if_bwn.c revision 300189
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 300189 2016-05-19 04:29:25Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include "opt_bwn.h"
38#include "opt_wlan.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/malloc.h>
44#include <sys/module.h>
45#include <sys/endian.h>
46#include <sys/errno.h>
47#include <sys/firmware.h>
48#include <sys/lock.h>
49#include <sys/mutex.h>
50#include <machine/bus.h>
51#include <machine/resource.h>
52#include <sys/bus.h>
53#include <sys/rman.h>
54#include <sys/socket.h>
55#include <sys/sockio.h>
56
57#include <net/ethernet.h>
58#include <net/if.h>
59#include <net/if_var.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_llc.h>
63#include <net/if_media.h>
64#include <net/if_types.h>
65
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcireg.h>
68#include <dev/siba/siba_ids.h>
69#include <dev/siba/sibareg.h>
70#include <dev/siba/sibavar.h>
71
72#include <net80211/ieee80211_var.h>
73#include <net80211/ieee80211_radiotap.h>
74#include <net80211/ieee80211_regdomain.h>
75#include <net80211/ieee80211_phy.h>
76#include <net80211/ieee80211_ratectl.h>
77
78#include <dev/bwn/if_bwnreg.h>
79#include <dev/bwn/if_bwnvar.h>
80
81#include <dev/bwn/if_bwn_debug.h>
82#include <dev/bwn/if_bwn_misc.h>
83#include <dev/bwn/if_bwn_util.h>
84#include <dev/bwn/if_bwn_phy_common.h>
85#include <dev/bwn/if_bwn_phy_g.h>
86#include <dev/bwn/if_bwn_phy_lp.h>
87#include <dev/bwn/if_bwn_phy_n.h>
88
89static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90    "Broadcom driver parameters");
91
92/*
93 * Tunable & sysctl variables.
94 */
95
96#ifdef BWN_DEBUG
97static	int bwn_debug = 0;
98SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99    "Broadcom debugging printfs");
100#endif
101
102static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104    "uses Bad Frames Preemption");
105static int	bwn_bluetooth = 1;
106SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107    "turns on Bluetooth Coexistence");
108static int	bwn_hwpctl = 0;
109SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110    "uses H/W power control");
111static int	bwn_msi_disable = 0;		/* MSI disabled  */
112TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113static int	bwn_usedma = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115    "uses DMA");
116TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117static int	bwn_wme = 1;
118SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119    "uses WME support");
120
121static void	bwn_attach_pre(struct bwn_softc *);
122static int	bwn_attach_post(struct bwn_softc *);
123static void	bwn_sprom_bugfixes(device_t);
124static int	bwn_init(struct bwn_softc *);
125static void	bwn_parent(struct ieee80211com *);
126static void	bwn_start(struct bwn_softc *);
127static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128static int	bwn_attach_core(struct bwn_mac *);
129static int	bwn_phy_getinfo(struct bwn_mac *, int);
130static int	bwn_chiptest(struct bwn_mac *);
131static int	bwn_setup_channels(struct bwn_mac *, int, int);
132static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133		    uint16_t);
134static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135		    const struct bwn_channelinfo *, const uint8_t []);
136static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137		    const struct ieee80211_bpf_params *);
138static void	bwn_updateslot(struct ieee80211com *);
139static void	bwn_update_promisc(struct ieee80211com *);
140static void	bwn_wme_init(struct bwn_mac *);
141static int	bwn_wme_update(struct ieee80211com *);
142static void	bwn_wme_clear(struct bwn_softc *);
143static void	bwn_wme_load(struct bwn_mac *);
144static void	bwn_wme_loadparams(struct bwn_mac *,
145		    const struct wmeParams *, uint16_t);
146static void	bwn_scan_start(struct ieee80211com *);
147static void	bwn_scan_end(struct ieee80211com *);
148static void	bwn_set_channel(struct ieee80211com *);
149static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151		    const uint8_t [IEEE80211_ADDR_LEN],
152		    const uint8_t [IEEE80211_ADDR_LEN]);
153static void	bwn_vap_delete(struct ieee80211vap *);
154static void	bwn_stop(struct bwn_softc *);
155static int	bwn_core_init(struct bwn_mac *);
156static void	bwn_core_start(struct bwn_mac *);
157static void	bwn_core_exit(struct bwn_mac *);
158static void	bwn_bt_disable(struct bwn_mac *);
159static int	bwn_chip_init(struct bwn_mac *);
160static void	bwn_set_txretry(struct bwn_mac *, int, int);
161static void	bwn_rate_init(struct bwn_mac *);
162static void	bwn_set_phytxctl(struct bwn_mac *);
163static void	bwn_spu_setdelay(struct bwn_mac *, int);
164static void	bwn_bt_enable(struct bwn_mac *);
165static void	bwn_set_macaddr(struct bwn_mac *);
166static void	bwn_crypt_init(struct bwn_mac *);
167static void	bwn_chip_exit(struct bwn_mac *);
168static int	bwn_fw_fillinfo(struct bwn_mac *);
169static int	bwn_fw_loaducode(struct bwn_mac *);
170static int	bwn_gpio_init(struct bwn_mac *);
171static int	bwn_fw_loadinitvals(struct bwn_mac *);
172static int	bwn_phy_init(struct bwn_mac *);
173static void	bwn_set_txantenna(struct bwn_mac *, int);
174static void	bwn_set_opmode(struct bwn_mac *);
175static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176static uint8_t	bwn_plcp_getcck(const uint8_t);
177static uint8_t	bwn_plcp_getofdm(const uint8_t);
178static void	bwn_pio_init(struct bwn_mac *);
179static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181		    int);
182static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183		    struct bwn_pio_rxqueue *, int);
184static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186		    uint16_t);
187static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190static void	bwn_pio_handle_txeof(struct bwn_mac *,
191		    const struct bwn_txstatus *);
192static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195		    uint16_t);
196static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197		    uint32_t);
198static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199		    struct mbuf *);
200static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204		    uint16_t, uint32_t);
205static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210		    uint16_t, struct bwn_pio_txpkt **);
211static void	bwn_dma_init(struct bwn_mac *);
212static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213static int	bwn_dma_mask2type(uint64_t);
214static uint64_t	bwn_dma_mask(struct bwn_mac *);
215static uint16_t	bwn_dma_base(int, int);
216static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218		    int, struct bwn_dmadesc_generic **,
219		    struct bwn_dmadesc_meta **);
220static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222		    int, int);
223static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229		    int, struct bwn_dmadesc_generic **,
230		    struct bwn_dmadesc_meta **);
231static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233		    int, int);
234static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240static void	bwn_dma_setup(struct bwn_dma_ring *);
241static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245static void	bwn_dma_rx(struct bwn_dma_ring *);
246static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248		    struct bwn_dmadesc_meta *);
249static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250static int	bwn_dma_gettype(struct bwn_mac *);
251static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257		    int);
258static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259		    bus_size_t, int);
260static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261static void	bwn_dma_handle_txeof(struct bwn_mac *,
262		    const struct bwn_txstatus *);
263static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264		    struct mbuf *);
265static int	bwn_dma_getslot(struct bwn_dma_ring *);
266static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267		    uint8_t);
268static int	bwn_dma_attach(struct bwn_mac *);
269static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270		    int, int, int);
271static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272		    const struct bwn_txstatus *, uint16_t, int *);
273static void	bwn_dma_free(struct bwn_mac *);
274static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276		    const char *, struct bwn_fwfile *);
277static void	bwn_release_firmware(struct bwn_mac *);
278static void	bwn_do_release_fw(struct bwn_fwfile *);
279static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280static int	bwn_fwinitvals_write(struct bwn_mac *,
281		    const struct bwn_fwinitvals *, size_t, size_t);
282static uint16_t	bwn_ant2phy(int);
283static void	bwn_mac_write_bssid(struct bwn_mac *);
284static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285		    const uint8_t *);
286static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *, size_t, const uint8_t *);
