if_bwn.c revision 300188
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 300188 2016-05-19 04:28:49Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include "opt_bwn.h"
38#include "opt_wlan.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/malloc.h>
44#include <sys/module.h>
45#include <sys/endian.h>
46#include <sys/errno.h>
47#include <sys/firmware.h>
48#include <sys/lock.h>
49#include <sys/mutex.h>
50#include <machine/bus.h>
51#include <machine/resource.h>
52#include <sys/bus.h>
53#include <sys/rman.h>
54#include <sys/socket.h>
55#include <sys/sockio.h>
56
57#include <net/ethernet.h>
58#include <net/if.h>
59#include <net/if_var.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_llc.h>
63#include <net/if_media.h>
64#include <net/if_types.h>
65
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcireg.h>
68#include <dev/siba/siba_ids.h>
69#include <dev/siba/sibareg.h>
70#include <dev/siba/sibavar.h>
71
72#include <net80211/ieee80211_var.h>
73#include <net80211/ieee80211_radiotap.h>
74#include <net80211/ieee80211_regdomain.h>
75#include <net80211/ieee80211_phy.h>
76#include <net80211/ieee80211_ratectl.h>
77
78#include <dev/bwn/if_bwnreg.h>
79#include <dev/bwn/if_bwnvar.h>
80
81#include <dev/bwn/if_bwn_debug.h>
82#include <dev/bwn/if_bwn_misc.h>
83#include <dev/bwn/if_bwn_util.h>
84#include <dev/bwn/if_bwn_phy_common.h>
85#include <dev/bwn/if_bwn_phy_g.h>
86#include <dev/bwn/if_bwn_phy_lp.h>
87#include <dev/bwn/if_bwn_phy_n.h>
88
89static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90    "Broadcom driver parameters");
91
92/*
93 * Tunable & sysctl variables.
94 */
95
96#ifdef BWN_DEBUG
97static	int bwn_debug = 0;
98SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99    "Broadcom debugging printfs");
100#endif
101
102static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104    "uses Bad Frames Preemption");
105static int	bwn_bluetooth = 1;
106SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107    "turns on Bluetooth Coexistence");
108static int	bwn_hwpctl = 0;
109SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110    "uses H/W power control");
111static int	bwn_msi_disable = 0;		/* MSI disabled  */
112TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113static int	bwn_usedma = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115    "uses DMA");
116TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117static int	bwn_wme = 1;
118SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119    "uses WME support");
120
121static void	bwn_attach_pre(struct bwn_softc *);
122static int	bwn_attach_post(struct bwn_softc *);
123static void	bwn_sprom_bugfixes(device_t);
124static int	bwn_init(struct bwn_softc *);
125static void	bwn_parent(struct ieee80211com *);
126static void	bwn_start(struct bwn_softc *);
127static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128static int	bwn_attach_core(struct bwn_mac *);
129static int	bwn_phy_getinfo(struct bwn_mac *, int);
130static int	bwn_chiptest(struct bwn_mac *);
131static int	bwn_setup_channels(struct bwn_mac *, int, int);
132static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133		    uint16_t);
134static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135		    const struct bwn_channelinfo *, const uint8_t []);
136static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137		    const struct ieee80211_bpf_params *);
138static void	bwn_updateslot(struct ieee80211com *);
139static void	bwn_update_promisc(struct ieee80211com *);
140static void	bwn_wme_init(struct bwn_mac *);
141static int	bwn_wme_update(struct ieee80211com *);
142static void	bwn_wme_clear(struct bwn_softc *);
143static void	bwn_wme_load(struct bwn_mac *);
144static void	bwn_wme_loadparams(struct bwn_mac *,
145		    const struct wmeParams *, uint16_t);
146static void	bwn_scan_start(struct ieee80211com *);
147static void	bwn_scan_end(struct ieee80211com *);
148static void	bwn_set_channel(struct ieee80211com *);
149static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151		    const uint8_t [IEEE80211_ADDR_LEN],
152		    const uint8_t [IEEE80211_ADDR_LEN]);
153static void	bwn_vap_delete(struct ieee80211vap *);
154static void	bwn_stop(struct bwn_softc *);
155static int	bwn_core_init(struct bwn_mac *);
156static void	bwn_core_start(struct bwn_mac *);
157static void	bwn_core_exit(struct bwn_mac *);
158static void	bwn_bt_disable(struct bwn_mac *);
159static int	bwn_chip_init(struct bwn_mac *);
160static void	bwn_set_txretry(struct bwn_mac *, int, int);
161static void	bwn_rate_init(struct bwn_mac *);
162static void	bwn_set_phytxctl(struct bwn_mac *);
163static void	bwn_spu_setdelay(struct bwn_mac *, int);
164static void	bwn_bt_enable(struct bwn_mac *);
165static void	bwn_set_macaddr(struct bwn_mac *);
166static void	bwn_crypt_init(struct bwn_mac *);
167static void	bwn_chip_exit(struct bwn_mac *);
168static int	bwn_fw_fillinfo(struct bwn_mac *);
169static int	bwn_fw_loaducode(struct bwn_mac *);
170static int	bwn_gpio_init(struct bwn_mac *);
171static int	bwn_fw_loadinitvals(struct bwn_mac *);
172static int	bwn_phy_init(struct bwn_mac *);
173static void	bwn_set_txantenna(struct bwn_mac *, int);
174static void	bwn_set_opmode(struct bwn_mac *);
175static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176static uint8_t	bwn_plcp_getcck(const uint8_t);
177static uint8_t	bwn_plcp_getofdm(const uint8_t);
178static void	bwn_pio_init(struct bwn_mac *);
179static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181		    int);
182static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183		    struct bwn_pio_rxqueue *, int);
184static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186		    uint16_t);
187static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190static void	bwn_pio_handle_txeof(struct bwn_mac *,
191		    const struct bwn_txstatus *);
192static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195		    uint16_t);
196static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197		    uint32_t);
198static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199		    struct mbuf *);
200static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204		    uint16_t, uint32_t);
205static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210		    uint16_t, struct bwn_pio_txpkt **);
211static void	bwn_dma_init(struct bwn_mac *);
212static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213static int	bwn_dma_mask2type(uint64_t);
214static uint64_t	bwn_dma_mask(struct bwn_mac *);
215static uint16_t	bwn_dma_base(int, int);
216static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218		    int, struct bwn_dmadesc_generic **,
219		    struct bwn_dmadesc_meta **);
220static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222		    int, int);
223static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229		    int, struct bwn_dmadesc_generic **,
230		    struct bwn_dmadesc_meta **);
231static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233		    int, int);
234static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240static void	bwn_dma_setup(struct bwn_dma_ring *);
241static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245static void	bwn_dma_rx(struct bwn_dma_ring *);
246static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248		    struct bwn_dmadesc_meta *);
249static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250static int	bwn_dma_gettype(struct bwn_mac *);
251static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257		    int);
258static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259		    bus_size_t, int);
260static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261static void	bwn_dma_handle_txeof(struct bwn_mac *,
262		    const struct bwn_txstatus *);
263static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264		    struct mbuf *);
265static int	bwn_dma_getslot(struct bwn_dma_ring *);
266static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267		    uint8_t);
268static int	bwn_dma_attach(struct bwn_mac *);
269static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270		    int, int, int);
271static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272		    const struct bwn_txstatus *, uint16_t, int *);
273static void	bwn_dma_free(struct bwn_mac *);
274static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276		    const char *, struct bwn_fwfile *);
277static void	bwn_release_firmware(struct bwn_mac *);
278static void	bwn_do_release_fw(struct bwn_fwfile *);
279static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280static int	bwn_fwinitvals_write(struct bwn_mac *,
281		    const struct bwn_fwinitvals *, size_t, size_t);
282static uint16_t	bwn_ant2phy(int);
283static void	bwn_mac_write_bssid(struct bwn_mac *);
284static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285		    const uint8_t *);
286static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *, size_t, const uint8_t *);
288static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289		    const uint8_t *);
290static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291		    const uint8_t *);
292static void	bwn_phy_exit(struct bwn_mac *);
293static void	bwn_core_stop(struct bwn_mac *);
294static int	bwn_switch_band(struct bwn_softc *,
295		    struct ieee80211_channel *);
296static void	bwn_phy_reset(struct bwn_mac *);
297static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298static void	bwn_set_pretbtt(struct bwn_mac *);
299static int	bwn_intr(void *);
300static void	bwn_intrtask(void *, int);
301static void	bwn_restart(struct bwn_mac *, const char *);
302static void	bwn_intr_ucode_debug(struct bwn_mac *);
303static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304static void	bwn_intr_atim_end(struct bwn_mac *);
305static void	bwn_intr_beacon(struct bwn_mac *);
306static void	bwn_intr_pmq(struct bwn_mac *);
307static void	bwn_intr_noise(struct bwn_mac *);
308static void	bwn_intr_txeof(struct bwn_mac *);
309static void	bwn_hwreset(void *, int);
310static void	bwn_handle_fwpanic(struct bwn_mac *);
311static void	bwn_load_beacon0(struct bwn_mac *);
312static void	bwn_load_beacon1(struct bwn_mac *);
313static uint32_t	bwn_jssi_read(struct bwn_mac *);
314static void	bwn_noise_gensample(struct bwn_mac *);
315static void	bwn_handle_txeof(struct bwn_mac *,
316		    const struct bwn_txstatus *);
317static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320		    struct mbuf *);
321static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322static int	bwn_set_txhdr(struct bwn_mac *,
323		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324		    uint16_t);
325static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326		    const uint8_t);
327static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328static uint8_t	bwn_get_fbrate(uint8_t);
329static void	bwn_txpwr(void *, int);
330static void	bwn_tasks(void *);
331static void	bwn_task_15s(struct bwn_mac *);
332static void	bwn_task_30s(struct bwn_mac *);
333static void	bwn_task_60s(struct bwn_mac *);
334static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335		    uint8_t);
336static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339		    int, int);
340static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342static void	bwn_watchdog(void *);
343static void	bwn_dma_stop(struct bwn_mac *);
344static void	bwn_pio_stop(struct bwn_mac *);
345static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346static void	bwn_led_attach(struct bwn_mac *);
347static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348static void	bwn_led_event(struct bwn_mac *, int);
349static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350static void	bwn_led_blink_next(void *);
351static void	bwn_led_blink_end(void *);
352static void	bwn_rfswitch(void *);
353static void	bwn_rf_turnon(struct bwn_mac *);
354static void	bwn_rf_turnoff(struct bwn_mac *);
355static void	bwn_sysctl_node(struct bwn_softc *);
356
357static struct resource_spec bwn_res_spec_legacy[] = {
358	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359	{ -1,			0,		0 }
360};
361
362static struct resource_spec bwn_res_spec_msi[] = {
363	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364	{ -1,			0,		0 }
365};
366
367static const struct bwn_channelinfo bwn_chantable_bg = {
368	.channels = {
369		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374	.nchannels = 14
375};
376
377static const struct bwn_channelinfo bwn_chantable_a = {
378	.channels = {
379		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391		{ 6080, 216, 30 } },
392	.nchannels = 37
393};
394
395#if 0
396static const struct bwn_channelinfo bwn_chantable_n = {
397	.channels = {
398		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435	.nchannels = 110
436};
437#endif
438
439#define	VENDOR_LED_ACT(vendor)				\
440{							\
441	.vid = PCI_VENDOR_##vendor,			\
442	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443}
444
445static const struct {
446	uint16_t	vid;
447	uint8_t		led_act[BWN_LED_MAX];
448} bwn_vendor_led_act[] = {
449	VENDOR_LED_ACT(COMPAQ),
450	VENDOR_LED_ACT(ASUSTEK)
451};
452
453static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454	{ BWN_VENDOR_LED_ACT_DEFAULT };
455
456#undef VENDOR_LED_ACT
457
458static const struct {
459	int		on_dur;
460	int		off_dur;
461} bwn_led_duration[109] = {
462	[0]	= { 400, 100 },
463	[2]	= { 150, 75 },
464	[4]	= { 90, 45 },
465	[11]	= { 66, 34 },
466	[12]	= { 53, 26 },
467	[18]	= { 42, 21 },
468	[22]	= { 35, 17 },
469	[24]	= { 32, 16 },
470	[36]	= { 21, 10 },
471	[48]	= { 16, 8 },
472	[72]	= { 11, 5 },
473	[96]	= { 9, 4 },
474	[108]	= { 7, 3 }
475};
476
477static const uint16_t bwn_wme_shm_offsets[] = {
478	[0] = BWN_WME_BESTEFFORT,
479	[1] = BWN_WME_BACKGROUND,
480	[2] = BWN_WME_VOICE,
481	[3] = BWN_WME_VIDEO,
482};
483
484static const struct siba_devid bwn_devs[] = {
485	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495};
496
497static int
498bwn_probe(device_t dev)
499{
500	int i;
501
502	for (i = 0; i < nitems(bwn_devs); i++) {
503		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506			return (BUS_PROBE_DEFAULT);
507	}
508
509	return (ENXIO);
510}
511
512static int
513bwn_attach(device_t dev)
514{
515	struct bwn_mac *mac;
516	struct bwn_softc *sc = device_get_softc(dev);
517	int error, i, msic, reg;
518
519	sc->sc_dev = dev;
520#ifdef BWN_DEBUG
521	sc->sc_debug = bwn_debug;
522#endif
523
524	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525		bwn_attach_pre(sc);
526		bwn_sprom_bugfixes(dev);
527		sc->sc_flags |= BWN_FLAG_ATTACHED;
528	}
529
530	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531		if (siba_get_pci_device(dev) != 0x4313 &&
532		    siba_get_pci_device(dev) != 0x431a &&
533		    siba_get_pci_device(dev) != 0x4321) {
534			device_printf(sc->sc_dev,
535			    "skip 802.11 cores\n");
536			return (ENODEV);
537		}
538	}
539
540	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541	mac->mac_sc = sc;
542	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543	if (bwn_bfp != 0)
544		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545
546	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549
550	error = bwn_attach_core(mac);
551	if (error)
552		goto fail0;
553	bwn_led_attach(mac);
554
555	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560	    mac->mac_phy.rf_rev);
561	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563		    mac->mac_method.dma.dmatype);
564	else
565		device_printf(sc->sc_dev, "PIO\n");
566
567#ifdef	BWN_GPL_PHY
568	device_printf(sc->sc_dev,
569	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570#endif
571
572	/*
573	 * setup PCI resources and interrupt.
574	 */
575	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576		msic = pci_msi_count(dev);
577		if (bootverbose)
578			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579	} else
580		msic = 0;
581
582	mac->mac_intr_spec = bwn_res_spec_legacy;
583	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584		if (pci_alloc_msi(dev, &msic) == 0) {
585			device_printf(sc->sc_dev,
586			    "Using %d MSI messages\n", msic);
587			mac->mac_intr_spec = bwn_res_spec_msi;
588			mac->mac_msi = 1;
589		}
590	}
591
592	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593	    mac->mac_res_irq);
594	if (error) {
595		device_printf(sc->sc_dev,
596		    "couldn't allocate IRQ resources (%d)\n", error);
597		goto fail1;
598	}
599
600	if (mac->mac_msi == 0)
601		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603		    &mac->mac_intrhand[0]);
604	else {
605		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608			    &mac->mac_intrhand[i]);
609			if (error != 0) {
610				device_printf(sc->sc_dev,
611				    "couldn't setup interrupt (%d)\n", error);
612				break;
613			}
614		}
615	}
616
617	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618
619	/*
620	 * calls attach-post routine
621	 */
622	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623		bwn_attach_post(sc);
624
625	return (0);
626fail1:
627	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628		pci_release_msi(dev);
629fail0:
630	free(mac, M_DEVBUF);
631	return (error);
632}
633
634static int
635bwn_is_valid_ether_addr(uint8_t *addr)
636{
637	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638
639	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640		return (FALSE);
641
642	return (TRUE);
643}
644
645static int
646bwn_attach_post(struct bwn_softc *sc)
647{
648	struct ieee80211com *ic = &sc->sc_ic;
649
650	ic->ic_softc = sc;
651	ic->ic_name = device_get_nameunit(sc->sc_dev);
652	/* XXX not right but it's not used anywhere important */
653	ic->ic_phytype = IEEE80211_T_OFDM;
654	ic->ic_opmode = IEEE80211_M_STA;
655	ic->ic_caps =
656		  IEEE80211_C_STA		/* station mode supported */
657		| IEEE80211_C_MONITOR		/* monitor mode */
658		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660		| IEEE80211_C_SHSLOT		/* short slot time supported */
661		| IEEE80211_C_WME		/* WME/WMM supported */
662		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663#if 0
664		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665#endif
666		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667		;
668
669	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670
671	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675
676	/* call MI attach routine. */
677	ieee80211_ifattach(ic);
678
679	ic->ic_headroom = sizeof(struct bwn_txhdr);
680
681	/* override default methods */
682	ic->ic_raw_xmit = bwn_raw_xmit;
683	ic->ic_updateslot = bwn_updateslot;
684	ic->ic_update_promisc = bwn_update_promisc;
685	ic->ic_wme.wme_update = bwn_wme_update;
686	ic->ic_scan_start = bwn_scan_start;
687	ic->ic_scan_end = bwn_scan_end;
688	ic->ic_set_channel = bwn_set_channel;
689	ic->ic_vap_create = bwn_vap_create;
690	ic->ic_vap_delete = bwn_vap_delete;
691	ic->ic_transmit = bwn_transmit;
692	ic->ic_parent = bwn_parent;
693
694	ieee80211_radiotap_attach(ic,
695	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696	    BWN_TX_RADIOTAP_PRESENT,
697	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698	    BWN_RX_RADIOTAP_PRESENT);
699
700	bwn_sysctl_node(sc);
701
702	if (bootverbose)
703		ieee80211_announce(ic);
704	return (0);
705}
706
707static void
708bwn_phy_detach(struct bwn_mac *mac)
709{
710
711	if (mac->mac_phy.detach != NULL)
712		mac->mac_phy.detach(mac);
713}
714
715static int
716bwn_detach(device_t dev)
717{
718	struct bwn_softc *sc = device_get_softc(dev);
719	struct bwn_mac *mac = sc->sc_curmac;
720	struct ieee80211com *ic = &sc->sc_ic;
721	int i;
722
723	sc->sc_flags |= BWN_FLAG_INVALID;
724
725	if (device_is_attached(sc->sc_dev)) {
726		BWN_LOCK(sc);
727		bwn_stop(sc);
728		BWN_UNLOCK(sc);
729		bwn_dma_free(mac);
730		callout_drain(&sc->sc_led_blink_ch);
731		callout_drain(&sc->sc_rfswitch_ch);
732		callout_drain(&sc->sc_task_ch);
733		callout_drain(&sc->sc_watchdog_ch);
734		bwn_phy_detach(mac);
735		ieee80211_draintask(ic, &mac->mac_hwreset);
736		ieee80211_draintask(ic, &mac->mac_txpower);
737		ieee80211_ifdetach(ic);
738	}
739	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740	taskqueue_free(sc->sc_tq);
741
742	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743		if (mac->mac_intrhand[i] != NULL) {
744			bus_teardown_intr(dev, mac->mac_res_irq[i],
745			    mac->mac_intrhand[i]);
746			mac->mac_intrhand[i] = NULL;
747		}
748	}
749	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750	if (mac->mac_msi != 0)
751		pci_release_msi(dev);
752	mbufq_drain(&sc->sc_snd);
753	BWN_LOCK_DESTROY(sc);
754	return (0);
755}
756
757static void
758bwn_attach_pre(struct bwn_softc *sc)
759{
760
761	BWN_LOCK_INIT(sc);
762	TAILQ_INIT(&sc->sc_maclist);
763	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
764	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
765	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
766	mbufq_init(&sc->sc_snd, ifqmaxlen);
767	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
768		taskqueue_thread_enqueue, &sc->sc_tq);
769	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
770		"%s taskq", device_get_nameunit(sc->sc_dev));
771}
772
773static void
774bwn_sprom_bugfixes(device_t dev)
775{
776#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
777	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
778	 (siba_get_pci_device(dev) == _device) &&			\
779	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
780	 (siba_get_pci_subdevice(dev) == _subdevice))
781
782	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
783	    siba_get_pci_subdevice(dev) == 0x4e &&
784	    siba_get_pci_revid(dev) > 0x40)
785		siba_sprom_set_bf_lo(dev,
786		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
787	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
788	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
789		siba_sprom_set_bf_lo(dev,
790		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
791	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
792		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
793		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
794		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
795		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
796		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
797		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
798		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
799			siba_sprom_set_bf_lo(dev,
800			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
801	}
802#undef	BWN_ISDEV
803}
804
805static void
806bwn_parent(struct ieee80211com *ic)
807{
808	struct bwn_softc *sc = ic->ic_softc;
809	int startall = 0;
810
811	BWN_LOCK(sc);
812	if (ic->ic_nrunning > 0) {
813		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
814			bwn_init(sc);
815			startall = 1;
816		} else
817			bwn_update_promisc(ic);
818	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
819		bwn_stop(sc);
820	BWN_UNLOCK(sc);
821
822	if (startall)
823		ieee80211_start_all(ic);
824}
825
826static int
827bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
828{
829	struct bwn_softc *sc = ic->ic_softc;
830	int error;
831
832	BWN_LOCK(sc);
833	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
834		BWN_UNLOCK(sc);
835		return (ENXIO);
836	}
837	error = mbufq_enqueue(&sc->sc_snd, m);
838	if (error) {
839		BWN_UNLOCK(sc);
840		return (error);
841	}
842	bwn_start(sc);
843	BWN_UNLOCK(sc);
844	return (0);
845}
846
847static void
848bwn_start(struct bwn_softc *sc)
849{
850	struct bwn_mac *mac = sc->sc_curmac;
851	struct ieee80211_frame *wh;
852	struct ieee80211_node *ni;
853	struct ieee80211_key *k;
854	struct mbuf *m;
855
856	BWN_ASSERT_LOCKED(sc);
857
858	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
859	    mac->mac_status < BWN_MAC_STATUS_STARTED)
860		return;
861
862	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
863		if (bwn_tx_isfull(sc, m))
864			break;
865		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
866		if (ni == NULL) {
867			device_printf(sc->sc_dev, "unexpected NULL ni\n");
868			m_freem(m);
869			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
870			continue;
871		}
872		wh = mtod(m, struct ieee80211_frame *);
873		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
874			k = ieee80211_crypto_encap(ni, m);
875			if (k == NULL) {
876				if_inc_counter(ni->ni_vap->iv_ifp,
877				    IFCOUNTER_OERRORS, 1);
878				ieee80211_free_node(ni);
879				m_freem(m);
880				continue;
881			}
882		}
883		wh = NULL;	/* Catch any invalid use */
884		if (bwn_tx_start(sc, ni, m) != 0) {
885			if (ni != NULL) {
886				if_inc_counter(ni->ni_vap->iv_ifp,
887				    IFCOUNTER_OERRORS, 1);
888				ieee80211_free_node(ni);
889			}
890			continue;
891		}
892		sc->sc_watchdog_timer = 5;
893	}
894}
895
896static int
897bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
898{
899	struct bwn_dma_ring *dr;
900	struct bwn_mac *mac = sc->sc_curmac;
901	struct bwn_pio_txqueue *tq;
902	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
903
904	BWN_ASSERT_LOCKED(sc);
905
906	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
907		dr = bwn_dma_select(mac, M_WME_GETAC(m));
908		if (dr->dr_stop == 1 ||
909		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
910			dr->dr_stop = 1;
911			goto full;
912		}
913	} else {
914		tq = bwn_pio_select(mac, M_WME_GETAC(m));
915		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
916		    pktlen > (tq->tq_size - tq->tq_used))
917			goto full;
918	}
919	return (0);
920full:
921	mbufq_prepend(&sc->sc_snd, m);
922	return (1);
923}
924
925static int
926bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
927{
928	struct bwn_mac *mac = sc->sc_curmac;
929	int error;
930
931	BWN_ASSERT_LOCKED(sc);
932
933	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
934		m_freem(m);
935		return (ENXIO);
936	}
937
938	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
939	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
940	if (error) {
941		m_freem(m);
942		return (error);
943	}
944	return (0);
945}
946
947static int
948bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
949{
950	struct bwn_pio_txpkt *tp;
951	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
952	struct bwn_softc *sc = mac->mac_sc;
953	struct bwn_txhdr txhdr;
954	struct mbuf *m_new;
955	uint32_t ctl32;
956	int error;
957	uint16_t ctl16;
958
959	BWN_ASSERT_LOCKED(sc);
960
961	/* XXX TODO send packets after DTIM */
962
963	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
964	tp = TAILQ_FIRST(&tq->tq_pktlist);
965	tp->tp_ni = ni;
966	tp->tp_m = m;
967
968	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
969	if (error) {
970		device_printf(sc->sc_dev, "tx fail\n");
971		return (error);
972	}
973
974	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
975	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
976	tq->tq_free--;
977
978	if (siba_get_revid(sc->sc_dev) >= 8) {
979		/*
980		 * XXX please removes m_defrag(9)
981		 */
982		m_new = m_defrag(m, M_NOWAIT);
983		if (m_new == NULL) {
984			device_printf(sc->sc_dev,
985			    "%s: can't defrag TX buffer\n",
986			    __func__);
987			return (ENOBUFS);
988		}
989		if (m_new->m_next != NULL)
990			device_printf(sc->sc_dev,
991			    "TODO: fragmented packets for PIO\n");
992		tp->tp_m = m_new;
993
994		/* send HEADER */
995		ctl32 = bwn_pio_write_multi_4(mac, tq,
996		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
997			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
998		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
999		/* send BODY */
1000		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1002		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003		    ctl32 | BWN_PIO8_TXCTL_EOF);
1004	} else {
1005		ctl16 = bwn_pio_write_multi_2(mac, tq,
1006		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011		    ctl16 | BWN_PIO_TXCTL_EOF);
1012	}
1013
1014	return (0);
1015}
1016
1017static struct bwn_pio_txqueue *
1018bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019{
1020
1021	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024	switch (prio) {
1025	case 0:
1026		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027	case 1:
1028		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029	case 2:
1030		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031	case 3:
1032		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033	}
1034	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035	return (NULL);
1036}
1037
1038static int
1039bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040{
1041#define	BWN_GET_TXHDRCACHE(slot)					\
1042	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043	struct bwn_dma *dma = &mac->mac_method.dma;
1044	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045	struct bwn_dmadesc_generic *desc;
1046	struct bwn_dmadesc_meta *mt;
1047	struct bwn_softc *sc = mac->mac_sc;
1048	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051	BWN_ASSERT_LOCKED(sc);
1052	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054	/* XXX send after DTIM */
1055
1056	slot = bwn_dma_getslot(dr);
1057	dr->getdesc(dr, slot, &desc, &mt);
1058	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059	    ("%s:%d: fail", __func__, __LINE__));
1060
1061	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063	    BWN_DMA_COOKIE(dr, slot));
1064	if (error)
1065		goto fail;
1066	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1069	if (error) {
1070		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071		    __func__, error);
1072		goto fail;
1073	}
1074	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075	    BUS_DMASYNC_PREWRITE);
1076	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078	    BUS_DMASYNC_PREWRITE);
1079
1080	slot = bwn_dma_getslot(dr);
1081	dr->getdesc(dr, slot, &desc, &mt);
1082	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084	mt->mt_m = m;
1085	mt->mt_ni = ni;
1086
1087	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089	if (error && error != EFBIG) {
1090		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091		    __func__, error);
1092		goto fail;
1093	}
1094	if (error) {    /* error == EFBIG */
1095		struct mbuf *m_new;
1096
1097		m_new = m_defrag(m, M_NOWAIT);
1098		if (m_new == NULL) {
1099			device_printf(sc->sc_dev,
1100			    "%s: can't defrag TX buffer\n",
1101			    __func__);
1102			error = ENOBUFS;
1103			goto fail;
1104		} else {
1105			m = m_new;
1106		}
1107
1108		mt->mt_m = m;
1109		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111		if (error) {
1112			device_printf(sc->sc_dev,
1113			    "%s: can't load TX buffer (2) %d\n",
1114			    __func__, error);
1115			goto fail;
1116		}
1117	}
1118	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121	    BUS_DMASYNC_PREWRITE);
1122
1123	/* XXX send after DTIM */
1124
1125	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126	return (0);
1127fail:
1128	dr->dr_curslot = backup[0];
1129	dr->dr_usedslot = backup[1];
1130	return (error);
1131#undef BWN_GET_TXHDRCACHE
1132}
1133
1134static void
1135bwn_watchdog(void *arg)
1136{
1137	struct bwn_softc *sc = arg;
1138
1139	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140		device_printf(sc->sc_dev, "device timeout\n");
1141		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142	}
1143	callout_schedule(&sc->sc_watchdog_ch, hz);
1144}
1145
1146static int
1147bwn_attach_core(struct bwn_mac *mac)
1148{
1149	struct bwn_softc *sc = mac->mac_sc;
1150	int error, have_bg = 0, have_a = 0;
1151	uint32_t high;
1152
1153	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155
1156	siba_powerup(sc->sc_dev, 0);
1157
1158	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1159
1160	/*
1161	 * Guess at whether it has A-PHY or G-PHY.
