mimo";
3825		break;
3826	case 29:
3827		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3828			filename = "ucode29_mimo";
3829		break;
3830	case 26:
3831		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3832			filename = "ucode26_mimo";
3833		break;
3834	case 28:
3835	case 25:
3836		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3837			filename = "ucode25_mimo";
3838		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3839			filename = "ucode25_lcn";
3840		break;
3841	case 24:
3842		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3843			filename = "ucode24_lcn";
3844		break;
3845	case 23:
3846		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3847			filename = "ucode16_mimo";
3848		break;
3849	case 16:
3850	case 17:
3851	case 18:
3852	case 19:
3853		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3854			filename = "ucode16_mimo";
3855		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3856			filename = "ucode16_lp";
3857		break;
3858	case 15:
3859		filename = "ucode15";
3860		break;
3861	case 14:
3862		filename = "ucode14";
3863		break;
3864	case 13:
3865		filename = "ucode13";
3866		break;
3867	case 12:
3868	case 11:
3869		filename = "ucode11";
3870		break;
3871	case 10:
3872	case 9:
3873	case 8:
3874	case 7:
3875	case 6:
3876	case 5:
3877		filename = "ucode5";
3878		break;
3879	default:
3880		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3881		bwn_release_firmware(mac);
3882		return (EOPNOTSUPP);
3883	}
3884
3885	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3886	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3887	if (error) {
3888		bwn_release_firmware(mac);
3889		return (error);
3890	}
3891
3892	/* PCM */
3893	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3894	if (rev >= 5 && rev <= 10) {
3895		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3896		if (error == ENOENT)
3897			fw->no_pcmfile = 1;
3898		else if (error) {
3899			bwn_release_firmware(mac);
3900			return (error);
3901		}
3902	} else if (rev < 11) {
3903		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3904		return (EOPNOTSUPP);
3905	}
3906
3907	/* initvals */
3908	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3909	switch (mac->mac_phy.type) {
3910	case BWN_PHYTYPE_A:
3911		if (rev < 5 || rev > 10)
3912			goto fail1;
3913		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3914			filename = "a0g1initvals5";
3915		else
3916			filename = "a0g0initvals5";
3917		break;
3918	case BWN_PHYTYPE_G:
3919		if (rev >= 5 && rev <= 10)
3920			filename = "b0g0initvals5";
3921		else if (rev >= 13)
3922			filename = "b0g0initvals13";
3923		else
3924			goto fail1;
3925		break;
3926	case BWN_PHYTYPE_LP:
3927		if (rev == 13)
3928			filename = "lp0initvals13";
3929		else if (rev == 14)
3930			filename = "lp0initvals14";
3931		else if (rev >= 15)
3932			filename = "lp0initvals15";
3933		else
3934			goto fail1;
3935		break;
3936	case BWN_PHYTYPE_N:
3937		if (rev == 30)
3938			filename = "n16initvals30";
3939		else if (rev == 28 || rev == 25)
3940			filename = "n0initvals25";
3941		else if (rev == 24)
3942			filename = "n0initvals24";
3943		else if (rev == 23)
3944			filename = "n0initvals16";
3945		else if (rev >= 16 && rev <= 18)
3946			filename = "n0initvals16";
3947		else if (rev >= 11 && rev <= 12)
3948			filename = "n0initvals11";
3949		else
3950			goto fail1;
3951		break;
3952	default:
3953		goto fail1;
3954	}
3955	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3956	if (error) {
3957		bwn_release_firmware(mac);
3958		return (error);
3959	}
3960
3961	/* bandswitch initvals */
3962	switch (mac->mac_phy.type) {
3963	case BWN_PHYTYPE_A:
3964		if (rev >= 5 && rev <= 10) {
3965			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3966				filename = "a0g1bsinitvals5";
3967			else
3968				filename = "a0g0bsinitvals5";
3969		} else if (rev >= 11)
3970			filename = NULL;
3971		else
3972			goto fail1;
3973		break;
3974	case BWN_PHYTYPE_G:
3975		if (rev >= 5 && rev <= 10)
3976			filename = "b0g0bsinitvals5";
3977		else if (rev >= 11)
3978			filename = NULL;
3979		else
3980			goto fail1;
3981		break;
3982	case BWN_PHYTYPE_LP:
3983		if (rev == 13)
3984			filename = "lp0bsinitvals13";
3985		else if (rev == 14)
3986			filename = "lp0bsinitvals14";
3987		else if (rev >= 15)
3988			filename = "lp0bsinitvals15";
3989		else
3990			goto fail1;
3991		break;
3992	case BWN_PHYTYPE_N:
3993		if (rev == 30)
3994			filename = "n16bsinitvals30";
3995		else if (rev == 28 || rev == 25)
3996			filename = "n0bsinitvals25";
3997		else if (rev == 24)
3998			filename = "n0bsinitvals24";
3999		else if (rev == 23)
4000			filename = "n0bsinitvals16";
4001		else if (rev >= 16 && rev <= 18)
4002			filename = "n0bsinitvals16";
4003		else if (rev >= 11 && rev <= 12)
4004			filename = "n0bsinitvals11";
4005		else
4006			goto fail1;
4007		break;
4008	default:
4009		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4010		    mac->mac_phy.type);
4011		goto fail1;
4012	}
4013	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4014	if (error) {
4015		bwn_release_firmware(mac);
4016		return (error);
4017	}
4018	return (0);
4019fail1:
4020	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4021	    rev, mac->mac_phy.type);
4022	bwn_release_firmware(mac);
4023	return (EOPNOTSUPP);
4024}
4025
4026static int
4027bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4028    const char *name, struct bwn_fwfile *bfw)
4029{
4030	const struct bwn_fwhdr *hdr;
4031	struct bwn_softc *sc = mac->mac_sc;
4032	const struct firmware *fw;
4033	char namebuf[64];
4034
4035	if (name == NULL) {
4036		bwn_do_release_fw(bfw);
4037		return (0);
4038	}
4039	if (bfw->filename != NULL) {
4040		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4041			return (0);
4042		bwn_do_release_fw(bfw);
4043	}
4044
4045	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4046	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4047	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4048	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4049	fw = firmware_get(namebuf);
4050	if (fw == NULL) {
4051		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4052		    namebuf);
4053		return (ENOENT);
4054	}
4055	if (fw->datasize < sizeof(struct bwn_fwhdr))
4056		goto fail;
4057	hdr = (const struct bwn_fwhdr *)(fw->data);
4058	switch (hdr->type) {
4059	case BWN_FWTYPE_UCODE:
4060	case BWN_FWTYPE_PCM:
4061		if (be32toh(hdr->size) !=
4062		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4063			goto fail;
4064		/* FALLTHROUGH */
4065	case BWN_FWTYPE_IV:
4066		if (hdr->ver != 1)
4067			goto fail;
4068		break;
4069	default:
4070		goto fail;
4071	}
4072	bfw->filename = name;
4073	bfw->fw = fw;
4074	bfw->type = type;
4075	return (0);
4076fail:
4077	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4078	if (fw != NULL)
4079		firmware_put(fw, FIRMWARE_UNLOAD);
4080	return (EPROTO);
4081}
4082
4083static void
4084bwn_release_firmware(struct bwn_mac *mac)
4085{
4086
4087	bwn_do_release_fw(&mac->mac_fw.ucode);
4088	bwn_do_release_fw(&mac->mac_fw.pcm);
4089	bwn_do_release_fw(&mac->mac_fw.initvals);
4090	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4091}
4092
4093static void
4094bwn_do_release_fw(struct bwn_fwfile *bfw)
4095{
4096
4097	if (bfw->fw != NULL)
4098		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4099	bfw->fw = NULL;
4100	bfw->filename = NULL;
4101}
4102
4103static int
4104bwn_fw_loaducode(struct bwn_mac *mac)
4105{
4106#define	GETFWOFFSET(fwp, offset)	\
4107	((const uint32_t *)((const char *)fwp.fw->data + offset))
4108#define	GETFWSIZE(fwp, offset)	\
4109	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4110	struct bwn_softc *sc = mac->mac_sc;
4111	const uint32_t *data;
4112	unsigned int i;
4113	uint32_t ctl;
4114	uint16_t date, fwcaps, time;
4115	int error = 0;
4116
4117	ctl = BWN_READ_4(mac, BWN_MACCTL);
4118	ctl |= BWN_MACCTL_MCODE_JMP0;
4119	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4120	    __LINE__));
4121	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4122	for (i = 0; i < 64; i++)
4123		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4124	for (i = 0; i < 4096; i += 2)
4125		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4126
4127	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4128	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4129	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4130	     i++) {
4131		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4132		DELAY(10);
4133	}
4134
4135	if (mac->mac_fw.pcm.fw) {
4136		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4137		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4138		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4139		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4140		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4141		    sizeof(struct bwn_fwhdr)); i++) {
4142			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4143			DELAY(10);
4144		}
4145	}
4146
4147	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4148	BWN_WRITE_4(mac, BWN_MACCTL,
4149	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4150	    BWN_MACCTL_MCODE_RUN);
4151
4152	for (i = 0; i < 21; i++) {
4153		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4154			break;
4155		if (i >= 20) {
4156			device_printf(sc->sc_dev, "ucode timeout\n");
4157			error = ENXIO;
4158			goto error;
4159		}
4160		DELAY(50000);
4161	}
4162	BWN_READ_4(mac, BWN_INTR_REASON);
4163
4164	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4165	if (mac->mac_fw.rev <= 0x128) {
4166		device_printf(sc->sc_dev, "the firmware is too old\n");
4167		error = EOPNOTSUPP;
4168		goto error;
4169	}
4170
4171	/*
4172	 * Determine firmware header version; needed for TX/RX packet
4173	 * handling.
4174	 */
4175	if (mac->mac_fw.rev >= 598)
4176		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4177	else if (mac->mac_fw.rev >= 410)
4178		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4179	else
4180		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4181
4182	/*
4183	 * We don't support rev 598 or later; that requires
4184	 * another round of changes to the TX/RX descriptor
4185	 * and status layout.
4186	 *
4187	 * So, complain this is the case and exit out, rather
4188	 * than attaching and then failing.