288static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289		    const uint8_t *);
290static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291		    const uint8_t *);
292static void	bwn_phy_exit(struct bwn_mac *);
293static void	bwn_core_stop(struct bwn_mac *);
294static int	bwn_switch_band(struct bwn_softc *,
295		    struct ieee80211_channel *);
296static void	bwn_phy_reset(struct bwn_mac *);
297static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298static void	bwn_set_pretbtt(struct bwn_mac *);
299static int	bwn_intr(void *);
300static void	bwn_intrtask(void *, int);
301static void	bwn_restart(struct bwn_mac *, const char *);
302static void	bwn_intr_ucode_debug(struct bwn_mac *);
303static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304static void	bwn_intr_atim_end(struct bwn_mac *);
305static void	bwn_intr_beacon(struct bwn_mac *);
306static void	bwn_intr_pmq(struct bwn_mac *);
307static void	bwn_intr_noise(struct bwn_mac *);
308static void	bwn_intr_txeof(struct bwn_mac *);
309static void	bwn_hwreset(void *, int);
310static void	bwn_handle_fwpanic(struct bwn_mac *);
311static void	bwn_load_beacon0(struct bwn_mac *);
312static void	bwn_load_beacon1(struct bwn_mac *);
313static uint32_t	bwn_jssi_read(struct bwn_mac *);
314static void	bwn_noise_gensample(struct bwn_mac *);
315static void	bwn_handle_txeof(struct bwn_mac *,
316		    const struct bwn_txstatus *);
317static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320		    struct mbuf *);
321static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322static int	bwn_set_txhdr(struct bwn_mac *,
323		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324		    uint16_t);
325static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326		    const uint8_t);
327static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328static uint8_t	bwn_get_fbrate(uint8_t);
329static void	bwn_txpwr(void *, int);
330static void	bwn_tasks(void *);
331static void	bwn_task_15s(struct bwn_mac *);
332static void	bwn_task_30s(struct bwn_mac *);
333static void	bwn_task_60s(struct bwn_mac *);
334static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335		    uint8_t);
336static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339		    int, int);
340static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342static void	bwn_watchdog(void *);
343static void	bwn_dma_stop(struct bwn_mac *);
344static void	bwn_pio_stop(struct bwn_mac *);
345static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346static void	bwn_led_attach(struct bwn_mac *);
347static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348static void	bwn_led_event(struct bwn_mac *, int);
349static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350static void	bwn_led_blink_next(void *);
351static void	bwn_led_blink_end(void *);
352static void	bwn_rfswitch(void *);
353static void	bwn_rf_turnon(struct bwn_mac *);
354static void	bwn_rf_turnoff(struct bwn_mac *);
355static void	bwn_sysctl_node(struct bwn_softc *);
356
357static struct resource_spec bwn_res_spec_legacy[] = {
358	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359	{ -1,			0,		0 }
360};
361
362static struct resource_spec bwn_res_spec_msi[] = {
363	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364	{ -1,			0,		0 }
365};
366
367static const struct bwn_channelinfo bwn_chantable_bg = {
368	.channels = {
369		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374	.nchannels = 14
375};
376
377static const struct bwn_channelinfo bwn_chantable_a = {
378	.channels = {
379		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391		{ 6080, 216, 30 } },
392	.nchannels = 37
393};
394
395#if 0
396static const struct bwn_channelinfo bwn_chantable_n = {
397	.channels = {
398		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435	.nchannels = 110
436};
437#endif
438
439#define	VENDOR_LED_ACT(vendor)				\
440{							\
441	.vid = PCI_VENDOR_##vendor,			\
442	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443}
444
445static const struct {
446	uint16_t	vid;
447	uint8_t		led_act[BWN_LED_MAX];
448} bwn_vendor_led_act[] = {
449	VENDOR_LED_ACT(COMPAQ),
450	VENDOR_LED_ACT(ASUSTEK)
451};
452
453static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454	{ BWN_VENDOR_LED_ACT_DEFAULT };
455
456#undef VENDOR_LED_ACT
457
458static const struct {
459	int		on_dur;
460	int		off_dur;
461} bwn_led_duration[109] = {
462	[0]	= { 400, 100 },
463	[2]	= { 150, 75 },
464	[4]	= { 90, 45 },
465	[11]	= { 66, 34 },
466	[12]	= { 53, 26 },
467	[18]	= { 42, 21 },
468	[22]	= { 35, 17 },
469	[24]	= { 32, 16 },
470	[36]	= { 21, 10 },
471	[48]	= { 16, 8 },
472	[72]	= { 11, 5 },
473	[96]	= { 9, 4 },
474	[108]	= { 7, 3 }
475};
476
477static const uint16_t bwn_wme_shm_offsets[] = {
478	[0] = BWN_WME_BESTEFFORT,
479	[1] = BWN_WME_BACKGROUND,
480	[2] = BWN_WME_VOICE,
481	[3] = BWN_WME_VIDEO,
482};
483
484static const struct siba_devid bwn_devs[] = {
485	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495};
496
497static int
498bwn_probe(device_t dev)
499{
500	int i;
501
502	for (i = 0; i < nitems(bwn_devs); i++) {
503		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506			return (BUS_PROBE_DEFAULT);
507	}
508
509	return (ENXIO);
510}
511
512static int
513bwn_attach(device_t dev)
514{
515	struct bwn_mac *mac;
516	struct bwn_softc *sc = device_get_softc(dev);
517	int error, i, msic, reg;
518
519	sc->sc_dev = dev;
520#ifdef BWN_DEBUG
521	sc->sc_debug = bwn_debug;
522#endif
523
524	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525		bwn_attach_pre(sc);
526		bwn_sprom_bugfixes(dev);
527		sc->sc_flags |= BWN_FLAG_ATTACHED;
528	}
529
530	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531		if (siba_get_pci_device(dev) != 0x4313 &&
532		    siba_get_pci_device(dev) != 0x431a &&
533		    siba_get_pci_device(dev) != 0x4321) {
534			device_printf(sc->sc_dev,
535			    "skip 802.11 cores\n");
536			return (ENODEV);
537		}
538	}
539
540	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541	mac->mac_sc = sc;
542	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543	if (bwn_bfp != 0)
544		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545
546	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549
550	error = bwn_attach_core(mac);
551	if (error)
552		goto fail0;
553	bwn_led_attach(mac);
554
555	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560	    mac->mac_phy.rf_rev);
561	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563		    mac->mac_method.dma.dmatype);
564	else
565		device_printf(sc->sc_dev, "PIO\n");
566
567#ifdef	BWN_GPL_PHY
568	device_printf(sc->sc_dev,
569	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570#endif
571
572	/*
573	 * setup PCI resources and interrupt.
574	 */
575	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576		msic = pci_msi_count(dev);
577		if (bootverbose)
578			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579	} else
580		msic = 0;
581
582	mac->mac_intr_spec = bwn_res_spec_legacy;
583	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584		if (pci_alloc_msi(dev, &msic) == 0) {
585			device_printf(sc->sc_dev,
586			    "Using %d MSI messages\n", msic);
587			mac->mac_intr_spec = bwn_res_spec_msi;
588			mac->mac_msi = 1;
589		}
590	}
591
592	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593	    mac->mac_res_irq);
594	if (error) {
595		device_printf(sc->sc_dev,
596		    "couldn't allocate IRQ resources (%d)\n", error);
597		goto fail1;
598	}
599
600	if (mac->mac_msi == 0)
601		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603		    &mac->mac_intrhand[0]);
604	else {
605		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608			    &mac->mac_intrhand[i]);
609			if (error != 0) {
610				device_printf(sc->sc_dev,
611				    "couldn't setup interrupt (%d)\n", error);
612				break;
613			}
614		}
615	}
616
617	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618
619	/*
620	 * calls attach-post routine
621	 */
622	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623		bwn_attach_post(sc);
624
625	return (0);
626fail1:
627	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628		pci_release_msi(dev);
629fail0:
630	free(mac, M_DEVBUF);
631	return (error);
632}
633
634static int
635bwn_is_valid_ether_addr(uint8_t *addr)
636{
637	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638
639	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640		return (FALSE);
641
642	return (TRUE);
643}
644
645static int
646bwn_attach_post(struct bwn_softc *sc)
647{
648	struct ieee80211com *ic = &sc->sc_ic;
649
650	ic->ic_softc = sc;
651	ic->ic_name = device_get_nameunit(sc->sc_dev);
652	/* XXX not right but it's not used anywhere important */
653	ic->ic_phytype = IEEE80211_T_OFDM;
654	ic->ic_opmode = IEEE80211_M_STA;
655	ic->ic_caps =
656		  IEEE80211_C_STA		/* station mode supported */
657		| IEEE80211_C_MONITOR		/* monitor mode */
658		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660		| IEEE80211_C_SHSLOT		/* short slot time supported */