1162	 * This is just used for resetting the core to probe things;
1163	 * we will re-guess once it's all up and working.
1164	 *
1165	 * XXX TODO: there's the TGSHIGH DUALPHY flag based on
1166	 * the PHY revision.
1167	 */
1168	bwn_reset_core(mac, !!(high & BWN_TGSHIGH_HAVE_2GHZ));
1169
1170	/*
1171	 * Get the PHY version.
1172	 */
1173	error = bwn_phy_getinfo(mac, high);
1174	if (error)
1175		goto fail;
1176
1177	/* XXX TODO need bhnd */
1178	if (bwn_is_bus_siba(mac)) {
1179		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1180		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1181		if (high & BWN_TGSHIGH_DUALPHY) {
1182			have_bg = 1;
1183			have_a = 1;
1184		}
1185	} else {
1186		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1187		error = ENXIO;
1188		goto fail;
1189	}
1190
1191#if 0
1192	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1193	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1194	    __func__,
1195	    high,
1196	    have_a,
1197	    have_bg,
1198	    siba_get_pci_device(sc->sc_dev),
1199	    siba_get_chipid(sc->sc_dev));
1200#endif
1201
1202	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1203	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207		have_a = have_bg = 0;
1208		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209			have_a = 1;
1210		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1212		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1213			have_bg = 1;
1214		else
1215			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216			    mac->mac_phy.type));
1217	}
1218
1219	/*
1220	 * XXX The PHY-G support doesn't do 5GHz operation.
1221	 */
1222	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1224		device_printf(sc->sc_dev,
1225		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226		    __func__);
1227		have_a = 0;
1228		have_bg = 1;
1229	}
1230
1231	mac->mac_phy.phy_n = NULL;
1232
1233	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234		mac->mac_phy.attach = bwn_phy_g_attach;
1235		mac->mac_phy.detach = bwn_phy_g_detach;
1236		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238		mac->mac_phy.init = bwn_phy_g_init;
1239		mac->mac_phy.exit = bwn_phy_g_exit;
1240		mac->mac_phy.phy_read = bwn_phy_g_read;
1241		mac->mac_phy.phy_write = bwn_phy_g_write;
1242		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250		mac->mac_phy.set_im = bwn_phy_g_im;
1251		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257		mac->mac_phy.init = bwn_phy_lp_init;
1258		mac->mac_phy.phy_read = bwn_phy_lp_read;
1259		mac->mac_phy.phy_write = bwn_phy_lp_write;
1260		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270		mac->mac_phy.attach = bwn_phy_n_attach;
1271		mac->mac_phy.detach = bwn_phy_n_detach;
1272		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274		mac->mac_phy.init = bwn_phy_n_init;
1275		mac->mac_phy.exit = bwn_phy_n_exit;
1276		mac->mac_phy.phy_read = bwn_phy_n_read;
1277		mac->mac_phy.phy_write = bwn_phy_n_write;
1278		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286		mac->mac_phy.set_im = bwn_phy_n_im;
1287		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291	} else {
1292		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293		    mac->mac_phy.type);
1294		error = ENXIO;
1295		goto fail;
1296	}
1297
1298	mac->mac_phy.gmode = have_bg;
1299	if (mac->mac_phy.attach != NULL) {
1300		error = mac->mac_phy.attach(mac);
1301		if (error) {
1302			device_printf(sc->sc_dev, "failed\n");
1303			goto fail;
1304		}
1305	}
1306
1307	bwn_reset_core(mac, have_bg);
1308
1309	error = bwn_chiptest(mac);
1310	if (error)
1311		goto fail;
1312	error = bwn_setup_channels(mac, have_bg, have_a);
1313	if (error) {
1314		device_printf(sc->sc_dev, "failed to setup channels\n");
1315		goto fail;
1316	}
1317
1318	if (sc->sc_curmac == NULL)
1319		sc->sc_curmac = mac;
1320
1321	error = bwn_dma_attach(mac);
1322	if (error != 0) {
1323		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324		goto fail;
1325	}
1326
1327	mac->mac_phy.switch_analog(mac, 0);
1328
1329	siba_dev_down(sc->sc_dev, 0);
1330fail:
1331	siba_powerdown(sc->sc_dev);
1332	return (error);
1333}
1334
1335/*
1336 * Reset - SIBA.
1337 *
1338 * XXX TODO: implement BCMA version!
1339 */
1340void
1341bwn_reset_core(struct bwn_mac *mac, int g_mode)
1342{
1343	struct bwn_softc *sc = mac->mac_sc;
1344	uint32_t low, ctl;
1345	uint32_t flags = 0;
1346
1347	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1348
1349	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1350	if (g_mode)
1351		flags |= BWN_TGSLOW_SUPPORT_G;
1352
1353	/* XXX N-PHY only; and hard-code to 20MHz for now */
1354	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1355		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1356
1357	siba_dev_up(sc->sc_dev, flags);
1358	DELAY(2000);
1359
1360	/* Take PHY out of reset */
1361	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1362	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1363	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1364	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1365	DELAY(2000);
1366	low &= ~SIBA_TGSLOW_FGC;
1367	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1368	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1369	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1370	DELAY(2000);
1371
1372	if (mac->mac_phy.switch_analog != NULL)
1373		mac->mac_phy.switch_analog(mac, 1);
1374
1375	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1376	if (g_mode)
1377		ctl |= BWN_MACCTL_GMODE;
1378	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1379}
1380
1381static int
1382bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1383{
1384	struct bwn_phy *phy = &mac->mac_phy;
1385	struct bwn_softc *sc = mac->mac_sc;
1386	uint32_t tmp;
1387
1388	/* PHY */
1389	tmp = BWN_READ_2(mac, BWN_PHYVER);
1390	phy->gmode = !! (tgshigh & BWN_TGSHIGH_HAVE_2GHZ);
1391	phy->rf_on = 1;
1392	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1393	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1394	phy->rev = (tmp & BWN_PHYVER_VERSION);
1395	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1396	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1397		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1398	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1399	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1400	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1401		goto unsupphy;
1402
1403	/* RADIO */
1404	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1405		if (siba_get_chiprev(sc->sc_dev) == 0)
1406			tmp = 0x3205017f;
1407		else if (siba_get_chiprev(sc->sc_dev) == 1)
1408			tmp = 0x4205017f;
1409		else
1410			tmp = 0x5205017f;
1411	} else {
1412		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1413		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1414		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1415		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1416	}
1417	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1418	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1419	phy->rf_manuf = (tmp & 0x00000fff);
1420
1421	/*
1422	 * For now, just always do full init (ie, what bwn has traditionally
1423	 * done)
1424	 */
1425	phy->phy_do_full_init = 1;
1426
1427	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1428		goto unsupradio;
1429	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1430	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1431	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1432	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1433	    (phy->type == BWN_PHYTYPE_N &&
1434	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1435	    (phy->type == BWN_PHYTYPE_LP &&
1436	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1437		goto unsupradio;
1438
1439	return (0);
1440unsupphy:
1441	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1442	    "analog %#x)\n",
1443	    phy->type, phy->rev, phy->analog);
1444	return (ENXIO);
1445unsupradio:
1446	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1447	    "rev %#x)\n",
1448	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1449	return (ENXIO);
1450}
1451
1452static int
1453bwn_chiptest(struct bwn_mac *mac)
1454{
1455#define	TESTVAL0	0x55aaaa55
1456#define	TESTVAL1	0xaa5555aa
1457	struct bwn_softc *sc = mac->mac_sc;
1458	uint32_t v, backup;
1459
1460	BWN_LOCK(sc);
1461
1462	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1463
1464	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1465	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1466		goto error;
1467	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1468	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1469		goto error;
1470
1471	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1472
1473	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1474	    (siba_get_revid(sc->sc_dev) <= 10)) {
1475		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1476		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1477		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1478			goto error;
1479		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1480			goto error;
1481	}
1482	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1483
1484	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1485	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1486		goto error;
1487
1488	BWN_UNLOCK(sc);
1489	return (0);
1490error:
1491	BWN_UNLOCK(sc);
1492	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1493	return (ENODEV);
1494}
1495
1496static int
1497bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1498{
1499	struct bwn_softc *sc = mac->mac_sc;
1500	struct ieee80211com *ic = &sc->sc_ic;
1501	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
1502
1503	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1504	ic->ic_nchans = 0;
1505
1506	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1507	    __func__,
1508	    have_bg,
1509	    have_a);
1510
1511	if (have_bg) {
1512		memset(bands, 0, sizeof(bands));
1513		setbit(bands, IEEE80211_MODE_11B);
1514		setbit(bands, IEEE80211_MODE_11G);
1515		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1516		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1517	}
1518
1519	if (have_a) {
1520		memset(bands, 0, sizeof(bands));
1521		setbit(bands, IEEE80211_MODE_11A);
1522		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1523		    &ic->ic_nchans, &bwn_chantable_a, bands);
1524	}
1525
1526	mac->mac_phy.supports_2ghz = have_bg;
1527	mac->mac_phy.supports_5ghz = have_a;
1528
1529	return (ic->ic_nchans == 0 ? ENXIO : 0);
1530}
1531
1532uint32_t
1533bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1534{
1535	uint32_t ret;
1536
1537	BWN_ASSERT_LOCKED(mac->mac_sc);
1538
1539	if (way == BWN_SHARED) {
1540		KASSERT((offset & 0x0001) == 0,
1541		    ("%s:%d warn", __func__, __LINE__));
1542		if (offset & 0x0003) {
1543			bwn_shm_ctlword(mac, way, offset >> 2);
1544			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1545			ret <<= 16;
1546			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1547			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1548			goto out;
1549		}
1550		offset >>= 2;
1551	}
1552	bwn_shm_ctlword(mac, way, offset);
1553	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1554out:
1555	return (ret);
1556}
1557
1558uint16_t
1559bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1560{
1561	uint16_t ret;
1562
1563	BWN_ASSERT_LOCKED(mac->mac_sc);
1564
1565	if (way == BWN_SHARED) {
1566		KASSERT((offset & 0x0001) == 0,
1567		    ("%s:%d warn", __func__, __LINE__));
1568		if (offset & 0x0003) {
1569			bwn_shm_ctlword(mac, way, offset >> 2);
1570			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1571			goto out;
1572		}
1573		offset >>= 2;
1574	}
1575	bwn_shm_ctlword(mac, way, offset);
1576	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1577out:
1578
1579	return (ret);
1580}
1581
1582static void
1583bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1584    uint16_t offset)
1585{
1586	uint32_t control;
1587
1588	control = way;
1589	control <<= 16;
1590	control |= offset;
1591	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1592}
1593
1594void
1595bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1596    uint32_t value)
1597{
1598	BWN_ASSERT_LOCKED(mac->mac_sc);
1599
1600	if (way == BWN_SHARED) {
1601		KASSERT((offset & 0x0001) == 0,
1602		    ("%s:%d warn", __func__, __LINE__));
1603		if (offset & 0x0003) {
1604			bwn_shm_ctlword(mac, way, offset >> 2);
1605			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1606				    (value >> 16) & 0xffff);
1607			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1608			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1609			return;
1610		}
1611		offset >>= 2;
1612	}
1613	bwn_shm_ctlword(mac, way, offset);
1614	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1615}
1616
1617void
1618bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1619    uint16_t value)
1620{
1621	BWN_ASSERT_LOCKED(mac->mac_sc);
1622
1623	if (way == BWN_SHARED) {
1624		KASSERT((offset & 0x0001) == 0,
1625		    ("%s:%d warn", __func__, __LINE__));
1626		if (offset & 0x0003) {
1627			bwn_shm_ctlword(mac, way, offset >> 2);
1628			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1629			return;
1630		}
1631		offset >>= 2;
1632	}
1633	bwn_shm_ctlword(mac, way, offset);
1634	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1635}
1636
1637static void
1638bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1639    const struct bwn_channelinfo *ci, const uint8_t bands[])
1640{
1641	int i, error;
1642
1643	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1644		const struct bwn_channel *hc = &ci->channels[i];
1645
1646		error = ieee80211_add_channel(chans, maxchans, nchans,
1647		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1648	}
1649}
1650
1651static int
1652bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1653	const struct ieee80211_bpf_params *params)
1654{
1655	struct ieee80211com *ic = ni->ni_ic;
1656	struct bwn_softc *sc = ic->ic_softc;
1657	struct bwn_mac *mac = sc->sc_curmac;
1658	int error;
1659
1660	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1661	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1662		m_freem(m);
1663		return (ENETDOWN);
1664	}
1665
1666	BWN_LOCK(sc);
1667	if (bwn_tx_isfull(sc, m)) {
1668		m_freem(m);
1669		BWN_UNLOCK(sc);
1670		return (ENOBUFS);
1671	}
1672
1673	error = bwn_tx_start(sc, ni, m);
1674	if (error == 0)
1675		sc->sc_watchdog_timer = 5;
1676	BWN_UNLOCK(sc);
1677	return (error);
1678}
1679
1680/*
1681 * Callback from the 802.11 layer to update the slot time
1682 * based on the current setting.  We use it to notify the
1683 * firmware of ERP changes and the f/w takes care of things
1684 * like slot time and preamble.
1685 */
1686static void
1687bwn_updateslot(struct ieee80211com *ic)
1688{
1689	struct bwn_softc *sc = ic->ic_softc;
1690	struct bwn_mac *mac;
1691
1692	BWN_LOCK(sc);
1693	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1694		mac = (struct bwn_mac *)sc->sc_curmac;
1695		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1696	}
1697	BWN_UNLOCK(sc);
1698}
1699
1700/*
1701 * Callback from the 802.11 layer after a promiscuous mode change.
1702 * Note this interface does not check the operating mode as this
1703 * is an internal callback and we are expected to honor the current
1704 * state (e.g. this is used for setting the interface in promiscuous
1705 * mode when operating in hostap mode to do ACS).
1706 */
1707static void
1708bwn_update_promisc(struct ieee80211com *ic)
1709{
1710	struct bwn_softc *sc = ic->ic_softc;
1711	struct bwn_mac *mac = sc->sc_curmac;
1712
1713	BWN_LOCK(sc);
1714	mac = sc->sc_curmac;
1715	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1716		if (ic->ic_promisc > 0)
1717			sc->sc_filters |= BWN_MACCTL_PROMISC;
1718		else
1719			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1720		bwn_set_opmode(mac);
1721	}
1722	BWN_UNLOCK(sc);
1723}
1724
1725/*
1726 * Callback from the 802.11 layer to update WME parameters.