4189	 */
4190#if 0
4191	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4192		device_printf(sc->sc_dev,
4193		    "firmware is too new (>=598); not supported\n");
4194		error = EOPNOTSUPP;
4195		goto error;
4196	}
4197#endif
4198
4199	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4200	    BWN_SHARED_UCODE_PATCH);
4201	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4202	mac->mac_fw.opensource = (date == 0xffff);
4203	if (bwn_wme != 0)
4204		mac->mac_flags |= BWN_MAC_FLAG_WME;
4205	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4206
4207	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4208	if (mac->mac_fw.opensource == 0) {
4209		device_printf(sc->sc_dev,
4210		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4211		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4212		if (mac->mac_fw.no_pcmfile)
4213			device_printf(sc->sc_dev,
4214			    "no HW crypto acceleration due to pcm5\n");
4215	} else {
4216		mac->mac_fw.patch = time;
4217		fwcaps = bwn_fwcaps_read(mac);
4218		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4219			device_printf(sc->sc_dev,
4220			    "disabling HW crypto acceleration\n");
4221			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4222		}
4223		if (!(fwcaps & BWN_FWCAPS_WME)) {
4224			device_printf(sc->sc_dev, "disabling WME support\n");
4225			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4226		}
4227	}
4228
4229	if (BWN_ISOLDFMT(mac))
4230		device_printf(sc->sc_dev, "using old firmware image\n");
4231
4232	return (0);
4233
4234error:
4235	BWN_WRITE_4(mac, BWN_MACCTL,
4236	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4237	    BWN_MACCTL_MCODE_JMP0);
4238
4239	return (error);
4240#undef GETFWSIZE
4241#undef GETFWOFFSET
4242}
4243
4244/* OpenFirmware only */
4245static uint16_t
4246bwn_fwcaps_read(struct bwn_mac *mac)
4247{
4248
4249	KASSERT(mac->mac_fw.opensource == 1,
4250	    ("%s:%d: fail", __func__, __LINE__));
4251	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4252}
4253
4254static int
4255bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4256    size_t count, size_t array_size)
4257{
4258#define	GET_NEXTIV16(iv)						\
4259	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4260	    sizeof(uint16_t) + sizeof(uint16_t)))
4261#define	GET_NEXTIV32(iv)						\
4262	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4263	    sizeof(uint16_t) + sizeof(uint32_t)))
4264	struct bwn_softc *sc = mac->mac_sc;
4265	const struct bwn_fwinitvals *iv;
4266	uint16_t offset;
4267	size_t i;
4268	uint8_t bit32;
4269
4270	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4271	    ("%s:%d: fail", __func__, __LINE__));
4272	iv = ivals;
4273	for (i = 0; i < count; i++) {
4274		if (array_size < sizeof(iv->offset_size))
4275			goto fail;
4276		array_size -= sizeof(iv->offset_size);
4277		offset = be16toh(iv->offset_size);
4278		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4279		offset &= BWN_FWINITVALS_OFFSET_MASK;
4280		if (offset >= 0x1000)
4281			goto fail;
4282		if (bit32) {
4283			if (array_size < sizeof(iv->data.d32))
4284				goto fail;
4285			array_size -= sizeof(iv->data.d32);
4286			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4287			iv = GET_NEXTIV32(iv);
4288		} else {
4289
4290			if (array_size < sizeof(iv->data.d16))
4291				goto fail;
4292			array_size -= sizeof(iv->data.d16);
4293			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4294
4295			iv = GET_NEXTIV16(iv);
4296		}
4297	}
4298	if (array_size != 0)
4299		goto fail;
4300	return (0);
4301fail:
4302	device_printf(sc->sc_dev, "initvals: invalid format\n");
4303	return (EPROTO);
4304#undef GET_NEXTIV16
4305#undef GET_NEXTIV32
4306}
4307
4308int
4309bwn_switch_channel(struct bwn_mac *mac, int chan)
4310{
4311	struct bwn_phy *phy = &(mac->mac_phy);
4312	struct bwn_softc *sc = mac->mac_sc;
4313	struct ieee80211com *ic = &sc->sc_ic;
4314	uint16_t channelcookie, savedcookie;
4315	int error;
4316
4317	if (chan == 0xffff)
4318		chan = phy->get_default_chan(mac);
4319
4320	channelcookie = chan;
4321	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4322		channelcookie |= 0x100;
4323	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4324	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4325	error = phy->switch_channel(mac, chan);
4326	if (error)
4327		goto fail;
4328
4329	mac->mac_phy.chan = chan;
4330	DELAY(8000);
4331	return (0);
4332fail:
4333	device_printf(sc->sc_dev, "failed to switch channel\n");
4334	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4335	return (error);
4336}
4337
4338static uint16_t
4339bwn_ant2phy(int antenna)
4340{
4341
4342	switch (antenna) {
4343	case BWN_ANT0:
4344		return (BWN_TX_PHY_ANT0);
4345	case BWN_ANT1:
4346		return (BWN_TX_PHY_ANT1);
4347	case BWN_ANT2:
4348		return (BWN_TX_PHY_ANT2);
4349	case BWN_ANT3:
4350		return (BWN_TX_PHY_ANT3);
4351	case BWN_ANTAUTO:
4352		return (BWN_TX_PHY_ANT01AUTO);
4353	}
4354	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4355	return (0);
4356}
4357
4358static void
4359bwn_wme_load(struct bwn_mac *mac)
4360{
4361	struct bwn_softc *sc = mac->mac_sc;
4362	int i;
4363
4364	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4365	    ("%s:%d: fail", __func__, __LINE__));
4366
4367	bwn_mac_suspend(mac);
4368	for (i = 0; i < N(sc->sc_wmeParams); i++)
4369		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4370		    bwn_wme_shm_offsets[i]);
4371	bwn_mac_enable(mac);
4372}
4373
4374static void
4375bwn_wme_loadparams(struct bwn_mac *mac,
4376    const struct wmeParams *p, uint16_t shm_offset)
4377{
4378#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4379	struct bwn_softc *sc = mac->mac_sc;
4380	uint16_t params[BWN_NR_WMEPARAMS];
4381	int slot, tmp;
4382	unsigned int i;
4383
4384	slot = BWN_READ_2(mac, BWN_RNG) &
4385	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4386
4387	memset(&params, 0, sizeof(params));
4388
4389	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4390	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4391	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4392
4393	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4394	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4395	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4396	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4397	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4398	params[BWN_WMEPARAM_BSLOTS] = slot;
4399	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4400
4401	for (i = 0; i < N(params); i++) {
4402		if (i == BWN_WMEPARAM_STATUS) {
4403			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4404			    shm_offset + (i * 2));
4405			tmp |= 0x100;
4406			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4407			    tmp);
4408		} else {
4409			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4410			    params[i]);
4411		}
4412	}
4413}
4414
4415static void
4416bwn_mac_write_bssid(struct bwn_mac *mac)
4417{
4418	struct bwn_softc *sc = mac->mac_sc;
4419	uint32_t tmp;
4420	int i;
4421	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4422
4423	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4424	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4425	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4426	    IEEE80211_ADDR_LEN);
4427
4428	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4429		tmp = (uint32_t) (mac_bssid[i + 0]);
4430		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4431		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4432		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4433		bwn_ram_write(mac, 0x20 + i, tmp);
4434	}
4435}
4436
4437static void
4438bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4439    const uint8_t *macaddr)
4440{
4441	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4442	uint16_t data;
4443
4444	if (!mac)
4445		macaddr = zero;
4446
4447	offset |= 0x0020;
4448	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4449
4450	data = macaddr[0];
4451	data |= macaddr[1] << 8;
4452	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4453	data = macaddr[2];
4454	data |= macaddr[3] << 8;
4455	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4456	data = macaddr[4];
4457	data |= macaddr[5] << 8;
4458	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4459}
4460
4461static void
4462bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4463    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4464{
4465	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4466	uint8_t per_sta_keys_start = 8;
4467
4468	if (BWN_SEC_NEWAPI(mac))
4469		per_sta_keys_start = 4;
4470
4471	KASSERT(index < mac->mac_max_nr_keys,
4472	    ("%s:%d: fail", __func__, __LINE__));
4473	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4474	    ("%s:%d: fail", __func__, __LINE__));
4475
4476	if (index >= per_sta_keys_start)
4477		bwn_key_macwrite(mac, index, NULL);
4478	if (key)
4479		memcpy(buf, key, key_len);
4480	bwn_key_write(mac, index, algorithm, buf);
4481	if (index >= per_sta_keys_start)
4482		bwn_key_macwrite(mac, index, mac_addr);
4483
4484	mac->mac_key[index].algorithm = algorithm;
4485}
4486
4487static void
4488bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4489{
4490	struct bwn_softc *sc = mac->mac_sc;
4491	uint32_t addrtmp[2] = { 0, 0 };
4492	uint8_t start = 8;
4493
4494	if (BWN_SEC_NEWAPI(mac))
4495		start = 4;
4496
4497	KASSERT(index >= start,
4498	    ("%s:%d: fail", __func__, __LINE__));
4499	index -= start;
4500
4501	if (addr) {
4502		addrtmp[0] = addr[0];
4503		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4504		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4505		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4506		addrtmp[1] = addr[4];
4507		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4508	}
4509
4510	if (siba_get_revid(sc->sc_dev) >= 5) {
4511		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4512		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4513	} else {
4514		if (index >= 8) {
4515			bwn_shm_write_4(mac, BWN_SHARED,
4516			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4517			bwn_shm_write_2(mac, BWN_SHARED,
4518			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4519		}
4520	}
4521}
4522
4523static void
4524bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4525    const uint8_t *key)
4526{
4527	unsigned int i;
4528	uint32_t offset;
4529	uint16_t kidx, value;
4530
4531	kidx = BWN_SEC_KEY2FW(mac, index);
4532	bwn_shm_write_2(mac, BWN_SHARED,
4533	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4534
4535	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4536	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4537		value = key[i];
4538		value |= (uint16_t)(key[i + 1]) << 8;
4539		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4540	}
4541}
4542
4543static void
4544bwn_phy_exit(struct bwn_mac *mac)
4545{
4546
4547	mac->mac_phy.rf_onoff(mac, 0);
4548	if (mac->mac_phy.exit != NULL)
4549		mac->mac_phy.exit(mac);
4550}
4551
4552static void
4553bwn_dma_free(struct bwn_mac *mac)
4554{
4555	struct bwn_dma *dma;
4556
4557	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4558		return;
4559	dma = &mac->mac_method.dma;
4560
4561	bwn_dma_ringfree(&dma->rx);
4562	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4563	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4564	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4565	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4566	bwn_dma_ringfree(&dma->mcast);
4567}
4568
4569static void
4570bwn_core_stop(struct bwn_mac *mac)
4571{
4572	struct bwn_softc *sc = mac->mac_sc;
4573
4574	BWN_ASSERT_LOCKED(sc);
4575
4576	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4577		return;
4578
4579	callout_stop(&sc->sc_rfswitch_ch);
4580	callout_stop(&sc->sc_task_ch);
4581	callout_stop(&sc->sc_watchdog_ch);
4582	sc->sc_watchdog_timer = 0;
4583	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4584	BWN_READ_4(mac, BWN_INTR_MASK);
4585	bwn_mac_suspend(mac);
4586
4587	mac->mac_status = BWN_MAC_STATUS_INITED;
4588}
4589
4590static int
4591bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4592{
4593	struct bwn_mac *up_dev = NULL;
4594	struct bwn_mac *down_dev;
4595	struct bwn_mac *mac;
4596	int err, status;
4597	uint8_t gmode;
4598
4599	BWN_ASSERT_LOCKED(sc);
4600
4601	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4602		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4603		    mac->mac_phy.supports_2ghz) {
4604			up_dev = mac;
4605			gmode = 1;
4606		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4607		    mac->mac_phy.supports_5ghz) {
4608			up_dev = mac;
4609			gmode = 0;
4610		} else {
4611			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4612			return (EINVAL);
4613		}
4614		if (up_dev != NULL)
4615			break;
4616	}
4617	if (up_dev == NULL) {
4618		device_printf(sc->sc_dev, "Could not find a device\n");
4619		return (ENODEV);
4620	}
4621	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4622		return (0);
4623
4624	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4625	    "switching to %s-GHz band\n",
4626	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4627
4628	down_dev = sc->sc_curmac;
4629	status = down_dev->mac_status;
4630	if (status >= BWN_MAC_STATUS_STARTED)
4631		bwn_core_stop(down_dev);
4632	if (status >= BWN_MAC_STATUS_INITED)
4633		bwn_core_exit(down_dev);
4634
4635	if (down_dev != up_dev)
4636		bwn_phy_reset(down_dev);
4637
4638	up_dev->mac_phy.gmode = gmode;
4639	if (status >= BWN_MAC_STATUS_INITED) {
4640		err = bwn_core_init(up_dev);
4641		if (err) {
4642			device_printf(sc->sc_dev,
4643			    "fatal: failed to initialize for %s-GHz\n",
4644			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4645			goto fail;
4646		}
4647	}
4648	if (status >= BWN_MAC_STATUS_STARTED)
4649		bwn_core_start(up_dev);
4650	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4651	sc->sc_curmac = up_dev;
4652
4653	return (0);
4654fail:
4655	sc->sc_curmac = NULL;
4656	return (err);
4657}
4658
4659static void
4660bwn_rf_turnon(struct bwn_mac *mac)
4661{
4662
4663	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4664
4665	bwn_mac_suspend(mac);
4666	mac->mac_phy.rf_onoff(mac, 1);
4667	mac->mac_phy.rf_on = 1;
4668	bwn_mac_enable(mac);
4669}
4670
4671static void
4672bwn_rf_turnoff(struct bwn_mac *mac)
4673{
4674
4675	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4676
4677	bwn_mac_suspend(mac);
4678	mac->mac_phy.rf_onoff(mac, 0);
4679	mac->mac_phy.rf_on = 0;
4680	bwn_mac_enable(mac);
4681}
4682
4683/*
4684 * SSB PHY reset.
4685 *
4686 * XXX TODO: BCMA PHY reset.
4687 */
4688static void
4689bwn_phy_reset(struct bwn_mac *mac)
4690{
4691	struct bwn_softc *sc = mac->mac_sc;
4692
4693	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4694	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4695	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4696	DELAY(1000);
4697	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4698	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4699	DELAY(1000);
4700}
4701
4702static int
4703bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4704{
4705	struct bwn_vap *bvp = BWN_VAP(vap);
4706	struct ieee80211com *ic= vap->iv_ic;
4707	enum ieee80211_state ostate = vap->iv_state;
4708	struct bwn_softc *sc = ic->ic_softc;
4709	struct bwn_mac *mac = sc->sc_curmac;
4710	int error;
4711
4712	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4713	    ieee80211_state_name[vap->iv_state],
4714	    ieee80211_state_name[nstate]);
4715
4716	error = bvp->bv_newstate(vap, nstate, arg);
4717	if (error != 0)
4718		return (error);
4719
4720	BWN_LOCK(sc);
4721
4722	bwn_led_newstate(mac, nstate);
4723
4724	/*
4725	 * Clear the BSSID when we stop a STA
4726	 */
4727	if (vap->iv_opmode == IEEE80211_M_STA) {
4728		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4729			/*
4730			 * Clear out the BSSID.  If we reassociate to
4731			 * the same AP, this will reinialize things
4732			 * correctly...