661		| IEEE80211_C_WME		/* WME/WMM supported */
662		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663#if 0
664		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665#endif
666		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667		;
668
669	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670
671	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675
676	/* call MI attach routine. */
677	ieee80211_ifattach(ic);
678
679	ic->ic_headroom = sizeof(struct bwn_txhdr);
680
681	/* override default methods */
682	ic->ic_raw_xmit = bwn_raw_xmit;
683	ic->ic_updateslot = bwn_updateslot;
684	ic->ic_update_promisc = bwn_update_promisc;
685	ic->ic_wme.wme_update = bwn_wme_update;
686	ic->ic_scan_start = bwn_scan_start;
687	ic->ic_scan_end = bwn_scan_end;
688	ic->ic_set_channel = bwn_set_channel;
689	ic->ic_vap_create = bwn_vap_create;
690	ic->ic_vap_delete = bwn_vap_delete;
691	ic->ic_transmit = bwn_transmit;
692	ic->ic_parent = bwn_parent;
693
694	ieee80211_radiotap_attach(ic,
695	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696	    BWN_TX_RADIOTAP_PRESENT,
697	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698	    BWN_RX_RADIOTAP_PRESENT);
699
700	bwn_sysctl_node(sc);
701
702	if (bootverbose)
703		ieee80211_announce(ic);
704	return (0);
705}
706
707static void
708bwn_phy_detach(struct bwn_mac *mac)
709{
710
711	if (mac->mac_phy.detach != NULL)
712		mac->mac_phy.detach(mac);
713}
714
715static int
716bwn_detach(device_t dev)
717{
718	struct bwn_softc *sc = device_get_softc(dev);
719	struct bwn_mac *mac = sc->sc_curmac;
720	struct ieee80211com *ic = &sc->sc_ic;
721	int i;
722
723	sc->sc_flags |= BWN_FLAG_INVALID;
724
725	if (device_is_attached(sc->sc_dev)) {
726		BWN_LOCK(sc);
727		bwn_stop(sc);
728		BWN_UNLOCK(sc);
729		bwn_dma_free(mac);
730		callout_drain(&sc->sc_led_blink_ch);
731		callout_drain(&sc->sc_rfswitch_ch);
732		callout_drain(&sc->sc_task_ch);
733		callout_drain(&sc->sc_watchdog_ch);
734		bwn_phy_detach(mac);
735		ieee80211_draintask(ic, &mac->mac_hwreset);
736		ieee80211_draintask(ic, &mac->mac_txpower);
737		ieee80211_ifdetach(ic);
738	}
739	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740	taskqueue_free(sc->sc_tq);
741
742	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743		if (mac->mac_intrhand[i] != NULL) {
744			bus_teardown_intr(dev, mac->mac_res_irq[i],
745			    mac->mac_intrhand[i]);
746			mac->mac_intrhand[i] = NULL;
747		}
748	}
749	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750	if (mac->mac_msi != 0)
751		pci_release_msi(dev);
752	mbufq_drain(&sc->sc_snd);
753	BWN_LOCK_DESTROY(sc);
754	return (0);
755}
756
757static void
758bwn_attach_pre(struct bwn_softc *sc)
759{
760
761	BWN_LOCK_INIT(sc);
762	TAILQ_INIT(&sc->sc_maclist);
763	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
764	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
765	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
766	mbufq_init(&sc->sc_snd, ifqmaxlen);
767	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
768		taskqueue_thread_enqueue, &sc->sc_tq);
769	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
770		"%s taskq", device_get_nameunit(sc->sc_dev));
771}
772
773static void
774bwn_sprom_bugfixes(device_t dev)
775{
776#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
777	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
778	 (siba_get_pci_device(dev) == _device) &&			\
779	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
780	 (siba_get_pci_subdevice(dev) == _subdevice))
781
782	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
783	    siba_get_pci_subdevice(dev) == 0x4e &&
784	    siba_get_pci_revid(dev) > 0x40)
785		siba_sprom_set_bf_lo(dev,
786		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
787	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
788	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
789		siba_sprom_set_bf_lo(dev,
790		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
791	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
792		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
793		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
794		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
795		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
796		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
797		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
798		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
799			siba_sprom_set_bf_lo(dev,
800			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
801	}
802#undef	BWN_ISDEV
803}
804
805static void
806bwn_parent(struct ieee80211com *ic)
807{
808	struct bwn_softc *sc = ic->ic_softc;
809	int startall = 0;
810
811	BWN_LOCK(sc);
812	if (ic->ic_nrunning > 0) {
813		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
814			bwn_init(sc);
815			startall = 1;
816		} else
817			bwn_update_promisc(ic);
818	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
819		bwn_stop(sc);
820	BWN_UNLOCK(sc);
821
822	if (startall)
823		ieee80211_start_all(ic);
824}
825
826static int
827bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
828{
829	struct bwn_softc *sc = ic->ic_softc;
830	int error;
831
832	BWN_LOCK(sc);
833	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
834		BWN_UNLOCK(sc);
835		return (ENXIO);
836	}
837	error = mbufq_enqueue(&sc->sc_snd, m);
838	if (error) {
839		BWN_UNLOCK(sc);
840		return (error);
841	}
842	bwn_start(sc);
843	BWN_UNLOCK(sc);
844	return (0);
845}
846
847static void
848bwn_start(struct bwn_softc *sc)
849{
850	struct bwn_mac *mac = sc->sc_curmac;
851	struct ieee80211_frame *wh;
852	struct ieee80211_node *ni;
853	struct ieee80211_key *k;
854	struct mbuf *m;
855
856	BWN_ASSERT_LOCKED(sc);
857
858	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
859	    mac->mac_status < BWN_MAC_STATUS_STARTED)
860		return;
861
862	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
863		if (bwn_tx_isfull(sc, m))
864			break;
865		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
866		if (ni == NULL) {
867			device_printf(sc->sc_dev, "unexpected NULL ni\n");
868			m_freem(m);
869			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
870			continue;
871		}
872		wh = mtod(m, struct ieee80211_frame *);
873		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
874			k = ieee80211_crypto_encap(ni, m);
875			if (k == NULL) {
876				if_inc_counter(ni->ni_vap->iv_ifp,
877				    IFCOUNTER_OERRORS, 1);
878				ieee80211_free_node(ni);
879				m_freem(m);
880				continue;
881			}
882		}
883		wh = NULL;	/* Catch any invalid use */
884		if (bwn_tx_start(sc, ni, m) != 0) {
885			if (ni != NULL) {
886				if_inc_counter(ni->ni_vap->iv_ifp,
887				    IFCOUNTER_OERRORS, 1);
888				ieee80211_free_node(ni);
889			}
890			continue;
891		}
892		sc->sc_watchdog_timer = 5;
893	}
894}
895
896static int
897bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
898{
899	struct bwn_dma_ring *dr;
900	struct bwn_mac *mac = sc->sc_curmac;
901	struct bwn_pio_txqueue *tq;
902	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
903
904	BWN_ASSERT_LOCKED(sc);
905
906	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
907		dr = bwn_dma_select(mac, M_WME_GETAC(m));
908		if (dr->dr_stop == 1 ||
909		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
910			dr->dr_stop = 1;
911			goto full;
912		}
913	} else {
914		tq = bwn_pio_select(mac, M_WME_GETAC(m));
915		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
916		    pktlen > (tq->tq_size - tq->tq_used))
917			goto full;
918	}
919	return (0);
920full:
921	mbufq_prepend(&sc->sc_snd, m);
922	return (1);
923}
924
925static int
926bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
927{
928	struct bwn_mac *mac = sc->sc_curmac;
929	int error;
930
931	BWN_ASSERT_LOCKED(sc);
932
933	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
934		m_freem(m);
935		return (ENXIO);
936	}
937
938	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
939	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
940	if (error) {
941		m_freem(m);
942		return (error);
943	}
944	return (0);
945}
946
947static int
948bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
949{
950	struct bwn_pio_txpkt *tp;
951	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
952	struct bwn_softc *sc = mac->mac_sc;
953	struct bwn_txhdr txhdr;
954	struct mbuf *m_new;
955	uint32_t ctl32;
956	int error;
957	uint16_t ctl16;
958
959	BWN_ASSERT_LOCKED(sc);
960
961	/* XXX TODO send packets after DTIM */
962
963	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
964	tp = TAILQ_FIRST(&tq->tq_pktlist);
965	tp->tp_ni = ni;
966	tp->tp_m = m;
967
968	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
969	if (error) {
970		device_printf(sc->sc_dev, "tx fail\n");
971		return (error);
972	}
973
974	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
975	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
976	tq->tq_free--;
977
978	if (siba_get_revid(sc->sc_dev) >= 8) {
979		/*
980		 * XXX please removes m_defrag(9)
981		 */