1727 */
1728static int
1729bwn_wme_update(struct ieee80211com *ic)
1730{
1731	struct bwn_softc *sc = ic->ic_softc;
1732	struct bwn_mac *mac = sc->sc_curmac;
1733	struct wmeParams *wmep;
1734	int i;
1735
1736	BWN_LOCK(sc);
1737	mac = sc->sc_curmac;
1738	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1739		bwn_mac_suspend(mac);
1740		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1741			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1742			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1743		}
1744		bwn_mac_enable(mac);
1745	}
1746	BWN_UNLOCK(sc);
1747	return (0);
1748}
1749
1750static void
1751bwn_scan_start(struct ieee80211com *ic)
1752{
1753	struct bwn_softc *sc = ic->ic_softc;
1754	struct bwn_mac *mac;
1755
1756	BWN_LOCK(sc);
1757	mac = sc->sc_curmac;
1758	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1759		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1760		bwn_set_opmode(mac);
1761		/* disable CFP update during scan */
1762		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1763	}
1764	BWN_UNLOCK(sc);
1765}
1766
1767static void
1768bwn_scan_end(struct ieee80211com *ic)
1769{
1770	struct bwn_softc *sc = ic->ic_softc;
1771	struct bwn_mac *mac;
1772
1773	BWN_LOCK(sc);
1774	mac = sc->sc_curmac;
1775	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1776		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1777		bwn_set_opmode(mac);
1778		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1779	}
1780	BWN_UNLOCK(sc);
1781}
1782
1783static void
1784bwn_set_channel(struct ieee80211com *ic)
1785{
1786	struct bwn_softc *sc = ic->ic_softc;
1787	struct bwn_mac *mac = sc->sc_curmac;
1788	struct bwn_phy *phy = &mac->mac_phy;
1789	int chan, error;
1790
1791	BWN_LOCK(sc);
1792
1793	error = bwn_switch_band(sc, ic->ic_curchan);
1794	if (error)
1795		goto fail;
1796	bwn_mac_suspend(mac);
1797	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1798	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1799	if (chan != phy->chan)
1800		bwn_switch_channel(mac, chan);
1801
1802	/* TX power level */
1803	if (ic->ic_curchan->ic_maxpower != 0 &&
1804	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1805		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1806		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1807		    BWN_TXPWR_IGNORE_TSSI);
1808	}
1809
1810	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1811	if (phy->set_antenna)
1812		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1813
1814	if (sc->sc_rf_enabled != phy->rf_on) {
1815		if (sc->sc_rf_enabled) {
1816			bwn_rf_turnon(mac);
1817			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1818				device_printf(sc->sc_dev,
1819				    "please turn on the RF switch\n");
1820		} else
1821			bwn_rf_turnoff(mac);
1822	}
1823
1824	bwn_mac_enable(mac);
1825
1826fail:
1827	/*
1828	 * Setup radio tap channel freq and flags
1829	 */
1830	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1831		htole16(ic->ic_curchan->ic_freq);
1832	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1833		htole16(ic->ic_curchan->ic_flags & 0xffff);
1834
1835	BWN_UNLOCK(sc);
1836}
1837
1838static struct ieee80211vap *
1839bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1840    enum ieee80211_opmode opmode, int flags,
1841    const uint8_t bssid[IEEE80211_ADDR_LEN],
1842    const uint8_t mac[IEEE80211_ADDR_LEN])
1843{
1844	struct ieee80211vap *vap;
1845	struct bwn_vap *bvp;
1846
1847	switch (opmode) {
1848	case IEEE80211_M_HOSTAP:
1849	case IEEE80211_M_MBSS:
1850	case IEEE80211_M_STA:
1851	case IEEE80211_M_WDS:
1852	case IEEE80211_M_MONITOR:
1853	case IEEE80211_M_IBSS:
1854	case IEEE80211_M_AHDEMO:
1855		break;
1856	default:
1857		return (NULL);
1858	}
1859
1860	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1861	vap = &bvp->bv_vap;
1862	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1863	/* override with driver methods */
1864	bvp->bv_newstate = vap->iv_newstate;
1865	vap->iv_newstate = bwn_newstate;
1866
1867	/* override max aid so sta's cannot assoc when we're out of sta id's */
1868	vap->iv_max_aid = BWN_STAID_MAX;
1869
1870	ieee80211_ratectl_init(vap);
1871
1872	/* complete setup */
1873	ieee80211_vap_attach(vap, ieee80211_media_change,
1874	    ieee80211_media_status, mac);
1875	return (vap);
1876}
1877
1878static void
1879bwn_vap_delete(struct ieee80211vap *vap)
1880{
1881	struct bwn_vap *bvp = BWN_VAP(vap);
1882
1883	ieee80211_ratectl_deinit(vap);
1884	ieee80211_vap_detach(vap);
1885	free(bvp, M_80211_VAP);
1886}
1887
1888static int
1889bwn_init(struct bwn_softc *sc)
1890{
1891	struct bwn_mac *mac;
1892	int error;
1893
1894	BWN_ASSERT_LOCKED(sc);
1895
1896	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1897
1898	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1899	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1900	sc->sc_filters = 0;
1901	bwn_wme_clear(sc);
1902	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1903	sc->sc_rf_enabled = 1;
1904
1905	mac = sc->sc_curmac;
1906	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1907		error = bwn_core_init(mac);
1908		if (error != 0)
1909			return (error);
1910	}
1911	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1912		bwn_core_start(mac);
1913
1914	bwn_set_opmode(mac);
1915	bwn_set_pretbtt(mac);
1916	bwn_spu_setdelay(mac, 0);
1917	bwn_set_macaddr(mac);
1918
1919	sc->sc_flags |= BWN_FLAG_RUNNING;
1920	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1921	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1922
1923	return (0);
1924}
1925
1926static void
1927bwn_stop(struct bwn_softc *sc)
1928{
1929	struct bwn_mac *mac = sc->sc_curmac;
1930
1931	BWN_ASSERT_LOCKED(sc);
1932
1933	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1934
1935	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936		/* XXX FIXME opmode not based on VAP */
1937		bwn_set_opmode(mac);
1938		bwn_set_macaddr(mac);
1939	}
1940
1941	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1942		bwn_core_stop(mac);
1943
1944	callout_stop(&sc->sc_led_blink_ch);
1945	sc->sc_led_blinking = 0;
1946
1947	bwn_core_exit(mac);
1948	sc->sc_rf_enabled = 0;
1949
1950	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1951}
1952
1953static void
1954bwn_wme_clear(struct bwn_softc *sc)
1955{
1956#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1957	struct wmeParams *p;
1958	unsigned int i;
1959
1960	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1961	    ("%s:%d: fail", __func__, __LINE__));
1962
1963	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1964		p = &(sc->sc_wmeParams[i]);
1965
1966		switch (bwn_wme_shm_offsets[i]) {
1967		case BWN_WME_VOICE:
1968			p->wmep_txopLimit = 0;
1969			p->wmep_aifsn = 2;
1970			/* XXX FIXME: log2(cwmin) */
1971			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1972			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1973			break;
1974		case BWN_WME_VIDEO:
1975			p->wmep_txopLimit = 0;
1976			p->wmep_aifsn = 2;
1977			/* XXX FIXME: log2(cwmin) */
1978			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1979			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1980			break;
1981		case BWN_WME_BESTEFFORT:
1982			p->wmep_txopLimit = 0;
1983			p->wmep_aifsn = 3;
1984			/* XXX FIXME: log2(cwmin) */
1985			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1986			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1987			break;
1988		case BWN_WME_BACKGROUND:
1989			p->wmep_txopLimit = 0;
1990			p->wmep_aifsn = 7;
1991			/* XXX FIXME: log2(cwmin) */
1992			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1993			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1994			break;
1995		default:
1996			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1997		}
1998	}
1999}
2000
2001static int
2002bwn_core_init(struct bwn_mac *mac)
2003{
2004	struct bwn_softc *sc = mac->mac_sc;
2005	uint64_t hf;
2006	int error;
2007
2008	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2009	    ("%s:%d: fail", __func__, __LINE__));
2010
2011	siba_powerup(sc->sc_dev, 0);
2012	if (!siba_dev_isup(sc->sc_dev))
2013		bwn_reset_core(mac, mac->mac_phy.gmode);
2014
2015	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2016	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2017	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2018	BWN_GETTIME(mac->mac_phy.nexttime);
2019	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2020	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2021	mac->mac_stats.link_noise = -95;
2022	mac->mac_reason_intr = 0;
2023	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2024	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2025#ifdef BWN_DEBUG
2026	if (sc->sc_debug & BWN_DEBUG_XMIT)
2027		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2028#endif
2029	mac->mac_suspended = 1;
2030	mac->mac_task_state = 0;
2031	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2032
2033	mac->mac_phy.init_pre(mac);
2034
2035	siba_pcicore_intr(sc->sc_dev);
2036
2037	siba_fix_imcfglobug(sc->sc_dev);
2038	bwn_bt_disable(mac);
2039	if (mac->mac_phy.prepare_hw) {
2040		error = mac->mac_phy.prepare_hw(mac);
2041		if (error)
2042			goto fail0;
2043	}
2044	error = bwn_chip_init(mac);
2045	if (error)
2046		goto fail0;
2047	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2048	    siba_get_revid(sc->sc_dev));
2049	hf = bwn_hf_read(mac);
2050	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2051		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2052		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2053			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2054		if (mac->mac_phy.rev == 1)
2055			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2056	}
2057	if (mac->mac_phy.rf_ver == 0x2050) {
2058		if (mac->mac_phy.rf_rev < 6)
2059			hf |= BWN_HF_FORCE_VCO_RECALC;
2060		if (mac->mac_phy.rf_rev == 6)
2061			hf |= BWN_HF_4318_TSSI;
2062	}
2063	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2064		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2065	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2066	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2067		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2068	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2069	bwn_hf_write(mac, hf);
2070
2071	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2072	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2073	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2074	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2075
2076	bwn_rate_init(mac);
2077	bwn_set_phytxctl(mac);
2078
2079	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2080	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2081	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2082
2083	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2084		bwn_pio_init(mac);
2085	else
2086		bwn_dma_init(mac);
2087	bwn_wme_init(mac);
2088	bwn_spu_setdelay(mac, 1);
2089	bwn_bt_enable(mac);
2090
2091	siba_powerup(sc->sc_dev,
2092	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2093	bwn_set_macaddr(mac);
2094	bwn_crypt_init(mac);
2095
2096	/* XXX LED initializatin */
2097
2098	mac->mac_status = BWN_MAC_STATUS_INITED;
2099
2100	return (error);
2101
2102fail0:
2103	siba_powerdown(sc->sc_dev);
2104	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2105	    ("%s:%d: fail", __func__, __LINE__));
2106	return (error);
2107}
2108
2109static void
2110bwn_core_start(struct bwn_mac *mac)
2111{
2112	struct bwn_softc *sc = mac->mac_sc;
2113	uint32_t tmp;
2114
2115	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2116	    ("%s:%d: fail", __func__, __LINE__));
2117
2118	if (siba_get_revid(sc->sc_dev) < 5)
2119		return;
2120
2121	while (1) {
2122		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2123		if (!(tmp & 0x00000001))
2124			break;
2125		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2126	}
2127
2128	bwn_mac_enable(mac);
2129	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2130	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2131
2132	mac->mac_status = BWN_MAC_STATUS_STARTED;
2133}
2134
2135static void
2136bwn_core_exit(struct bwn_mac *mac)
2137{
2138	struct bwn_softc *sc = mac->mac_sc;
2139	uint32_t macctl;
2140
2141	BWN_ASSERT_LOCKED(mac->mac_sc);
2142
2143	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2144	    ("%s:%d: fail", __func__, __LINE__));
2145
2146	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2147		return;
2148	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2149
2150	macctl = BWN_READ_4(mac, BWN_MACCTL);
2151	macctl &= ~BWN_MACCTL_MCODE_RUN;
2152	macctl |= BWN_MACCTL_MCODE_JMP0;
2153	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2154
2155	bwn_dma_stop(mac);
2156	bwn_pio_stop(mac);
2157	bwn_chip_exit(mac);
2158	mac->mac_phy.switch_analog(mac, 0);
2159	siba_dev_down(sc->sc_dev, 0);
2160	siba_powerdown(sc->sc_dev);
2161}
2162
2163static void
2164bwn_bt_disable(struct bwn_mac *mac)
2165{
2166	struct bwn_softc *sc = mac->mac_sc;
2167
2168	(void)sc;
2169	/* XXX do nothing yet */
2170}
2171
2172static int
2173bwn_chip_init(struct bwn_mac *mac)
2174{
2175	struct bwn_softc *sc = mac->mac_sc;
2176	struct bwn_phy *phy = &mac->mac_phy;
2177	uint32_t macctl;
2178	int error;
2179
2180	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2181	if (phy->gmode)
2182		macctl |= BWN_MACCTL_GMODE;
2183	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2184
2185	error = bwn_fw_fillinfo(mac);
2186	if (error)
2187		return (error);
2188	error = bwn_fw_loaducode(mac);
2189	if (error)
2190		return (error);
2191
2192	error = bwn_gpio_init(mac);
2193	if (error)
2194		return (error);
2195
2196	error = bwn_fw_loadinitvals(mac);
2197	if (error) {
2198		siba_gpio_set(sc->sc_dev, 0);
2199		return (error);
2200	}
2201	phy->switch_analog(mac, 1);
2202	error = bwn_phy_init(mac);
2203	if (error) {
2204		siba_gpio_set(sc->sc_dev, 0);
2205		return (error);
2206	}
2207	if (phy->set_im)
2208		phy->set_im(mac, BWN_IMMODE_NONE);
2209	if (phy->set_antenna)
2210		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2211	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2212
2213	if (phy->type == BWN_PHYTYPE_B)
2214		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2215	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2216	if (siba_get_revid(sc->sc_dev) < 5)
2217		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2218
2219	BWN_WRITE_4(mac, BWN_MACCTL,
2220	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2221	BWN_WRITE_4(mac, BWN_MACCTL,
2222	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2223	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2224
2225	bwn_set_opmode(mac);
2226	if (siba_get_revid(sc->sc_dev) < 3) {
2227		BWN_WRITE_2(mac, 0x060e, 0x0000);
2228		BWN_WRITE_2(mac, 0x0610, 0x8000);
2229		BWN_WRITE_2(mac, 0x0604, 0x0000);
2230		BWN_WRITE_2(mac, 0x0606, 0x0200);
2231	} else {
2232		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2233		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2234	}
2235	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2236	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2237	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2238	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2239	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2240	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2241	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2242
2243	bwn_mac_phy_clock_set(mac, true);
2244
2245	/* SIBA powerup */
2246	/* XXX TODO: BCMA powerup */
2247	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2248	return (error);
2249}
2250
2251/* read hostflags */
2252uint64_t
2253bwn_hf_read(struct bwn_mac *mac)
2254{
2255	uint64_t ret;
2256
2257	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2258	ret <<= 16;
2259	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2260	ret <<= 16;
2261	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2262	return (ret);
2263}
2264
2265void
2266bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2267{
2268
2269	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2270	    (value & 0x00000000ffffull));
2271	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2272	    (value & 0x0000ffff0000ull) >> 16);
2273	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2274	    (value & 0xffff00000000ULL) >> 32);
2275}
2276
2277static void
2278bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2279{
2280
2281	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2282	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2283}
2284
2285static void
2286bwn_rate_init(struct bwn_mac *mac)
2287{
2288
2289	switch (mac->mac_phy.type) {
2290	case BWN_PHYTYPE_A:
2291	case BWN_PHYTYPE_G:
2292	case BWN_PHYTYPE_LP:
2293	case BWN_PHYTYPE_N:
2294		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2295		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2296		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2297		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2298		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2299		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2300		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2301		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2302			break;
2303		/* FALLTHROUGH */
2304	case BWN_PHYTYPE_B:
2305		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2306		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2307		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2308		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2309		break;
2310	default:
2311		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2312	}
2313}
2314
2315static void
2316bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2317{
2318	uint16_t offset;
2319
2320	if (ofdm) {
2321		offset = 0x480;
2322		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2323	} else {
2324		offset = 0x4c0;
2325		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2326	}
2327	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2328	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2329}
2330
2331static uint8_t
2332bwn_plcp_getcck(const uint8_t bitrate)
2333{
2334
2335	switch (bitrate) {
2336	case BWN_CCK_RATE_1MB:
2337		return (0x0a);
2338	case BWN_CCK_RATE_2MB:
2339		return (0x14);
2340	case BWN_CCK_RATE_5MB:
2341		return (0x37);
2342	case BWN_CCK_RATE_11MB:
2343		return (0x6e);
2344	}
2345	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2346	return (0);
2347}
2348
2349static uint8_t
2350bwn_plcp_getofdm(const uint8_t bitrate)
2351{
2352
2353	switch (bitrate) {
2354	case BWN_OFDM_RATE_6MB:
2355		return (0xb);
2356	case BWN_OFDM_RATE_9MB:
2357		return (0xf);
2358	case BWN_OFDM_RATE_12MB:
2359		return (0xa);
2360	case BWN_OFDM_RATE_18MB:
2361		return (0xe);
2362	case BWN_OFDM_RATE_24MB:
2363		return (0x9);
2364	case BWN_OFDM_RATE_36MB:
2365		return (0xd);
2366	case BWN_OFDM_RATE_48MB:
2367		return (0x8);
2368	case BWN_OFDM_RATE_54MB:
2369		return (0xc);
2370	}
2371	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2372	return (0);
2373}
2374
2375static void
2376bwn_set_phytxctl(struct bwn_mac *mac)
2377{
2378	uint16_t ctl;
2379
2380	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2381	    BWN_TX_PHY_TXPWR);
2382	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2383	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2384	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2385}
2386
2387static void
2388bwn_pio_init(struct bwn_mac *mac)
2389{
2390	struct bwn_pio *pio = &mac->mac_method.pio;
2391
2392	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2393	    & ~BWN_MACCTL_BIGENDIAN);
2394	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2395
2396	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2397	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2398	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2399	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2400	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2401	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2402}
2403
2404static void
2405bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2406    int index)
2407{
2408	struct bwn_pio_txpkt *tp;
2409	struct bwn_softc *sc = mac->mac_sc;
2410	unsigned int i;
2411
2412	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2413	tq->tq_index = index;
2414
2415	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2416	if (siba_get_revid(sc->sc_dev) >= 8)
2417		tq->tq_size = 1920;
2418	else {
2419		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2420		tq->tq_size -= 80;
2421	}
2422
2423	TAILQ_INIT(&tq->tq_pktlist);
2424	for (i = 0; i < N(tq->tq_pkts); i++) {
2425		tp = &(tq->tq_pkts[i]);
2426		tp->tp_index = i;
2427		tp->tp_queue = tq;
2428		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2429	}
2430}
2431
2432static uint16_t
2433bwn_pio_idx2base(struct bwn_mac *mac, int index)
2434{
2435	struct bwn_softc *sc = mac->mac_sc;
2436	static const uint16_t bases[] = {
2437		BWN_PIO_BASE0,
2438		BWN_PIO_BASE1,
2439		BWN_PIO_BASE2,
2440		BWN_PIO_BASE3,
2441		BWN_PIO_BASE4,
2442		BWN_PIO_BASE5,
2443		BWN_PIO_BASE6,
2444		BWN_PIO_BASE7,
2445	};
2446	static const uint16_t bases_rev11[] = {
2447		BWN_PIO11_BASE0,
2448		BWN_PIO11_BASE1,
2449		BWN_PIO11_BASE2,
2450		BWN_PIO11_BASE3,
2451		BWN_PIO11_BASE4,
2452		BWN_PIO11_BASE5,
2453	};
2454
2455	if (siba_get_revid(sc->sc_dev) >= 11) {
2456		if (index >= N(bases_rev11))
2457			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2458		return (bases_rev11[index]);
2459	}
2460	if (index >= N(bases))
2461		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2462	return (bases[index]);
2463}
2464
2465static void
2466bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2467    int index)
2468{
2469	struct bwn_softc *sc = mac->mac_sc;
2470
2471	prq->prq_mac = mac;
2472	prq->prq_rev = siba_get_revid(sc->sc_dev);
2473	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2474	bwn_dma_rxdirectfifo(mac, index, 1);
2475}
2476
2477static void
2478bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2479{
2480	if (tq == NULL)
2481		return;
2482	bwn_pio_cancel_tx_packets(tq);
2483}
2484
2485static void
2486bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2487{
2488
2489	bwn_destroy_pioqueue_tx(pio);
2490}
2491
2492static uint16_t
2493bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2494    uint16_t offset)
2495{
2496
2497	return (BWN_READ_2(mac, tq->tq_base + offset));
2498}
2499
2500static void
2501bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2502{
2503	uint32_t ctl;
2504	int type;
2505	uint16_t base;
2506
2507	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2508	base = bwn_dma_base(type, idx);
2509	if (type == BWN_DMA_64BIT) {
2510		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2511		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2512		if (enable)
2513			ctl |= BWN_DMA64_RXDIRECTFIFO;
2514		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2515	} else {
2516		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2517		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2518		if (enable)
2519			ctl |= BWN_DMA32_RXDIRECTFIFO;
2520		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2521	}
2522}
2523
2524static uint64_t
2525bwn_dma_mask(struct bwn_mac *mac)
2526{
2527	uint32_t tmp;
2528	uint16_t base;
2529
2530	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2531	if (tmp & SIBA_TGSHIGH_DMA64)
2532		return (BWN_DMA_BIT_MASK(64));
2533	base = bwn_dma_base(0, 0);
2534	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2535	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2536	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2537		return (BWN_DMA_BIT_MASK(32));
2538
2539	return (BWN_DMA_BIT_MASK(30));
2540}
2541
2542static int
2543bwn_dma_mask2type(uint64_t dmamask)
2544{
2545
2546	if (dmamask == BWN_DMA_BIT_MASK(30))
2547		return (BWN_DMA_30BIT);
2548	if (dmamask == BWN_DMA_BIT_MASK(32))
2549		return (BWN_DMA_32BIT);
2550	if (dmamask == BWN_DMA_BIT_MASK(64))
2551		return (BWN_DMA_64BIT);
2552	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2553	return (BWN_DMA_30BIT);
2554}
2555
2556static void
2557bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2558{
2559	struct bwn_pio_txpkt *tp;
2560	unsigned int i;
2561
2562	for (i = 0; i < N(tq->tq_pkts); i++) {
2563		tp = &(tq->tq_pkts[i]);
2564		if (tp->tp_m) {
2565			m_freem(tp->tp_m);
2566			tp->tp_m = NULL;
2567		}
2568	}
2569}
2570
2571static uint16_t
2572bwn_dma_base(int type, int controller_idx)
2573{
2574	static const uint16_t map64[] = {
2575		BWN_DMA64_BASE0,
2576		BWN_DMA64_BASE1,
2577		BWN_DMA64_BASE2,
2578		BWN_DMA64_BASE3,
2579		BWN_DMA64_BASE4,
2580		BWN_DMA64_BASE5,
2581	};
2582	static const uint16_t map32[] = {
2583		BWN_DMA32_BASE0,
2584		BWN_DMA32_BASE1,
2585		BWN_DMA32_BASE2,
2586		BWN_DMA32_BASE3,
2587		BWN_DMA32_BASE4,
2588		BWN_DMA32_BASE5,
2589	};
2590
2591	if (type == BWN_DMA_64BIT) {
2592		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2593		    ("%s:%d: fail", __func__, __LINE__));
2594		return (map64[controller_idx]);
2595	}
2596	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2597	    ("%s:%d: fail", __func__, __LINE__));
2598	return (map32[controller_idx]);
2599}
2600
2601static void
2602bwn_dma_init(struct bwn_mac *mac)
2603{
2604	struct bwn_dma *dma = &mac->mac_method.dma;
2605
2606	/* setup TX DMA channels. */
2607	bwn_dma_setup(dma->wme[WME_AC_BK]);
2608	bwn_dma_setup(dma->wme[WME_AC_BE]);
2609	bwn_dma_setup(dma->wme[WME_AC_VI]);
2610	bwn_dma_setup(dma->wme[WME_AC_VO]);
2611	bwn_dma_setup(dma->mcast);
2612	/* setup RX DMA channel. */
2613	bwn_dma_setup(dma->rx);
2614}
2615
2616static struct bwn_dma_ring *
2617bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2618    int for_tx, int type)
2619{
2620	struct bwn_dma *dma = &mac->mac_method.dma;
2621	struct bwn_dma_ring *dr;
2622	struct bwn_dmadesc_generic *desc;
2623	struct bwn_dmadesc_meta *mt;
2624	struct bwn_softc *sc = mac->mac_sc;
2625	int error, i;
2626
2627	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2628	if (dr == NULL)
2629		goto out;
2630	dr->dr_numslots = BWN_RXRING_SLOTS;
2631	if (for_tx)
2632		dr->dr_numslots = BWN_TXRING_SLOTS;
2633
2634	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2635	    M_DEVBUF, M_NOWAIT | M_ZERO);
2636	if (dr->dr_meta == NULL)
2637		goto fail0;
2638
2639	dr->dr_type = type;
2640	dr->dr_mac = mac;
2641	dr->dr_base = bwn_dma_base(type, controller_index);
2642	dr->dr_index = controller_index;
2643	if (type == BWN_DMA_64BIT) {
2644		dr->getdesc = bwn_dma_64_getdesc;
2645		dr->setdesc = bwn_dma_64_setdesc;
2646		dr->start_transfer = bwn_dma_64_start_transfer;
2647		dr->suspend = bwn_dma_64_suspend;
2648		dr->resume = bwn_dma_64_resume;
2649		dr->get_curslot = bwn_dma_64_get_curslot;
2650		dr->set_curslot = bwn_dma_64_set_curslot;
2651	} else {
2652		dr->getdesc = bwn_dma_32_getdesc;
2653		dr->setdesc = bwn_dma_32_setdesc;
2654		dr->start_transfer = bwn_dma_32_start_transfer;
2655		dr->suspend = bwn_dma_32_suspend;
2656		dr->resume = bwn_dma_32_resume;
2657		dr->get_curslot = bwn_dma_32_get_curslot;
2658		dr->set_curslot = bwn_dma_32_set_curslot;
2659	}
2660	if (for_tx) {
2661		dr->dr_tx = 1;
2662		dr->dr_curslot = -1;
2663	} else {
2664		if (dr->dr_index == 0) {
2665			switch (mac->mac_fw.fw_hdr_format) {
2666			case BWN_FW_HDR_351:
2667			case BWN_FW_HDR_410:
2668				dr->dr_rx_bufsize =
2669				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2670				dr->dr_frameoffset =
2671				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2672				break;
2673			case BWN_FW_HDR_598:
2674				dr->dr_rx_bufsize =
2675				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2676				dr->dr_frameoffset =
2677				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2678				break;
2679			}
2680		} else
2681			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2682	}
2683
2684	error = bwn_dma_allocringmemory(dr);
2685	if (error)
2686		goto fail2;
2687
2688	if (for_tx) {
2689		/*
2690		 * Assumption: BWN_TXRING_SLOTS can be divided by
2691		 * BWN_TX_SLOTS_PER_FRAME
2692		 */
2693		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2694		    ("%s:%d: fail", __func__, __LINE__));
2695
2696		dr->dr_txhdr_cache = contigmalloc(
2697		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2698		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2699		    0, BUS_SPACE_MAXADDR, 8, 0);
2700		if (dr->dr_txhdr_cache == NULL) {
2701			device_printf(sc->sc_dev,
2702			    "can't allocate TX header DMA memory\n");
2703			goto fail1;
2704		}
2705
2706		/*
2707		 * Create TX ring DMA stuffs
2708		 */
2709		error = bus_dma_tag_create(dma->parent_dtag,
2710				    BWN_ALIGN, 0,
2711				    BUS_SPACE_MAXADDR,
2712				    BUS_SPACE_MAXADDR,
2713				    NULL, NULL,
2714				    BWN_HDRSIZE(mac),
2715				    1,
2716				    BUS_SPACE_MAXSIZE_32BIT,
2717				    0,
2718				    NULL, NULL,
2719				    &dr->dr_txring_dtag);
2720		if (error) {
2721			device_printf(sc->sc_dev,
2722			    "can't create TX ring DMA tag: TODO frees\n");
2723			goto fail2;
2724		}
2725
2726		for (i = 0; i < dr->dr_numslots; i += 2) {
2727			dr->getdesc(dr, i, &desc, &mt);
2728
2729			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2730			mt->mt_m = NULL;