4733			 */
4734			if (ic->ic_opmode == IEEE80211_M_STA &&
4735			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4736				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4737				bwn_set_macaddr(mac);
4738			}
4739		}
4740	}
4741
4742	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4743	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4744		/* XXX nothing to do? */
4745	} else if (nstate == IEEE80211_S_RUN) {
4746		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4747		bwn_set_opmode(mac);
4748		bwn_set_pretbtt(mac);
4749		bwn_spu_setdelay(mac, 0);
4750		bwn_set_macaddr(mac);
4751	}
4752
4753	BWN_UNLOCK(sc);
4754
4755	return (error);
4756}
4757
4758static void
4759bwn_set_pretbtt(struct bwn_mac *mac)
4760{
4761	struct bwn_softc *sc = mac->mac_sc;
4762	struct ieee80211com *ic = &sc->sc_ic;
4763	uint16_t pretbtt;
4764
4765	if (ic->ic_opmode == IEEE80211_M_IBSS)
4766		pretbtt = 2;
4767	else
4768		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4769	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4770	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4771}
4772
4773static int
4774bwn_intr(void *arg)
4775{
4776	struct bwn_mac *mac = arg;
4777	struct bwn_softc *sc = mac->mac_sc;
4778	uint32_t reason;
4779
4780	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4781	    (sc->sc_flags & BWN_FLAG_INVALID))
4782		return (FILTER_STRAY);
4783
4784	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4785	if (reason == 0xffffffff)	/* shared IRQ */
4786		return (FILTER_STRAY);
4787	reason &= mac->mac_intr_mask;
4788	if (reason == 0)
4789		return (FILTER_HANDLED);
4790
4791	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4792	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4793	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4794	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4795	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4796	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4797	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4798	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4799	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4800	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4801	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4802
4803	/* Disable interrupts. */
4804	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4805
4806	mac->mac_reason_intr = reason;
4807
4808	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4809	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4810
4811	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4812	return (FILTER_HANDLED);
4813}
4814
4815static void
4816bwn_intrtask(void *arg, int npending)
4817{
4818	struct bwn_mac *mac = arg;
4819	struct bwn_softc *sc = mac->mac_sc;
4820	uint32_t merged = 0;
4821	int i, tx = 0, rx = 0;
4822
4823	BWN_LOCK(sc);
4824	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4825	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4826		BWN_UNLOCK(sc);
4827		return;
4828	}
4829
4830	for (i = 0; i < N(mac->mac_reason); i++)
4831		merged |= mac->mac_reason[i];
4832
4833	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4834		device_printf(sc->sc_dev, "MAC trans error\n");
4835
4836	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4837		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4838		mac->mac_phy.txerrors--;
4839		if (mac->mac_phy.txerrors == 0) {
4840			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4841			bwn_restart(mac, "PHY TX errors");
4842		}
4843	}
4844
4845	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4846		if (merged & BWN_DMAINTR_FATALMASK) {
4847			device_printf(sc->sc_dev,
4848			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4849			    mac->mac_reason[0], mac->mac_reason[1],
4850			    mac->mac_reason[2], mac->mac_reason[3],
4851			    mac->mac_reason[4], mac->mac_reason[5]);
4852			bwn_restart(mac, "DMA error");
4853			BWN_UNLOCK(sc);
4854			return;
4855		}
4856		if (merged & BWN_DMAINTR_NONFATALMASK) {
4857			device_printf(sc->sc_dev,
4858			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4859			    mac->mac_reason[0], mac->mac_reason[1],
4860			    mac->mac_reason[2], mac->mac_reason[3],
4861			    mac->mac_reason[4], mac->mac_reason[5]);
4862		}
4863	}
4864
4865	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4866		bwn_intr_ucode_debug(mac);
4867	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4868		bwn_intr_tbtt_indication(mac);
4869	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4870		bwn_intr_atim_end(mac);
4871	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4872		bwn_intr_beacon(mac);
4873	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4874		bwn_intr_pmq(mac);
4875	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4876		bwn_intr_noise(mac);
4877
4878	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4879		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4880			bwn_dma_rx(mac->mac_method.dma.rx);
4881			rx = 1;
4882		}
4883	} else
4884		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4885
4886	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4887	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4888	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4889	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4890	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4891
4892	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4893		bwn_intr_txeof(mac);
4894		tx = 1;
4895	}
4896
4897	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4898
4899	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4900		int evt = BWN_LED_EVENT_NONE;
4901
4902		if (tx && rx) {
4903			if (sc->sc_rx_rate > sc->sc_tx_rate)
4904				evt = BWN_LED_EVENT_RX;
4905			else
4906				evt = BWN_LED_EVENT_TX;
4907		} else if (tx) {
4908			evt = BWN_LED_EVENT_TX;
4909		} else if (rx) {
4910			evt = BWN_LED_EVENT_RX;
4911		} else if (rx == 0) {
4912			evt = BWN_LED_EVENT_POLL;
4913		}
4914
4915		if (evt != BWN_LED_EVENT_NONE)
4916			bwn_led_event(mac, evt);
4917       }
4918
4919	if (mbufq_first(&sc->sc_snd) != NULL)
4920		bwn_start(sc);
4921
4922	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4923	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4924
4925	BWN_UNLOCK(sc);
4926}
4927
4928static void
4929bwn_restart(struct bwn_mac *mac, const char *msg)
4930{
4931	struct bwn_softc *sc = mac->mac_sc;
4932	struct ieee80211com *ic = &sc->sc_ic;
4933
4934	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4935		return;
4936
4937	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4938	ieee80211_runtask(ic, &mac->mac_hwreset);
4939}
4940
4941static void
4942bwn_intr_ucode_debug(struct bwn_mac *mac)
4943{
4944	struct bwn_softc *sc = mac->mac_sc;
4945	uint16_t reason;
4946
4947	if (mac->mac_fw.opensource == 0)
4948		return;
4949
4950	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4951	switch (reason) {
4952	case BWN_DEBUGINTR_PANIC:
4953		bwn_handle_fwpanic(mac);
4954		break;
4955	case BWN_DEBUGINTR_DUMP_SHM:
4956		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4957		break;
4958	case BWN_DEBUGINTR_DUMP_REGS:
4959		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4960		break;
4961	case BWN_DEBUGINTR_MARKER:
4962		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4963		break;
4964	default:
4965		device_printf(sc->sc_dev,
4966		    "ucode debug unknown reason: %#x\n", reason);
4967	}
4968
4969	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4970	    BWN_DEBUGINTR_ACK);
4971}
4972
4973static void
4974bwn_intr_tbtt_indication(struct bwn_mac *mac)
4975{
4976	struct bwn_softc *sc = mac->mac_sc;
4977	struct ieee80211com *ic = &sc->sc_ic;
4978
4979	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4980		bwn_psctl(mac, 0);
4981	if (ic->ic_opmode == IEEE80211_M_IBSS)
4982		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4983}
4984
4985static void
4986bwn_intr_atim_end(struct bwn_mac *mac)
4987{
4988
4989	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4990		BWN_WRITE_4(mac, BWN_MACCMD,
4991		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4992		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4993	}
4994}
4995
4996static void
4997bwn_intr_beacon(struct bwn_mac *mac)
4998{
4999	struct bwn_softc *sc = mac->mac_sc;
5000	struct ieee80211com *ic = &sc->sc_ic;
5001	uint32_t cmd, beacon0, beacon1;
5002
5003	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5004	    ic->ic_opmode == IEEE80211_M_MBSS)
5005		return;
5006
5007	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5008
5009	cmd = BWN_READ_4(mac, BWN_MACCMD);
5010	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5011	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5012
5013	if (beacon0 && beacon1) {
5014		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5015		mac->mac_intr_mask |= BWN_INTR_BEACON;
5016		return;
5017	}
5018
5019	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5020		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5021		bwn_load_beacon0(mac);
5022		bwn_load_beacon1(mac);
5023		cmd = BWN_READ_4(mac, BWN_MACCMD);
5024		cmd |= BWN_MACCMD_BEACON0_VALID;
5025		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5026	} else {
5027		if (!beacon0) {
5028			bwn_load_beacon0(mac);
5029			cmd = BWN_READ_4(mac, BWN_MACCMD);
5030			cmd |= BWN_MACCMD_BEACON0_VALID;
5031			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5032		} else if (!beacon1) {
5033			bwn_load_beacon1(mac);
5034			cmd = BWN_READ_4(mac, BWN_MACCMD);
5035			cmd |= BWN_MACCMD_BEACON1_VALID;
5036			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5037		}
5038	}
5039}
5040
5041static void
5042bwn_intr_pmq(struct bwn_mac *mac)
5043{
5044	uint32_t tmp;
5045
5046	while (1) {
5047		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5048		if (!(tmp & 0x00000008))
5049			break;
5050	}
5051	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5052}
5053
5054static void
5055bwn_intr_noise(struct bwn_mac *mac)
5056{
5057	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5058	uint16_t tmp;
5059	uint8_t noise[4];
5060	uint8_t i, j;
5061	int32_t average;
5062
5063	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5064		return;
5065
5066	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5067	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5068	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5069	    noise[3] == 0x7f)
5070		goto new;
5071
5072	KASSERT(mac->mac_noise.noi_nsamples < 8,
5073	    ("%s:%d: fail", __func__, __LINE__));
5074	i = mac->mac_noise.noi_nsamples;
5075	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5076	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5077	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5078	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5079	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5080	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5081	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5082	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5083	mac->mac_noise.noi_nsamples++;
5084	if (mac->mac_noise.noi_nsamples == 8) {
5085		average = 0;
5086		for (i = 0; i < 8; i++) {
5087			for (j = 0; j < 4; j++)
5088				average += mac->mac_noise.noi_samples[i][j];
5089		}
5090		average = (((average / 32) * 125) + 64) / 128;
5091		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5092		if (tmp >= 8)
5093			average += 2;
5094		else
5095			average -= 25;
5096		average -= (tmp == 8) ? 72 : 48;
5097
5098		mac->mac_stats.link_noise = average;
5099		mac->mac_noise.noi_running = 0;
5100		return;
5101	}
5102new:
5103	bwn_noise_gensample(mac);
5104}
5105
5106static int
5107bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5108{
5109	struct bwn_mac *mac = prq->prq_mac;
5110	struct bwn_softc *sc = mac->mac_sc;
5111	unsigned int i;
5112
5113	BWN_ASSERT_LOCKED(sc);
5114
5115	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5116		return (0);
5117
5118	for (i = 0; i < 5000; i++) {
5119		if (bwn_pio_rxeof(prq) == 0)
5120			break;
5121	}
5122	if (i >= 5000)
5123		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5124	return ((i > 0) ? 1 : 0);
5125}
5126
5127static void
5128bwn_dma_rx(struct bwn_dma_ring *dr)
5129{
5130	int slot, curslot;
5131
5132	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5133	curslot = dr->get_curslot(dr);
5134	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5135	    ("%s:%d: fail", __func__, __LINE__));
5136
5137	slot = dr->dr_curslot;
5138	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5139		bwn_dma_rxeof(dr, &slot);
5140
5141	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5142	    BUS_DMASYNC_PREWRITE);
5143
5144	dr->set_curslot(dr, slot);
5145	dr->dr_curslot = slot;
5146}
5147
5148static void
5149bwn_intr_txeof(struct bwn_mac *mac)
5150{
5151	struct bwn_txstatus stat;
5152	uint32_t stat0, stat1;
5153	uint16_t tmp;
5154
5155	BWN_ASSERT_LOCKED(mac->mac_sc);
5156
5157	while (1) {
5158		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5159		if (!(stat0 & 0x00000001))
5160			break;
5161		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5162
5163		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5164		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5165		    __func__,
5166		    stat0,