982		m_new = m_defrag(m, M_NOWAIT);
983		if (m_new == NULL) {
984			device_printf(sc->sc_dev,
985			    "%s: can't defrag TX buffer\n",
986			    __func__);
987			return (ENOBUFS);
988		}
989		if (m_new->m_next != NULL)
990			device_printf(sc->sc_dev,
991			    "TODO: fragmented packets for PIO\n");
992		tp->tp_m = m_new;
993
994		/* send HEADER */
995		ctl32 = bwn_pio_write_multi_4(mac, tq,
996		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
997			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
998		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
999		/* send BODY */
1000		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1002		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003		    ctl32 | BWN_PIO8_TXCTL_EOF);
1004	} else {
1005		ctl16 = bwn_pio_write_multi_2(mac, tq,
1006		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011		    ctl16 | BWN_PIO_TXCTL_EOF);
1012	}
1013
1014	return (0);
1015}
1016
1017static struct bwn_pio_txqueue *
1018bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019{
1020
1021	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024	switch (prio) {
1025	case 0:
1026		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027	case 1:
1028		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029	case 2:
1030		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031	case 3:
1032		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033	}
1034	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035	return (NULL);
1036}
1037
1038static int
1039bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040{
1041#define	BWN_GET_TXHDRCACHE(slot)					\
1042	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043	struct bwn_dma *dma = &mac->mac_method.dma;
1044	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045	struct bwn_dmadesc_generic *desc;
1046	struct bwn_dmadesc_meta *mt;
1047	struct bwn_softc *sc = mac->mac_sc;
1048	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051	BWN_ASSERT_LOCKED(sc);
1052	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054	/* XXX send after DTIM */
1055
1056	slot = bwn_dma_getslot(dr);
1057	dr->getdesc(dr, slot, &desc, &mt);
1058	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059	    ("%s:%d: fail", __func__, __LINE__));
1060
1061	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063	    BWN_DMA_COOKIE(dr, slot));
1064	if (error)
1065		goto fail;
1066	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1069	if (error) {
1070		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071		    __func__, error);
1072		goto fail;
1073	}
1074	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075	    BUS_DMASYNC_PREWRITE);
1076	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078	    BUS_DMASYNC_PREWRITE);
1079
1080	slot = bwn_dma_getslot(dr);
1081	dr->getdesc(dr, slot, &desc, &mt);
1082	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084	mt->mt_m = m;
1085	mt->mt_ni = ni;
1086
1087	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089	if (error && error != EFBIG) {
1090		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091		    __func__, error);
1092		goto fail;
1093	}
1094	if (error) {    /* error == EFBIG */
1095		struct mbuf *m_new;
1096
1097		m_new = m_defrag(m, M_NOWAIT);
1098		if (m_new == NULL) {
1099			device_printf(sc->sc_dev,
1100			    "%s: can't defrag TX buffer\n",
1101			    __func__);
1102			error = ENOBUFS;
1103			goto fail;
1104		} else {
1105			m = m_new;
1106		}
1107
1108		mt->mt_m = m;
1109		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111		if (error) {
1112			device_printf(sc->sc_dev,
1113			    "%s: can't load TX buffer (2) %d\n",
1114			    __func__, error);
1115			goto fail;
1116		}
1117	}
1118	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121	    BUS_DMASYNC_PREWRITE);
1122
1123	/* XXX send after DTIM */
1124
1125	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126	return (0);
1127fail:
1128	dr->dr_curslot = backup[0];
1129	dr->dr_usedslot = backup[1];
1130	return (error);
1131#undef BWN_GET_TXHDRCACHE
1132}
1133
1134static void
1135bwn_watchdog(void *arg)
1136{
1137	struct bwn_softc *sc = arg;
1138
1139	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140		device_printf(sc->sc_dev, "device timeout\n");
1141		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142	}
1143	callout_schedule(&sc->sc_watchdog_ch, hz);
1144}
1145
1146static int
1147bwn_attach_core(struct bwn_mac *mac)
1148{
1149	struct bwn_softc *sc = mac->mac_sc;
1150	int error, have_bg = 0, have_a = 0;
1151	uint32_t high;
1152
1153	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155
1156	siba_powerup(sc->sc_dev, 0);
1157
1158	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1159
1160	/*
1161	 * Guess at whether it has A-PHY or G-PHY.
1162	 * This is just used for resetting the core to probe things;
1163	 * we will re-guess once it's all up and working.
1164	 *
1165	 * XXX TODO: there's the TGSHIGH DUALPHY flag based on
1166	 * the PHY revision.
1167	 */
1168	bwn_reset_core(mac, !!(high & BWN_TGSHIGH_HAVE_2GHZ));
1169
1170	/*
1171	 * Get the PHY version.
1172	 */
1173	error = bwn_phy_getinfo(mac, high);
1174	if (error)
1175		goto fail;
1176
1177	/* XXX TODO need bhnd */
1178	if (bwn_is_bus_siba(mac)) {
1179		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1180		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1181		if (high & BWN_TGSHIGH_DUALPHY) {
1182			have_bg = 1;
1183			have_a = 1;
1184		}
1185	} else {
1186		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1187		error = ENXIO;
1188		goto fail;
1189	}
1190
1191#if 0
1192	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1193	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1194	    __func__,
1195	    high,
1196	    have_a,
1197	    have_bg,
1198	    siba_get_pci_device(sc->sc_dev),
1199	    siba_get_chipid(sc->sc_dev));
1200#endif
1201
1202	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1203	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207		have_a = have_bg = 0;
1208		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209			have_a = 1;
1210		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1212		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1213			have_bg = 1;
1214		else
1215			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216			    mac->mac_phy.type));
1217	}
1218
1219	/*
1220	 * XXX The PHY-G support doesn't do 5GHz operation.
1221	 */
1222	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1224		device_printf(sc->sc_dev,
1225		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226		    __func__);
1227		have_a = 0;
1228		have_bg = 1;
1229	}
1230
1231	mac->mac_phy.phy_n = NULL;
1232
1233	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234		mac->mac_phy.attach = bwn_phy_g_attach;
1235		mac->mac_phy.detach = bwn_phy_g_detach;
1236		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238		mac->mac_phy.init = bwn_phy_g_init;
1239		mac->mac_phy.exit = bwn_phy_g_exit;
1240		mac->mac_phy.phy_read = bwn_phy_g_read;
1241		mac->mac_phy.phy_write = bwn_phy_g_write;
1242		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250		mac->mac_phy.set_im = bwn_phy_g_im;
1251		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257		mac->mac_phy.init = bwn_phy_lp_init;
1258		mac->mac_phy.phy_read = bwn_phy_lp_read;
1259		mac->mac_phy.phy_write = bwn_phy_lp_write;
1260		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270		mac->mac_phy.attach = bwn_phy_n_attach;
1271		mac->mac_phy.detach = bwn_phy_n_detach;
1272		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274		mac->mac_phy.init = bwn_phy_n_init;
1275		mac->mac_phy.exit = bwn_phy_n_exit;
1276		mac->mac_phy.phy_read = bwn_phy_n_read;
1277		mac->mac_phy.phy_write = bwn_phy_n_write;
1278		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286		mac->mac_phy.set_im = bwn_phy_n_im;
1287		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291	} else {
1292		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293		    mac->mac_phy.type);
1294		error = ENXIO;
1295		goto fail;
1296	}
1297
1298	mac->mac_phy.gmode = have_bg;
1299	if (mac->mac_phy.attach != NULL) {
1300		error = mac->mac_phy.attach(mac);
1301		if (error) {
1302			device_printf(sc->sc_dev, "failed\n");
1303			goto fail;
1304		}
1305	}
1306
1307	bwn_reset_core(mac, have_bg);
1308
1309	error = bwn_chiptest(mac);
1310	if (error)
1311		goto fail;
1312	error = bwn_setup_channels(mac, have_bg, have_a);
1313	if (error) {
1314		device_printf(sc->sc_dev, "failed to setup channels\n");
1315		goto fail;
1316	}
1317
1318	if (sc->sc_curmac == NULL)
1319		sc->sc_curmac = mac;
1320
1321	error = bwn_dma_attach(mac);
1322	if (error != 0) {
1323		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324		goto fail;
1325	}
1326
1327	mac->mac_phy.switch_analog(mac, 0);
1328
1329	siba_dev_down(sc->sc_dev, 0);
1330fail:
1331	siba_powerdown(sc->sc_dev);
1332	return (error);
1333}
1334
1335/*
1336 * Reset - SIBA.
1337 *
1338 * XXX TODO: implement BCMA version!