2731			mt->mt_ni = NULL;
2732			mt->mt_islast = 0;
2733			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2734			    &mt->mt_dmap);
2735			if (error) {
2736				device_printf(sc->sc_dev,
2737				     "can't create RX buf DMA map\n");
2738				goto fail2;
2739			}
2740
2741			dr->getdesc(dr, i + 1, &desc, &mt);
2742
2743			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2744			mt->mt_m = NULL;
2745			mt->mt_ni = NULL;
2746			mt->mt_islast = 1;
2747			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2748			    &mt->mt_dmap);
2749			if (error) {
2750				device_printf(sc->sc_dev,
2751				     "can't create RX buf DMA map\n");
2752				goto fail2;
2753			}
2754		}
2755	} else {
2756		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2757		    &dr->dr_spare_dmap);
2758		if (error) {
2759			device_printf(sc->sc_dev,
2760			    "can't create RX buf DMA map\n");
2761			goto out;		/* XXX wrong! */
2762		}
2763
2764		for (i = 0; i < dr->dr_numslots; i++) {
2765			dr->getdesc(dr, i, &desc, &mt);
2766
2767			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2768			    &mt->mt_dmap);
2769			if (error) {
2770				device_printf(sc->sc_dev,
2771				    "can't create RX buf DMA map\n");
2772				goto out;	/* XXX wrong! */
2773			}
2774			error = bwn_dma_newbuf(dr, desc, mt, 1);
2775			if (error) {
2776				device_printf(sc->sc_dev,
2777				    "failed to allocate RX buf\n");
2778				goto out;	/* XXX wrong! */
2779			}
2780		}
2781
2782		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2783		    BUS_DMASYNC_PREWRITE);
2784
2785		dr->dr_usedslot = dr->dr_numslots;
2786	}
2787
2788      out:
2789	return (dr);
2790
2791fail2:
2792	if (dr->dr_txhdr_cache != NULL) {
2793		contigfree(dr->dr_txhdr_cache,
2794		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2795		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2796	}
2797fail1:
2798	free(dr->dr_meta, M_DEVBUF);
2799fail0:
2800	free(dr, M_DEVBUF);
2801	return (NULL);
2802}
2803
2804static void
2805bwn_dma_ringfree(struct bwn_dma_ring **dr)
2806{
2807
2808	if (dr == NULL)
2809		return;
2810
2811	bwn_dma_free_descbufs(*dr);
2812	bwn_dma_free_ringmemory(*dr);
2813
2814	if ((*dr)->dr_txhdr_cache != NULL) {
2815		contigfree((*dr)->dr_txhdr_cache,
2816		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2817		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2818	}
2819	free((*dr)->dr_meta, M_DEVBUF);
2820	free(*dr, M_DEVBUF);
2821
2822	*dr = NULL;
2823}
2824
2825static void
2826bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2827    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2828{
2829	struct bwn_dmadesc32 *desc;
2830
2831	*meta = &(dr->dr_meta[slot]);
2832	desc = dr->dr_ring_descbase;
2833	desc = &(desc[slot]);
2834
2835	*gdesc = (struct bwn_dmadesc_generic *)desc;
2836}
2837
2838static void
2839bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2840    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2841    int start, int end, int irq)
2842{
2843	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2844	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2845	uint32_t addr, addrext, ctl;
2846	int slot;
2847
2848	slot = (int)(&(desc->dma.dma32) - descbase);
2849	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2850	    ("%s:%d: fail", __func__, __LINE__));
2851
2852	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2853	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2854	addr |= siba_dma_translation(sc->sc_dev);
2855	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2856	if (slot == dr->dr_numslots - 1)
2857		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2858	if (start)
2859		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2860	if (end)
2861		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2862	if (irq)
2863		ctl |= BWN_DMA32_DCTL_IRQ;
2864	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2865	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2866
2867	desc->dma.dma32.control = htole32(ctl);
2868	desc->dma.dma32.address = htole32(addr);
2869}
2870
2871static void
2872bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2873{
2874
2875	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2876	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2877}
2878
2879static void
2880bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2881{
2882
2883	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2884	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2885}
2886
2887static void
2888bwn_dma_32_resume(struct bwn_dma_ring *dr)
2889{
2890
2891	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2892	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2893}
2894
2895static int
2896bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2897{
2898	uint32_t val;
2899
2900	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2901	val &= BWN_DMA32_RXDPTR;
2902
2903	return (val / sizeof(struct bwn_dmadesc32));
2904}
2905
2906static void
2907bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2908{
2909
2910	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2911	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2912}
2913
2914static void
2915bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2916    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2917{
2918	struct bwn_dmadesc64 *desc;
2919
2920	*meta = &(dr->dr_meta[slot]);
2921	desc = dr->dr_ring_descbase;
2922	desc = &(desc[slot]);
2923
2924	*gdesc = (struct bwn_dmadesc_generic *)desc;
2925}
2926
2927static void
2928bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2929    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2930    int start, int end, int irq)
2931{
2932	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2933	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2934	int slot;
2935	uint32_t ctl0 = 0, ctl1 = 0;
2936	uint32_t addrlo, addrhi;
2937	uint32_t addrext;
2938
2939	slot = (int)(&(desc->dma.dma64) - descbase);
2940	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2941	    ("%s:%d: fail", __func__, __LINE__));
2942
2943	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2944	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2945	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2946	    30;
2947	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2948	if (slot == dr->dr_numslots - 1)
2949		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2950	if (start)
2951		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2952	if (end)
2953		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2954	if (irq)
2955		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2956	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2957	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2958	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2959
2960	desc->dma.dma64.control0 = htole32(ctl0);
2961	desc->dma.dma64.control1 = htole32(ctl1);
2962	desc->dma.dma64.address_low = htole32(addrlo);
2963	desc->dma.dma64.address_high = htole32(addrhi);
2964}
2965
2966static void
2967bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2968{
2969
2970	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2971	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2972}
2973
2974static void
2975bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2976{
2977
2978	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2979	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2980}
2981
2982static void
2983bwn_dma_64_resume(struct bwn_dma_ring *dr)
2984{
2985
2986	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2987	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2988}
2989
2990static int
2991bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2992{
2993	uint32_t val;
2994
2995	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2996	val &= BWN_DMA64_RXSTATDPTR;
2997
2998	return (val / sizeof(struct bwn_dmadesc64));
2999}
3000
3001static void
3002bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3003{
3004
3005	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3006	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3007}
3008
3009static int
3010bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3011{
3012	struct bwn_mac *mac = dr->dr_mac;
3013	struct bwn_dma *dma = &mac->mac_method.dma;
3014	struct bwn_softc *sc = mac->mac_sc;
3015	int error;
3016
3017	error = bus_dma_tag_create(dma->parent_dtag,
3018			    BWN_ALIGN, 0,
3019			    BUS_SPACE_MAXADDR,
3020			    BUS_SPACE_MAXADDR,
3021			    NULL, NULL,
3022			    BWN_DMA_RINGMEMSIZE,
3023			    1,
3024			    BUS_SPACE_MAXSIZE_32BIT,
3025			    0,
3026			    NULL, NULL,
3027			    &dr->dr_ring_dtag);
3028	if (error) {
3029		device_printf(sc->sc_dev,
3030		    "can't create TX ring DMA tag: TODO frees\n");
3031		return (-1);
3032	}
3033
3034	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3035	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3036	    &dr->dr_ring_dmap);
3037	if (error) {
3038		device_printf(sc->sc_dev,
3039		    "can't allocate DMA mem: TODO frees\n");
3040		return (-1);
3041	}
3042	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3043	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3044	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3045	if (error) {
3046		device_printf(sc->sc_dev,
3047		    "can't load DMA mem: TODO free\n");
3048		return (-1);
3049	}
3050
3051	return (0);
3052}
3053
3054static void
3055bwn_dma_setup(struct bwn_dma_ring *dr)
3056{
3057	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3058	uint64_t ring64;
3059	uint32_t addrext, ring32, value;
3060	uint32_t trans = siba_dma_translation(sc->sc_dev);
3061
3062	if (dr->dr_tx) {
3063		dr->dr_curslot = -1;
3064
3065		if (dr->dr_type == BWN_DMA_64BIT) {
3066			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3067			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3068			    >> 30;
3069			value = BWN_DMA64_TXENABLE;
3070			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3071			    & BWN_DMA64_TXADDREXT_MASK;
3072			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3073			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3074			    (ring64 & 0xffffffff));
3075			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3076			    ((ring64 >> 32) &
3077			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3078		} else {
3079			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3080			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3081			value = BWN_DMA32_TXENABLE;
3082			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3083			    & BWN_DMA32_TXADDREXT_MASK;
3084			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3085			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3086			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3087		}
3088		return;
3089	}
3090
3091	/*
3092	 * set for RX
3093	 */
3094	dr->dr_usedslot = dr->dr_numslots;
3095
3096	if (dr->dr_type == BWN_DMA_64BIT) {
3097		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3098		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3099		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3100		value |= BWN_DMA64_RXENABLE;
3101		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3102		    & BWN_DMA64_RXADDREXT_MASK;
3103		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3104		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3105		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3106		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3107		    | (trans << 1));
3108		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3109		    sizeof(struct bwn_dmadesc64));
3110	} else {
3111		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3112		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3113		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3114		value |= BWN_DMA32_RXENABLE;
3115		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3116		    & BWN_DMA32_RXADDREXT_MASK;
3117		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3118		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3119		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3120		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3121		    sizeof(struct bwn_dmadesc32));
3122	}
3123}
3124
3125static void
3126bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3127{
3128
3129	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3130	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3131	    dr->dr_ring_dmap);
3132}
3133
3134static void
3135bwn_dma_cleanup(struct bwn_dma_ring *dr)
3136{
3137
3138	if (dr->dr_tx) {
3139		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3140		if (dr->dr_type == BWN_DMA_64BIT) {
3141			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3142			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3143		} else
3144			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3145	} else {
3146		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3147		if (dr->dr_type == BWN_DMA_64BIT) {
3148			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3149			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3150		} else
3151			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3152	}
3153}
3154
3155static void
3156bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3157{
3158	struct bwn_dmadesc_generic *desc;
3159	struct bwn_dmadesc_meta *meta;
3160	struct bwn_mac *mac = dr->dr_mac;
3161	struct bwn_dma *dma = &mac->mac_method.dma;
3162	struct bwn_softc *sc = mac->mac_sc;
3163	int i;
3164
3165	if (!dr->dr_usedslot)
3166		return;
3167	for (i = 0; i < dr->dr_numslots; i++) {
3168		dr->getdesc(dr, i, &desc, &meta);
3169
3170		if (meta->mt_m == NULL) {
3171			if (!dr->dr_tx)
3172				device_printf(sc->sc_dev, "%s: not TX?\n",
3173				    __func__);
3174			continue;
3175		}
3176		if (dr->dr_tx) {
3177			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3178				bus_dmamap_unload(dr->dr_txring_dtag,
3179				    meta->mt_dmap);
3180			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3181				bus_dmamap_unload(dma->txbuf_dtag,
3182				    meta->mt_dmap);
3183		} else
3184			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3185		bwn_dma_free_descbuf(dr, meta);
3186	}
3187}
3188
3189static int
3190bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3191    int type)
3192{
3193	struct bwn_softc *sc = mac->mac_sc;
3194	uint32_t value;
3195	int i;
3196	uint16_t offset;
3197
3198	for (i = 0; i < 10; i++) {
3199		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3200		    BWN_DMA32_TXSTATUS;
3201		value = BWN_READ_4(mac, base + offset);
3202		if (type == BWN_DMA_64BIT) {
3203			value &= BWN_DMA64_TXSTAT;
3204			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3205			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3206			    value == BWN_DMA64_TXSTAT_STOPPED)
3207				break;
3208		} else {
3209			value &= BWN_DMA32_TXSTATE;
3210			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3211			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3212			    value == BWN_DMA32_TXSTAT_STOPPED)
3213				break;
3214		}
3215		DELAY(1000);
3216	}
3217	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3218	BWN_WRITE_4(mac, base + offset, 0);
3219	for (i = 0; i < 10; i++) {
3220		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3221						   BWN_DMA32_TXSTATUS;
3222		value = BWN_READ_4(mac, base + offset);
3223		if (type == BWN_DMA_64BIT) {
3224			value &= BWN_DMA64_TXSTAT;
3225			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3226				i = -1;
3227				break;
3228			}
3229		} else {
3230			value &= BWN_DMA32_TXSTATE;
3231			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3232				i = -1;
3233				break;
3234			}
3235		}
3236		DELAY(1000);
3237	}
3238	if (i != -1) {
3239		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3240		return (ENODEV);
3241	}
3242	DELAY(1000);
3243
3244	return (0);
3245}
3246
3247static int
3248bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3249    int type)
3250{
3251	struct bwn_softc *sc = mac->mac_sc;
3252	uint32_t value;
3253	int i;
3254	uint16_t offset;
3255
3256	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3257	BWN_WRITE_4(mac, base + offset, 0);
3258	for (i = 0; i < 10; i++) {
3259		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3260		    BWN_DMA32_RXSTATUS;
3261		value = BWN_READ_4(mac, base + offset);
3262		if (type == BWN_DMA_64BIT) {
3263			value &= BWN_DMA64_RXSTAT;
3264			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3265				i = -1;
3266				break;
3267			}
3268		} else {
3269			value &= BWN_DMA32_RXSTATE;
3270			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3271				i = -1;
3272				break;
3273			}
3274		}
3275		DELAY(1000);
3276	}
3277	if (i != -1) {
3278		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3279		return (ENODEV);
3280	}
3281
3282	return (0);
3283}
3284
3285static void
3286bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3287    struct bwn_dmadesc_meta *meta)
3288{
3289
3290	if (meta->mt_m != NULL) {
3291		m_freem(meta->mt_m);
3292		meta->mt_m = NULL;
3293	}
3294	if (meta->mt_ni != NULL) {
3295		ieee80211_free_node(meta->mt_ni);
3296		meta->mt_ni = NULL;
3297	}
3298}
3299
3300static void
3301bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3302{
3303	struct bwn_rxhdr4 *rxhdr;
3304	unsigned char *frame;
3305
3306	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3307	rxhdr->frame_len = 0;
3308
3309	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3310	    sizeof(struct bwn_plcp6) + 2,
3311	    ("%s:%d: fail", __func__, __LINE__));
3312	frame = mtod(m, char *) + dr->dr_frameoffset;
3313	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3314}
3315
3316static uint8_t
3317bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3318{
3319	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3320
3321	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3322	    == 0xff);
3323}
3324
3325static void
3326bwn_wme_init(struct bwn_mac *mac)
3327{
3328
3329	bwn_wme_load(mac);
3330
3331	/* enable WME support. */
3332	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3333	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3334	    BWN_IFSCTL_USE_EDCF);
3335}
3336
3337static void
3338bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3339{
3340	struct bwn_softc *sc = mac->mac_sc;
3341	struct ieee80211com *ic = &sc->sc_ic;
3342	uint16_t delay;	/* microsec */
3343
3344	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3345	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3346		delay = 500;
3347	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3348		delay = max(delay, (uint16_t)2400);
3349
3350	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3351}
3352
3353static void
3354bwn_bt_enable(struct bwn_mac *mac)
3355{
3356	struct bwn_softc *sc = mac->mac_sc;
3357	uint64_t hf;
3358
3359	if (bwn_bluetooth == 0)
3360		return;
3361	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3362		return;
3363	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3364		return;
3365
3366	hf = bwn_hf_read(mac);
3367	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3368		hf |= BWN_HF_BT_COEXISTALT;
3369	else
3370		hf |= BWN_HF_BT_COEXIST;
3371	bwn_hf_write(mac, hf);
3372}
3373
3374static void
3375bwn_set_macaddr(struct bwn_mac *mac)
3376{
3377
3378	bwn_mac_write_bssid(mac);
3379	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3380	    mac->mac_sc->sc_ic.ic_macaddr);
3381}
3382
3383static void
3384bwn_clear_keys(struct bwn_mac *mac)
3385{
3386	int i;
3387
3388	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3389		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3390		    ("%s:%d: fail", __func__, __LINE__));
3391
3392		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3393		    NULL, BWN_SEC_KEYSIZE, NULL);
3394		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3395			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3396			    NULL, BWN_SEC_KEYSIZE, NULL);
3397		}
3398		mac->mac_key[i].keyconf = NULL;
3399	}
3400}
3401
3402static void
3403bwn_crypt_init(struct bwn_mac *mac)
3404{
3405	struct bwn_softc *sc = mac->mac_sc;
3406
3407	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3408	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3409	    ("%s:%d: fail", __func__, __LINE__));
3410	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3411	mac->mac_ktp *= 2;
3412	if (siba_get_revid(sc->sc_dev) >= 5)
3413		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3414	bwn_clear_keys(mac);
3415}
3416
3417static void
3418bwn_chip_exit(struct bwn_mac *mac)
3419{
3420	struct bwn_softc *sc = mac->mac_sc;
3421
3422	bwn_phy_exit(mac);
3423	siba_gpio_set(sc->sc_dev, 0);
3424}
3425
3426static int
3427bwn_fw_fillinfo(struct bwn_mac *mac)
3428{
3429	int error;
3430
3431	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3432	if (error == 0)
3433		return (0);
3434	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3435	if (error == 0)
3436		return (0);
3437	return (error);
3438}
3439
3440static int
3441bwn_gpio_init(struct bwn_mac *mac)
3442{
3443	struct bwn_softc *sc = mac->mac_sc;
3444	uint32_t mask = 0x1f, set = 0xf, value;
3445
3446	BWN_WRITE_4(mac, BWN_MACCTL,
3447	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3448	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3449	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3450
3451	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3452		mask |= 0x0060;
3453		set |= 0x0060;
3454	}
3455	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3456		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3457		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3458		mask |= 0x0200;
3459		set |= 0x0200;
3460	}
3461	if (siba_get_revid(sc->sc_dev) >= 2)
3462		mask |= 0x0010;
3463
3464	value = siba_gpio_get(sc->sc_dev);
3465	if (value == -1)
3466		return (0);
3467	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3468
3469	return (0);
3470}
3471
3472static int
3473bwn_fw_loadinitvals(struct bwn_mac *mac)
3474{
3475#define	GETFWOFFSET(fwp, offset)				\
3476	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3477	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3478	const struct bwn_fwhdr *hdr;
3479	struct bwn_fw *fw = &mac->mac_fw;
3480	int error;
3481
3482	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3483	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3484	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3485	if (error)
3486		return (error);
3487	if (fw->initvals_band.fw) {
3488		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3489		error = bwn_fwinitvals_write(mac,
3490		    GETFWOFFSET(fw->initvals_band, hdr_len),
3491		    be32toh(hdr->size),
3492		    fw->initvals_band.fw->datasize - hdr_len);
3493	}
3494	return (error);
3495#undef GETFWOFFSET
3496}
3497
3498static int
3499bwn_phy_init(struct bwn_mac *mac)
3500{
3501	struct bwn_softc *sc = mac->mac_sc;
3502	int error;
3503
3504	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3505	mac->mac_phy.rf_onoff(mac, 1);
3506	error = mac->mac_phy.init(mac);
3507	if (error) {
3508		device_printf(sc->sc_dev, "PHY init failed\n");
3509		goto fail0;
3510	}
3511	error = bwn_switch_channel(mac,
3512	    mac->mac_phy.get_default_chan(mac));
3513	if (error) {
3514		device_printf(sc->sc_dev,
3515		    "failed to switch default channel\n");
3516		goto fail1;
3517	}
3518	return (0);
3519fail1:
3520	if (mac->mac_phy.exit)
3521		mac->mac_phy.exit(mac);
3522fail0:
3523	mac->mac_phy.rf_onoff(mac, 0);
3524
3525	return (error);
3526}
3527
3528static void
3529bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3530{
3531	uint16_t ant;
3532	uint16_t tmp;
3533
3534	ant = bwn_ant2phy(antenna);
3535
3536	/* For ACK/CTS */
3537	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3538	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3539	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3540	/* For Probe Resposes */
3541	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3542	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3543	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3544}
3545
3546static void
3547bwn_set_opmode(struct bwn_mac *mac)
3548{
3549	struct bwn_softc *sc = mac->mac_sc;
3550	struct ieee80211com *ic = &sc->sc_ic;
3551	uint32_t ctl;
3552	uint16_t cfp_pretbtt;
3553
3554	ctl = BWN_READ_4(mac, BWN_MACCTL);
3555	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3556	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3557	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3558	ctl |= BWN_MACCTL_STA;
3559
3560	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3561	    ic->ic_opmode == IEEE80211_M_MBSS)
3562		ctl |= BWN_MACCTL_HOSTAP;
3563	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3564		ctl &= ~BWN_MACCTL_STA;
3565	ctl |= sc->sc_filters;
3566
3567	if (siba_get_revid(sc->sc_dev) <= 4)
3568		ctl |= BWN_MACCTL_PROMISC;
3569
3570	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3571
3572	cfp_pretbtt = 2;
3573	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3574		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3575		    siba_get_chiprev(sc->sc_dev) == 3)
3576			cfp_pretbtt = 100;
3577		else
3578			cfp_pretbtt = 50;
3579	}
3580	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3581}
3582
3583static int
3584bwn_dma_gettype(struct bwn_mac *mac)
3585{
3586	uint32_t tmp;
3587	uint16_t base;
3588
3589	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3590	if (tmp & SIBA_TGSHIGH_DMA64)
3591		return (BWN_DMA_64BIT);
3592	base = bwn_dma_base(0, 0);
3593	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3594	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3595	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3596		return (BWN_DMA_32BIT);
3597
3598	return (BWN_DMA_30BIT);
3599}
3600
3601static void
3602bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3603{
3604	if (!error) {
3605		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3606		*((bus_addr_t *)arg) = seg->ds_addr;
3607	}
3608}
3609
3610void
3611bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3612{
3613	struct bwn_phy *phy = &mac->mac_phy;
3614	struct bwn_softc *sc = mac->mac_sc;
3615	unsigned int i, max_loop;
3616	uint16_t value;
3617	uint32_t buffer[5] = {
3618		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3619	};
3620
3621	if (ofdm) {
3622		max_loop = 0x1e;
3623		buffer[0] = 0x000201cc;
3624	} else {
3625		max_loop = 0xfa;
3626		buffer[0] = 0x000b846e;
3627	}
3628
3629	BWN_ASSERT_LOCKED(mac->mac_sc);
3630
3631	for (i = 0; i < 5; i++)
3632		bwn_ram_write(mac, i * 4, buffer[i]);
3633
3634	BWN_WRITE_2(mac, 0x0568, 0x0000);
3635	BWN_WRITE_2(mac, 0x07c0,
3636	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3637
3638	value = (ofdm ? 0x41 : 0x40);
3639	BWN_WRITE_2(mac, 0x050c, value);
3640
3641	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3642	    phy->type == BWN_PHYTYPE_LCN)
3643		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3644	BWN_WRITE_2(mac, 0x0508, 0x0000);
3645	BWN_WRITE_2(mac, 0x050a, 0x0000);
3646	BWN_WRITE_2(mac, 0x054c, 0x0000);
3647	BWN_WRITE_2(mac, 0x056a, 0x0014);
3648	BWN_WRITE_2(mac, 0x0568, 0x0826);
3649	BWN_WRITE_2(mac, 0x0500, 0x0000);
3650
3651	/* XXX TODO: n phy pa override? */
3652
3653	switch (phy->type) {
3654	case BWN_PHYTYPE_N:
3655	case BWN_PHYTYPE_LCN:
3656		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3657		break;
3658	case BWN_PHYTYPE_LP:
3659		BWN_WRITE_2(mac, 0x0502, 0x0050);
3660		break;
3661	default:
3662		BWN_WRITE_2(mac, 0x0502, 0x0030);
3663		break;
3664	}
3665
3666	/* flush */
3667	BWN_READ_2(mac, 0x0502);
3668
3669	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3670		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3671	for (i = 0x00; i < max_loop; i++) {
3672		value = BWN_READ_2(mac, 0x050e);
3673		if (value & 0x0080)
3674			break;
3675		DELAY(10);
3676	}
3677	for (i = 0x00; i < 0x0a; i++) {
3678		value = BWN_READ_2(mac, 0x050e);
3679		if (value & 0x0400)
3680			break;
3681		DELAY(10);
3682	}
3683	for (i = 0x00; i < 0x19; i++) {
3684		value = BWN_READ_2(mac, 0x0690);
3685		if (!(value & 0x0100))
3686			break;
3687		DELAY(10);
3688	}
3689	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3690		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3691}
3692
3693void
3694bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3695{
3696	uint32_t macctl;
3697
3698	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3699
3700	macctl = BWN_READ_4(mac, BWN_MACCTL);
3701	if (macctl & BWN_MACCTL_BIGENDIAN)
3702		printf("TODO: need swap\n");
3703
3704	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3705	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3706	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3707}
3708
3709void
3710bwn_mac_suspend(struct bwn_mac *mac)
3711{
3712	struct bwn_softc *sc = mac->mac_sc;
3713	int i;
3714	uint32_t tmp;
3715
3716	KASSERT(mac->mac_suspended >= 0,
3717	    ("%s:%d: fail", __func__, __LINE__));
3718
3719	if (mac->mac_suspended == 0) {
3720		bwn_psctl(mac, BWN_PS_AWAKE);
3721		BWN_WRITE_4(mac, BWN_MACCTL,
3722			    BWN_READ_4(mac, BWN_MACCTL)
3723			    & ~BWN_MACCTL_ON);
3724		BWN_READ_4(mac, BWN_MACCTL);
3725		for (i = 35; i; i--) {