5167		    stat1);
5168
5169		stat.cookie = (stat0 >> 16);
5170		stat.seq = (stat1 & 0x0000ffff);
5171		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5172		tmp = (stat0 & 0x0000ffff);
5173		stat.framecnt = ((tmp & 0xf000) >> 12);
5174		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5175		stat.sreason = ((tmp & 0x001c) >> 2);
5176		stat.pm = (tmp & 0x0080) ? 1 : 0;
5177		stat.im = (tmp & 0x0040) ? 1 : 0;
5178		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5179		stat.ack = (tmp & 0x0002) ? 1 : 0;
5180
5181		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5182		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5183		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5184		    __func__,
5185		    stat.cookie,
5186		    stat.seq,
5187		    stat.phy_stat,
5188		    stat.framecnt,
5189		    stat.rtscnt,
5190		    stat.sreason,
5191		    stat.pm,
5192		    stat.im,
5193		    stat.ampdu,
5194		    stat.ack);
5195
5196		bwn_handle_txeof(mac, &stat);
5197	}
5198}
5199
5200static void
5201bwn_hwreset(void *arg, int npending)
5202{
5203	struct bwn_mac *mac = arg;
5204	struct bwn_softc *sc = mac->mac_sc;
5205	int error = 0;
5206	int prev_status;
5207
5208	BWN_LOCK(sc);
5209
5210	prev_status = mac->mac_status;
5211	if (prev_status >= BWN_MAC_STATUS_STARTED)
5212		bwn_core_stop(mac);
5213	if (prev_status >= BWN_MAC_STATUS_INITED)
5214		bwn_core_exit(mac);
5215
5216	if (prev_status >= BWN_MAC_STATUS_INITED) {
5217		error = bwn_core_init(mac);
5218		if (error)
5219			goto out;
5220	}
5221	if (prev_status >= BWN_MAC_STATUS_STARTED)
5222		bwn_core_start(mac);
5223out:
5224	if (error) {
5225		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5226		sc->sc_curmac = NULL;
5227	}
5228	BWN_UNLOCK(sc);
5229}
5230
5231static void
5232bwn_handle_fwpanic(struct bwn_mac *mac)
5233{
5234	struct bwn_softc *sc = mac->mac_sc;
5235	uint16_t reason;
5236
5237	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5238	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5239
5240	if (reason == BWN_FWPANIC_RESTART)
5241		bwn_restart(mac, "ucode panic");
5242}
5243
5244static void
5245bwn_load_beacon0(struct bwn_mac *mac)
5246{
5247
5248	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5249}
5250
5251static void
5252bwn_load_beacon1(struct bwn_mac *mac)
5253{
5254
5255	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5256}
5257
5258static uint32_t
5259bwn_jssi_read(struct bwn_mac *mac)
5260{
5261	uint32_t val = 0;
5262
5263	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5264	val <<= 16;
5265	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5266
5267	return (val);
5268}
5269
5270static void
5271bwn_noise_gensample(struct bwn_mac *mac)
5272{
5273	uint32_t jssi = 0x7f7f7f7f;
5274
5275	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5276	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5277	BWN_WRITE_4(mac, BWN_MACCMD,
5278	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5279}
5280
5281static int
5282bwn_dma_freeslot(struct bwn_dma_ring *dr)
5283{
5284	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5285
5286	return (dr->dr_numslots - dr->dr_usedslot);
5287}
5288
5289static int
5290bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5291{
5292	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5293
5294	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5295	    ("%s:%d: fail", __func__, __LINE__));
5296	if (slot == dr->dr_numslots - 1)
5297		return (0);
5298	return (slot + 1);
5299}
5300
5301static void
5302bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5303{
5304	struct bwn_mac *mac = dr->dr_mac;
5305	struct bwn_softc *sc = mac->mac_sc;
5306	struct bwn_dma *dma = &mac->mac_method.dma;
5307	struct bwn_dmadesc_generic *desc;
5308	struct bwn_dmadesc_meta *meta;
5309	struct bwn_rxhdr4 *rxhdr;
5310	struct mbuf *m;
5311	uint32_t macstat;
5312	int32_t tmp;
5313	int cnt = 0;
5314	uint16_t len;
5315
5316	dr->getdesc(dr, *slot, &desc, &meta);
5317
5318	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5319	m = meta->mt_m;
5320
5321	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5322		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5323		return;
5324	}
5325
5326	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5327	len = le16toh(rxhdr->frame_len);
5328	if (len <= 0) {
5329		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5330		return;
5331	}
5332	if (bwn_dma_check_redzone(dr, m)) {
5333		device_printf(sc->sc_dev, "redzone error.\n");
5334		bwn_dma_set_redzone(dr, m);
5335		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5336		    BUS_DMASYNC_PREWRITE);
5337		return;
5338	}
5339	if (len > dr->dr_rx_bufsize) {
5340		tmp = len;
5341		while (1) {
5342			dr->getdesc(dr, *slot, &desc, &meta);
5343			bwn_dma_set_redzone(dr, meta->mt_m);
5344			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5345			    BUS_DMASYNC_PREWRITE);
5346			*slot = bwn_dma_nextslot(dr, *slot);
5347			cnt++;
5348			tmp -= dr->dr_rx_bufsize;
5349			if (tmp <= 0)
5350				break;
5351		}
5352		device_printf(sc->sc_dev, "too small buffer "
5353		       "(len %u buffer %u dropped %d)\n",
5354		       len, dr->dr_rx_bufsize, cnt);
5355		return;
5356	}
5357
5358	switch (mac->mac_fw.fw_hdr_format) {
5359	case BWN_FW_HDR_351:
5360	case BWN_FW_HDR_410:
5361		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5362		break;
5363	case BWN_FW_HDR_598:
5364		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5365		break;
5366	}
5367
5368	if (macstat & BWN_RX_MAC_FCSERR) {
5369		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5370			device_printf(sc->sc_dev, "RX drop\n");
5371			return;
5372		}
5373	}
5374
5375	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5376	m_adj(m, dr->dr_frameoffset);
5377
5378	bwn_rxeof(dr->dr_mac, m, rxhdr);
5379}
5380
5381static void
5382bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5383{
5384	struct bwn_softc *sc = mac->mac_sc;
5385	struct bwn_stats *stats = &mac->mac_stats;
5386
5387	BWN_ASSERT_LOCKED(mac->mac_sc);
5388
5389	if (status->im)
5390		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5391	if (status->ampdu)
5392		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5393	if (status->rtscnt) {
5394		if (status->rtscnt == 0xf)
5395			stats->rtsfail++;
5396		else
5397			stats->rts++;
5398	}
5399
5400	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5401		bwn_dma_handle_txeof(mac, status);
5402	} else {
5403		bwn_pio_handle_txeof(mac, status);
5404	}
5405
5406	bwn_phy_txpower_check(mac, 0);
5407}
5408
5409static uint8_t
5410bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5411{
5412	struct bwn_mac *mac = prq->prq_mac;
5413	struct bwn_softc *sc = mac->mac_sc;
5414	struct bwn_rxhdr4 rxhdr;
5415	struct mbuf *m;
5416	uint32_t ctl32, macstat, v32;
5417	unsigned int i, padding;
5418	uint16_t ctl16, len, totlen, v16;
5419	unsigned char *mp;
5420	char *data;
5421
5422	memset(&rxhdr, 0, sizeof(rxhdr));
5423
5424	if (prq->prq_rev >= 8) {
5425		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5426		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5427			return (0);
5428		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5429		    BWN_PIO8_RXCTL_FRAMEREADY);
5430		for (i = 0; i < 10; i++) {
5431			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5432			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5433				goto ready;
5434			DELAY(10);
5435		}
5436	} else {
5437		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5438		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5439			return (0);
5440		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5441		    BWN_PIO_RXCTL_FRAMEREADY);
5442		for (i = 0; i < 10; i++) {
5443			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5444			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5445				goto ready;
5446			DELAY(10);
5447		}
5448	}
5449	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5450	return (1);
5451ready:
5452	if (prq->prq_rev >= 8)
5453		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5454		    prq->prq_base + BWN_PIO8_RXDATA);
5455	else
5456		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5457		    prq->prq_base + BWN_PIO_RXDATA);
5458	len = le16toh(rxhdr.frame_len);
5459	if (len > 0x700) {
5460		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5461		goto error;
5462	}
5463	if (len == 0) {
5464		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5465		goto error;
5466	}
5467
5468	switch (mac->mac_fw.fw_hdr_format) {
5469	case BWN_FW_HDR_351:
5470	case BWN_FW_HDR_410:
5471		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5472		break;
5473	case BWN_FW_HDR_598:
5474		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5475		break;
5476	}
5477
5478	if (macstat & BWN_RX_MAC_FCSERR) {
5479		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5480			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5481			goto error;
5482		}
5483	}
5484
5485	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5486	totlen = len + padding;
5487	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5488	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5489	if (m == NULL) {
5490		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5491		goto error;
5492	}
5493	mp = mtod(m, unsigned char *);
5494	if (prq->prq_rev >= 8) {
5495		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5496		    prq->prq_base + BWN_PIO8_RXDATA);
5497		if (totlen & 3) {
5498			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5499			data = &(mp[totlen - 1]);
5500			switch (totlen & 3) {
5501			case 3:
5502				*data = (v32 >> 16);
5503				data--;
5504			case 2:
5505				*data = (v32 >> 8);
5506				data--;
5507			case 1:
5508				*data = v32;
5509			}
5510		}
5511	} else {
5512		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5513		    prq->prq_base + BWN_PIO_RXDATA);
5514		if (totlen & 1) {
5515			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5516			mp[totlen - 1] = v16;
5517		}
5518	}
5519
5520	m->m_len = m->m_pkthdr.len = totlen;
5521
5522	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5523
5524	return (1);
5525error:
5526	if (prq->prq_rev >= 8)
5527		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5528		    BWN_PIO8_RXCTL_DATAREADY);
5529	else
5530		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5531	return (1);
5532}
5533
5534static int
5535bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5536    struct bwn_dmadesc_meta *meta, int init)
5537{
5538	struct bwn_mac *mac = dr->dr_mac;
5539	struct bwn_dma *dma = &mac->mac_method.dma;
5540	struct bwn_rxhdr4 *hdr;
5541	bus_dmamap_t map;
5542	bus_addr_t paddr;
5543	struct mbuf *m;
5544	int error;
5545
5546	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5547	if (m == NULL) {
5548		error = ENOBUFS;
5549
5550		/*
5551		 * If the NIC is up and running, we need to:
5552		 * - Clear RX buffer's header.
5553		 * - Restore RX descriptor settings.
5554		 */
5555		if (init)
5556			return (error);
5557		else
5558			goto back;
5559	}
5560	m->m_len = m->m_pkthdr.len = MCLBYTES;
5561
5562	bwn_dma_set_redzone(dr, m);
5563
5564	/*
5565	 * Try to load RX buf into temporary DMA map
5566	 */
5567	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5568	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5569	if (error) {
5570		m_freem(m);
5571
5572		/*
5573		 * See the comment above
5574		 */
5575		if (init)
5576			return (error);
5577		else
5578			goto back;
5579	}
5580
5581	if (!init)
5582		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5583	meta->mt_m = m;
5584	meta->mt_paddr = paddr;
5585
5586	/*
5587	 * Swap RX buf's DMA map with the loaded temporary one
5588	 */
5589	map = meta->mt_dmap;
5590	meta->mt_dmap = dr->dr_spare_dmap;
5591	dr->dr_spare_dmap = map;
5592
5593back:
5594	/*
5595	 * Clear RX buf header
5596	 */
5597	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5598	bzero(hdr, sizeof(*hdr));
5599	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5600	    BUS_DMASYNC_PREWRITE);
5601
5602	/*
5603	 * Setup RX buf descriptor
5604	 */
5605	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5606	    sizeof(*hdr), 0, 0, 0);
5607	return (error);
5608}
5609
5610static void
5611bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5612		 bus_size_t mapsz __unused, int error)
5613{
5614
5615	if (!error) {
5616		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5617		*((bus_addr_t *)arg) = seg->ds_addr;
5618	}
5619}
5620
5621static int
5622bwn_hwrate2ieeerate(int rate)
5623{
5624
5625	switch (rate) {
5626	case BWN_CCK_RATE_1MB:
5627		return (2);
5628	case BWN_CCK_RATE_2MB:
5629		return (4);
5630	case BWN_CCK_RATE_5MB:
5631		return (11);
5632	case BWN_CCK_RATE_11MB:
5633		return (22);
5634	case BWN_OFDM_RATE_6MB:
5635		return (12);
5636	case BWN_OFDM_RATE_9MB:
5637		return (18);
5638	case BWN_OFDM_RATE_12MB:
5639		return (24);
5640	case BWN_OFDM_RATE_18MB:
5641		return (36);
5642	case BWN_OFDM_RATE_24MB:
5643		return (48);
5644	case BWN_OFDM_RATE_36MB:
5645		return (72);
5646	case BWN_OFDM_RATE_48MB:
5647		return (96);
5648	case BWN_OFDM_RATE_54MB:
5649		return (108);
5650	default:
5651		printf("Ooops\n");
5652		return (0);
5653	}
5654}
5655
5656/*
5657 * Post process the RX provided RSSI.
5658 *
5659 * Valid for A, B, G, LP PHYs.