1339 */
1340void
1341bwn_reset_core(struct bwn_mac *mac, int g_mode)
1342{
1343	struct bwn_softc *sc = mac->mac_sc;
1344	uint32_t low, ctl;
1345	uint32_t flags = 0;
1346
1347	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1348
1349	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1350	if (g_mode)
1351		flags |= BWN_TGSLOW_SUPPORT_G;
1352
1353	/* XXX N-PHY only; and hard-code to 20MHz for now */
1354	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1355		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1356
1357	siba_dev_up(sc->sc_dev, flags);
1358	DELAY(2000);
1359
1360	/* Take PHY out of reset */
1361	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1362	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1363	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1364	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1365	DELAY(2000);
1366	low &= ~SIBA_TGSLOW_FGC;
1367	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1368	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1369	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1370	DELAY(2000);
1371
1372	if (mac->mac_phy.switch_analog != NULL)
1373		mac->mac_phy.switch_analog(mac, 1);
1374
1375	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1376	if (g_mode)
1377		ctl |= BWN_MACCTL_GMODE;
1378	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1379}
1380
1381static int
1382bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1383{
1384	struct bwn_phy *phy = &mac->mac_phy;
1385	struct bwn_softc *sc = mac->mac_sc;
1386	uint32_t tmp;
1387
1388	/* PHY */
1389	tmp = BWN_READ_2(mac, BWN_PHYVER);
1390	phy->gmode = !! (tgshigh & BWN_TGSHIGH_HAVE_2GHZ);
1391	phy->rf_on = 1;
1392	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1393	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1394	phy->rev = (tmp & BWN_PHYVER_VERSION);
1395	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1396	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1397		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1398	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1399	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1400	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1401		goto unsupphy;
1402
1403	/* RADIO */
1404	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1405		if (siba_get_chiprev(sc->sc_dev) == 0)
1406			tmp = 0x3205017f;
1407		else if (siba_get_chiprev(sc->sc_dev) == 1)
1408			tmp = 0x4205017f;
1409		else
1410			tmp = 0x5205017f;
1411	} else {
1412		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1413		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1414		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1415		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1416	}
1417	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1418	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1419	phy->rf_manuf = (tmp & 0x00000fff);
1420
1421	/*
1422	 * For now, just always do full init (ie, what bwn has traditionally
1423	 * done)
1424	 */
1425	phy->phy_do_full_init = 1;
1426
1427	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1428		goto unsupradio;
1429	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1430	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1431	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1432	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1433	    (phy->type == BWN_PHYTYPE_N &&
1434	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1435	    (phy->type == BWN_PHYTYPE_LP &&
1436	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1437		goto unsupradio;
1438
1439	return (0);
1440unsupphy:
1441	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1442	    "analog %#x)\n",
1443	    phy->type, phy->rev, phy->analog);
1444	return (ENXIO);
1445unsupradio:
1446	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1447	    "rev %#x)\n",
1448	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1449	return (ENXIO);
1450}
1451
1452static int
1453bwn_chiptest(struct bwn_mac *mac)
1454{
1455#define	TESTVAL0	0x55aaaa55
1456#define	TESTVAL1	0xaa5555aa
1457	struct bwn_softc *sc = mac->mac_sc;
1458	uint32_t v, backup;
1459
1460	BWN_LOCK(sc);
1461
1462	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1463
1464	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1465	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1466		goto error;
1467	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1468	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1469		goto error;
1470
1471	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1472
1473	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1474	    (siba_get_revid(sc->sc_dev) <= 10)) {
1475		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1476		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1477		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1478			goto error;
1479		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1480			goto error;
1481	}
1482	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1483
1484	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1485	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1486		goto error;
1487
1488	BWN_UNLOCK(sc);
1489	return (0);
1490error:
1491	BWN_UNLOCK(sc);
1492	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1493	return (ENODEV);
1494}
1495
1496static int
1497bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1498{
1499	struct bwn_softc *sc = mac->mac_sc;
1500	struct ieee80211com *ic = &sc->sc_ic;
1501	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
1502
1503	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1504	ic->ic_nchans = 0;
1505
1506	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1507	    __func__,
1508	    have_bg,
1509	    have_a);
1510
1511	if (have_bg) {
1512		memset(bands, 0, sizeof(bands));
1513		setbit(bands, IEEE80211_MODE_11B);
1514		setbit(bands, IEEE80211_MODE_11G);
1515		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1516		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1517	}
1518
1519	if (have_a) {
1520		memset(bands, 0, sizeof(bands));
1521		setbit(bands, IEEE80211_MODE_11A);
1522		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1523		    &ic->ic_nchans, &bwn_chantable_a, bands);
1524	}
1525
1526	mac->mac_phy.supports_2ghz = have_bg;
1527	mac->mac_phy.supports_5ghz = have_a;
1528
1529	return (ic->ic_nchans == 0 ? ENXIO : 0);
1530}
1531
1532uint32_t
1533bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1534{
1535	uint32_t ret;
1536
1537	BWN_ASSERT_LOCKED(mac->mac_sc);
1538
1539	if (way == BWN_SHARED) {
1540		KASSERT((offset & 0x0001) == 0,
1541		    ("%s:%d warn", __func__, __LINE__));
1542		if (offset & 0x0003) {
1543			bwn_shm_ctlword(mac, way, offset >> 2);
1544			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1545			ret <<= 16;
1546			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1547			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1548			goto out;
1549		}
1550		offset >>= 2;
1551	}
1552	bwn_shm_ctlword(mac, way, offset);
1553	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1554out:
1555	return (ret);
1556}
1557
1558uint16_t
1559bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1560{
1561	uint16_t ret;
1562
1563	BWN_ASSERT_LOCKED(mac->mac_sc);
1564
1565	if (way == BWN_SHARED) {
1566		KASSERT((offset & 0x0001) == 0,
1567		    ("%s:%d warn", __func__, __LINE__));
1568		if (offset & 0x0003) {
1569			bwn_shm_ctlword(mac, way, offset >> 2);
1570			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1571			goto out;
1572		}
1573		offset >>= 2;
1574	}
1575	bwn_shm_ctlword(mac, way, offset);
1576	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1577out:
1578
1579	return (ret);
1580}
1581
1582static void
1583bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1584    uint16_t offset)
1585{
1586	uint32_t control;
1587
1588	control = way;
1589	control <<= 16;
1590	control |= offset;
1591	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1592}
1593
1594void
1595bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1596    uint32_t value)
1597{
1598	BWN_ASSERT_LOCKED(mac->mac_sc);
1599
1600	if (way == BWN_SHARED) {
1601		KASSERT((offset & 0x0001) == 0,
1602		    ("%s:%d warn", __func__, __LINE__));
1603		if (offset & 0x0003) {
1604			bwn_shm_ctlword(mac, way, offset >> 2);
1605			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1606				    (value >> 16) & 0xffff);
1607			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1608			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1609			return;
1610		}
1611		offset >>= 2;
1612	}
1613	bwn_shm_ctlword(mac, way, offset);
1614	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1615}
1616
1617void
1618bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1619    uint16_t value)
1620{
1621	BWN_ASSERT_LOCKED(mac->mac_sc);
1622
1623	if (way == BWN_SHARED) {
1624		KASSERT((offset & 0x0001) == 0,
1625		    ("%s:%d warn", __func__, __LINE__));
1626		if (offset & 0x0003) {
1627			bwn_shm_ctlword(mac, way, offset >> 2);
1628			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1629			return;
1630		}
1631		offset >>= 2;
1632	}
1633	bwn_shm_ctlword(mac, way, offset);
1634	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1635}
1636
1637static void
1638bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1639    const struct bwn_channelinfo *ci, const uint8_t bands[])
1640{
1641	int i, error;
1642
1643	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1644		const struct bwn_channel *hc = &ci->channels[i];
1645
1646		error = ieee80211_add_channel(chans, maxchans, nchans,
1647		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1648	}
1649}
1650
1651static int
1652bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1653	const struct ieee80211_bpf_params *params)
1654{
1655	struct ieee80211com *ic = ni->ni_ic;
1656	struct bwn_softc *sc = ic->ic_softc;
1657	struct bwn_mac *mac = sc->sc_curmac;
1658	int error;
1659
1660	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1661	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1662		m_freem(m);
1663		return (ENETDOWN);
1664	}
1665
1666	BWN_LOCK(sc);
1667	if (bwn_tx_isfull(sc, m)) {
1668		m_freem(m);
1669		BWN_UNLOCK(sc);
1670		return (ENOBUFS);
1671	}
1672
1673	error = bwn_tx_start(sc, ni, m);
1674	if (error == 0)
1675		sc->sc_watchdog_timer = 5;
1676	BWN_UNLOCK(sc);
1677	return (error);
1678}
1679
1680/*
1681 * Callback from the 802.11 layer to update the slot time
1682 * based on the current setting.  We use it to notify the
1683 * firmware of ERP changes and the f/w takes care of things
1684 * like slot time and preamble.
1685 */
1686static void
1687bwn_updateslot(struct ieee80211com *ic)
1688{
1689	struct bwn_softc *sc = ic->ic_softc;
1690	struct bwn_mac *mac;
1691
1692	BWN_LOCK(sc);
1693	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1694		mac = (struct bwn_mac *)sc->sc_curmac;
1695		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1696	}
1697	BWN_UNLOCK(sc);
1698}
1699
1700/*
1701 * Callback from the 802.11 layer after a promiscuous mode change.
1702 * Note this interface does not check the operating mode as this
1703 * is an internal callback and we are expected to honor the current
1704 * state (e.g. this is used for setting the interface in promiscuous
1705 * mode when operating in hostap mode to do ACS).