3726			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3727			if (tmp & BWN_INTR_MAC_SUSPENDED)
3728				goto out;
3729			DELAY(10);
3730		}
3731		for (i = 40; i; i--) {
3732			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3733			if (tmp & BWN_INTR_MAC_SUSPENDED)
3734				goto out;
3735			DELAY(1000);
3736		}
3737		device_printf(sc->sc_dev, "MAC suspend failed\n");
3738	}
3739out:
3740	mac->mac_suspended++;
3741}
3742
3743void
3744bwn_mac_enable(struct bwn_mac *mac)
3745{
3746	struct bwn_softc *sc = mac->mac_sc;
3747	uint16_t state;
3748
3749	state = bwn_shm_read_2(mac, BWN_SHARED,
3750	    BWN_SHARED_UCODESTAT);
3751	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3752	    state != BWN_SHARED_UCODESTAT_SLEEP)
3753		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3754
3755	mac->mac_suspended--;
3756	KASSERT(mac->mac_suspended >= 0,
3757	    ("%s:%d: fail", __func__, __LINE__));
3758	if (mac->mac_suspended == 0) {
3759		BWN_WRITE_4(mac, BWN_MACCTL,
3760		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3761		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3762		BWN_READ_4(mac, BWN_MACCTL);
3763		BWN_READ_4(mac, BWN_INTR_REASON);
3764		bwn_psctl(mac, 0);
3765	}
3766}
3767
3768void
3769bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3770{
3771	struct bwn_softc *sc = mac->mac_sc;
3772	int i;
3773	uint16_t ucstat;
3774
3775	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3776	    ("%s:%d: fail", __func__, __LINE__));
3777	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3778	    ("%s:%d: fail", __func__, __LINE__));
3779
3780	/* XXX forcibly awake and hwps-off */
3781
3782	BWN_WRITE_4(mac, BWN_MACCTL,
3783	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3784	    ~BWN_MACCTL_HWPS);
3785	BWN_READ_4(mac, BWN_MACCTL);
3786	if (siba_get_revid(sc->sc_dev) >= 5) {
3787		for (i = 0; i < 100; i++) {
3788			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3789			    BWN_SHARED_UCODESTAT);
3790			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3791				break;
3792			DELAY(10);
3793		}
3794	}
3795	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3796	    ucstat);
3797}
3798
3799static int
3800bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3801{
3802	struct bwn_softc *sc = mac->mac_sc;
3803	struct bwn_fw *fw = &mac->mac_fw;
3804	const uint8_t rev = siba_get_revid(sc->sc_dev);
3805	const char *filename;
3806	uint32_t high;
3807	int error;
3808
3809	/* microcode */
3810	filename = NULL;
3811	switch (rev) {
3812	case 42:
3813		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3814			filename = "ucode42";
3815		break;
3816	case 40:
3817		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3818			filename = "ucode40";
3819		break;
3820	case 33:
3821		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3822			filename = "ucode33_lcn40";
3823		break;
3824	case 30:
3825		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3826			filename = "ucode30_mimo";
3827		break;
3828	case 29:
3829		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3830			filename = "ucode29_mimo";
3831		break;
3832	case 26:
3833		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3834			filename = "ucode26_mimo";
3835		break;
3836	case 28:
3837	case 25:
3838		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3839			filename = "ucode25_mimo";
3840		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3841			filename = "ucode25_lcn";
3842		break;
3843	case 24:
3844		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3845			filename = "ucode24_lcn";
3846		break;
3847	case 23:
3848		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3849			filename = "ucode16_mimo";
3850		break;
3851	case 16:
3852	case 17:
3853	case 18:
3854	case 19:
3855		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3856			filename = "ucode16_mimo";
3857		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3858			filename = "ucode16_lp";
3859		break;
3860	case 15:
3861		filename = "ucode15";
3862		break;
3863	case 14:
3864		filename = "ucode14";
3865		break;
3866	case 13:
3867		filename = "ucode13";
3868		break;
3869	case 12:
3870	case 11:
3871		filename = "ucode11";
3872		break;
3873	case 10:
3874	case 9:
3875	case 8:
3876	case 7:
3877	case 6:
3878	case 5:
3879		filename = "ucode5";
3880		break;
3881	default:
3882		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3883		bwn_release_firmware(mac);
3884		return (EOPNOTSUPP);
3885	}
3886
3887	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3888	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3889	if (error) {
3890		bwn_release_firmware(mac);
3891		return (error);
3892	}
3893
3894	/* PCM */
3895	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3896	if (rev >= 5 && rev <= 10) {
3897		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3898		if (error == ENOENT)
3899			fw->no_pcmfile = 1;
3900		else if (error) {
3901			bwn_release_firmware(mac);
3902			return (error);
3903		}
3904	} else if (rev < 11) {
3905		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3906		return (EOPNOTSUPP);
3907	}
3908
3909	/* initvals */
3910	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3911	switch (mac->mac_phy.type) {
3912	case BWN_PHYTYPE_A:
3913		if (rev < 5 || rev > 10)
3914			goto fail1;
3915		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3916			filename = "a0g1initvals5";
3917		else
3918			filename = "a0g0initvals5";
3919		break;
3920	case BWN_PHYTYPE_G:
3921		if (rev >= 5 && rev <= 10)
3922			filename = "b0g0initvals5";
3923		else if (rev >= 13)
3924			filename = "b0g0initvals13";
3925		else
3926			goto fail1;
3927		break;
3928	case BWN_PHYTYPE_LP:
3929		if (rev == 13)
3930			filename = "lp0initvals13";
3931		else if (rev == 14)
3932			filename = "lp0initvals14";
3933		else if (rev >= 15)
3934			filename = "lp0initvals15";
3935		else
3936			goto fail1;
3937		break;
3938	case BWN_PHYTYPE_N:
3939		if (rev == 30)
3940			filename = "n16initvals30";
3941		else if (rev == 28 || rev == 25)
3942			filename = "n0initvals25";
3943		else if (rev == 24)
3944			filename = "n0initvals24";
3945		else if (rev == 23)
3946			filename = "n0initvals16";
3947		else if (rev >= 16 && rev <= 18)
3948			filename = "n0initvals16";
3949		else if (rev >= 11 && rev <= 12)
3950			filename = "n0initvals11";
3951		else
3952			goto fail1;
3953		break;
3954	default:
3955		goto fail1;
3956	}
3957	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3958	if (error) {
3959		bwn_release_firmware(mac);
3960		return (error);
3961	}
3962
3963	/* bandswitch initvals */
3964	switch (mac->mac_phy.type) {
3965	case BWN_PHYTYPE_A:
3966		if (rev >= 5 && rev <= 10) {
3967			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3968				filename = "a0g1bsinitvals5";
3969			else
3970				filename = "a0g0bsinitvals5";
3971		} else if (rev >= 11)
3972			filename = NULL;
3973		else
3974			goto fail1;
3975		break;
3976	case BWN_PHYTYPE_G:
3977		if (rev >= 5 && rev <= 10)
3978			filename = "b0g0bsinitvals5";
3979		else if (rev >= 11)
3980			filename = NULL;
3981		else
3982			goto fail1;
3983		break;
3984	case BWN_PHYTYPE_LP:
3985		if (rev == 13)
3986			filename = "lp0bsinitvals13";
3987		else if (rev == 14)
3988			filename = "lp0bsinitvals14";
3989		else if (rev >= 15)
3990			filename = "lp0bsinitvals15";
3991		else
3992			goto fail1;
3993		break;
3994	case BWN_PHYTYPE_N:
3995		if (rev == 30)
3996			filename = "n16bsinitvals30";
3997		else if (rev == 28 || rev == 25)
3998			filename = "n0bsinitvals25";
3999		else if (rev == 24)
4000			filename = "n0bsinitvals24";
4001		else if (rev == 23)
4002			filename = "n0bsinitvals16";
4003		else if (rev >= 16 && rev <= 18)
4004			filename = "n0bsinitvals16";
4005		else if (rev >= 11 && rev <= 12)
4006			filename = "n0bsinitvals11";
4007		else
4008			goto fail1;
4009		break;
4010	default:
4011		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4012		    mac->mac_phy.type);
4013		goto fail1;
4014	}
4015	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4016	if (error) {
4017		bwn_release_firmware(mac);
4018		return (error);
4019	}
4020	return (0);
4021fail1:
4022	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4023	    rev, mac->mac_phy.type);
4024	bwn_release_firmware(mac);
4025	return (EOPNOTSUPP);
4026}
4027
4028static int
4029bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4030    const char *name, struct bwn_fwfile *bfw)
4031{
4032	const struct bwn_fwhdr *hdr;
4033	struct bwn_softc *sc = mac->mac_sc;
4034	const struct firmware *fw;
4035	char namebuf[64];
4036
4037	if (name == NULL) {
4038		bwn_do_release_fw(bfw);
4039		return (0);
4040	}
4041	if (bfw->filename != NULL) {
4042		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4043			return (0);
4044		bwn_do_release_fw(bfw);
4045	}
4046
4047	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4048	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4049	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4050	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4051	fw = firmware_get(namebuf);
4052	if (fw == NULL) {
4053		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4054		    namebuf);
4055		return (ENOENT);
4056	}
4057	if (fw->datasize < sizeof(struct bwn_fwhdr))
4058		goto fail;
4059	hdr = (const struct bwn_fwhdr *)(fw->data);
4060	switch (hdr->type) {
4061	case BWN_FWTYPE_UCODE:
4062	case BWN_FWTYPE_PCM:
4063		if (be32toh(hdr->size) !=
4064		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4065			goto fail;
4066		/* FALLTHROUGH */
4067	case BWN_FWTYPE_IV:
4068		if (hdr->ver != 1)
4069			goto fail;
4070		break;
4071	default:
4072		goto fail;
4073	}
4074	bfw->filename = name;
4075	bfw->fw = fw;
4076	bfw->type = type;
4077	return (0);
4078fail:
4079	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4080	if (fw != NULL)
4081		firmware_put(fw, FIRMWARE_UNLOAD);
4082	return (EPROTO);
4083}
4084
4085static void
4086bwn_release_firmware(struct bwn_mac *mac)
4087{
4088
4089	bwn_do_release_fw(&mac->mac_fw.ucode);
4090	bwn_do_release_fw(&mac->mac_fw.pcm);
4091	bwn_do_release_fw(&mac->mac_fw.initvals);
4092	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4093}
4094
4095static void
4096bwn_do_release_fw(struct bwn_fwfile *bfw)
4097{
4098
4099	if (bfw->fw != NULL)
4100		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4101	bfw->fw = NULL;
4102	bfw->filename = NULL;
4103}
4104
4105static int
4106bwn_fw_loaducode(struct bwn_mac *mac)
4107{
4108#define	GETFWOFFSET(fwp, offset)	\
4109	((const uint32_t *)((const char *)fwp.fw->data + offset))
4110#define	GETFWSIZE(fwp, offset)	\
4111	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4112	struct bwn_softc *sc = mac->mac_sc;
4113	const uint32_t *data;
4114	unsigned int i;
4115	uint32_t ctl;
4116	uint16_t date, fwcaps, time;
4117	int error = 0;
4118
4119	ctl = BWN_READ_4(mac, BWN_MACCTL);
4120	ctl |= BWN_MACCTL_MCODE_JMP0;
4121	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4122	    __LINE__));
4123	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4124	for (i = 0; i < 64; i++)
4125		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4126	for (i = 0; i < 4096; i += 2)
4127		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4128
4129	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4130	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4131	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4132	     i++) {
4133		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4134		DELAY(10);
4135	}
4136
4137	if (mac->mac_fw.pcm.fw) {
4138		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4139		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4140		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4141		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4142		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4143		    sizeof(struct bwn_fwhdr)); i++) {
4144			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4145			DELAY(10);
4146		}
4147	}
4148
4149	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4150	BWN_WRITE_4(mac, BWN_MACCTL,
4151	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4152	    BWN_MACCTL_MCODE_RUN);
4153
4154	for (i = 0; i < 21; i++) {
4155		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4156			break;
4157		if (i >= 20) {
4158			device_printf(sc->sc_dev, "ucode timeout\n");
4159			error = ENXIO;
4160			goto error;
4161		}
4162		DELAY(50000);
4163	}
4164	BWN_READ_4(mac, BWN_INTR_REASON);
4165
4166	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4167	if (mac->mac_fw.rev <= 0x128) {
4168		device_printf(sc->sc_dev, "the firmware is too old\n");
4169		error = EOPNOTSUPP;
4170		goto error;
4171	}
4172
4173	/*
4174	 * Determine firmware header version; needed for TX/RX packet
4175	 * handling.
4176	 */
4177	if (mac->mac_fw.rev >= 598)
4178		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4179	else if (mac->mac_fw.rev >= 410)
4180		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4181	else
4182		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4183
4184	/*
4185	 * We don't support rev 598 or later; that requires
4186	 * another round of changes to the TX/RX descriptor
4187	 * and status layout.
4188	 *
4189	 * So, complain this is the case and exit out, rather
4190	 * than attaching and then failing.
4191	 */
4192#if 0
4193	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4194		device_printf(sc->sc_dev,
4195		    "firmware is too new (>=598); not supported\n");
4196		error = EOPNOTSUPP;
4197		goto error;
4198	}
4199#endif
4200
4201	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4202	    BWN_SHARED_UCODE_PATCH);
4203	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4204	mac->mac_fw.opensource = (date == 0xffff);
4205	if (bwn_wme != 0)
4206		mac->mac_flags |= BWN_MAC_FLAG_WME;
4207	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4208
4209	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4210	if (mac->mac_fw.opensource == 0) {
4211		device_printf(sc->sc_dev,
4212		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4213		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4214		if (mac->mac_fw.no_pcmfile)
4215			device_printf(sc->sc_dev,
4216			    "no HW crypto acceleration due to pcm5\n");
4217	} else {
4218		mac->mac_fw.patch = time;
4219		fwcaps = bwn_fwcaps_read(mac);
4220		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4221			device_printf(sc->sc_dev,
4222			    "disabling HW crypto acceleration\n");
4223			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4224		}
4225		if (!(fwcaps & BWN_FWCAPS_WME)) {
4226			device_printf(sc->sc_dev, "disabling WME support\n");
4227			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4228		}
4229	}
4230
4231	if (BWN_ISOLDFMT(mac))
4232		device_printf(sc->sc_dev, "using old firmware image\n");
4233
4234	return (0);
4235
4236error:
4237	BWN_WRITE_4(mac, BWN_MACCTL,
4238	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4239	    BWN_MACCTL_MCODE_JMP0);
4240
4241	return (error);
4242#undef GETFWSIZE
4243#undef GETFWOFFSET
4244}
4245
4246/* OpenFirmware only */
4247static uint16_t
4248bwn_fwcaps_read(struct bwn_mac *mac)
4249{
4250
4251	KASSERT(mac->mac_fw.opensource == 1,
4252	    ("%s:%d: fail", __func__, __LINE__));
4253	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4254}
4255
4256static int
4257bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4258    size_t count, size_t array_size)
4259{
4260#define	GET_NEXTIV16(iv)						\
4261	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4262	    sizeof(uint16_t) + sizeof(uint16_t)))
4263#define	GET_NEXTIV32(iv)						\
4264	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4265	    sizeof(uint16_t) + sizeof(uint32_t)))
4266	struct bwn_softc *sc = mac->mac_sc;
4267	const struct bwn_fwinitvals *iv;
4268	uint16_t offset;
4269	size_t i;
4270	uint8_t bit32;
4271
4272	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4273	    ("%s:%d: fail", __func__, __LINE__));
4274	iv = ivals;
4275	for (i = 0; i < count; i++) {
4276		if (array_size < sizeof(iv->offset_size))
4277			goto fail;
4278		array_size -= sizeof(iv->offset_size);
4279		offset = be16toh(iv->offset_size);
4280		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4281		offset &= BWN_FWINITVALS_OFFSET_MASK;
4282		if (offset >= 0x1000)
4283			goto fail;
4284		if (bit32) {
4285			if (array_size < sizeof(iv->data.d32))
4286				goto fail;
4287			array_size -= sizeof(iv->data.d32);
4288			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4289			iv = GET_NEXTIV32(iv);
4290		} else {
4291
4292			if (array_size < sizeof(iv->data.d16))
4293				goto fail;
4294			array_size -= sizeof(iv->data.d16);
4295			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4296
4297			iv = GET_NEXTIV16(iv);
4298		}
4299	}
4300	if (array_size != 0)
4301		goto fail;
4302	return (0);
4303fail:
4304	device_printf(sc->sc_dev, "initvals: invalid format\n");
4305	return (EPROTO);
4306#undef GET_NEXTIV16
4307#undef GET_NEXTIV32
4308}
4309
4310int
4311bwn_switch_channel(struct bwn_mac *mac, int chan)
4312{
4313	struct bwn_phy *phy = &(mac->mac_phy);
4314	struct bwn_softc *sc = mac->mac_sc;
4315	struct ieee80211com *ic = &sc->sc_ic;
4316	uint16_t channelcookie, savedcookie;
4317	int error;
4318
4319	if (chan == 0xffff)
4320		chan = phy->get_default_chan(mac);
4321
4322	channelcookie = chan;
4323	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4324		channelcookie |= 0x100;
4325	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4326	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4327	error = phy->switch_channel(mac, chan);
4328	if (error)
4329		goto fail;
4330
4331	mac->mac_phy.chan = chan;
4332	DELAY(8000);
4333	return (0);
4334fail:
4335	device_printf(sc->sc_dev, "failed to switch channel\n");
4336	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4337	return (error);
4338}
4339
4340static uint16_t
4341bwn_ant2phy(int antenna)
4342{
4343
4344	switch (antenna) {
4345	case BWN_ANT0:
4346		return (BWN_TX_PHY_ANT0);
4347	case BWN_ANT1:
4348		return (BWN_TX_PHY_ANT1);
4349	case BWN_ANT2:
4350		return (BWN_TX_PHY_ANT2);
4351	case BWN_ANT3:
4352		return (BWN_TX_PHY_ANT3);
4353	case BWN_ANTAUTO:
4354		return (BWN_TX_PHY_ANT01AUTO);
4355	}
4356	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4357	return (0);
4358}
4359
4360static void
4361bwn_wme_load(struct bwn_mac *mac)
4362{
4363	struct bwn_softc *sc = mac->mac_sc;
4364	int i;
4365
4366	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4367	    ("%s:%d: fail", __func__, __LINE__));
4368
4369	bwn_mac_suspend(mac);
4370	for (i = 0; i < N(sc->sc_wmeParams); i++)
4371		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4372		    bwn_wme_shm_offsets[i]);
4373	bwn_mac_enable(mac);
4374}
4375
4376static void
4377bwn_wme_loadparams(struct bwn_mac *mac,
4378    const struct wmeParams *p, uint16_t shm_offset)
4379{
4380#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4381	struct bwn_softc *sc = mac->mac_sc;
4382	uint16_t params[BWN_NR_WMEPARAMS];
4383	int slot, tmp;
4384	unsigned int i;
4385
4386	slot = BWN_READ_2(mac, BWN_RNG) &
4387	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4388
4389	memset(&params, 0, sizeof(params));
4390
4391	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4392	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4393	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4394
4395	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4396	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4397	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4398	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4399	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4400	params[BWN_WMEPARAM_BSLOTS] = slot;
4401	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4402
4403	for (i = 0; i < N(params); i++) {
4404		if (i == BWN_WMEPARAM_STATUS) {
4405			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4406			    shm_offset + (i * 2));
4407			tmp |= 0x100;
4408			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4409			    tmp);
4410		} else {
4411			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4412			    params[i]);
4413		}
4414	}
4415}
4416
4417static void
4418bwn_mac_write_bssid(struct bwn_mac *mac)
4419{
4420	struct bwn_softc *sc = mac->mac_sc;
4421	uint32_t tmp;
4422	int i;
4423	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4424
4425	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4426	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4427	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4428	    IEEE80211_ADDR_LEN);
4429
4430	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4431		tmp = (uint32_t) (mac_bssid[i + 0]);
4432		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4433		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4434		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4435		bwn_ram_write(mac, 0x20 + i, tmp);
4436	}
4437}
4438
4439static void
4440bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4441    const uint8_t *macaddr)
4442{
4443	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4444	uint16_t data;
4445
4446	if (!mac)
4447		macaddr = zero;
4448
4449	offset |= 0x0020;
4450	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4451
4452	data = macaddr[0];
4453	data |= macaddr[1] << 8;
4454	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4455	data = macaddr[2];
4456	data |= macaddr[3] << 8;
4457	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4458	data = macaddr[4];
4459	data |= macaddr[5] << 8;
4460	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4461}
4462
4463static void
4464bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4465    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4466{
4467	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4468	uint8_t per_sta_keys_start = 8;
4469
4470	if (BWN_SEC_NEWAPI(mac))
4471		per_sta_keys_start = 4;
4472
4473	KASSERT(index < mac->mac_max_nr_keys,
4474	    ("%s:%d: fail", __func__, __LINE__));
4475	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4476	    ("%s:%d: fail", __func__, __LINE__));
4477
4478	if (index >= per_sta_keys_start)
4479		bwn_key_macwrite(mac, index, NULL);
4480	if (key)
4481		memcpy(buf, key, key_len);
4482	bwn_key_write(mac, index, algorithm, buf);
4483	if (index >= per_sta_keys_start)
4484		bwn_key_macwrite(mac, index, mac_addr);
4485
4486	mac->mac_key[index].algorithm = algorithm;
4487}
4488
4489static void
4490bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4491{
4492	struct bwn_softc *sc = mac->mac_sc;
4493	uint32_t addrtmp[2] = { 0, 0 };
4494	uint8_t start = 8;
4495
4496	if (BWN_SEC_NEWAPI(mac))
4497		start = 4;
4498
4499	KASSERT(index >= start,
4500	    ("%s:%d: fail", __func__, __LINE__));
4501	index -= start;
4502
4503	if (addr) {
4504		addrtmp[0] = addr[0];
4505		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4506		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4507		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4508		addrtmp[1] = addr[4];
4509		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4510	}
4511
4512	if (siba_get_revid(sc->sc_dev) >= 5) {
4513		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4514		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4515	} else {
4516		if (index >= 8) {
4517			bwn_shm_write_4(mac, BWN_SHARED,
4518			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4519			bwn_shm_write_2(mac, BWN_SHARED,
4520			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4521		}
4522	}
4523}
4524
4525static void
4526bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4527    const uint8_t *key)
4528{
4529	unsigned int i;
4530	uint32_t offset;
4531	uint16_t kidx, value;
4532
4533	kidx = BWN_SEC_KEY2FW(mac, index);
4534	bwn_shm_write_2(mac, BWN_SHARED,
4535	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4536
4537	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4538	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4539		value = key[i];
4540		value |= (uint16_t)(key[i + 1]) << 8;
4541		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4542	}
4543}
4544
4545static void
4546bwn_phy_exit(struct bwn_mac *mac)
4547{
4548
4549	mac->mac_phy.rf_onoff(mac, 0);
4550	if (mac->mac_phy.exit != NULL)
4551		mac->mac_phy.exit(mac);
4552}
4553
4554static void
4555bwn_dma_free(struct bwn_mac *mac)
4556{
4557	struct bwn_dma *dma;
4558
4559	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4560		return;
4561	dma = &mac->mac_method.dma;
4562
4563	bwn_dma_ringfree(&dma->rx);
4564	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4565	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4566	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4567	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4568	bwn_dma_ringfree(&dma->mcast);
4569}
4570
4571static void
4572bwn_core_stop(struct bwn_mac *mac)
4573{
4574	struct bwn_softc *sc = mac->mac_sc;
4575
4576	BWN_ASSERT_LOCKED(sc);
4577
4578	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4579		return;
4580
4581	callout_stop(&sc->sc_rfswitch_ch);
4582	callout_stop(&sc->sc_task_ch);
4583	callout_stop(&sc->sc_watchdog_ch);
4584	sc->sc_watchdog_timer = 0;
4585	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4586	BWN_READ_4(mac, BWN_INTR_MASK);
4587	bwn_mac_suspend(mac);
4588
4589	mac->mac_status = BWN_MAC_STATUS_INITED;
4590}
4591
4592static int
4593bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4594{
4595	struct bwn_mac *up_dev = NULL;
4596	struct bwn_mac *down_dev;
4597	struct bwn_mac *mac;
4598	int err, status;
4599	uint8_t gmode;
4600
4601	BWN_ASSERT_LOCKED(sc);
4602
4603	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4604		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4605		    mac->mac_phy.supports_2ghz) {
4606			up_dev = mac;
4607			gmode = 1;
4608		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4609		    mac->mac_phy.supports_5ghz) {
4610			up_dev = mac;
4611			gmode = 0;
4612		} else {
4613			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4614			return (EINVAL);
4615		}
4616		if (up_dev != NULL)
4617			break;
4618	}
4619	if (up_dev == NULL) {
4620		device_printf(sc->sc_dev, "Could not find a device\n");
4621		return (ENODEV);
4622	}
4623	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4624		return (0);
4625
4626	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4627	    "switching to %s-GHz band\n",
4628	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4629
4630	down_dev = sc->sc_curmac;
4631	status = down_dev->mac_status;
4632	if (status >= BWN_MAC_STATUS_STARTED)
4633		bwn_core_stop(down_dev);
4634	if (status >= BWN_MAC_STATUS_INITED)
4635		bwn_core_exit(down_dev);
4636
4637	if (down_dev != up_dev)
4638		bwn_phy_reset(down_dev);
4639
4640	up_dev->mac_phy.gmode = gmode;
4641	if (status >= BWN_MAC_STATUS_INITED) {
4642		err = bwn_core_init(up_dev);
4643		if (err) {
4644			device_printf(sc->sc_dev,
4645			    "fatal: failed to initialize for %s-GHz\n",
4646			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4647			goto fail;
4648		}
4649	}
4650	if (status >= BWN_MAC_STATUS_STARTED)
4651		bwn_core_start(up_dev);
4652	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4653	sc->sc_curmac = up_dev;
4654
4655	return (0);
4656fail:
4657	sc->sc_curmac = NULL;
4658	return (err);
4659}
4660
4661static void
4662bwn_rf_turnon(struct bwn_mac *mac)
4663{
4664
4665	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4666
4667	bwn_mac_suspend(mac);
4668	mac->mac_phy.rf_onoff(mac, 1);
4669	mac->mac_phy.rf_on = 1;
4670	bwn_mac_enable(mac);
4671}
4672
4673static void
4674bwn_rf_turnoff(struct bwn_mac *mac)
4675{
4676
4677	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4678
4679	bwn_mac_suspend(mac);
4680	mac->mac_phy.rf_onoff(mac, 0);
4681	mac->mac_phy.rf_on = 0;
4682	bwn_mac_enable(mac);
4683}
4684
4685/*
4686 * SSB PHY reset.
4687 *
4688 * XXX TODO: BCMA PHY reset.
4689 */
4690static void
4691bwn_phy_reset(struct bwn_mac *mac)
4692{
4693	struct bwn_softc *sc = mac->mac_sc;
4694
4695	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4696	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4697	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4698	DELAY(1000);
4699	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4700	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4701	DELAY(1000);
4702}
4703
4704static int
4705bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4706{
4707	struct bwn_vap *bvp = BWN_VAP(vap);
4708	struct ieee80211com *ic= vap->iv_ic;
4709	enum ieee80211_state ostate = vap->iv_state;
4710	struct bwn_softc *sc = ic->ic_softc;
4711	struct bwn_mac *mac = sc->sc_curmac;
4712	int error;
4713
4714	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4715	    ieee80211_state_name[vap->iv_state],
4716	    ieee80211_state_name[nstate]);
4717
4718	error = bvp->bv_newstate(vap, nstate, arg);
4719	if (error != 0)
4720		return (error);
4721
4722	BWN_LOCK(sc);
4723
4724	bwn_led_newstate(mac, nstate);
4725
4726	/*
4727	 * Clear the BSSID when we stop a STA
4728	 */
4729	if (vap->iv_opmode == IEEE80211_M_STA) {
4730		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4731			/*
4732			 * Clear out the BSSID.  If we reassociate to
4733			 * the same AP, this will reinialize things
4734			 * correctly...