5660 */
5661static int8_t
5662bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5663    int ofdm, int adjust_2053, int adjust_2050)
5664{
5665	struct bwn_phy *phy = &mac->mac_phy;
5666	struct bwn_phy_g *gphy = &phy->phy_g;
5667	int tmp;
5668
5669	switch (phy->rf_ver) {
5670	case 0x2050:
5671		if (ofdm) {
5672			tmp = in_rssi;
5673			if (tmp > 127)
5674				tmp -= 256;
5675			tmp = tmp * 73 / 64;
5676			if (adjust_2050)
5677				tmp += 25;
5678			else
5679				tmp -= 3;
5680		} else {
5681			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5682			    & BWN_BFL_RSSI) {
5683				if (in_rssi > 63)
5684					in_rssi = 63;
5685				tmp = gphy->pg_nrssi_lt[in_rssi];
5686				tmp = (31 - tmp) * -131 / 128 - 57;
5687			} else {
5688				tmp = in_rssi;
5689				tmp = (31 - tmp) * -149 / 128 - 68;
5690			}
5691			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5692				tmp += 25;
5693		}
5694		break;
5695	case 0x2060:
5696		if (in_rssi > 127)
5697			tmp = in_rssi - 256;
5698		else
5699			tmp = in_rssi;
5700		break;
5701	default:
5702		tmp = in_rssi;
5703		tmp = (tmp - 11) * 103 / 64;
5704		if (adjust_2053)
5705			tmp -= 109;
5706		else
5707			tmp -= 83;
5708	}
5709
5710	return (tmp);
5711}
5712
5713static void
5714bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5715{
5716	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5717	struct bwn_plcp6 *plcp;
5718	struct bwn_softc *sc = mac->mac_sc;
5719	struct ieee80211_frame_min *wh;
5720	struct ieee80211_node *ni;
5721	struct ieee80211com *ic = &sc->sc_ic;
5722	uint32_t macstat;
5723	int padding, rate, rssi = 0, noise = 0, type;
5724	uint16_t phytype, phystat0, phystat3, chanstat;
5725	unsigned char *mp = mtod(m, unsigned char *);
5726	static int rx_mac_dec_rpt = 0;
5727
5728	BWN_ASSERT_LOCKED(sc);
5729
5730	phystat0 = le16toh(rxhdr->phy_status0);
5731
5732	/*
5733	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5734	 * used for LP-PHY.
5735	 */
5736	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5737
5738	switch (mac->mac_fw.fw_hdr_format) {
5739	case BWN_FW_HDR_351:
5740	case BWN_FW_HDR_410:
5741		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5742		chanstat = le16toh(rxhdr->ps4.r351.channel);
5743		break;
5744	case BWN_FW_HDR_598:
5745		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5746		chanstat = le16toh(rxhdr->ps4.r598.channel);
5747		break;
5748	}
5749
5750
5751	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5752
5753	if (macstat & BWN_RX_MAC_FCSERR)
5754		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5755	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5756		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5757	if (macstat & BWN_RX_MAC_DECERR)
5758		goto drop;
5759
5760	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5761	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5762		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5763		    m->m_pkthdr.len);
5764		goto drop;
5765	}
5766	plcp = (struct bwn_plcp6 *)(mp + padding);
5767	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5768	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5769		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5770		    m->m_pkthdr.len);
5771		goto drop;
5772	}
5773	wh = mtod(m, struct ieee80211_frame_min *);
5774
5775	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5776		device_printf(sc->sc_dev,
5777		    "RX decryption attempted (old %d keyidx %#x)\n",
5778		    BWN_ISOLDFMT(mac),
5779		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5780
5781	if (phystat0 & BWN_RX_PHYST0_OFDM)
5782		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5783		    phytype == BWN_PHYTYPE_A);
5784	else
5785		rate = bwn_plcp_get_cckrate(mac, plcp);
5786	if (rate == -1) {
5787		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5788			goto drop;
5789	}
5790	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5791
5792	/* rssi/noise */
5793	switch (phytype) {
5794	case BWN_PHYTYPE_A:
5795	case BWN_PHYTYPE_B:
5796	case BWN_PHYTYPE_G:
5797	case BWN_PHYTYPE_LP:
5798		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5799		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5800		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5801		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5802		break;
5803	case BWN_PHYTYPE_N:
5804		/* Broadcom has code for min/avg, but always used max */
5805		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5806			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5807		else
5808			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5809#if 0
5810		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5811		    "%s: power0=%d, power1=%d, power2=%d\n",
5812		    __func__,
5813		    rxhdr->phy.n.power0,
5814		    rxhdr->phy.n.power1,
5815		    rxhdr->ps2.n.power2);
5816#endif
5817		break;
5818	default:
5819		/* XXX TODO: implement rssi for other PHYs */
5820		break;
5821	}
5822
5823	/*
5824	 * RSSI here is absolute, not relative to the noise floor.
5825	 */
5826	noise = mac->mac_stats.link_noise;
5827	rssi = rssi - noise;
5828
5829	/* RX radio tap */
5830	if (ieee80211_radiotap_active(ic))
5831		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5832	m_adj(m, -IEEE80211_CRC_LEN);
5833
5834	BWN_UNLOCK(sc);
5835
5836	ni = ieee80211_find_rxnode(ic, wh);
5837	if (ni != NULL) {
5838		type = ieee80211_input(ni, m, rssi, noise);
5839		ieee80211_free_node(ni);
5840	} else
5841		type = ieee80211_input_all(ic, m, rssi, noise);
5842
5843	BWN_LOCK(sc);
5844	return;
5845drop:
5846	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5847}
5848
5849static void
5850bwn_dma_handle_txeof(struct bwn_mac *mac,
5851    const struct bwn_txstatus *status)
5852{
5853	struct bwn_dma *dma = &mac->mac_method.dma;
5854	struct bwn_dma_ring *dr;
5855	struct bwn_dmadesc_generic *desc;
5856	struct bwn_dmadesc_meta *meta;
5857	struct bwn_softc *sc = mac->mac_sc;
5858	int slot;
5859	int retrycnt = 0;
5860
5861	BWN_ASSERT_LOCKED(sc);
5862
5863	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5864	if (dr == NULL) {
5865		device_printf(sc->sc_dev, "failed to parse cookie\n");
5866		return;
5867	}
5868	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5869
5870	while (1) {
5871		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5872		    ("%s:%d: fail", __func__, __LINE__));
5873		dr->getdesc(dr, slot, &desc, &meta);
5874
5875		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5876			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5877		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5878			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5879
5880		if (meta->mt_islast) {
5881			KASSERT(meta->mt_m != NULL,
5882			    ("%s:%d: fail", __func__, __LINE__));
5883
5884			/*
5885			 * If we don't get an ACK, then we should log the
5886			 * full framecnt.  That may be 0 if it's a PHY
5887			 * failure, so ensure that gets logged as some
5888			 * retry attempt.
5889			 */
5890			if (status->ack) {
5891				retrycnt = status->framecnt - 1;
5892			} else {
5893				retrycnt = status->framecnt;
5894				if (retrycnt == 0)
5895					retrycnt = 1;
5896			}
5897			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5898			    status->ack ?
5899			      IEEE80211_RATECTL_TX_SUCCESS :
5900			      IEEE80211_RATECTL_TX_FAILURE,
5901			    &retrycnt, 0);
5902			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5903			meta->mt_ni = NULL;
5904			meta->mt_m = NULL;
5905		} else
5906			KASSERT(meta->mt_m == NULL,
5907			    ("%s:%d: fail", __func__, __LINE__));
5908
5909		dr->dr_usedslot--;
5910		if (meta->mt_islast)
5911			break;
5912		slot = bwn_dma_nextslot(dr, slot);
5913	}
5914	sc->sc_watchdog_timer = 0;
5915	if (dr->dr_stop) {
5916		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5917		    ("%s:%d: fail", __func__, __LINE__));
5918		dr->dr_stop = 0;
5919	}
5920}
5921
5922static void
5923bwn_pio_handle_txeof(struct bwn_mac *mac,
5924    const struct bwn_txstatus *status)
5925{
5926	struct bwn_pio_txqueue *tq;
5927	struct bwn_pio_txpkt *tp = NULL;
5928	struct bwn_softc *sc = mac->mac_sc;
5929	int retrycnt = 0;
5930
5931	BWN_ASSERT_LOCKED(sc);
5932
5933	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5934	if (tq == NULL)
5935		return;
5936
5937	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5938	tq->tq_free++;
5939
5940	if (tp->tp_ni != NULL) {
5941		/*
5942		 * Do any tx complete callback.  Note this must
5943		 * be done before releasing the node reference.
5944		 */
5945
5946		/*
5947		 * If we don't get an ACK, then we should log the
5948		 * full framecnt.  That may be 0 if it's a PHY
5949		 * failure, so ensure that gets logged as some
5950		 * retry attempt.
5951		 */
5952		if (status->ack) {
5953			retrycnt = status->framecnt - 1;
5954		} else {
5955			retrycnt = status->framecnt;
5956			if (retrycnt == 0)
5957				retrycnt = 1;
5958		}
5959		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5960		    status->ack ?
5961		      IEEE80211_RATECTL_TX_SUCCESS :
5962		      IEEE80211_RATECTL_TX_FAILURE,
5963		    &retrycnt, 0);
5964
5965		if (tp->tp_m->m_flags & M_TXCB)
5966			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5967		ieee80211_free_node(tp->tp_ni);
5968		tp->tp_ni = NULL;
5969	}
5970	m_freem(tp->tp_m);
5971	tp->tp_m = NULL;
5972	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5973
5974	sc->sc_watchdog_timer = 0;
5975}
5976
5977static void
5978bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5979{
5980	struct bwn_softc *sc = mac->mac_sc;
5981	struct bwn_phy *phy = &mac->mac_phy;
5982	struct ieee80211com *ic = &sc->sc_ic;
5983	unsigned long now;
5984	bwn_txpwr_result_t result;
5985
5986	BWN_GETTIME(now);
5987
5988	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5989		return;
5990	phy->nexttime = now + 2 * 1000;
5991
5992	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5993	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5994		return;
5995
5996	if (phy->recalc_txpwr != NULL) {
5997		result = phy->recalc_txpwr(mac,
5998		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5999		if (result == BWN_TXPWR_RES_DONE)
6000			return;
6001		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6002		    ("%s: fail", __func__));
6003		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6004
6005		ieee80211_runtask(ic, &mac->mac_txpower);
6006	}
6007}
6008
6009static uint16_t
6010bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6011{
6012
6013	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6014}
6015
6016static uint32_t
6017bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6018{
6019
6020	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6021}
6022
6023static void
6024bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6025{
6026
6027	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6028}
6029
6030static void
6031bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6032{
6033
6034	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6035}
6036
6037static int
6038bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6039{
6040
6041	switch (rate) {
6042	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6043	case 12:
6044		return (BWN_OFDM_RATE_6MB);
6045	case 18:
6046		return (BWN_OFDM_RATE_9MB);
6047	case 24:
6048		return (BWN_OFDM_RATE_12MB);
6049	case 36:
6050		return (BWN_OFDM_RATE_18MB);
6051	case 48:
6052		return (BWN_OFDM_RATE_24MB);
6053	case 72:
6054		return (BWN_OFDM_RATE_36MB);
6055	case 96:
6056		return (BWN_OFDM_RATE_48MB);
6057	case 108:
6058		return (BWN_OFDM_RATE_54MB);
6059	/* CCK rates (NB: not IEEE std, device-specific) */
6060	case 2:
6061		return (BWN_CCK_RATE_1MB);
6062	case 4:
6063		return (BWN_CCK_RATE_2MB);
6064	case 11:
6065		return (BWN_CCK_RATE_5MB);
6066	case 22:
6067		return (BWN_CCK_RATE_11MB);
6068	}
6069
6070	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6071	return (BWN_CCK_RATE_1MB);
6072}
6073
6074static uint16_t
6075bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6076{
6077	struct bwn_phy *phy = &mac->mac_phy;
6078	uint16_t control = 0;
6079	uint16_t bw;
6080
6081	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6082	bw = BWN_TXH_PHY1_BW_20;
6083
6084	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6085		control = bw;
6086	} else {
6087		control = bw;
6088		/* Figure out coding rate and modulation */
6089		/* XXX TODO: table-ize, for MCS transmit */