1706 */
1707static void
1708bwn_update_promisc(struct ieee80211com *ic)
1709{
1710	struct bwn_softc *sc = ic->ic_softc;
1711	struct bwn_mac *mac = sc->sc_curmac;
1712
1713	BWN_LOCK(sc);
1714	mac = sc->sc_curmac;
1715	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1716		if (ic->ic_promisc > 0)
1717			sc->sc_filters |= BWN_MACCTL_PROMISC;
1718		else
1719			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1720		bwn_set_opmode(mac);
1721	}
1722	BWN_UNLOCK(sc);
1723}
1724
1725/*
1726 * Callback from the 802.11 layer to update WME parameters.
1727 */
1728static int
1729bwn_wme_update(struct ieee80211com *ic)
1730{
1731	struct bwn_softc *sc = ic->ic_softc;
1732	struct bwn_mac *mac = sc->sc_curmac;
1733	struct wmeParams *wmep;
1734	int i;
1735
1736	BWN_LOCK(sc);
1737	mac = sc->sc_curmac;
1738	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1739		bwn_mac_suspend(mac);
1740		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1741			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1742			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1743		}
1744		bwn_mac_enable(mac);
1745	}
1746	BWN_UNLOCK(sc);
1747	return (0);
1748}
1749
1750static void
1751bwn_scan_start(struct ieee80211com *ic)
1752{
1753	struct bwn_softc *sc = ic->ic_softc;
1754	struct bwn_mac *mac;
1755
1756	BWN_LOCK(sc);
1757	mac = sc->sc_curmac;
1758	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1759		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1760		bwn_set_opmode(mac);
1761		/* disable CFP update during scan */
1762		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1763	}
1764	BWN_UNLOCK(sc);
1765}
1766
1767static void
1768bwn_scan_end(struct ieee80211com *ic)
1769{
1770	struct bwn_softc *sc = ic->ic_softc;
1771	struct bwn_mac *mac;
1772
1773	BWN_LOCK(sc);
1774	mac = sc->sc_curmac;
1775	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1776		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1777		bwn_set_opmode(mac);
1778		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1779	}
1780	BWN_UNLOCK(sc);
1781}
1782
1783static void
1784bwn_set_channel(struct ieee80211com *ic)
1785{
1786	struct bwn_softc *sc = ic->ic_softc;
1787	struct bwn_mac *mac = sc->sc_curmac;
1788	struct bwn_phy *phy = &mac->mac_phy;
1789	int chan, error;
1790
1791	BWN_LOCK(sc);
1792
1793	error = bwn_switch_band(sc, ic->ic_curchan);
1794	if (error)
1795		goto fail;
1796	bwn_mac_suspend(mac);
1797	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1798	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1799	if (chan != phy->chan)
1800		bwn_switch_channel(mac, chan);
1801
1802	/* TX power level */
1803	if (ic->ic_curchan->ic_maxpower != 0 &&
1804	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1805		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1806		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1807		    BWN_TXPWR_IGNORE_TSSI);
1808	}
1809
1810	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1811	if (phy->set_antenna)
1812		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1813
1814	if (sc->sc_rf_enabled != phy->rf_on) {
1815		if (sc->sc_rf_enabled) {
1816			bwn_rf_turnon(mac);
1817			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1818				device_printf(sc->sc_dev,
1819				    "please turn on the RF switch\n");
1820		} else
1821			bwn_rf_turnoff(mac);
1822	}
1823
1824	bwn_mac_enable(mac);
1825
1826fail:
1827	/*
1828	 * Setup radio tap channel freq and flags
1829	 */
1830	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1831		htole16(ic->ic_curchan->ic_freq);
1832	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1833		htole16(ic->ic_curchan->ic_flags & 0xffff);
1834
1835	BWN_UNLOCK(sc);
1836}
1837
1838static struct ieee80211vap *
1839bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1840    enum ieee80211_opmode opmode, int flags,
1841    const uint8_t bssid[IEEE80211_ADDR_LEN],
1842    const uint8_t mac[IEEE80211_ADDR_LEN])
1843{
1844	struct ieee80211vap *vap;
1845	struct bwn_vap *bvp;
1846
1847	switch (opmode) {
1848	case IEEE80211_M_HOSTAP:
1849	case IEEE80211_M_MBSS:
1850	case IEEE80211_M_STA:
1851	case IEEE80211_M_WDS:
1852	case IEEE80211_M_MONITOR:
1853	case IEEE80211_M_IBSS:
1854	case IEEE80211_M_AHDEMO:
1855		break;
1856	default:
1857		return (NULL);
1858	}
1859
1860	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1861	vap = &bvp->bv_vap;
1862	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1863	/* override with driver methods */
1864	bvp->bv_newstate = vap->iv_newstate;
1865	vap->iv_newstate = bwn_newstate;
1866
1867	/* override max aid so sta's cannot assoc when we're out of sta id's */
1868	vap->iv_max_aid = BWN_STAID_MAX;
1869
1870	ieee80211_ratectl_init(vap);
1871
1872	/* complete setup */
1873	ieee80211_vap_attach(vap, ieee80211_media_change,
1874	    ieee80211_media_status, mac);
1875	return (vap);
1876}
1877
1878static void
1879bwn_vap_delete(struct ieee80211vap *vap)
1880{
1881	struct bwn_vap *bvp = BWN_VAP(vap);
1882
1883	ieee80211_ratectl_deinit(vap);
1884	ieee80211_vap_detach(vap);
1885	free(bvp, M_80211_VAP);
1886}
1887
1888static int
1889bwn_init(struct bwn_softc *sc)
1890{
1891	struct bwn_mac *mac;
1892	int error;
1893
1894	BWN_ASSERT_LOCKED(sc);
1895
1896	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1897
1898	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1899	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1900	sc->sc_filters = 0;
1901	bwn_wme_clear(sc);
1902	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1903	sc->sc_rf_enabled = 1;
1904
1905	mac = sc->sc_curmac;
1906	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1907		error = bwn_core_init(mac);
1908		if (error != 0)
1909			return (error);
1910	}
1911	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1912		bwn_core_start(mac);
1913
1914	bwn_set_opmode(mac);
1915	bwn_set_pretbtt(mac);
1916	bwn_spu_setdelay(mac, 0);
1917	bwn_set_macaddr(mac);
1918
1919	sc->sc_flags |= BWN_FLAG_RUNNING;
1920	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1921	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1922
1923	return (0);
1924}
1925
1926static void
1927bwn_stop(struct bwn_softc *sc)
1928{
1929	struct bwn_mac *mac = sc->sc_curmac;
1930
1931	BWN_ASSERT_LOCKED(sc);
1932
1933	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1934
1935	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936		/* XXX FIXME opmode not based on VAP */
1937		bwn_set_opmode(mac);
1938		bwn_set_macaddr(mac);
1939	}
1940
1941	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1942		bwn_core_stop(mac);
1943
1944	callout_stop(&sc->sc_led_blink_ch);
1945	sc->sc_led_blinking = 0;
1946
1947	bwn_core_exit(mac);
1948	sc->sc_rf_enabled = 0;
1949
1950	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1951}
1952
1953static void
1954bwn_wme_clear(struct bwn_softc *sc)
1955{
1956#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1957	struct wmeParams *p;
1958	unsigned int i;
1959
1960	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1961	    ("%s:%d: fail", __func__, __LINE__));
1962
1963	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1964		p = &(sc->sc_wmeParams[i]);
1965
1966		switch (bwn_wme_shm_offsets[i]) {
1967		case BWN_WME_VOICE:
1968			p->wmep_txopLimit = 0;
1969			p->wmep_aifsn = 2;
1970			/* XXX FIXME: log2(cwmin) */
1971			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1972			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1973			break;
1974		case BWN_WME_VIDEO:
1975			p->wmep_txopLimit = 0;
1976			p->wmep_aifsn = 2;
1977			/* XXX FIXME: log2(cwmin) */
1978			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1979			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1980			break;
1981		case BWN_WME_BESTEFFORT:
1982			p->wmep_txopLimit = 0;
1983			p->wmep_aifsn = 3;
1984			/* XXX FIXME: log2(cwmin) */
1985			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1986			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1987			break;
1988		case BWN_WME_BACKGROUND:
1989			p->wmep_txopLimit = 0;
1990			p->wmep_aifsn = 7;
1991			/* XXX FIXME: log2(cwmin) */
1992			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1993			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1994			break;
1995		default:
1996			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1997		}
1998	}
1999}
2000
2001static int
2002bwn_core_init(struct bwn_mac *mac)
2003{
2004	struct bwn_softc *sc = mac->mac_sc;
2005	uint64_t hf;
2006	int error;
2007
2008	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2009	    ("%s:%d: fail", __func__, __LINE__));
2010
2011	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2012
2013	siba_powerup(sc->sc_dev, 0);
2014	if (!siba_dev_isup(sc->sc_dev))
2015		bwn_reset_core(mac, mac->mac_phy.gmode);
2016
2017	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2018	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2019	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2020	BWN_GETTIME(mac->mac_phy.nexttime);
2021	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2022	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2023	mac->mac_stats.link_noise = -95;