4735			 */
4736			if (ic->ic_opmode == IEEE80211_M_STA &&
4737			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4738				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4739				bwn_set_macaddr(mac);
4740			}
4741		}
4742	}
4743
4744	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4745	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4746		/* XXX nothing to do? */
4747	} else if (nstate == IEEE80211_S_RUN) {
4748		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4749		bwn_set_opmode(mac);
4750		bwn_set_pretbtt(mac);
4751		bwn_spu_setdelay(mac, 0);
4752		bwn_set_macaddr(mac);
4753	}
4754
4755	BWN_UNLOCK(sc);
4756
4757	return (error);
4758}
4759
4760static void
4761bwn_set_pretbtt(struct bwn_mac *mac)
4762{
4763	struct bwn_softc *sc = mac->mac_sc;
4764	struct ieee80211com *ic = &sc->sc_ic;
4765	uint16_t pretbtt;
4766
4767	if (ic->ic_opmode == IEEE80211_M_IBSS)
4768		pretbtt = 2;
4769	else
4770		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4771	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4772	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4773}
4774
4775static int
4776bwn_intr(void *arg)
4777{
4778	struct bwn_mac *mac = arg;
4779	struct bwn_softc *sc = mac->mac_sc;
4780	uint32_t reason;
4781
4782	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4783	    (sc->sc_flags & BWN_FLAG_INVALID))
4784		return (FILTER_STRAY);
4785
4786	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4787	if (reason == 0xffffffff)	/* shared IRQ */
4788		return (FILTER_STRAY);
4789	reason &= mac->mac_intr_mask;
4790	if (reason == 0)
4791		return (FILTER_HANDLED);
4792
4793	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4794	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4795	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4796	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4797	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4798	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4799	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4800	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4801	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4802	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4803	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4804
4805	/* Disable interrupts. */
4806	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4807
4808	mac->mac_reason_intr = reason;
4809
4810	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4811	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4812
4813	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4814	return (FILTER_HANDLED);
4815}
4816
4817static void
4818bwn_intrtask(void *arg, int npending)
4819{
4820	struct bwn_mac *mac = arg;
4821	struct bwn_softc *sc = mac->mac_sc;
4822	uint32_t merged = 0;
4823	int i, tx = 0, rx = 0;
4824
4825	BWN_LOCK(sc);
4826	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4827	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4828		BWN_UNLOCK(sc);
4829		return;
4830	}
4831
4832	for (i = 0; i < N(mac->mac_reason); i++)
4833		merged |= mac->mac_reason[i];
4834
4835	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4836		device_printf(sc->sc_dev, "MAC trans error\n");
4837
4838	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4839		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4840		mac->mac_phy.txerrors--;
4841		if (mac->mac_phy.txerrors == 0) {
4842			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4843			bwn_restart(mac, "PHY TX errors");
4844		}
4845	}
4846
4847	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4848		if (merged & BWN_DMAINTR_FATALMASK) {
4849			device_printf(sc->sc_dev,
4850			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4851			    mac->mac_reason[0], mac->mac_reason[1],
4852			    mac->mac_reason[2], mac->mac_reason[3],
4853			    mac->mac_reason[4], mac->mac_reason[5]);
4854			bwn_restart(mac, "DMA error");
4855			BWN_UNLOCK(sc);
4856			return;
4857		}
4858		if (merged & BWN_DMAINTR_NONFATALMASK) {
4859			device_printf(sc->sc_dev,
4860			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4861			    mac->mac_reason[0], mac->mac_reason[1],
4862			    mac->mac_reason[2], mac->mac_reason[3],
4863			    mac->mac_reason[4], mac->mac_reason[5]);
4864		}
4865	}
4866
4867	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4868		bwn_intr_ucode_debug(mac);
4869	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4870		bwn_intr_tbtt_indication(mac);
4871	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4872		bwn_intr_atim_end(mac);
4873	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4874		bwn_intr_beacon(mac);
4875	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4876		bwn_intr_pmq(mac);
4877	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4878		bwn_intr_noise(mac);
4879
4880	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4881		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4882			bwn_dma_rx(mac->mac_method.dma.rx);
4883			rx = 1;
4884		}
4885	} else
4886		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4887
4888	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4889	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4890	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4891	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4892	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4893
4894	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4895		bwn_intr_txeof(mac);
4896		tx = 1;
4897	}
4898
4899	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4900
4901	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4902		int evt = BWN_LED_EVENT_NONE;
4903
4904		if (tx && rx) {
4905			if (sc->sc_rx_rate > sc->sc_tx_rate)
4906				evt = BWN_LED_EVENT_RX;
4907			else
4908				evt = BWN_LED_EVENT_TX;
4909		} else if (tx) {
4910			evt = BWN_LED_EVENT_TX;
4911		} else if (rx) {
4912			evt = BWN_LED_EVENT_RX;
4913		} else if (rx == 0) {
4914			evt = BWN_LED_EVENT_POLL;
4915		}
4916
4917		if (evt != BWN_LED_EVENT_NONE)
4918			bwn_led_event(mac, evt);
4919       }
4920
4921	if (mbufq_first(&sc->sc_snd) != NULL)
4922		bwn_start(sc);
4923
4924	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4925	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4926
4927	BWN_UNLOCK(sc);
4928}
4929
4930static void
4931bwn_restart(struct bwn_mac *mac, const char *msg)
4932{
4933	struct bwn_softc *sc = mac->mac_sc;
4934	struct ieee80211com *ic = &sc->sc_ic;
4935
4936	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4937		return;
4938
4939	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4940	ieee80211_runtask(ic, &mac->mac_hwreset);
4941}
4942
4943static void
4944bwn_intr_ucode_debug(struct bwn_mac *mac)
4945{
4946	struct bwn_softc *sc = mac->mac_sc;
4947	uint16_t reason;
4948
4949	if (mac->mac_fw.opensource == 0)
4950		return;
4951
4952	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4953	switch (reason) {
4954	case BWN_DEBUGINTR_PANIC:
4955		bwn_handle_fwpanic(mac);
4956		break;
4957	case BWN_DEBUGINTR_DUMP_SHM:
4958		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4959		break;
4960	case BWN_DEBUGINTR_DUMP_REGS:
4961		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4962		break;
4963	case BWN_DEBUGINTR_MARKER:
4964		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4965		break;
4966	default:
4967		device_printf(sc->sc_dev,
4968		    "ucode debug unknown reason: %#x\n", reason);
4969	}
4970
4971	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4972	    BWN_DEBUGINTR_ACK);
4973}
4974
4975static void
4976bwn_intr_tbtt_indication(struct bwn_mac *mac)
4977{
4978	struct bwn_softc *sc = mac->mac_sc;
4979	struct ieee80211com *ic = &sc->sc_ic;
4980
4981	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4982		bwn_psctl(mac, 0);
4983	if (ic->ic_opmode == IEEE80211_M_IBSS)
4984		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4985}
4986
4987static void
4988bwn_intr_atim_end(struct bwn_mac *mac)
4989{
4990
4991	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4992		BWN_WRITE_4(mac, BWN_MACCMD,
4993		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4994		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4995	}
4996}
4997
4998static void
4999bwn_intr_beacon(struct bwn_mac *mac)
5000{
5001	struct bwn_softc *sc = mac->mac_sc;
5002	struct ieee80211com *ic = &sc->sc_ic;
5003	uint32_t cmd, beacon0, beacon1;
5004
5005	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5006	    ic->ic_opmode == IEEE80211_M_MBSS)
5007		return;
5008
5009	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5010
5011	cmd = BWN_READ_4(mac, BWN_MACCMD);
5012	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5013	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5014
5015	if (beacon0 && beacon1) {
5016		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5017		mac->mac_intr_mask |= BWN_INTR_BEACON;
5018		return;
5019	}
5020
5021	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5022		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5023		bwn_load_beacon0(mac);
5024		bwn_load_beacon1(mac);
5025		cmd = BWN_READ_4(mac, BWN_MACCMD);
5026		cmd |= BWN_MACCMD_BEACON0_VALID;
5027		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5028	} else {
5029		if (!beacon0) {
5030			bwn_load_beacon0(mac);
5031			cmd = BWN_READ_4(mac, BWN_MACCMD);
5032			cmd |= BWN_MACCMD_BEACON0_VALID;
5033			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5034		} else if (!beacon1) {
5035			bwn_load_beacon1(mac);
5036			cmd = BWN_READ_4(mac, BWN_MACCMD);
5037			cmd |= BWN_MACCMD_BEACON1_VALID;
5038			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5039		}
5040	}
5041}
5042
5043static void
5044bwn_intr_pmq(struct bwn_mac *mac)
5045{
5046	uint32_t tmp;
5047
5048	while (1) {
5049		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5050		if (!(tmp & 0x00000008))
5051			break;
5052	}
5053	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5054}
5055
5056static void
5057bwn_intr_noise(struct bwn_mac *mac)
5058{
5059	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5060	uint16_t tmp;
5061	uint8_t noise[4];
5062	uint8_t i, j;
5063	int32_t average;
5064
5065	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5066		return;
5067
5068	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5069	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5070	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5071	    noise[3] == 0x7f)
5072		goto new;
5073
5074	KASSERT(mac->mac_noise.noi_nsamples < 8,
5075	    ("%s:%d: fail", __func__, __LINE__));
5076	i = mac->mac_noise.noi_nsamples;
5077	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5078	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5079	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5080	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5081	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5082	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5083	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5084	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5085	mac->mac_noise.noi_nsamples++;
5086	if (mac->mac_noise.noi_nsamples == 8) {
5087		average = 0;
5088		for (i = 0; i < 8; i++) {
5089			for (j = 0; j < 4; j++)
5090				average += mac->mac_noise.noi_samples[i][j];
5091		}
5092		average = (((average / 32) * 125) + 64) / 128;
5093		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5094		if (tmp >= 8)
5095			average += 2;
5096		else
5097			average -= 25;
5098		average -= (tmp == 8) ? 72 : 48;
5099
5100		mac->mac_stats.link_noise = average;
5101		mac->mac_noise.noi_running = 0;
5102		return;
5103	}
5104new:
5105	bwn_noise_gensample(mac);
5106}
5107
5108static int
5109bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5110{
5111	struct bwn_mac *mac = prq->prq_mac;
5112	struct bwn_softc *sc = mac->mac_sc;
5113	unsigned int i;
5114
5115	BWN_ASSERT_LOCKED(sc);
5116
5117	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5118		return (0);
5119
5120	for (i = 0; i < 5000; i++) {
5121		if (bwn_pio_rxeof(prq) == 0)
5122			break;
5123	}
5124	if (i >= 5000)
5125		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5126	return ((i > 0) ? 1 : 0);
5127}
5128
5129static void
5130bwn_dma_rx(struct bwn_dma_ring *dr)
5131{
5132	int slot, curslot;
5133
5134	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5135	curslot = dr->get_curslot(dr);
5136	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5137	    ("%s:%d: fail", __func__, __LINE__));
5138
5139	slot = dr->dr_curslot;
5140	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5141		bwn_dma_rxeof(dr, &slot);
5142
5143	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5144	    BUS_DMASYNC_PREWRITE);
5145
5146	dr->set_curslot(dr, slot);
5147	dr->dr_curslot = slot;
5148}
5149
5150static void
5151bwn_intr_txeof(struct bwn_mac *mac)
5152{
5153	struct bwn_txstatus stat;
5154	uint32_t stat0, stat1;
5155	uint16_t tmp;
5156
5157	BWN_ASSERT_LOCKED(mac->mac_sc);
5158
5159	while (1) {
5160		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5161		if (!(stat0 & 0x00000001))
5162			break;
5163		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5164
5165		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5166		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5167		    __func__,
5168		    stat0,
5169		    stat1);
5170
5171		stat.cookie = (stat0 >> 16);
5172		stat.seq = (stat1 & 0x0000ffff);
5173		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5174		tmp = (stat0 & 0x0000ffff);
5175		stat.framecnt = ((tmp & 0xf000) >> 12);
5176		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5177		stat.sreason = ((tmp & 0x001c) >> 2);
5178		stat.pm = (tmp & 0x0080) ? 1 : 0;
5179		stat.im = (tmp & 0x0040) ? 1 : 0;
5180		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5181		stat.ack = (tmp & 0x0002) ? 1 : 0;
5182
5183		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5184		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5185		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5186		    __func__,
5187		    stat.cookie,
5188		    stat.seq,
5189		    stat.phy_stat,
5190		    stat.framecnt,
5191		    stat.rtscnt,
5192		    stat.sreason,
5193		    stat.pm,
5194		    stat.im,
5195		    stat.ampdu,
5196		    stat.ack);
5197
5198		bwn_handle_txeof(mac, &stat);
5199	}
5200}
5201
5202static void
5203bwn_hwreset(void *arg, int npending)
5204{
5205	struct bwn_mac *mac = arg;
5206	struct bwn_softc *sc = mac->mac_sc;
5207	int error = 0;
5208	int prev_status;
5209
5210	BWN_LOCK(sc);
5211
5212	prev_status = mac->mac_status;
5213	if (prev_status >= BWN_MAC_STATUS_STARTED)
5214		bwn_core_stop(mac);
5215	if (prev_status >= BWN_MAC_STATUS_INITED)
5216		bwn_core_exit(mac);
5217
5218	if (prev_status >= BWN_MAC_STATUS_INITED) {
5219		error = bwn_core_init(mac);
5220		if (error)
5221			goto out;
5222	}
5223	if (prev_status >= BWN_MAC_STATUS_STARTED)
5224		bwn_core_start(mac);
5225out:
5226	if (error) {
5227		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5228		sc->sc_curmac = NULL;
5229	}
5230	BWN_UNLOCK(sc);
5231}
5232
5233static void
5234bwn_handle_fwpanic(struct bwn_mac *mac)
5235{
5236	struct bwn_softc *sc = mac->mac_sc;
5237	uint16_t reason;
5238
5239	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5240	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5241
5242	if (reason == BWN_FWPANIC_RESTART)
5243		bwn_restart(mac, "ucode panic");
5244}
5245
5246static void
5247bwn_load_beacon0(struct bwn_mac *mac)
5248{
5249
5250	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5251}
5252
5253static void
5254bwn_load_beacon1(struct bwn_mac *mac)
5255{
5256
5257	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5258}
5259
5260static uint32_t
5261bwn_jssi_read(struct bwn_mac *mac)
5262{
5263	uint32_t val = 0;
5264
5265	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5266	val <<= 16;
5267	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5268
5269	return (val);
5270}
5271
5272static void
5273bwn_noise_gensample(struct bwn_mac *mac)
5274{
5275	uint32_t jssi = 0x7f7f7f7f;
5276
5277	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5278	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5279	BWN_WRITE_4(mac, BWN_MACCMD,
5280	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5281}
5282
5283static int
5284bwn_dma_freeslot(struct bwn_dma_ring *dr)
5285{
5286	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5287
5288	return (dr->dr_numslots - dr->dr_usedslot);
5289}
5290
5291static int
5292bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5293{
5294	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5295
5296	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5297	    ("%s:%d: fail", __func__, __LINE__));
5298	if (slot == dr->dr_numslots - 1)
5299		return (0);
5300	return (slot + 1);
5301}
5302
5303static void
5304bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5305{
5306	struct bwn_mac *mac = dr->dr_mac;
5307	struct bwn_softc *sc = mac->mac_sc;
5308	struct bwn_dma *dma = &mac->mac_method.dma;
5309	struct bwn_dmadesc_generic *desc;
5310	struct bwn_dmadesc_meta *meta;
5311	struct bwn_rxhdr4 *rxhdr;
5312	struct mbuf *m;
5313	uint32_t macstat;
5314	int32_t tmp;
5315	int cnt = 0;
5316	uint16_t len;
5317
5318	dr->getdesc(dr, *slot, &desc, &meta);
5319
5320	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5321	m = meta->mt_m;
5322
5323	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5324		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5325		return;
5326	}
5327
5328	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5329	len = le16toh(rxhdr->frame_len);
5330	if (len <= 0) {
5331		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5332		return;
5333	}
5334	if (bwn_dma_check_redzone(dr, m)) {
5335		device_printf(sc->sc_dev, "redzone error.\n");
5336		bwn_dma_set_redzone(dr, m);
5337		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5338		    BUS_DMASYNC_PREWRITE);
5339		return;
5340	}
5341	if (len > dr->dr_rx_bufsize) {
5342		tmp = len;
5343		while (1) {
5344			dr->getdesc(dr, *slot, &desc, &meta);
5345			bwn_dma_set_redzone(dr, meta->mt_m);
5346			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5347			    BUS_DMASYNC_PREWRITE);
5348			*slot = bwn_dma_nextslot(dr, *slot);
5349			cnt++;
5350			tmp -= dr->dr_rx_bufsize;
5351			if (tmp <= 0)
5352				break;
5353		}
5354		device_printf(sc->sc_dev, "too small buffer "
5355		       "(len %u buffer %u dropped %d)\n",
5356		       len, dr->dr_rx_bufsize, cnt);
5357		return;
5358	}
5359
5360	switch (mac->mac_fw.fw_hdr_format) {
5361	case BWN_FW_HDR_351:
5362	case BWN_FW_HDR_410:
5363		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5364		break;
5365	case BWN_FW_HDR_598:
5366		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5367		break;
5368	}
5369
5370	if (macstat & BWN_RX_MAC_FCSERR) {
5371		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5372			device_printf(sc->sc_dev, "RX drop\n");
5373			return;
5374		}
5375	}
5376
5377	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5378	m_adj(m, dr->dr_frameoffset);
5379
5380	bwn_rxeof(dr->dr_mac, m, rxhdr);
5381}
5382
5383static void
5384bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5385{
5386	struct bwn_softc *sc = mac->mac_sc;
5387	struct bwn_stats *stats = &mac->mac_stats;
5388
5389	BWN_ASSERT_LOCKED(mac->mac_sc);
5390
5391	if (status->im)
5392		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5393	if (status->ampdu)
5394		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5395	if (status->rtscnt) {
5396		if (status->rtscnt == 0xf)
5397			stats->rtsfail++;
5398		else
5399			stats->rts++;
5400	}
5401
5402	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5403		bwn_dma_handle_txeof(mac, status);
5404	} else {
5405		bwn_pio_handle_txeof(mac, status);
5406	}
5407
5408	bwn_phy_txpower_check(mac, 0);
5409}
5410
5411static uint8_t
5412bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5413{
5414	struct bwn_mac *mac = prq->prq_mac;
5415	struct bwn_softc *sc = mac->mac_sc;
5416	struct bwn_rxhdr4 rxhdr;
5417	struct mbuf *m;
5418	uint32_t ctl32, macstat, v32;
5419	unsigned int i, padding;
5420	uint16_t ctl16, len, totlen, v16;
5421	unsigned char *mp;
5422	char *data;
5423
5424	memset(&rxhdr, 0, sizeof(rxhdr));
5425
5426	if (prq->prq_rev >= 8) {
5427		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5428		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5429			return (0);
5430		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5431		    BWN_PIO8_RXCTL_FRAMEREADY);
5432		for (i = 0; i < 10; i++) {
5433			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5434			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5435				goto ready;
5436			DELAY(10);
5437		}
5438	} else {
5439		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5440		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5441			return (0);
5442		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5443		    BWN_PIO_RXCTL_FRAMEREADY);
5444		for (i = 0; i < 10; i++) {
5445			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5446			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5447				goto ready;
5448			DELAY(10);
5449		}
5450	}
5451	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5452	return (1);
5453ready:
5454	if (prq->prq_rev >= 8)
5455		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5456		    prq->prq_base + BWN_PIO8_RXDATA);
5457	else
5458		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5459		    prq->prq_base + BWN_PIO_RXDATA);
5460	len = le16toh(rxhdr.frame_len);
5461	if (len > 0x700) {
5462		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5463		goto error;
5464	}
5465	if (len == 0) {
5466		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5467		goto error;
5468	}
5469
5470	switch (mac->mac_fw.fw_hdr_format) {
5471	case BWN_FW_HDR_351:
5472	case BWN_FW_HDR_410:
5473		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5474		break;
5475	case BWN_FW_HDR_598:
5476		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5477		break;
5478	}
5479
5480	if (macstat & BWN_RX_MAC_FCSERR) {
5481		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5482			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5483			goto error;
5484		}
5485	}
5486
5487	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5488	totlen = len + padding;
5489	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5490	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5491	if (m == NULL) {
5492		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5493		goto error;
5494	}
5495	mp = mtod(m, unsigned char *);
5496	if (prq->prq_rev >= 8) {
5497		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5498		    prq->prq_base + BWN_PIO8_RXDATA);
5499		if (totlen & 3) {
5500			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5501			data = &(mp[totlen - 1]);
5502			switch (totlen & 3) {
5503			case 3:
5504				*data = (v32 >> 16);
5505				data--;
5506			case 2:
5507				*data = (v32 >> 8);
5508				data--;
5509			case 1:
5510				*data = v32;
5511			}
5512		}
5513	} else {
5514		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5515		    prq->prq_base + BWN_PIO_RXDATA);
5516		if (totlen & 1) {
5517			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5518			mp[totlen - 1] = v16;
5519		}
5520	}
5521
5522	m->m_len = m->m_pkthdr.len = totlen;
5523
5524	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5525
5526	return (1);
5527error:
5528	if (prq->prq_rev >= 8)
5529		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5530		    BWN_PIO8_RXCTL_DATAREADY);
5531	else
5532		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5533	return (1);
5534}
5535
5536static int
5537bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5538    struct bwn_dmadesc_meta *meta, int init)
5539{
5540	struct bwn_mac *mac = dr->dr_mac;
5541	struct bwn_dma *dma = &mac->mac_method.dma;
5542	struct bwn_rxhdr4 *hdr;
5543	bus_dmamap_t map;
5544	bus_addr_t paddr;
5545	struct mbuf *m;
5546	int error;
5547
5548	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5549	if (m == NULL) {
5550		error = ENOBUFS;
5551
5552		/*
5553		 * If the NIC is up and running, we need to:
5554		 * - Clear RX buffer's header.
5555		 * - Restore RX descriptor settings.
5556		 */
5557		if (init)
5558			return (error);
5559		else
5560			goto back;
5561	}
5562	m->m_len = m->m_pkthdr.len = MCLBYTES;
5563
5564	bwn_dma_set_redzone(dr, m);
5565
5566	/*
5567	 * Try to load RX buf into temporary DMA map
5568	 */
5569	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5570	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5571	if (error) {
5572		m_freem(m);
5573
5574		/*
5575		 * See the comment above
5576		 */
5577		if (init)
5578			return (error);
5579		else
5580			goto back;
5581	}
5582
5583	if (!init)
5584		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5585	meta->mt_m = m;
5586	meta->mt_paddr = paddr;
5587
5588	/*
5589	 * Swap RX buf's DMA map with the loaded temporary one
5590	 */
5591	map = meta->mt_dmap;
5592	meta->mt_dmap = dr->dr_spare_dmap;
5593	dr->dr_spare_dmap = map;
5594
5595back:
5596	/*
5597	 * Clear RX buf header
5598	 */
5599	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5600	bzero(hdr, sizeof(*hdr));
5601	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5602	    BUS_DMASYNC_PREWRITE);
5603
5604	/*
5605	 * Setup RX buf descriptor
5606	 */
5607	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5608	    sizeof(*hdr), 0, 0, 0);
5609	return (error);
5610}
5611
5612static void
5613bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5614		 bus_size_t mapsz __unused, int error)
5615{
5616
5617	if (!error) {
5618		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5619		*((bus_addr_t *)arg) = seg->ds_addr;
5620	}
5621}
5622
5623static int
5624bwn_hwrate2ieeerate(int rate)
5625{
5626
5627	switch (rate) {
5628	case BWN_CCK_RATE_1MB:
5629		return (2);
5630	case BWN_CCK_RATE_2MB:
5631		return (4);
5632	case BWN_CCK_RATE_5MB:
5633		return (11);
5634	case BWN_CCK_RATE_11MB:
5635		return (22);
5636	case BWN_OFDM_RATE_6MB:
5637		return (12);
5638	case BWN_OFDM_RATE_9MB:
5639		return (18);
5640	case BWN_OFDM_RATE_12MB:
5641		return (24);
5642	case BWN_OFDM_RATE_18MB:
5643		return (36);
5644	case BWN_OFDM_RATE_24MB:
5645		return (48);
5646	case BWN_OFDM_RATE_36MB:
5647		return (72);
5648	case BWN_OFDM_RATE_48MB:
5649		return (96);
5650	case BWN_OFDM_RATE_54MB:
5651		return (108);
5652	default:
5653		printf("Ooops\n");
5654		return (0);
5655	}
5656}
5657
5658/*
5659 * Post process the RX provided RSSI.
5660 *
5661 * Valid for A, B, G, LP PHYs.