6090		/* Note: this is BWN_*_RATE values */
6091		switch (bitrate) {
6092		case BWN_CCK_RATE_1MB:
6093			control |= 0;
6094			break;
6095		case BWN_CCK_RATE_2MB:
6096			control |= 1;
6097			break;
6098		case BWN_CCK_RATE_5MB:
6099			control |= 2;
6100			break;
6101		case BWN_CCK_RATE_11MB:
6102			control |= 3;
6103			break;
6104		case BWN_OFDM_RATE_6MB:
6105			control |= BWN_TXH_PHY1_CRATE_1_2;
6106			control |= BWN_TXH_PHY1_MODUL_BPSK;
6107			break;
6108		case BWN_OFDM_RATE_9MB:
6109			control |= BWN_TXH_PHY1_CRATE_3_4;
6110			control |= BWN_TXH_PHY1_MODUL_BPSK;
6111			break;
6112		case BWN_OFDM_RATE_12MB:
6113			control |= BWN_TXH_PHY1_CRATE_1_2;
6114			control |= BWN_TXH_PHY1_MODUL_QPSK;
6115			break;
6116		case BWN_OFDM_RATE_18MB:
6117			control |= BWN_TXH_PHY1_CRATE_3_4;
6118			control |= BWN_TXH_PHY1_MODUL_QPSK;
6119			break;
6120		case BWN_OFDM_RATE_24MB:
6121			control |= BWN_TXH_PHY1_CRATE_1_2;
6122			control |= BWN_TXH_PHY1_MODUL_QAM16;
6123			break;
6124		case BWN_OFDM_RATE_36MB:
6125			control |= BWN_TXH_PHY1_CRATE_3_4;
6126			control |= BWN_TXH_PHY1_MODUL_QAM16;
6127			break;
6128		case BWN_OFDM_RATE_48MB:
6129			control |= BWN_TXH_PHY1_CRATE_1_2;
6130			control |= BWN_TXH_PHY1_MODUL_QAM64;
6131			break;
6132		case BWN_OFDM_RATE_54MB:
6133			control |= BWN_TXH_PHY1_CRATE_3_4;
6134			control |= BWN_TXH_PHY1_MODUL_QAM64;
6135			break;
6136		default:
6137			break;
6138		}
6139		control |= BWN_TXH_PHY1_MODE_SISO;
6140	}
6141
6142	return control;
6143}
6144
6145static int
6146bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6147    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6148{
6149	const struct bwn_phy *phy = &mac->mac_phy;
6150	struct bwn_softc *sc = mac->mac_sc;
6151	struct ieee80211_frame *wh;
6152	struct ieee80211_frame *protwh;
6153	struct ieee80211_frame_cts *cts;
6154	struct ieee80211_frame_rts *rts;
6155	const struct ieee80211_txparam *tp;
6156	struct ieee80211vap *vap = ni->ni_vap;
6157	struct ieee80211com *ic = &sc->sc_ic;
6158	struct mbuf *mprot;
6159	unsigned int len;
6160	uint32_t macctl = 0;
6161	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6162	uint16_t phyctl = 0;
6163	uint8_t rate, rate_fb;
6164	int fill_phy_ctl1 = 0;
6165
6166	wh = mtod(m, struct ieee80211_frame *);
6167	memset(txhdr, 0, sizeof(*txhdr));
6168
6169	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6170	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6171	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6172
6173	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6174	    || (phy->type == BWN_PHYTYPE_HT))
6175		fill_phy_ctl1 = 1;
6176
6177	/*
6178	 * Find TX rate
6179	 */
6180	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6181	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6182		rate = rate_fb = tp->mgmtrate;
6183	else if (ismcast)
6184		rate = rate_fb = tp->mcastrate;
6185	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6186		rate = rate_fb = tp->ucastrate;
6187	else {
6188		/* XXX TODO: don't fall back to CCK rates for OFDM */
6189		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6190		rate = ni->ni_txrate;
6191
6192		if (rix > 0)
6193			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6194			    IEEE80211_RATE_VAL;
6195		else
6196			rate_fb = rate;
6197	}
6198
6199	sc->sc_tx_rate = rate;
6200
6201	/* Note: this maps the select ieee80211 rate to hardware rate */
6202	rate = bwn_ieeerate2hwrate(sc, rate);
6203	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6204
6205	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6206	    bwn_plcp_getcck(rate);
6207	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6208	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6209
6210	/* XXX rate/rate_fb is the hardware rate */
6211	if ((rate_fb == rate) ||
6212	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6213	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6214		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6215	else
6216		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6217		    m->m_pkthdr.len, rate, isshort);
6218
6219	/* XXX TX encryption */
6220
6221	switch (mac->mac_fw.fw_hdr_format) {
6222	case BWN_FW_HDR_351:
6223		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6224		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6225		break;
6226	case BWN_FW_HDR_410:
6227		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6228		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6229		break;
6230	case BWN_FW_HDR_598:
6231		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6232		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6233		break;
6234	}
6235
6236	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6237	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6238
6239	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6240	    BWN_TX_EFT_FB_CCK;
6241	txhdr->chan = phy->chan;
6242	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6243	    BWN_TX_PHY_ENC_CCK;
6244	/* XXX preamble? obey net80211 */
6245	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6246	     rate == BWN_CCK_RATE_11MB))
6247		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6248
6249	if (! phy->gmode)
6250		macctl |= BWN_TX_MAC_5GHZ;
6251
6252	/* XXX TX antenna selection */
6253
6254	switch (bwn_antenna_sanitize(mac, 0)) {
6255	case 0:
6256		phyctl |= BWN_TX_PHY_ANT01AUTO;
6257		break;
6258	case 1:
6259		phyctl |= BWN_TX_PHY_ANT0;
6260		break;
6261	case 2:
6262		phyctl |= BWN_TX_PHY_ANT1;
6263		break;
6264	case 3:
6265		phyctl |= BWN_TX_PHY_ANT2;
6266		break;
6267	case 4:
6268		phyctl |= BWN_TX_PHY_ANT3;
6269		break;
6270	default:
6271		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6272	}
6273
6274	if (!ismcast)
6275		macctl |= BWN_TX_MAC_ACK;
6276
6277	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6278	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6279	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6280		macctl |= BWN_TX_MAC_LONGFRAME;
6281
6282	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6283		/* XXX RTS rate is always 1MB??? */
6284		/* XXX TODO: don't fall back to CCK rates for OFDM */
6285		rts_rate = BWN_CCK_RATE_1MB;
6286		rts_rate_fb = bwn_get_fbrate(rts_rate);
6287
6288		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6289		protdur = ieee80211_compute_duration(ic->ic_rt,
6290		    m->m_pkthdr.len, rate, isshort) +
6291		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6292
6293		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6294
6295			switch (mac->mac_fw.fw_hdr_format) {
6296			case BWN_FW_HDR_351:
6297				cts = (struct ieee80211_frame_cts *)
6298				    txhdr->body.r351.rts_frame;
6299				break;
6300			case BWN_FW_HDR_410:
6301				cts = (struct ieee80211_frame_cts *)
6302				    txhdr->body.r410.rts_frame;
6303				break;
6304			case BWN_FW_HDR_598:
6305				cts = (struct ieee80211_frame_cts *)
6306				    txhdr->body.r598.rts_frame;
6307				break;
6308			}
6309
6310			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6311			    protdur);
6312			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6313			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6314			    mprot->m_pkthdr.len);
6315			m_freem(mprot);
6316			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6317			len = sizeof(struct ieee80211_frame_cts);
6318		} else {
6319			switch (mac->mac_fw.fw_hdr_format) {
6320			case BWN_FW_HDR_351:
6321				rts = (struct ieee80211_frame_rts *)
6322				    txhdr->body.r351.rts_frame;
6323				break;
6324			case BWN_FW_HDR_410:
6325				rts = (struct ieee80211_frame_rts *)
6326				    txhdr->body.r410.rts_frame;
6327				break;
6328			case BWN_FW_HDR_598:
6329				rts = (struct ieee80211_frame_rts *)
6330				    txhdr->body.r598.rts_frame;
6331				break;
6332			}
6333
6334			/* XXX rate/rate_fb is the hardware rate */
6335			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6336			    isshort);
6337			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6338			    wh->i_addr2, protdur);
6339			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6340			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6341			    mprot->m_pkthdr.len);
6342			m_freem(mprot);
6343			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6344			len = sizeof(struct ieee80211_frame_rts);
6345		}
6346		len += IEEE80211_CRC_LEN;
6347
6348		switch (mac->mac_fw.fw_hdr_format) {
6349		case BWN_FW_HDR_351:
6350			bwn_plcp_genhdr((struct bwn_plcp4 *)
6351			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6352			break;
6353		case BWN_FW_HDR_410:
6354			bwn_plcp_genhdr((struct bwn_plcp4 *)
6355			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6356			break;
6357		case BWN_FW_HDR_598:
6358			bwn_plcp_genhdr((struct bwn_plcp4 *)
6359			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6360			break;
6361		}
6362
6363		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6364		    rts_rate_fb);
6365
6366		switch (mac->mac_fw.fw_hdr_format) {
6367		case BWN_FW_HDR_351:
6368			protwh = (struct ieee80211_frame *)
6369			    &txhdr->body.r351.rts_frame;
6370			break;
6371		case BWN_FW_HDR_410:
6372			protwh = (struct ieee80211_frame *)
6373			    &txhdr->body.r410.rts_frame;
6374			break;
6375		case BWN_FW_HDR_598:
6376			protwh = (struct ieee80211_frame *)
6377			    &txhdr->body.r598.rts_frame;
6378			break;
6379		}
6380
6381		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6382
6383		if (BWN_ISOFDMRATE(rts_rate)) {
6384			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6385			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6386		} else {
6387			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6388			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6389		}
6390		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6391		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6392
6393		if (fill_phy_ctl1) {
6394			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6395			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6396		}
6397	}
6398
6399	if (fill_phy_ctl1) {
6400		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6401		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6402	}
6403
6404	switch (mac->mac_fw.fw_hdr_format) {
6405	case BWN_FW_HDR_351:
6406		txhdr->body.r351.cookie = htole16(cookie);
6407		break;
6408	case BWN_FW_HDR_410:
6409		txhdr->body.r410.cookie = htole16(cookie);
6410		break;
6411	case BWN_FW_HDR_598:
6412		txhdr->body.r598.cookie = htole16(cookie);
6413		break;
6414	}
6415
6416	txhdr->macctl = htole32(macctl);
6417	txhdr->phyctl = htole16(phyctl);
6418
6419	/*
6420	 * TX radio tap
6421	 */
6422	if (ieee80211_radiotap_active_vap(vap)) {
6423		sc->sc_tx_th.wt_flags = 0;
6424		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6425			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6426		if (isshort &&
6427		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6428		     rate == BWN_CCK_RATE_11MB))
6429			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6430		sc->sc_tx_th.wt_rate = rate;
6431
6432		ieee80211_radiotap_tx(vap, m);
6433	}
6434
6435	return (0);
6436}
6437
6438static void
6439bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6440    const uint8_t rate)
6441{
6442	uint32_t d, plen;
6443	uint8_t *raw = plcp->o.raw;
6444
6445	if (BWN_ISOFDMRATE(rate)) {
6446		d = bwn_plcp_getofdm(rate);
6447		KASSERT(!(octets & 0xf000),
6448		    ("%s:%d: fail", __func__, __LINE__));
6449		d |= (octets << 5);
6450		plcp->o.data = htole32(d);
6451	} else {
6452		plen = octets * 16 / rate;
6453		if ((octets * 16 % rate) > 0) {
6454			plen++;
6455			if ((rate == BWN_CCK_RATE_11MB)
6456			    && ((octets * 8 % 11) < 4)) {
6457				raw[1] = 0x84;
6458			} else
6459				raw[1] = 0x04;
6460		} else
6461			raw[1] = 0x04;
6462		plcp->o.data |= htole32(plen << 16);
6463		raw[0] = bwn_plcp_getcck(rate);
6464	}
6465}
6466
6467static uint8_t
6468bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6469{
6470	struct bwn_softc *sc = mac->mac_sc;
6471	uint8_t mask;
6472
6473	if (n == 0)
6474		return (0);
6475	if (mac->mac_phy.gmode)
6476		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6477	else
6478		mask = siba_sprom_get_ant_a(sc->sc_dev);
6479	if (!(mask & (1 << (n - 1))))
6480		return (0);
6481	return (n);
6482}
6483
6484/*
6485 * Return a fallback rate for the given rate.
6486 *
6487 * Note: Don't fall back from OFDM to CCK.