5662 */
5663static int8_t
5664bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5665    int ofdm, int adjust_2053, int adjust_2050)
5666{
5667	struct bwn_phy *phy = &mac->mac_phy;
5668	struct bwn_phy_g *gphy = &phy->phy_g;
5669	int tmp;
5670
5671	switch (phy->rf_ver) {
5672	case 0x2050:
5673		if (ofdm) {
5674			tmp = in_rssi;
5675			if (tmp > 127)
5676				tmp -= 256;
5677			tmp = tmp * 73 / 64;
5678			if (adjust_2050)
5679				tmp += 25;
5680			else
5681				tmp -= 3;
5682		} else {
5683			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5684			    & BWN_BFL_RSSI) {
5685				if (in_rssi > 63)
5686					in_rssi = 63;
5687				tmp = gphy->pg_nrssi_lt[in_rssi];
5688				tmp = (31 - tmp) * -131 / 128 - 57;
5689			} else {
5690				tmp = in_rssi;
5691				tmp = (31 - tmp) * -149 / 128 - 68;
5692			}
5693			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5694				tmp += 25;
5695		}
5696		break;
5697	case 0x2060:
5698		if (in_rssi > 127)
5699			tmp = in_rssi - 256;
5700		else
5701			tmp = in_rssi;
5702		break;
5703	default:
5704		tmp = in_rssi;
5705		tmp = (tmp - 11) * 103 / 64;
5706		if (adjust_2053)
5707			tmp -= 109;
5708		else
5709			tmp -= 83;
5710	}
5711
5712	return (tmp);
5713}
5714
5715static void
5716bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5717{
5718	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5719	struct bwn_plcp6 *plcp;
5720	struct bwn_softc *sc = mac->mac_sc;
5721	struct ieee80211_frame_min *wh;
5722	struct ieee80211_node *ni;
5723	struct ieee80211com *ic = &sc->sc_ic;
5724	uint32_t macstat;
5725	int padding, rate, rssi = 0, noise = 0, type;
5726	uint16_t phytype, phystat0, phystat3, chanstat;
5727	unsigned char *mp = mtod(m, unsigned char *);
5728	static int rx_mac_dec_rpt = 0;
5729
5730	BWN_ASSERT_LOCKED(sc);
5731
5732	phystat0 = le16toh(rxhdr->phy_status0);
5733
5734	/*
5735	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5736	 * used for LP-PHY.
5737	 */
5738	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5739
5740	switch (mac->mac_fw.fw_hdr_format) {
5741	case BWN_FW_HDR_351:
5742	case BWN_FW_HDR_410:
5743		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5744		chanstat = le16toh(rxhdr->ps4.r351.channel);
5745		break;
5746	case BWN_FW_HDR_598:
5747		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5748		chanstat = le16toh(rxhdr->ps4.r598.channel);
5749		break;
5750	}
5751
5752
5753	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5754
5755	if (macstat & BWN_RX_MAC_FCSERR)
5756		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5757	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5758		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5759	if (macstat & BWN_RX_MAC_DECERR)
5760		goto drop;
5761
5762	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5763	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5764		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5765		    m->m_pkthdr.len);
5766		goto drop;
5767	}
5768	plcp = (struct bwn_plcp6 *)(mp + padding);
5769	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5770	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5771		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5772		    m->m_pkthdr.len);
5773		goto drop;
5774	}
5775	wh = mtod(m, struct ieee80211_frame_min *);
5776
5777	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5778		device_printf(sc->sc_dev,
5779		    "RX decryption attempted (old %d keyidx %#x)\n",
5780		    BWN_ISOLDFMT(mac),
5781		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5782
5783	if (phystat0 & BWN_RX_PHYST0_OFDM)
5784		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5785		    phytype == BWN_PHYTYPE_A);
5786	else
5787		rate = bwn_plcp_get_cckrate(mac, plcp);
5788	if (rate == -1) {
5789		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5790			goto drop;
5791	}
5792	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5793
5794	/* rssi/noise */
5795	switch (phytype) {
5796	case BWN_PHYTYPE_A:
5797	case BWN_PHYTYPE_B:
5798	case BWN_PHYTYPE_G:
5799	case BWN_PHYTYPE_LP:
5800		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5801		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5802		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5803		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5804		break;
5805	case BWN_PHYTYPE_N:
5806		/* Broadcom has code for min/avg, but always used max */
5807		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5808			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5809		else
5810			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5811#if 0
5812		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5813		    "%s: power0=%d, power1=%d, power2=%d\n",
5814		    __func__,
5815		    rxhdr->phy.n.power0,
5816		    rxhdr->phy.n.power1,
5817		    rxhdr->ps2.n.power2);
5818#endif
5819		break;
5820	default:
5821		/* XXX TODO: implement rssi for other PHYs */
5822		break;
5823	}
5824
5825	/*
5826	 * RSSI here is absolute, not relative to the noise floor.
5827	 */
5828	noise = mac->mac_stats.link_noise;
5829	rssi = rssi - noise;
5830
5831	/* RX radio tap */
5832	if (ieee80211_radiotap_active(ic))
5833		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5834	m_adj(m, -IEEE80211_CRC_LEN);
5835
5836	BWN_UNLOCK(sc);
5837
5838	ni = ieee80211_find_rxnode(ic, wh);
5839	if (ni != NULL) {
5840		type = ieee80211_input(ni, m, rssi, noise);
5841		ieee80211_free_node(ni);
5842	} else
5843		type = ieee80211_input_all(ic, m, rssi, noise);
5844
5845	BWN_LOCK(sc);
5846	return;
5847drop:
5848	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5849}
5850
5851static void
5852bwn_dma_handle_txeof(struct bwn_mac *mac,
5853    const struct bwn_txstatus *status)
5854{
5855	struct bwn_dma *dma = &mac->mac_method.dma;
5856	struct bwn_dma_ring *dr;
5857	struct bwn_dmadesc_generic *desc;
5858	struct bwn_dmadesc_meta *meta;
5859	struct bwn_softc *sc = mac->mac_sc;
5860	int slot;
5861	int retrycnt = 0;
5862
5863	BWN_ASSERT_LOCKED(sc);
5864
5865	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5866	if (dr == NULL) {
5867		device_printf(sc->sc_dev, "failed to parse cookie\n");
5868		return;
5869	}
5870	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5871
5872	while (1) {
5873		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5874		    ("%s:%d: fail", __func__, __LINE__));
5875		dr->getdesc(dr, slot, &desc, &meta);
5876
5877		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5878			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5879		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5880			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5881
5882		if (meta->mt_islast) {
5883			KASSERT(meta->mt_m != NULL,
5884			    ("%s:%d: fail", __func__, __LINE__));
5885
5886			/*
5887			 * If we don't get an ACK, then we should log the
5888			 * full framecnt.  That may be 0 if it's a PHY
5889			 * failure, so ensure that gets logged as some
5890			 * retry attempt.
5891			 */
5892			if (status->ack) {
5893				retrycnt = status->framecnt - 1;
5894			} else {
5895				retrycnt = status->framecnt;
5896				if (retrycnt == 0)
5897					retrycnt = 1;
5898			}
5899			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5900			    status->ack ?
5901			      IEEE80211_RATECTL_TX_SUCCESS :
5902			      IEEE80211_RATECTL_TX_FAILURE,
5903			    &retrycnt, 0);
5904			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5905			meta->mt_ni = NULL;
5906			meta->mt_m = NULL;
5907		} else
5908			KASSERT(meta->mt_m == NULL,
5909			    ("%s:%d: fail", __func__, __LINE__));
5910
5911		dr->dr_usedslot--;
5912		if (meta->mt_islast)
5913			break;
5914		slot = bwn_dma_nextslot(dr, slot);
5915	}
5916	sc->sc_watchdog_timer = 0;
5917	if (dr->dr_stop) {
5918		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5919		    ("%s:%d: fail", __func__, __LINE__));
5920		dr->dr_stop = 0;
5921	}
5922}
5923
5924static void
5925bwn_pio_handle_txeof(struct bwn_mac *mac,
5926    const struct bwn_txstatus *status)
5927{
5928	struct bwn_pio_txqueue *tq;
5929	struct bwn_pio_txpkt *tp = NULL;
5930	struct bwn_softc *sc = mac->mac_sc;
5931	int retrycnt = 0;
5932
5933	BWN_ASSERT_LOCKED(sc);
5934
5935	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5936	if (tq == NULL)
5937		return;
5938
5939	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5940	tq->tq_free++;
5941
5942	if (tp->tp_ni != NULL) {
5943		/*
5944		 * Do any tx complete callback.  Note this must
5945		 * be done before releasing the node reference.
5946		 */
5947
5948		/*
5949		 * If we don't get an ACK, then we should log the
5950		 * full framecnt.  That may be 0 if it's a PHY
5951		 * failure, so ensure that gets logged as some
5952		 * retry attempt.
5953		 */
5954		if (status->ack) {
5955			retrycnt = status->framecnt - 1;
5956		} else {
5957			retrycnt = status->framecnt;
5958			if (retrycnt == 0)
5959				retrycnt = 1;
5960		}
5961		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5962		    status->ack ?
5963		      IEEE80211_RATECTL_TX_SUCCESS :
5964		      IEEE80211_RATECTL_TX_FAILURE,
5965		    &retrycnt, 0);
5966
5967		if (tp->tp_m->m_flags & M_TXCB)
5968			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5969		ieee80211_free_node(tp->tp_ni);
5970		tp->tp_ni = NULL;
5971	}
5972	m_freem(tp->tp_m);
5973	tp->tp_m = NULL;
5974	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5975
5976	sc->sc_watchdog_timer = 0;
5977}
5978
5979static void
5980bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5981{
5982	struct bwn_softc *sc = mac->mac_sc;
5983	struct bwn_phy *phy = &mac->mac_phy;
5984	struct ieee80211com *ic = &sc->sc_ic;
5985	unsigned long now;
5986	bwn_txpwr_result_t result;
5987
5988	BWN_GETTIME(now);
5989
5990	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5991		return;
5992	phy->nexttime = now + 2 * 1000;
5993
5994	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5995	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5996		return;
5997
5998	if (phy->recalc_txpwr != NULL) {
5999		result = phy->recalc_txpwr(mac,
6000		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6001		if (result == BWN_TXPWR_RES_DONE)
6002			return;
6003		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6004		    ("%s: fail", __func__));
6005		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6006
6007		ieee80211_runtask(ic, &mac->mac_txpower);
6008	}
6009}
6010
6011static uint16_t
6012bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6013{
6014
6015	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6016}
6017
6018static uint32_t
6019bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6020{
6021
6022	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6023}
6024
6025static void
6026bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6027{
6028
6029	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6030}
6031
6032static void
6033bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6034{
6035
6036	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6037}
6038
6039static int
6040bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6041{
6042
6043	switch (rate) {
6044	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6045	case 12:
6046		return (BWN_OFDM_RATE_6MB);
6047	case 18:
6048		return (BWN_OFDM_RATE_9MB);
6049	case 24:
6050		return (BWN_OFDM_RATE_12MB);
6051	case 36:
6052		return (BWN_OFDM_RATE_18MB);
6053	case 48:
6054		return (BWN_OFDM_RATE_24MB);
6055	case 72:
6056		return (BWN_OFDM_RATE_36MB);
6057	case 96:
6058		return (BWN_OFDM_RATE_48MB);
6059	case 108:
6060		return (BWN_OFDM_RATE_54MB);
6061	/* CCK rates (NB: not IEEE std, device-specific) */
6062	case 2:
6063		return (BWN_CCK_RATE_1MB);
6064	case 4:
6065		return (BWN_CCK_RATE_2MB);
6066	case 11:
6067		return (BWN_CCK_RATE_5MB);
6068	case 22:
6069		return (BWN_CCK_RATE_11MB);
6070	}
6071
6072	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6073	return (BWN_CCK_RATE_1MB);
6074}
6075
6076static uint16_t
6077bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6078{
6079	struct bwn_phy *phy = &mac->mac_phy;
6080	uint16_t control = 0;
6081	uint16_t bw;
6082
6083	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6084	bw = BWN_TXH_PHY1_BW_20;
6085
6086	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6087		control = bw;
6088	} else {
6089		control = bw;
6090		/* Figure out coding rate and modulation */
6091		/* XXX TODO: table-ize, for MCS transmit */
6092		/* Note: this is BWN_*_RATE values */
6093		switch (bitrate) {
6094		case BWN_CCK_RATE_1MB:
6095			control |= 0;
6096			break;
6097		case BWN_CCK_RATE_2MB:
6098			control |= 1;
6099			break;
6100		case BWN_CCK_RATE_5MB:
6101			control |= 2;
6102			break;
6103		case BWN_CCK_RATE_11MB:
6104			control |= 3;
6105			break;
6106		case BWN_OFDM_RATE_6MB:
6107			control |= BWN_TXH_PHY1_CRATE_1_2;
6108			control |= BWN_TXH_PHY1_MODUL_BPSK;
6109			break;
6110		case BWN_OFDM_RATE_9MB:
6111			control |= BWN_TXH_PHY1_CRATE_3_4;
6112			control |= BWN_TXH_PHY1_MODUL_BPSK;
6113			break;
6114		case BWN_OFDM_RATE_12MB:
6115			control |= BWN_TXH_PHY1_CRATE_1_2;
6116			control |= BWN_TXH_PHY1_MODUL_QPSK;
6117			break;
6118		case BWN_OFDM_RATE_18MB:
6119			control |= BWN_TXH_PHY1_CRATE_3_4;
6120			control |= BWN_TXH_PHY1_MODUL_QPSK;
6121			break;
6122		case BWN_OFDM_RATE_24MB:
6123			control |= BWN_TXH_PHY1_CRATE_1_2;
6124			control |= BWN_TXH_PHY1_MODUL_QAM16;
6125			break;
6126		case BWN_OFDM_RATE_36MB:
6127			control |= BWN_TXH_PHY1_CRATE_3_4;
6128			control |= BWN_TXH_PHY1_MODUL_QAM16;
6129			break;
6130		case BWN_OFDM_RATE_48MB:
6131			control |= BWN_TXH_PHY1_CRATE_1_2;
6132			control |= BWN_TXH_PHY1_MODUL_QAM64;
6133			break;
6134		case BWN_OFDM_RATE_54MB:
6135			control |= BWN_TXH_PHY1_CRATE_3_4;
6136			control |= BWN_TXH_PHY1_MODUL_QAM64;
6137			break;
6138		default:
6139			break;
6140		}
6141		control |= BWN_TXH_PHY1_MODE_SISO;
6142	}
6143
6144	return control;
6145}
6146
6147static int
6148bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6149    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6150{
6151	const struct bwn_phy *phy = &mac->mac_phy;
6152	struct bwn_softc *sc = mac->mac_sc;
6153	struct ieee80211_frame *wh;
6154	struct ieee80211_frame *protwh;
6155	struct ieee80211_frame_cts *cts;
6156	struct ieee80211_frame_rts *rts;
6157	const struct ieee80211_txparam *tp;
6158	struct ieee80211vap *vap = ni->ni_vap;
6159	struct ieee80211com *ic = &sc->sc_ic;
6160	struct mbuf *mprot;
6161	unsigned int len;
6162	uint32_t macctl = 0;
6163	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6164	uint16_t phyctl = 0;
6165	uint8_t rate, rate_fb;
6166	int fill_phy_ctl1 = 0;
6167
6168	wh = mtod(m, struct ieee80211_frame *);
6169	memset(txhdr, 0, sizeof(*txhdr));
6170
6171	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6172	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6173	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6174
6175	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6176	    || (phy->type == BWN_PHYTYPE_HT))
6177		fill_phy_ctl1 = 1;
6178
6179	/*
6180	 * Find TX rate
6181	 */
6182	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6183	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6184		rate = rate_fb = tp->mgmtrate;
6185	else if (ismcast)
6186		rate = rate_fb = tp->mcastrate;
6187	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6188		rate = rate_fb = tp->ucastrate;
6189	else {
6190		/* XXX TODO: don't fall back to CCK rates for OFDM */
6191		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6192		rate = ni->ni_txrate;
6193
6194		if (rix > 0)
6195			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6196			    IEEE80211_RATE_VAL;
6197		else
6198			rate_fb = rate;
6199	}
6200
6201	sc->sc_tx_rate = rate;
6202
6203	/* Note: this maps the select ieee80211 rate to hardware rate */
6204	rate = bwn_ieeerate2hwrate(sc, rate);
6205	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6206
6207	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6208	    bwn_plcp_getcck(rate);
6209	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6210	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6211
6212	/* XXX rate/rate_fb is the hardware rate */
6213	if ((rate_fb == rate) ||
6214	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6215	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6216		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6217	else
6218		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6219		    m->m_pkthdr.len, rate, isshort);
6220
6221	/* XXX TX encryption */
6222
6223	switch (mac->mac_fw.fw_hdr_format) {
6224	case BWN_FW_HDR_351:
6225		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6226		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6227		break;
6228	case BWN_FW_HDR_410:
6229		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6230		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6231		break;
6232	case BWN_FW_HDR_598:
6233		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6234		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6235		break;
6236	}
6237
6238	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6239	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6240
6241	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6242	    BWN_TX_EFT_FB_CCK;
6243	txhdr->chan = phy->chan;
6244	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6245	    BWN_TX_PHY_ENC_CCK;
6246	/* XXX preamble? obey net80211 */
6247	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6248	     rate == BWN_CCK_RATE_11MB))
6249		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6250
6251	if (! phy->gmode)
6252		macctl |= BWN_TX_MAC_5GHZ;
6253
6254	/* XXX TX antenna selection */
6255
6256	switch (bwn_antenna_sanitize(mac, 0)) {
6257	case 0:
6258		phyctl |= BWN_TX_PHY_ANT01AUTO;
6259		break;
6260	case 1:
6261		phyctl |= BWN_TX_PHY_ANT0;
6262		break;
6263	case 2:
6264		phyctl |= BWN_TX_PHY_ANT1;
6265		break;
6266	case 3:
6267		phyctl |= BWN_TX_PHY_ANT2;
6268		break;
6269	case 4:
6270		phyctl |= BWN_TX_PHY_ANT3;
6271		break;
6272	default:
6273		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6274	}
6275
6276	if (!ismcast)
6277		macctl |= BWN_TX_MAC_ACK;
6278
6279	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6280	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6281	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6282		macctl |= BWN_TX_MAC_LONGFRAME;
6283
6284	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6285		/* XXX RTS rate is always 1MB??? */
6286		/* XXX TODO: don't fall back to CCK rates for OFDM */
6287		rts_rate = BWN_CCK_RATE_1MB;
6288		rts_rate_fb = bwn_get_fbrate(rts_rate);
6289
6290		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6291		protdur = ieee80211_compute_duration(ic->ic_rt,
6292		    m->m_pkthdr.len, rate, isshort) +
6293		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6294
6295		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6296
6297			switch (mac->mac_fw.fw_hdr_format) {
6298			case BWN_FW_HDR_351:
6299				cts = (struct ieee80211_frame_cts *)
6300				    txhdr->body.r351.rts_frame;
6301				break;
6302			case BWN_FW_HDR_410:
6303				cts = (struct ieee80211_frame_cts *)
6304				    txhdr->body.r410.rts_frame;
6305				break;
6306			case BWN_FW_HDR_598:
6307				cts = (struct ieee80211_frame_cts *)
6308				    txhdr->body.r598.rts_frame;
6309				break;
6310			}
6311
6312			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6313			    protdur);
6314			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6315			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6316			    mprot->m_pkthdr.len);
6317			m_freem(mprot);
6318			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6319			len = sizeof(struct ieee80211_frame_cts);
6320		} else {
6321			switch (mac->mac_fw.fw_hdr_format) {
6322			case BWN_FW_HDR_351:
6323				rts = (struct ieee80211_frame_rts *)
6324				    txhdr->body.r351.rts_frame;
6325				break;
6326			case BWN_FW_HDR_410:
6327				rts = (struct ieee80211_frame_rts *)
6328				    txhdr->body.r410.rts_frame;
6329				break;
6330			case BWN_FW_HDR_598:
6331				rts = (struct ieee80211_frame_rts *)
6332				    txhdr->body.r598.rts_frame;
6333				break;
6334			}
6335
6336			/* XXX rate/rate_fb is the hardware rate */
6337			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6338			    isshort);
6339			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6340			    wh->i_addr2, protdur);
6341			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6342			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6343			    mprot->m_pkthdr.len);
6344			m_freem(mprot);
6345			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6346			len = sizeof(struct ieee80211_frame_rts);
6347		}
6348		len += IEEE80211_CRC_LEN;
6349
6350		switch (mac->mac_fw.fw_hdr_format) {
6351		case BWN_FW_HDR_351:
6352			bwn_plcp_genhdr((struct bwn_plcp4 *)
6353			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6354			break;
6355		case BWN_FW_HDR_410:
6356			bwn_plcp_genhdr((struct bwn_plcp4 *)
6357			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6358			break;
6359		case BWN_FW_HDR_598:
6360			bwn_plcp_genhdr((struct bwn_plcp4 *)
6361			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6362			break;
6363		}
6364
6365		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6366		    rts_rate_fb);
6367
6368		switch (mac->mac_fw.fw_hdr_format) {
6369		case BWN_FW_HDR_351:
6370			protwh = (struct ieee80211_frame *)
6371			    &txhdr->body.r351.rts_frame;
6372			break;
6373		case BWN_FW_HDR_410:
6374			protwh = (struct ieee80211_frame *)
6375			    &txhdr->body.r410.rts_frame;
6376			break;
6377		case BWN_FW_HDR_598:
6378			protwh = (struct ieee80211_frame *)
6379			    &txhdr->body.r598.rts_frame;
6380			break;
6381		}
6382
6383		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6384
6385		if (BWN_ISOFDMRATE(rts_rate)) {
6386			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6387			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6388		} else {
6389			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6390			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6391		}
6392		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6393		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6394
6395		if (fill_phy_ctl1) {
6396			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6397			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6398		}
6399	}
6400
6401	if (fill_phy_ctl1) {
6402		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6403		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6404	}
6405
6406	switch (mac->mac_fw.fw_hdr_format) {
6407	case BWN_FW_HDR_351:
6408		txhdr->body.r351.cookie = htole16(cookie);
6409		break;
6410	case BWN_FW_HDR_410:
6411		txhdr->body.r410.cookie = htole16(cookie);
6412		break;
6413	case BWN_FW_HDR_598:
6414		txhdr->body.r598.cookie = htole16(cookie);
6415		break;
6416	}
6417
6418	txhdr->macctl = htole32(macctl);
6419	txhdr->phyctl = htole16(phyctl);
6420
6421	/*
6422	 * TX radio tap
6423	 */
6424	if (ieee80211_radiotap_active_vap(vap)) {
6425		sc->sc_tx_th.wt_flags = 0;
6426		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6427			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6428		if (isshort &&
6429		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6430		     rate == BWN_CCK_RATE_11MB))
6431			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6432		sc->sc_tx_th.wt_rate = rate;
6433
6434		ieee80211_radiotap_tx(vap, m);
6435	}
6436
6437	return (0);
6438}
6439
6440static void
6441bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6442    const uint8_t rate)
6443{
6444	uint32_t d, plen;
6445	uint8_t *raw = plcp->o.raw;
6446
6447	if (BWN_ISOFDMRATE(rate)) {
6448		d = bwn_plcp_getofdm(rate);
6449		KASSERT(!(octets & 0xf000),
6450		    ("%s:%d: fail", __func__, __LINE__));
6451		d |= (octets << 5);
6452		plcp->o.data = htole32(d);
6453	} else {
6454		plen = octets * 16 / rate;
6455		if ((octets * 16 % rate) > 0) {
6456			plen++;
6457			if ((rate == BWN_CCK_RATE_11MB)
6458			    && ((octets * 8 % 11) < 4)) {
6459				raw[1] = 0x84;
6460			} else
6461				raw[1] = 0x04;
6462		} else
6463			raw[1] = 0x04;
6464		plcp->o.data |= htole32(plen << 16);
6465		raw[0] = bwn_plcp_getcck(rate);
6466	}
6467}
6468
6469static uint8_t
6470bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6471{
6472	struct bwn_softc *sc = mac->mac_sc;
6473	uint8_t mask;
6474
6475	if (n == 0)
6476		return (0);
6477	if (mac->mac_phy.gmode)
6478		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6479	else
6480		mask = siba_sprom_get_ant_a(sc->sc_dev);
6481	if (!(mask & (1 << (n - 1))))
6482		return (0);
6483	return (n);
6484}
6485
6486/*
6487 * Return a fallback rate for the given rate.
6488 *
6489 * Note: Don't fall back from OFDM to CCK.