6488 */
6489static uint8_t
6490bwn_get_fbrate(uint8_t bitrate)
6491{
6492	switch (bitrate) {
6493	/* CCK */
6494	case BWN_CCK_RATE_1MB:
6495		return (BWN_CCK_RATE_1MB);
6496	case BWN_CCK_RATE_2MB:
6497		return (BWN_CCK_RATE_1MB);
6498	case BWN_CCK_RATE_5MB:
6499		return (BWN_CCK_RATE_2MB);
6500	case BWN_CCK_RATE_11MB:
6501		return (BWN_CCK_RATE_5MB);
6502
6503	/* OFDM */
6504	case BWN_OFDM_RATE_6MB:
6505		return (BWN_OFDM_RATE_6MB);
6506	case BWN_OFDM_RATE_9MB:
6507		return (BWN_OFDM_RATE_6MB);
6508	case BWN_OFDM_RATE_12MB:
6509		return (BWN_OFDM_RATE_9MB);
6510	case BWN_OFDM_RATE_18MB:
6511		return (BWN_OFDM_RATE_12MB);
6512	case BWN_OFDM_RATE_24MB:
6513		return (BWN_OFDM_RATE_18MB);
6514	case BWN_OFDM_RATE_36MB:
6515		return (BWN_OFDM_RATE_24MB);
6516	case BWN_OFDM_RATE_48MB:
6517		return (BWN_OFDM_RATE_36MB);
6518	case BWN_OFDM_RATE_54MB:
6519		return (BWN_OFDM_RATE_48MB);
6520	}
6521	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6522	return (0);
6523}
6524
6525static uint32_t
6526bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6527    uint32_t ctl, const void *_data, int len)
6528{
6529	struct bwn_softc *sc = mac->mac_sc;
6530	uint32_t value = 0;
6531	const uint8_t *data = _data;
6532
6533	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6534	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6535	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6536
6537	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6538	    tq->tq_base + BWN_PIO8_TXDATA);
6539	if (len & 3) {
6540		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6541		    BWN_PIO8_TXCTL_24_31);
6542		data = &(data[len - 1]);
6543		switch (len & 3) {
6544		case 3:
6545			ctl |= BWN_PIO8_TXCTL_16_23;
6546			value |= (uint32_t)(*data) << 16;
6547			data--;
6548		case 2:
6549			ctl |= BWN_PIO8_TXCTL_8_15;
6550			value |= (uint32_t)(*data) << 8;
6551			data--;
6552		case 1:
6553			value |= (uint32_t)(*data);
6554		}
6555		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6556		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6557	}
6558
6559	return (ctl);
6560}
6561
6562static void
6563bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6564    uint16_t offset, uint32_t value)
6565{
6566
6567	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6568}
6569
6570static uint16_t
6571bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6572    uint16_t ctl, const void *_data, int len)
6573{
6574	struct bwn_softc *sc = mac->mac_sc;
6575	const uint8_t *data = _data;
6576
6577	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6578	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6579
6580	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6581	    tq->tq_base + BWN_PIO_TXDATA);
6582	if (len & 1) {
6583		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6584		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6585		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6586	}
6587
6588	return (ctl);
6589}
6590
6591static uint16_t
6592bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6593    uint16_t ctl, struct mbuf *m0)
6594{
6595	int i, j = 0;
6596	uint16_t data = 0;
6597	const uint8_t *buf;
6598	struct mbuf *m = m0;
6599
6600	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6601	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6602
6603	for (; m != NULL; m = m->m_next) {
6604		buf = mtod(m, const uint8_t *);
6605		for (i = 0; i < m->m_len; i++) {
6606			if (!((j++) % 2))
6607				data |= buf[i];
6608			else {
6609				data |= (buf[i] << 8);
6610				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6611				data = 0;
6612			}
6613		}
6614	}
6615	if (m0->m_pkthdr.len % 2) {
6616		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6617		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6618		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6619	}
6620
6621	return (ctl);
6622}
6623
6624static void
6625bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6626{
6627
6628	/* XXX should exit if 5GHz band .. */
6629	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6630		return;
6631
6632	BWN_WRITE_2(mac, 0x684, 510 + time);
6633	/* Disabled in Linux b43, can adversely effect performance */
6634#if 0
6635	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6636#endif
6637}
6638
6639static struct bwn_dma_ring *
6640bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6641{
6642
6643	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6644		return (mac->mac_method.dma.wme[WME_AC_BE]);
6645
6646	switch (prio) {
6647	case 3:
6648		return (mac->mac_method.dma.wme[WME_AC_VO]);
6649	case 2:
6650		return (mac->mac_method.dma.wme[WME_AC_VI]);
6651	case 0:
6652		return (mac->mac_method.dma.wme[WME_AC_BE]);
6653	case 1:
6654		return (mac->mac_method.dma.wme[WME_AC_BK]);
6655	}
6656	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6657	return (NULL);
6658}
6659
6660static int
6661bwn_dma_getslot(struct bwn_dma_ring *dr)
6662{
6663	int slot;
6664
6665	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6666
6667	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6668	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6669	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6670
6671	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6672	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6673	dr->dr_curslot = slot;
6674	dr->dr_usedslot++;
6675
6676	return (slot);
6677}
6678
6679static struct bwn_pio_txqueue *
6680bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6681    struct bwn_pio_txpkt **pack)
6682{
6683	struct bwn_pio *pio = &mac->mac_method.pio;
6684	struct bwn_pio_txqueue *tq = NULL;
6685	unsigned int index;
6686
6687	switch (cookie & 0xf000) {
6688	case 0x1000:
6689		tq = &pio->wme[WME_AC_BK];
6690		break;
6691	case 0x2000:
6692		tq = &pio->wme[WME_AC_BE];
6693		break;
6694	case 0x3000:
6695		tq = &pio->wme[WME_AC_VI];
6696		break;
6697	case 0x4000:
6698		tq = &pio->wme[WME_AC_VO];
6699		break;
6700	case 0x5000:
6701		tq = &pio->mcast;
6702		break;
6703	}
6704	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6705	if (tq == NULL)
6706		return (NULL);
6707	index = (cookie & 0x0fff);
6708	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6709	if (index >= N(tq->tq_pkts))
6710		return (NULL);
6711	*pack = &tq->tq_pkts[index];
6712	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6713	return (tq);
6714}
6715
6716static void
6717bwn_txpwr(void *arg, int npending)
6718{
6719	struct bwn_mac *mac = arg;
6720	struct bwn_softc *sc = mac->mac_sc;
6721
6722	BWN_LOCK(sc);
6723	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6724	    mac->mac_phy.set_txpwr != NULL)
6725		mac->mac_phy.set_txpwr(mac);
6726	BWN_UNLOCK(sc);
6727}
6728
6729static void
6730bwn_task_15s(struct bwn_mac *mac)
6731{
6732	uint16_t reg;
6733
6734	if (mac->mac_fw.opensource) {
6735		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6736		if (reg) {
6737			bwn_restart(mac, "fw watchdog");
6738			return;
6739		}
6740		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6741	}
6742	if (mac->mac_phy.task_15s)
6743		mac->mac_phy.task_15s(mac);
6744
6745	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6746}
6747
6748static void
6749bwn_task_30s(struct bwn_mac *mac)
6750{
6751
6752	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6753		return;
6754	mac->mac_noise.noi_running = 1;
6755	mac->mac_noise.noi_nsamples = 0;
6756
6757	bwn_noise_gensample(mac);
6758}
6759
6760static void
6761bwn_task_60s(struct bwn_mac *mac)
6762{
6763
6764	if (mac->mac_phy.task_60s)
6765		mac->mac_phy.task_60s(mac);
6766	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6767}
6768
6769static void
6770bwn_tasks(void *arg)
6771{
6772	struct bwn_mac *mac = arg;
6773	struct bwn_softc *sc = mac->mac_sc;
6774
6775	BWN_ASSERT_LOCKED(sc);
6776	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6777		return;
6778
6779	if (mac->mac_task_state % 4 == 0)
6780		bwn_task_60s(mac);
6781	if (mac->mac_task_state % 2 == 0)
6782		bwn_task_30s(mac);
6783	bwn_task_15s(mac);
6784
6785	mac->mac_task_state++;
6786	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6787}
6788
6789static int
6790bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6791{
6792	struct bwn_softc *sc = mac->mac_sc;
6793
6794	KASSERT(a == 0, ("not support APHY\n"));
6795
6796	switch (plcp->o.raw[0] & 0xf) {
6797	case 0xb:
6798		return (BWN_OFDM_RATE_6MB);
6799	case 0xf:
6800		return (BWN_OFDM_RATE_9MB);
6801	case 0xa:
6802		return (BWN_OFDM_RATE_12MB);
6803	case 0xe:
6804		return (BWN_OFDM_RATE_18MB);
6805	case 0x9:
6806		return (BWN_OFDM_RATE_24MB);
6807	case 0xd:
6808		return (BWN_OFDM_RATE_36MB);
6809	case 0x8:
6810		return (BWN_OFDM_RATE_48MB);
6811	case 0xc:
6812		return (BWN_OFDM_RATE_54MB);
6813	}
6814	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6815	    plcp->o.raw[0] & 0xf);
6816	return (-1);
6817}
6818
6819static int
6820bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6821{
6822	struct bwn_softc *sc = mac->mac_sc;
6823
6824	switch (plcp->o.raw[0]) {
6825	case 0x0a:
6826		return (BWN_CCK_RATE_1MB);
6827	case 0x14:
6828		return (BWN_CCK_RATE_2MB);
6829	case 0x37:
6830		return (BWN_CCK_RATE_5MB);
6831	case 0x6e:
6832		return (BWN_CCK_RATE_11MB);
6833	}
6834	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6835	return (-1);
6836}
6837
6838static void
6839bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6840    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6841    int rssi, int noise)
6842{
6843	struct bwn_softc *sc = mac->mac_sc;
6844	const struct ieee80211_frame_min *wh;
6845	uint64_t tsf;
6846	uint16_t low_mactime_now;
6847	uint16_t mt;
6848
6849	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6850		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6851
6852	wh = mtod(m, const struct ieee80211_frame_min *);
6853	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6854		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6855
6856	bwn_tsf_read(mac, &tsf);
6857	low_mactime_now = tsf;
6858	tsf = tsf & ~0xffffULL;
6859
6860	switch (mac->mac_fw.fw_hdr_format) {
6861	case BWN_FW_HDR_351:
6862	case BWN_FW_HDR_410:
6863		mt = le16toh(rxhdr->ps4.r351.mac_time);
6864		break;
6865	case BWN_FW_HDR_598:
6866		mt = le16toh(rxhdr->ps4.r598.mac_time);
6867		break;
6868	}
6869
6870	tsf += mt;
6871	if (low_mactime_now < mt)
6872		tsf -= 0x10000;
6873
6874	sc->sc_rx_th.wr_tsf = tsf;
6875	sc->sc_rx_th.wr_rate = rate;
6876	sc->sc_rx_th.wr_antsignal = rssi;
6877	sc->sc_rx_th.wr_antnoise = noise;
6878}
6879
6880static void
6881bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6882{
6883	uint32_t low, high;
6884
6885	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6886	    ("%s:%d: fail", __func__, __LINE__));
6887
6888	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6889	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6890	*tsf = high;
6891	*tsf <<= 32;
6892	*tsf |= low;
6893}
6894
6895static int
6896bwn_dma_attach(struct bwn_mac *mac)
6897{
6898	struct bwn_dma *dma = &mac->mac_method.dma;
6899	struct bwn_softc *sc = mac->mac_sc;
6900	bus_addr_t lowaddr = 0;
6901	int error;
6902
6903	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6904		return (0);
6905
6906	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6907
6908	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6909
6910	dma->dmatype = bwn_dma_gettype(mac);
6911	if (dma->dmatype == BWN_DMA_30BIT)
6912		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6913	else if (dma->dmatype == BWN_DMA_32BIT)
6914		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6915	else
6916		lowaddr = BUS_SPACE_MAXADDR;
6917
6918	/*
6919	 * Create top level DMA tag
6920	 */
6921	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6922			       BWN_ALIGN, 0,		/* alignment, bounds */
6923			       lowaddr,			/* lowaddr */
6924			       BUS_SPACE_MAXADDR,	/* highaddr */
6925			       NULL, NULL,		/* filter, filterarg */
6926			       BUS_SPACE_MAXSIZE,	/* maxsize */
6927			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6928			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6929			       0,			/* flags */
6930			       NULL, NULL,		/* lockfunc, lockarg */
6931			       &dma->parent_dtag);
6932	if (error) {
6933		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6934		return (error);
6935	}
6936
6937	/*
6938	 * Create TX/RX mbuf DMA tag
6939	 */
6940	error = bus_dma_tag_create(dma->parent_dtag,
6941				1,
6942				0,
6943				BUS_SPACE_MAXADDR,
6944				BUS_SPACE_MAXADDR,
6945				NULL, NULL,
6946				MCLBYTES,
6947				1,
6948				BUS_SPACE_MAXSIZE_32BIT,
6949				0,
6950				NULL, NULL,
6951				&dma->rxbuf_dtag);
6952	if (error) {
6953		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6954		goto fail0;
6955	}
6956	error = bus_dma_tag_create(dma->parent_dtag,
6957				1,
6958				0,
6959				BUS_SPACE_MAXADDR,
6960				BUS_SPACE_MAXADDR,
6961				NULL, NULL,
6962				MCLBYTES,
6963				1,
6964				BUS_SPACE_MAXSIZE_32BIT,
6965				0,
6966				NULL, NULL,
6967				&dma->txbuf_dtag);
6968	if (error) {
6969		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6970		goto fail1;
6971	}
6972
6973	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6974	if (!dma->wme[WME_AC_BK])
6975		goto fail2;
6976
6977	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6978	if (!dma->wme[WME_AC_BE])
6979		goto fail3;
6980
6981	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6982	if (!dma->wme[WME_AC_VI])
6983		goto fail4;
6984
6985	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6986	if (!dma->wme[WME_AC_VO])
6987		goto fail5;
6988
6989	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6990	if (!dma->mcast)
6991		goto fail6;
6992	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6993	if (!dma->rx)
6994		goto fail7;
6995
6996	return (error);
6997
6998fail7:	bwn_dma_ringfree(&dma->mcast);
6999fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7000fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7001fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7002fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7003fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7004fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7005fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7006	return (error);
7007}
7008
7009static struct bwn_dma_ring *
7010bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7011    uint16_t cookie, int *slot)
7012{
7013	struct bwn_dma *dma = &mac->mac_method.dma;
7014	struct bwn_dma_ring *dr;
7015	struct bwn_softc *sc = mac->mac_sc;
7016
7017	BWN_ASSERT_LOCKED(mac->mac_sc);
7018
7019	switch (cookie & 0xf000) {
7020	case 0x1000:
7021		dr = dma->wme[WME_AC_BK];
7022		break;
7023	case 0x2000:
7024		dr = dma->wme[WME_AC_BE];
7025		break;
7026	case 0x3000:
7027		dr = dma->wme[WME_AC_VI];
7028		break;
7029	case 0x4000:
7030		dr = dma->wme[WME_AC_VO];
7031		break;
7032	case 0x5000:
7033		dr = dma->mcast;
7034		break;
7035	default:
7036		dr = NULL;
7037		KASSERT(0 == 1,
7038		    ("invalid cookie value %d", cookie & 0xf000));
7039	}
7040	*slot = (cookie & 0x0fff);
7041	if (*slot < 0 || *slot >= dr->dr_numslots) {
7042		/*
7043		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7044		 * that it occurs events which have same H/W sequence numbers.