6490 */
6491static uint8_t
6492bwn_get_fbrate(uint8_t bitrate)
6493{
6494	switch (bitrate) {
6495	/* CCK */
6496	case BWN_CCK_RATE_1MB:
6497		return (BWN_CCK_RATE_1MB);
6498	case BWN_CCK_RATE_2MB:
6499		return (BWN_CCK_RATE_1MB);
6500	case BWN_CCK_RATE_5MB:
6501		return (BWN_CCK_RATE_2MB);
6502	case BWN_CCK_RATE_11MB:
6503		return (BWN_CCK_RATE_5MB);
6504
6505	/* OFDM */
6506	case BWN_OFDM_RATE_6MB:
6507		return (BWN_OFDM_RATE_6MB);
6508	case BWN_OFDM_RATE_9MB:
6509		return (BWN_OFDM_RATE_6MB);
6510	case BWN_OFDM_RATE_12MB:
6511		return (BWN_OFDM_RATE_9MB);
6512	case BWN_OFDM_RATE_18MB:
6513		return (BWN_OFDM_RATE_12MB);
6514	case BWN_OFDM_RATE_24MB:
6515		return (BWN_OFDM_RATE_18MB);
6516	case BWN_OFDM_RATE_36MB:
6517		return (BWN_OFDM_RATE_24MB);
6518	case BWN_OFDM_RATE_48MB:
6519		return (BWN_OFDM_RATE_36MB);
6520	case BWN_OFDM_RATE_54MB:
6521		return (BWN_OFDM_RATE_48MB);
6522	}
6523	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6524	return (0);
6525}
6526
6527static uint32_t
6528bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6529    uint32_t ctl, const void *_data, int len)
6530{
6531	struct bwn_softc *sc = mac->mac_sc;
6532	uint32_t value = 0;
6533	const uint8_t *data = _data;
6534
6535	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6536	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6537	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6538
6539	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6540	    tq->tq_base + BWN_PIO8_TXDATA);
6541	if (len & 3) {
6542		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6543		    BWN_PIO8_TXCTL_24_31);
6544		data = &(data[len - 1]);
6545		switch (len & 3) {
6546		case 3:
6547			ctl |= BWN_PIO8_TXCTL_16_23;
6548			value |= (uint32_t)(*data) << 16;
6549			data--;
6550		case 2:
6551			ctl |= BWN_PIO8_TXCTL_8_15;
6552			value |= (uint32_t)(*data) << 8;
6553			data--;
6554		case 1:
6555			value |= (uint32_t)(*data);
6556		}
6557		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6558		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6559	}
6560
6561	return (ctl);
6562}
6563
6564static void
6565bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6566    uint16_t offset, uint32_t value)
6567{
6568
6569	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6570}
6571
6572static uint16_t
6573bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6574    uint16_t ctl, const void *_data, int len)
6575{
6576	struct bwn_softc *sc = mac->mac_sc;
6577	const uint8_t *data = _data;
6578
6579	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6580	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6581
6582	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6583	    tq->tq_base + BWN_PIO_TXDATA);
6584	if (len & 1) {
6585		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6586		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6587		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6588	}
6589
6590	return (ctl);
6591}
6592
6593static uint16_t
6594bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6595    uint16_t ctl, struct mbuf *m0)
6596{
6597	int i, j = 0;
6598	uint16_t data = 0;
6599	const uint8_t *buf;
6600	struct mbuf *m = m0;
6601
6602	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6603	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6604
6605	for (; m != NULL; m = m->m_next) {
6606		buf = mtod(m, const uint8_t *);
6607		for (i = 0; i < m->m_len; i++) {
6608			if (!((j++) % 2))
6609				data |= buf[i];
6610			else {
6611				data |= (buf[i] << 8);
6612				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6613				data = 0;
6614			}
6615		}
6616	}
6617	if (m0->m_pkthdr.len % 2) {
6618		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6619		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6620		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6621	}
6622
6623	return (ctl);
6624}
6625
6626static void
6627bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6628{
6629
6630	/* XXX should exit if 5GHz band .. */
6631	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6632		return;
6633
6634	BWN_WRITE_2(mac, 0x684, 510 + time);
6635	/* Disabled in Linux b43, can adversely effect performance */
6636#if 0
6637	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6638#endif
6639}
6640
6641static struct bwn_dma_ring *
6642bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6643{
6644
6645	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6646		return (mac->mac_method.dma.wme[WME_AC_BE]);
6647
6648	switch (prio) {
6649	case 3:
6650		return (mac->mac_method.dma.wme[WME_AC_VO]);
6651	case 2:
6652		return (mac->mac_method.dma.wme[WME_AC_VI]);
6653	case 0:
6654		return (mac->mac_method.dma.wme[WME_AC_BE]);
6655	case 1:
6656		return (mac->mac_method.dma.wme[WME_AC_BK]);
6657	}
6658	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6659	return (NULL);
6660}
6661
6662static int
6663bwn_dma_getslot(struct bwn_dma_ring *dr)
6664{
6665	int slot;
6666
6667	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6668
6669	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6670	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6671	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6672
6673	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6674	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6675	dr->dr_curslot = slot;
6676	dr->dr_usedslot++;
6677
6678	return (slot);
6679}
6680
6681static struct bwn_pio_txqueue *
6682bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6683    struct bwn_pio_txpkt **pack)
6684{
6685	struct bwn_pio *pio = &mac->mac_method.pio;
6686	struct bwn_pio_txqueue *tq = NULL;
6687	unsigned int index;
6688
6689	switch (cookie & 0xf000) {
6690	case 0x1000:
6691		tq = &pio->wme[WME_AC_BK];
6692		break;
6693	case 0x2000:
6694		tq = &pio->wme[WME_AC_BE];
6695		break;
6696	case 0x3000:
6697		tq = &pio->wme[WME_AC_VI];
6698		break;
6699	case 0x4000:
6700		tq = &pio->wme[WME_AC_VO];
6701		break;
6702	case 0x5000:
6703		tq = &pio->mcast;
6704		break;
6705	}
6706	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6707	if (tq == NULL)
6708		return (NULL);
6709	index = (cookie & 0x0fff);
6710	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6711	if (index >= N(tq->tq_pkts))
6712		return (NULL);
6713	*pack = &tq->tq_pkts[index];
6714	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6715	return (tq);
6716}
6717
6718static void
6719bwn_txpwr(void *arg, int npending)
6720{
6721	struct bwn_mac *mac = arg;
6722	struct bwn_softc *sc = mac->mac_sc;
6723
6724	BWN_LOCK(sc);
6725	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6726	    mac->mac_phy.set_txpwr != NULL)
6727		mac->mac_phy.set_txpwr(mac);
6728	BWN_UNLOCK(sc);
6729}
6730
6731static void
6732bwn_task_15s(struct bwn_mac *mac)
6733{
6734	uint16_t reg;
6735
6736	if (mac->mac_fw.opensource) {
6737		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6738		if (reg) {
6739			bwn_restart(mac, "fw watchdog");
6740			return;
6741		}
6742		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6743	}
6744	if (mac->mac_phy.task_15s)
6745		mac->mac_phy.task_15s(mac);
6746
6747	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6748}
6749
6750static void
6751bwn_task_30s(struct bwn_mac *mac)
6752{
6753
6754	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6755		return;
6756	mac->mac_noise.noi_running = 1;
6757	mac->mac_noise.noi_nsamples = 0;
6758
6759	bwn_noise_gensample(mac);
6760}
6761
6762static void
6763bwn_task_60s(struct bwn_mac *mac)
6764{
6765
6766	if (mac->mac_phy.task_60s)
6767		mac->mac_phy.task_60s(mac);
6768	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6769}
6770
6771static void
6772bwn_tasks(void *arg)
6773{
6774	struct bwn_mac *mac = arg;
6775	struct bwn_softc *sc = mac->mac_sc;
6776
6777	BWN_ASSERT_LOCKED(sc);
6778	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6779		return;
6780
6781	if (mac->mac_task_state % 4 == 0)
6782		bwn_task_60s(mac);
6783	if (mac->mac_task_state % 2 == 0)
6784		bwn_task_30s(mac);
6785	bwn_task_15s(mac);
6786
6787	mac->mac_task_state++;
6788	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6789}
6790
6791static int
6792bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6793{
6794	struct bwn_softc *sc = mac->mac_sc;
6795
6796	KASSERT(a == 0, ("not support APHY\n"));
6797
6798	switch (plcp->o.raw[0] & 0xf) {
6799	case 0xb:
6800		return (BWN_OFDM_RATE_6MB);
6801	case 0xf:
6802		return (BWN_OFDM_RATE_9MB);
6803	case 0xa:
6804		return (BWN_OFDM_RATE_12MB);
6805	case 0xe:
6806		return (BWN_OFDM_RATE_18MB);
6807	case 0x9:
6808		return (BWN_OFDM_RATE_24MB);
6809	case 0xd:
6810		return (BWN_OFDM_RATE_36MB);
6811	case 0x8:
6812		return (BWN_OFDM_RATE_48MB);
6813	case 0xc:
6814		return (BWN_OFDM_RATE_54MB);
6815	}
6816	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6817	    plcp->o.raw[0] & 0xf);
6818	return (-1);
6819}
6820
6821static int
6822bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6823{
6824	struct bwn_softc *sc = mac->mac_sc;
6825
6826	switch (plcp->o.raw[0]) {
6827	case 0x0a:
6828		return (BWN_CCK_RATE_1MB);
6829	case 0x14:
6830		return (BWN_CCK_RATE_2MB);
6831	case 0x37:
6832		return (BWN_CCK_RATE_5MB);
6833	case 0x6e:
6834		return (BWN_CCK_RATE_11MB);
6835	}
6836	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6837	return (-1);
6838}
6839
6840static void
6841bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6842    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6843    int rssi, int noise)
6844{
6845	struct bwn_softc *sc = mac->mac_sc;
6846	const struct ieee80211_frame_min *wh;
6847	uint64_t tsf;
6848	uint16_t low_mactime_now;
6849	uint16_t mt;
6850
6851	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6852		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6853
6854	wh = mtod(m, const struct ieee80211_frame_min *);
6855	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6856		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6857
6858	bwn_tsf_read(mac, &tsf);
6859	low_mactime_now = tsf;
6860	tsf = tsf & ~0xffffULL;
6861
6862	switch (mac->mac_fw.fw_hdr_format) {
6863	case BWN_FW_HDR_351:
6864	case BWN_FW_HDR_410:
6865		mt = le16toh(rxhdr->ps4.r351.mac_time);
6866		break;
6867	case BWN_FW_HDR_598:
6868		mt = le16toh(rxhdr->ps4.r598.mac_time);
6869		break;
6870	}
6871
6872	tsf += mt;
6873	if (low_mactime_now < mt)
6874		tsf -= 0x10000;
6875
6876	sc->sc_rx_th.wr_tsf = tsf;
6877	sc->sc_rx_th.wr_rate = rate;
6878	sc->sc_rx_th.wr_antsignal = rssi;
6879	sc->sc_rx_th.wr_antnoise = noise;
6880}
6881
6882static void
6883bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6884{
6885	uint32_t low, high;
6886
6887	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6888	    ("%s:%d: fail", __func__, __LINE__));
6889
6890	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6891	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6892	*tsf = high;
6893	*tsf <<= 32;
6894	*tsf |= low;
6895}
6896
6897static int
6898bwn_dma_attach(struct bwn_mac *mac)
6899{
6900	struct bwn_dma *dma = &mac->mac_method.dma;
6901	struct bwn_softc *sc = mac->mac_sc;
6902	bus_addr_t lowaddr = 0;
6903	int error;
6904
6905	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6906		return (0);
6907
6908	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6909
6910	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6911
6912	dma->dmatype = bwn_dma_gettype(mac);
6913	if (dma->dmatype == BWN_DMA_30BIT)
6914		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6915	else if (dma->dmatype == BWN_DMA_32BIT)
6916		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6917	else
6918		lowaddr = BUS_SPACE_MAXADDR;
6919
6920	/*
6921	 * Create top level DMA tag
6922	 */
6923	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6924			       BWN_ALIGN, 0,		/* alignment, bounds */
6925			       lowaddr,			/* lowaddr */
6926			       BUS_SPACE_MAXADDR,	/* highaddr */
6927			       NULL, NULL,		/* filter, filterarg */
6928			       BUS_SPACE_MAXSIZE,	/* maxsize */
6929			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6930			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6931			       0,			/* flags */
6932			       NULL, NULL,		/* lockfunc, lockarg */
6933			       &dma->parent_dtag);
6934	if (error) {
6935		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6936		return (error);
6937	}
6938
6939	/*
6940	 * Create TX/RX mbuf DMA tag
6941	 */
6942	error = bus_dma_tag_create(dma->parent_dtag,
6943				1,
6944				0,
6945				BUS_SPACE_MAXADDR,
6946				BUS_SPACE_MAXADDR,
6947				NULL, NULL,
6948				MCLBYTES,
6949				1,
6950				BUS_SPACE_MAXSIZE_32BIT,
6951				0,
6952				NULL, NULL,
6953				&dma->rxbuf_dtag);
6954	if (error) {
6955		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6956		goto fail0;
6957	}
6958	error = bus_dma_tag_create(dma->parent_dtag,
6959				1,
6960				0,
6961				BUS_SPACE_MAXADDR,
6962				BUS_SPACE_MAXADDR,
6963				NULL, NULL,
6964				MCLBYTES,
6965				1,
6966				BUS_SPACE_MAXSIZE_32BIT,
6967				0,
6968				NULL, NULL,
6969				&dma->txbuf_dtag);
6970	if (error) {
6971		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6972		goto fail1;
6973	}
6974
6975	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6976	if (!dma->wme[WME_AC_BK])
6977		goto fail2;
6978
6979	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6980	if (!dma->wme[WME_AC_BE])
6981		goto fail3;
6982
6983	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6984	if (!dma->wme[WME_AC_VI])
6985		goto fail4;
6986
6987	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6988	if (!dma->wme[WME_AC_VO])
6989		goto fail5;
6990
6991	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6992	if (!dma->mcast)
6993		goto fail6;
6994	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6995	if (!dma->rx)
6996		goto fail7;
6997
6998	return (error);
6999
7000fail7:	bwn_dma_ringfree(&dma->mcast);
7001fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7002fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7003fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7004fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7005fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7006fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7007fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7008	return (error);
7009}
7010
7011static struct bwn_dma_ring *
7012bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7013    uint16_t cookie, int *slot)
7014{
7015	struct bwn_dma *dma = &mac->mac_method.dma;
7016	struct bwn_dma_ring *dr;
7017	struct bwn_softc *sc = mac->mac_sc;
7018
7019	BWN_ASSERT_LOCKED(mac->mac_sc);
7020
7021	switch (cookie & 0xf000) {
7022	case 0x1000:
7023		dr = dma->wme[WME_AC_BK];
7024		break;
7025	case 0x2000:
7026		dr = dma->wme[WME_AC_BE];
7027		break;
7028	case 0x3000:
7029		dr = dma->wme[WME_AC_VI];
7030		break;
7031	case 0x4000:
7032		dr = dma->wme[WME_AC_VO];
7033		break;
7034	case 0x5000:
7035		dr = dma->mcast;
7036		break;
7037	default:
7038		dr = NULL;
7039		KASSERT(0 == 1,
7040		    ("invalid cookie value %d", cookie & 0xf000));
7041	}
7042	*slot = (cookie & 0x0fff);
7043	if (*slot < 0 || *slot >= dr->dr_numslots) {
7044		/*
7045		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7046		 * that it occurs events which have same H/W sequence numbers.
7047		 * When it's occurred just prints a WARNING msgs and ignores.
7048		 */
7049		KASSERT(status->seq == dma->lastseq,
7050		    ("%s:%d: fail", __func__, __LINE__));
7051		device_printf(sc->sc_dev,
7052		    "out of slot ranges (0 < %d < %d)\n", *slot,
7053		    dr->dr_numslots);
7054		return (NULL);
7055	}
7056	dma->lastseq = status->seq;
7057	return (dr);
7058}
7059
7060static void
7061bwn_dma_stop(struct bwn_mac *mac)
7062{
7063	struct bwn_dma *dma;
7064
7065	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7066		return;
7067	dma = &mac->mac_method.dma;
7068
7069	bwn_dma_ringstop(&dma->rx);
7070	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7071	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7072	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7073	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7074	bwn_dma_ringstop(&dma->mcast);
7075}
7076
7077static void
7078bwn_dma_ringstop(struct bwn_dma_ring **dr)
7079{
7080
7081	if (dr == NULL)
7082		return;
7083
7084	bwn_dma_cleanup(*dr);
7085}
7086
7087static void
7088bwn_pio_stop(struct bwn_mac *mac)
7089{
7090	struct bwn_pio *pio;
7091
7092	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7093		return;
7094	pio = &mac->mac_method.pio;
7095
7096	bwn_destroy_queue_tx(&pio->mcast);
7097	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7098	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7099	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7100	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7101}
7102
7103static void
7104bwn_led_attach(struct bwn_mac *mac)
7105{
7106	struct bwn_softc *sc = mac->mac_sc;
7107	const uint8_t *led_act = NULL;
7108	uint16_t val[BWN_LED_MAX];
7109	int i;
7110
7111	sc->sc_led_idle = (2350 * hz) / 1000;
7112	sc->sc_led_blink = 1;
7113
7114	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7115		if (siba_get_pci_subvendor(sc->sc_dev) ==
7116		    bwn_vendor_led_act[i].vid) {
7117			led_act = bwn_vendor_led_act[i].led_act;
7118			break;
7119		}
7120	}
7121	if (led_act == NULL)
7122		led_act = bwn_default_led_act;
7123
7124	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7125	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7126	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7127	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7128
7129	for (i = 0; i < BWN_LED_MAX; ++i) {
7130		struct bwn_led *led = &sc->sc_leds[i];
7131
7132		if (val[i] == 0xff) {
7133			led->led_act = led_act[i];
7134		} else {
7135			if (val[i] & BWN_LED_ACT_LOW)
7136				led->led_flags |= BWN_LED_F_ACTLOW;
7137			led->led_act = val[i] & BWN_LED_ACT_MASK;
7138		}
7139		led->led_mask = (1 << i);
7140
7141		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7142		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7143		    led->led_act == BWN_LED_ACT_BLINK) {
7144			led->led_flags |= BWN_LED_F_BLINK;
7145			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7146				led->led_flags |= BWN_LED_F_POLLABLE;
7147			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7148				led->led_flags |= BWN_LED_F_SLOW;
7149
7150			if (sc->sc_blink_led == NULL) {
7151				sc->sc_blink_led = led;
7152				if (led->led_flags & BWN_LED_F_SLOW)
7153					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7154			}
7155		}
7156
7157		DPRINTF(sc, BWN_DEBUG_LED,
7158		    "%dth led, act %d, lowact %d\n", i,
7159		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7160	}
7161	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7162}
7163
7164static __inline uint16_t
7165bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7166{
7167
7168	if (led->led_flags & BWN_LED_F_ACTLOW)
7169		on = !on;
7170	if (on)
7171		val |= led->led_mask;
7172	else
7173		val &= ~led->led_mask;
7174	return val;
7175}
7176
7177static void
7178bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7179{
7180	struct bwn_softc *sc = mac->mac_sc;
7181	struct ieee80211com *ic = &sc->sc_ic;
7182	uint16_t val;
7183	int i;
7184
7185	if (nstate == IEEE80211_S_INIT) {
7186		callout_stop(&sc->sc_led_blink_ch);
7187		sc->sc_led_blinking = 0;
7188	}
7189
7190	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7191		return;
7192
7193	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7194	for (i = 0; i < BWN_LED_MAX; ++i) {
7195		struct bwn_led *led = &sc->sc_leds[i];
7196		int on;
7197
7198		if (led->led_act == BWN_LED_ACT_UNKN ||
7199		    led->led_act == BWN_LED_ACT_NULL)
7200			continue;
7201
7202		if ((led->led_flags & BWN_LED_F_BLINK) &&
7203		    nstate != IEEE80211_S_INIT)
7204			continue;
7205
7206		switch (led->led_act) {
7207		case BWN_LED_ACT_ON:    /* Always on */
7208			on = 1;
7209			break;
7210		case BWN_LED_ACT_OFF:   /* Always off */
7211		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7212			on = 0;
7213			break;
7214		default:
7215			on = 1;
7216			switch (nstate) {
7217			case IEEE80211_S_INIT:
7218				on = 0;
7219				break;
7220			case IEEE80211_S_RUN:
7221				if (led->led_act == BWN_LED_ACT_11G &&
7222				    ic->ic_curmode != IEEE80211_MODE_11G)
7223					on = 0;
7224				break;
7225			default:
7226				if (led->led_act == BWN_LED_ACT_ASSOC)
7227					on = 0;
7228				break;
7229			}
7230			break;
7231		}
7232
7233		val = bwn_led_onoff(led, val, on);
7234	}
7235	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7236}
7237
7238static void
7239bwn_led_event(struct bwn_mac *mac, int event)
7240{
7241	struct bwn_softc *sc = mac->mac_sc;
7242	struct bwn_led *led = sc->sc_blink_led;
7243	int rate;
7244
7245	if (event == BWN_LED_EVENT_POLL) {
7246		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7247			return;
7248		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7249			return;
7250	}
7251
7252	sc->sc_led_ticks = ticks;
7253	if (sc->sc_led_blinking)
7254		return;
7255
7256	switch (event) {
7257	case BWN_LED_EVENT_RX:
7258		rate = sc->sc_rx_rate;
7259		break;
7260	case BWN_LED_EVENT_TX:
7261		rate = sc->sc_tx_rate;
7262		break;
7263	case BWN_LED_EVENT_POLL:
7264		rate = 0;
7265		break;
7266	default:
7267		panic("unknown LED event %d\n", event);
7268		break;
7269	}
7270	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7271	    bwn_led_duration[rate].off_dur);
7272}
7273
7274static void
7275bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7276{
7277	struct bwn_softc *sc = mac->mac_sc;
7278	struct bwn_led *led = sc->sc_blink_led;
7279	uint16_t val;
7280
7281	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7282	val = bwn_led_onoff(led, val, 1);
7283	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7284
7285	if (led->led_flags & BWN_LED_F_SLOW) {
7286		BWN_LED_SLOWDOWN(on_dur);
7287		BWN_LED_SLOWDOWN(off_dur);
7288	}
7289
7290	sc->sc_led_blinking = 1;
7291	sc->sc_led_blink_offdur = off_dur;
7292
7293	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7294}
7295
7296static void
7297bwn_led_blink_next(void *arg)
7298{
7299	struct bwn_mac *mac = arg;
7300	struct bwn_softc *sc = mac->mac_sc;
7301	uint16_t val;
7302
7303	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7304	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7305	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7306
7307	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7308	    bwn_led_blink_end, mac);
7309}
7310
7311static void
7312bwn_led_blink_end(void *arg)
7313{
7314	struct bwn_mac *mac = arg;
7315	struct bwn_softc *sc = mac->mac_sc;
7316
7317	sc->sc_led_blinking = 0;
7318}
7319
7320static int
7321bwn_suspend(device_t dev)
7322{
7323	struct bwn_softc *sc = device_get_softc(dev);
7324
7325	BWN_LOCK(sc);
7326	bwn_stop(sc);
7327	BWN_UNLOCK(sc);
7328	return (0);
7329}
7330
7331static int
7332bwn_resume(device_t dev)
7333{
7334	struct bwn_softc *sc = device_get_softc(dev);
7335	int error = EDOOFUS;
7336
7337	BWN_LOCK(sc);
7338	if (sc->sc_ic.ic_nrunning > 0)
7339		error = bwn_init(sc);
7340	BWN_UNLOCK(sc);
7341	if (error == 0)
7342		ieee80211_start_all(&sc->sc_ic);
7343	return (0);
7344}
7345
7346static void
7347bwn_rfswitch(void *arg)
7348{
7349	struct bwn_softc *sc = arg;
7350	struct bwn_mac *mac = sc->sc_curmac;
7351	int cur = 0, prev = 0;
7352
7353	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7354	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7355
7356	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7357	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7358		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7359			& BWN_RF_HWENABLED_HI_MASK))
7360			cur = 1;
7361	} else {
7362		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7363		    & BWN_RF_HWENABLED_LO_MASK)
7364			cur = 1;
7365	}
7366
7367	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7368		prev = 1;
7369
7370	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7371	    __func__, cur, prev);
7372
7373	if (cur != prev) {
7374		if (cur)
7375			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7376		else
7377			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7378
7379		device_printf(sc->sc_dev,
7380		    "status of RF switch is changed to %s\n",
7381		    cur ? "ON" : "OFF");
7382		if (cur != mac->mac_phy.rf_on) {
7383			if (cur)
7384				bwn_rf_turnon(mac);
7385			else
7386				bwn_rf_turnoff(mac);
7387		}
7388	}
7389
7390	callout_schedule(&sc->sc_rfswitch_ch, hz);
7391}
7392
7393static void
7394bwn_sysctl_node(struct bwn_softc *sc)
7395{
7396	device_t dev = sc->sc_dev;
7397	struct bwn_mac *mac;
7398	struct bwn_stats *stats;
7399
7400	/* XXX assume that count of MAC is only 1. */
7401
7402	if ((mac = sc->sc_curmac) == NULL)
7403		return;
7404	stats = &mac->mac_stats;
7405
7406	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7407	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7408	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7409	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7410	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7411	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7412	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7413	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7414	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7415
7416#ifdef BWN_DEBUG
7417	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7418	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7419	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7420#endif
7421}
7422
7423static device_method_t bwn_methods[] = {
7424	/* Device interface */
7425	DEVMETHOD(device_probe,		bwn_probe),
7426	DEVMETHOD(device_attach,	bwn_attach),
7427	DEVMETHOD(device_detach,	bwn_detach),
7428	DEVMETHOD(device_suspend,	bwn_suspend),
7429	DEVMETHOD(device_resume,	bwn_resume),
7430	DEVMETHOD_END
7431};
7432static driver_t bwn_driver = {
7433	"bwn",
7434	bwn_methods,
7435	sizeof(struct bwn_softc)
7436};
7437static devclass_t bwn_devclass;
7438DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7439MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7440MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7441MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7442MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7443MODULE_VERSION(bwn, 1);
7444