7045		 * When it's occurred just prints a WARNING msgs and ignores.
7046		 */
7047		KASSERT(status->seq == dma->lastseq,
7048		    ("%s:%d: fail", __func__, __LINE__));
7049		device_printf(sc->sc_dev,
7050		    "out of slot ranges (0 < %d < %d)\n", *slot,
7051		    dr->dr_numslots);
7052		return (NULL);
7053	}
7054	dma->lastseq = status->seq;
7055	return (dr);
7056}
7057
7058static void
7059bwn_dma_stop(struct bwn_mac *mac)
7060{
7061	struct bwn_dma *dma;
7062
7063	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7064		return;
7065	dma = &mac->mac_method.dma;
7066
7067	bwn_dma_ringstop(&dma->rx);
7068	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7069	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7070	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7071	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7072	bwn_dma_ringstop(&dma->mcast);
7073}
7074
7075static void
7076bwn_dma_ringstop(struct bwn_dma_ring **dr)
7077{
7078
7079	if (dr == NULL)
7080		return;
7081
7082	bwn_dma_cleanup(*dr);
7083}
7084
7085static void
7086bwn_pio_stop(struct bwn_mac *mac)
7087{
7088	struct bwn_pio *pio;
7089
7090	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7091		return;
7092	pio = &mac->mac_method.pio;
7093
7094	bwn_destroy_queue_tx(&pio->mcast);
7095	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7096	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7097	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7098	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7099}
7100
7101static void
7102bwn_led_attach(struct bwn_mac *mac)
7103{
7104	struct bwn_softc *sc = mac->mac_sc;
7105	const uint8_t *led_act = NULL;
7106	uint16_t val[BWN_LED_MAX];
7107	int i;
7108
7109	sc->sc_led_idle = (2350 * hz) / 1000;
7110	sc->sc_led_blink = 1;
7111
7112	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7113		if (siba_get_pci_subvendor(sc->sc_dev) ==
7114		    bwn_vendor_led_act[i].vid) {
7115			led_act = bwn_vendor_led_act[i].led_act;
7116			break;
7117		}
7118	}
7119	if (led_act == NULL)
7120		led_act = bwn_default_led_act;
7121
7122	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7123	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7124	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7125	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7126
7127	for (i = 0; i < BWN_LED_MAX; ++i) {
7128		struct bwn_led *led = &sc->sc_leds[i];
7129
7130		if (val[i] == 0xff) {
7131			led->led_act = led_act[i];
7132		} else {
7133			if (val[i] & BWN_LED_ACT_LOW)
7134				led->led_flags |= BWN_LED_F_ACTLOW;
7135			led->led_act = val[i] & BWN_LED_ACT_MASK;
7136		}
7137		led->led_mask = (1 << i);
7138
7139		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7140		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7141		    led->led_act == BWN_LED_ACT_BLINK) {
7142			led->led_flags |= BWN_LED_F_BLINK;
7143			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7144				led->led_flags |= BWN_LED_F_POLLABLE;
7145			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7146				led->led_flags |= BWN_LED_F_SLOW;
7147
7148			if (sc->sc_blink_led == NULL) {
7149				sc->sc_blink_led = led;
7150				if (led->led_flags & BWN_LED_F_SLOW)
7151					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7152			}
7153		}
7154
7155		DPRINTF(sc, BWN_DEBUG_LED,
7156		    "%dth led, act %d, lowact %d\n", i,
7157		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7158	}
7159	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7160}
7161
7162static __inline uint16_t
7163bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7164{
7165
7166	if (led->led_flags & BWN_LED_F_ACTLOW)
7167		on = !on;
7168	if (on)
7169		val |= led->led_mask;
7170	else
7171		val &= ~led->led_mask;
7172	return val;
7173}
7174
7175static void
7176bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7177{
7178	struct bwn_softc *sc = mac->mac_sc;
7179	struct ieee80211com *ic = &sc->sc_ic;
7180	uint16_t val;
7181	int i;
7182
7183	if (nstate == IEEE80211_S_INIT) {
7184		callout_stop(&sc->sc_led_blink_ch);
7185		sc->sc_led_blinking = 0;
7186	}
7187
7188	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7189		return;
7190
7191	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7192	for (i = 0; i < BWN_LED_MAX; ++i) {
7193		struct bwn_led *led = &sc->sc_leds[i];
7194		int on;
7195
7196		if (led->led_act == BWN_LED_ACT_UNKN ||
7197		    led->led_act == BWN_LED_ACT_NULL)
7198			continue;
7199
7200		if ((led->led_flags & BWN_LED_F_BLINK) &&
7201		    nstate != IEEE80211_S_INIT)
7202			continue;
7203
7204		switch (led->led_act) {
7205		case BWN_LED_ACT_ON:    /* Always on */
7206			on = 1;
7207			break;
7208		case BWN_LED_ACT_OFF:   /* Always off */
7209		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7210			on = 0;
7211			break;
7212		default:
7213			on = 1;
7214			switch (nstate) {
7215			case IEEE80211_S_INIT:
7216				on = 0;
7217				break;
7218			case IEEE80211_S_RUN:
7219				if (led->led_act == BWN_LED_ACT_11G &&
7220				    ic->ic_curmode != IEEE80211_MODE_11G)
7221					on = 0;
7222				break;
7223			default:
7224				if (led->led_act == BWN_LED_ACT_ASSOC)
7225					on = 0;
7226				break;
7227			}
7228			break;
7229		}
7230
7231		val = bwn_led_onoff(led, val, on);
7232	}
7233	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7234}
7235
7236static void
7237bwn_led_event(struct bwn_mac *mac, int event)
7238{
7239	struct bwn_softc *sc = mac->mac_sc;
7240	struct bwn_led *led = sc->sc_blink_led;
7241	int rate;
7242
7243	if (event == BWN_LED_EVENT_POLL) {
7244		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7245			return;
7246		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7247			return;
7248	}
7249
7250	sc->sc_led_ticks = ticks;
7251	if (sc->sc_led_blinking)
7252		return;
7253
7254	switch (event) {
7255	case BWN_LED_EVENT_RX:
7256		rate = sc->sc_rx_rate;
7257		break;
7258	case BWN_LED_EVENT_TX:
7259		rate = sc->sc_tx_rate;
7260		break;
7261	case BWN_LED_EVENT_POLL:
7262		rate = 0;
7263		break;
7264	default:
7265		panic("unknown LED event %d\n", event);
7266		break;
7267	}
7268	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7269	    bwn_led_duration[rate].off_dur);
7270}
7271
7272static void
7273bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7274{
7275	struct bwn_softc *sc = mac->mac_sc;
7276	struct bwn_led *led = sc->sc_blink_led;
7277	uint16_t val;
7278
7279	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7280	val = bwn_led_onoff(led, val, 1);
7281	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7282
7283	if (led->led_flags & BWN_LED_F_SLOW) {
7284		BWN_LED_SLOWDOWN(on_dur);
7285		BWN_LED_SLOWDOWN(off_dur);
7286	}
7287
7288	sc->sc_led_blinking = 1;
7289	sc->sc_led_blink_offdur = off_dur;
7290
7291	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7292}
7293
7294static void
7295bwn_led_blink_next(void *arg)
7296{
7297	struct bwn_mac *mac = arg;
7298	struct bwn_softc *sc = mac->mac_sc;
7299	uint16_t val;
7300
7301	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7302	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7303	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7304
7305	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7306	    bwn_led_blink_end, mac);
7307}
7308
7309static void
7310bwn_led_blink_end(void *arg)
7311{
7312	struct bwn_mac *mac = arg;
7313	struct bwn_softc *sc = mac->mac_sc;
7314
7315	sc->sc_led_blinking = 0;
7316}
7317
7318static int
7319bwn_suspend(device_t dev)
7320{
7321	struct bwn_softc *sc = device_get_softc(dev);
7322
7323	BWN_LOCK(sc);
7324	bwn_stop(sc);
7325	BWN_UNLOCK(sc);
7326	return (0);
7327}
7328
7329static int
7330bwn_resume(device_t dev)
7331{
7332	struct bwn_softc *sc = device_get_softc(dev);
7333	int error = EDOOFUS;
7334
7335	BWN_LOCK(sc);
7336	if (sc->sc_ic.ic_nrunning > 0)
7337		error = bwn_init(sc);
7338	BWN_UNLOCK(sc);
7339	if (error == 0)
7340		ieee80211_start_all(&sc->sc_ic);
7341	return (0);
7342}
7343
7344static void
7345bwn_rfswitch(void *arg)
7346{
7347	struct bwn_softc *sc = arg;
7348	struct bwn_mac *mac = sc->sc_curmac;
7349	int cur = 0, prev = 0;
7350
7351	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7352	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7353
7354	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7355	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7356		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7357			& BWN_RF_HWENABLED_HI_MASK))
7358			cur = 1;
7359	} else {
7360		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7361		    & BWN_RF_HWENABLED_LO_MASK)
7362			cur = 1;
7363	}
7364
7365	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7366		prev = 1;
7367
7368	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7369	    __func__, cur, prev);
7370
7371	if (cur != prev) {
7372		if (cur)
7373			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7374		else
7375			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7376
7377		device_printf(sc->sc_dev,
7378		    "status of RF switch is changed to %s\n",
7379		    cur ? "ON" : "OFF");
7380		if (cur != mac->mac_phy.rf_on) {
7381			if (cur)
7382				bwn_rf_turnon(mac);
7383			else
7384				bwn_rf_turnoff(mac);
7385		}
7386	}
7387
7388	callout_schedule(&sc->sc_rfswitch_ch, hz);
7389}
7390
7391static void
7392bwn_sysctl_node(struct bwn_softc *sc)
7393{
7394	device_t dev = sc->sc_dev;
7395	struct bwn_mac *mac;
7396	struct bwn_stats *stats;
7397
7398	/* XXX assume that count of MAC is only 1. */
7399
7400	if ((mac = sc->sc_curmac) == NULL)
7401		return;
7402	stats = &mac->mac_stats;
7403
7404	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7405	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7406	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7407	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7408	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7409	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7410	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7411	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7412	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7413
7414#ifdef BWN_DEBUG
7415	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7416	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7417	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7418#endif
7419}
7420
7421static device_method_t bwn_methods[] = {
7422	/* Device interface */
7423	DEVMETHOD(device_probe,		bwn_probe),
7424	DEVMETHOD(device_attach,	bwn_attach),
7425	DEVMETHOD(device_detach,	bwn_detach),
7426	DEVMETHOD(device_suspend,	bwn_suspend),
7427	DEVMETHOD(device_resume,	bwn_resume),
7428	DEVMETHOD_END
7429};
7430static driver_t bwn_driver = {
7431	"bwn",
7432	bwn_methods,
7433	sizeof(struct bwn_softc)
7434};
7435static devclass_t bwn_devclass;
7436DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7437MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7438MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7439MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7440MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7441MODULE_VERSION(bwn, 1);
7442