2024	mac->mac_reason_intr = 0;
2025	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2026	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2027#ifdef BWN_DEBUG
2028	if (sc->sc_debug & BWN_DEBUG_XMIT)
2029		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2030#endif
2031	mac->mac_suspended = 1;
2032	mac->mac_task_state = 0;
2033	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2034
2035	mac->mac_phy.init_pre(mac);
2036
2037	siba_pcicore_intr(sc->sc_dev);
2038
2039	siba_fix_imcfglobug(sc->sc_dev);
2040	bwn_bt_disable(mac);
2041	if (mac->mac_phy.prepare_hw) {
2042		error = mac->mac_phy.prepare_hw(mac);
2043		if (error)
2044			goto fail0;
2045	}
2046	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2047	error = bwn_chip_init(mac);
2048	if (error)
2049		goto fail0;
2050	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2051	    siba_get_revid(sc->sc_dev));
2052	hf = bwn_hf_read(mac);
2053	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2054		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2055		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2056			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2057		if (mac->mac_phy.rev == 1)
2058			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2059	}
2060	if (mac->mac_phy.rf_ver == 0x2050) {
2061		if (mac->mac_phy.rf_rev < 6)
2062			hf |= BWN_HF_FORCE_VCO_RECALC;
2063		if (mac->mac_phy.rf_rev == 6)
2064			hf |= BWN_HF_4318_TSSI;
2065	}
2066	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2067		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2068	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2069	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2070		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2071	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2072	bwn_hf_write(mac, hf);
2073
2074	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2075	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2076	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2077	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2078
2079	bwn_rate_init(mac);
2080	bwn_set_phytxctl(mac);
2081
2082	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2083	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2084	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2085
2086	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2087		bwn_pio_init(mac);
2088	else
2089		bwn_dma_init(mac);
2090	bwn_wme_init(mac);
2091	bwn_spu_setdelay(mac, 1);
2092	bwn_bt_enable(mac);
2093
2094	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2095	siba_powerup(sc->sc_dev,
2096	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2097	bwn_set_macaddr(mac);
2098	bwn_crypt_init(mac);
2099
2100	/* XXX LED initializatin */
2101
2102	mac->mac_status = BWN_MAC_STATUS_INITED;
2103
2104	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2105	return (error);
2106
2107fail0:
2108	siba_powerdown(sc->sc_dev);
2109	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2110	    ("%s:%d: fail", __func__, __LINE__));
2111	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2112	return (error);
2113}
2114
2115static void
2116bwn_core_start(struct bwn_mac *mac)
2117{
2118	struct bwn_softc *sc = mac->mac_sc;
2119	uint32_t tmp;
2120
2121	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2122	    ("%s:%d: fail", __func__, __LINE__));
2123
2124	if (siba_get_revid(sc->sc_dev) < 5)
2125		return;
2126
2127	while (1) {
2128		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2129		if (!(tmp & 0x00000001))
2130			break;
2131		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2132	}
2133
2134	bwn_mac_enable(mac);
2135	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2136	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2137
2138	mac->mac_status = BWN_MAC_STATUS_STARTED;
2139}
2140
2141static void
2142bwn_core_exit(struct bwn_mac *mac)
2143{
2144	struct bwn_softc *sc = mac->mac_sc;
2145	uint32_t macctl;
2146
2147	BWN_ASSERT_LOCKED(mac->mac_sc);
2148
2149	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2150	    ("%s:%d: fail", __func__, __LINE__));
2151
2152	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2153		return;
2154	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2155
2156	macctl = BWN_READ_4(mac, BWN_MACCTL);
2157	macctl &= ~BWN_MACCTL_MCODE_RUN;
2158	macctl |= BWN_MACCTL_MCODE_JMP0;
2159	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2160
2161	bwn_dma_stop(mac);
2162	bwn_pio_stop(mac);
2163	bwn_chip_exit(mac);
2164	mac->mac_phy.switch_analog(mac, 0);
2165	siba_dev_down(sc->sc_dev, 0);
2166	siba_powerdown(sc->sc_dev);
2167}
2168
2169static void
2170bwn_bt_disable(struct bwn_mac *mac)
2171{
2172	struct bwn_softc *sc = mac->mac_sc;
2173
2174	(void)sc;
2175	/* XXX do nothing yet */
2176}
2177
2178static int
2179bwn_chip_init(struct bwn_mac *mac)
2180{
2181	struct bwn_softc *sc = mac->mac_sc;
2182	struct bwn_phy *phy = &mac->mac_phy;
2183	uint32_t macctl;
2184	int error;
2185
2186	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2187	if (phy->gmode)
2188		macctl |= BWN_MACCTL_GMODE;
2189	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2190
2191	error = bwn_fw_fillinfo(mac);
2192	if (error)
2193		return (error);
2194	error = bwn_fw_loaducode(mac);
2195	if (error)
2196		return (error);
2197
2198	error = bwn_gpio_init(mac);
2199	if (error)
2200		return (error);
2201
2202	error = bwn_fw_loadinitvals(mac);
2203	if (error) {
2204		siba_gpio_set(sc->sc_dev, 0);
2205		return (error);
2206	}
2207	phy->switch_analog(mac, 1);
2208	error = bwn_phy_init(mac);
2209	if (error) {
2210		siba_gpio_set(sc->sc_dev, 0);
2211		return (error);
2212	}
2213	if (phy->set_im)
2214		phy->set_im(mac, BWN_IMMODE_NONE);
2215	if (phy->set_antenna)
2216		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2217	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2218
2219	if (phy->type == BWN_PHYTYPE_B)
2220		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2221	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2222	if (siba_get_revid(sc->sc_dev) < 5)
2223		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2224
2225	BWN_WRITE_4(mac, BWN_MACCTL,
2226	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2227	BWN_WRITE_4(mac, BWN_MACCTL,
2228	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2229	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2230
2231	bwn_set_opmode(mac);
2232	if (siba_get_revid(sc->sc_dev) < 3) {
2233		BWN_WRITE_2(mac, 0x060e, 0x0000);
2234		BWN_WRITE_2(mac, 0x0610, 0x8000);
2235		BWN_WRITE_2(mac, 0x0604, 0x0000);
2236		BWN_WRITE_2(mac, 0x0606, 0x0200);
2237	} else {
2238		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2239		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2240	}
2241	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2242	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2243	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2244	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2245	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2246	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2247	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2248
2249	bwn_mac_phy_clock_set(mac, true);
2250
2251	/* SIBA powerup */
2252	/* XXX TODO: BCMA powerup */
2253	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2254	return (error);
2255}
2256
2257/* read hostflags */
2258uint64_t
2259bwn_hf_read(struct bwn_mac *mac)
2260{
2261	uint64_t ret;
2262
2263	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2264	ret <<= 16;
2265	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2266	ret <<= 16;
2267	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2268	return (ret);
2269}
2270
2271void
2272bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2273{
2274
2275	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2276	    (value & 0x00000000ffffull));
2277	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2278	    (value & 0x0000ffff0000ull) >> 16);
2279	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2280	    (value & 0xffff00000000ULL) >> 32);
2281}
2282
2283static void
2284bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2285{
2286
2287	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2288	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2289}
2290
2291static void
2292bwn_rate_init(struct bwn_mac *mac)
2293{
2294
2295	switch (mac->mac_phy.type) {
2296	case BWN_PHYTYPE_A:
2297	case BWN_PHYTYPE_G:
2298	case BWN_PHYTYPE_LP:
2299	case BWN_PHYTYPE_N:
2300		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2301		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2302		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2303		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2304		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2305		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2306		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2307		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2308			break;
2309		/* FALLTHROUGH */
2310	case BWN_PHYTYPE_B:
2311		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2312		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2313		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2314		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2315		break;
2316	default:
2317		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2318	}
2319}
2320
2321static void
2322bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2323{
2324	uint16_t offset;
2325
2326	if (ofdm) {
2327		offset = 0x480;
2328		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2329	} else {
2330		offset = 0x4c0;
2331		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2332	}
2333	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2334	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2335}
2336
2337static uint8_t
2338bwn_plcp_getcck(const uint8_t bitrate)
2339{
2340
2341	switch (bitrate) {
2342	case BWN_CCK_RATE_1MB:
2343		return (0x0a);
2344	case BWN_CCK_RATE_2MB:
2345		return (0x14);
2346	case BWN_CCK_RATE_5MB:
2347		return (0x37);
2348	case BWN_CCK_RATE_11MB:
2349		return (0x6e);
2350	}
2351	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2352	return (0);
2353}
2354
2355static uint8_t
2356bwn_plcp_getofdm(const uint8_t bitrate)
2357{
2358
2359	switch (bitrate) {
2360	case BWN_OFDM_RATE_6MB:
2361		return (0xb);
2362	case BWN_OFDM_RATE_9MB:
2363		return (0xf);
2364	case BWN_OFDM_RATE_12MB:
2365		return (0xa);
2366	case BWN_OFDM_RATE_18MB:
2367		return (0xe);
2368	case BWN_OFDM_RATE_24MB:
2369		return (0x9);
2370	case BWN_OFDM_RATE_36MB:
2371		return (0xd);
2372	case BWN_OFDM_RATE_48MB:
2373		return (0x8);
2374	case BWN_OFDM_RATE_54MB:
2375		return (0xc);
2376	}
2377	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2378	return (0);
2379}
2380
2381static void
2382bwn_set_phytxctl(struct bwn_mac *mac)
2383{
2384	uint16_t ctl;
2385
2386	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2387	    BWN_TX_PHY_TXPWR);
2388	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2389	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2390	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2391}
2392
2393static void
2394bwn_pio_init(struct bwn_mac *mac)
2395{
2396	struct bwn_pio *pio = &mac->mac_method.pio;
2397
2398	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2399	    & ~BWN_MACCTL_BIGENDIAN);
2400	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2401
2402	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2403	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2404	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2405	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2406	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2407	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2408}
2409
2410static void
2411bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2412    int index)
2413{
2414	struct bwn_pio_txpkt *tp;
2415	struct bwn_softc *sc = mac->mac_sc;
2416	unsigned int i;
2417
2418	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2419	tq->tq_index = index;
2420
2421	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2422	if (siba_get_revid(sc->sc_dev) >= 8)
2423		tq->tq_size = 1920;
2424	else {
2425		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2426		tq->tq_size -= 80;
2427	}
2428
2429	TAILQ_INIT(&tq->tq_pktlist);
2430	for (i = 0; i < N(tq->tq_pkts); i++) {
2431		tp = &(tq->tq_pkts[i]);
2432		tp->tp_index = i;
2433		tp->tp_queue = tq;
2434		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2435	}
2436}
2437
2438static uint16_t
2439bwn_pio_idx2base(struct bwn_mac *mac, int index)
2440{
2441	struct bwn_softc *sc = mac->mac_sc;
2442	static const uint16_t bases[] = {
2443		BWN_PIO_BASE0,
2444		BWN_PIO_BASE1,
2445		BWN_PIO_BASE2,
2446		BWN_PIO_BASE3,
2447		BWN_PIO_BASE4,
2448		BWN_PIO_BASE5,
2449		BWN_PIO_BASE6,
2450		BWN_PIO_BASE7,
2451	};
2452	static const uint16_t bases_rev11[] = {
2453		BWN_PIO11_BASE0,
2454		BWN_PIO11_BASE1,
2455		BWN_PIO11_BASE2,
2456		BWN_PIO11_BASE3,
2457		BWN_PIO11_BASE4,
2458		BWN_PIO11_BASE5,
2459	};
2460
2461	if (siba_get_revid(sc->sc_dev) >= 11) {
2462		if (index >= N(bases_rev11))
2463			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2464		return (bases_rev11[index]);
2465	}
2466	if (index >= N(bases))
2467		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2468	return (bases[index]);
2469}
2470
2471static void
2472bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2473    int index)
2474{
2475	struct bwn_softc *sc = mac->mac_sc;
2476
2477	prq->prq_mac = mac;
2478	prq->prq_rev = siba_get_revid(sc->sc_dev);
2479	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2480	bwn_dma_rxdirectfifo(mac, index, 1);
2481}
2482
2483static void
2484bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2485{
2486	if (tq == NULL)
2487		return;
2488	bwn_pio_cancel_tx_packets(tq);
2489}
2490
2491static void
2492bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2493{
2494
2495	bwn_destroy_pioqueue_tx(pio);
2496}
2497
2498static uint16_t
2499bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2500    uint16_t offset)
2501{
2502
2503	return (BWN_READ_2(mac, tq->tq_base + offset));
2504}
2505
2506static void
2507bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2508{
2509	uint32_t ctl;
2510	int type;
2511	uint16_t base;
2512
2513	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2514	base = bwn_dma_base(type, idx);
2515	if (type == BWN_DMA_64BIT) {
2516		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2517		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2518		if (enable)
2519			ctl |= BWN_DMA64_RXDIRECTFIFO;
2520		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2521	} else {
2522		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2523		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2524		if (enable)
2525			ctl |= BWN_DMA32_RXDIRECTFIFO;
2526		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2527	}
2528}
2529
2530static uint64_t
2531bwn_dma_mask(struct bwn_mac *mac)
2532{
2533	uint32_t tmp;
2534	uint16_t base;
2535
2536	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2537	if (tmp & SIBA_TGSHIGH_DMA64)
2538		return (BWN_DMA_BIT_MASK(64));
2539	base = bwn_dma_base(0, 0);
2540	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2541	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2542	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2543		return (BWN_DMA_BIT_MASK(32));
2544
2545	return (BWN_DMA_BIT_MASK(30));
2546}
2547
2548static int
2549bwn_dma_mask2type(uint64_t dmamask)
2550{
2551
2552	if (dmamask == BWN_DMA_BIT_MASK(30))
2553		return (BWN_DMA_30BIT);
2554	if (dmamask == BWN_DMA_BIT_MASK(32))
2555		return (BWN_DMA_32BIT);
2556	if (dmamask == BWN_DMA_BIT_MASK(64))
2557		return (BWN_DMA_64BIT);
2558	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2559	return (BWN_DMA_30BIT);
2560}
2561
2562static void
2563bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2564{
2565	struct bwn_pio_txpkt *tp;
2566	unsigned int i;
2567
2568	for (i = 0; i < N(tq->tq_pkts); i++) {
2569		tp = &(tq->tq_pkts[i]);
2570		if (tp->tp_m) {
2571			m_freem(tp->tp_m);
2572			tp->tp_m = NULL;
2573		}
2574	}
2575}
2576
2577static uint16_t
2578bwn_dma_base(int type, int controller_idx)
2579{
2580	static const uint16_t map64[] = {
2581		BWN_DMA64_BASE0,
2582		BWN_DMA64_BASE1,
2583		BWN_DMA64_BASE2,
2584		BWN_DMA64_BASE3,
2585		BWN_DMA64_BASE4,
2586		BWN_DMA64_BASE5,
2587	};
2588	static const uint16_t map32[] = {
2589		BWN_DMA32_BASE0,
2590		BWN_DMA32_BASE1,
2591		BWN_DMA32_BASE2,
2592		BWN_DMA32_BASE3,
2593		BWN_DMA32_BASE4,
2594		BWN_DMA32_BASE5,
2595	};
2596
2597	if (type == BWN_DMA_64BIT) {
2598		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2599		    ("%s:%d: fail", __func__, __LINE__));
2600		return (map64[controller_idx]);
2601	}
2602	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2603	    ("%s:%d: fail", __func__, __LINE__));
2604	return (map32[controller_idx]);
2605}
2606
2607static void
2608bwn_dma_init(struct bwn_mac *mac)
2609{
2610	struct bwn_dma *dma = &mac->mac_method.dma;
2611
2612	/* setup TX DMA channels. */
2613	bwn_dma_setup(dma->wme[WME_AC_BK]);
2614	bwn_dma_setup(dma->wme[WME_AC_BE]);
2615	bwn_dma_setup(dma->wme[WME_AC_VI]);
2616	bwn_dma_setup(dma->wme[WME_AC_VO]);
2617	bwn_dma_setup(dma->mcast);
2618	/* setup RX DMA channel. */
2619	bwn_dma_setup(dma->rx);
2620}
2621
2622static struct bwn_dma_ring *
2623bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2624    int for_tx, int type)
2625{
2626	struct bwn_dma *dma = &mac->mac_method.dma;
2627	struct bwn_dma_ring *dr;
2628	struct bwn_dmadesc_generic *desc;
2629	struct bwn_dmadesc_meta *mt;
2630	struct bwn_softc *sc = mac->mac_sc;
2631	int error, i;
2632
2633	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2634	if (dr == NULL)
2635		goto out;
2636	dr->dr_numslots = BWN_RXRING_SLOTS;
2637	if (for_tx)
2638		dr->dr_numslots = BWN_TXRING_SLOTS;
2639
2640	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2641	    M_DEVBUF, M_NOWAIT | M_ZERO);
2642	if (dr->dr_meta == NULL)
2643		goto fail0;
2644
2645	dr->dr_type = type;
2646	dr->dr_mac = mac;
2647	dr->dr_base = bwn_dma_base(type, controller_index);
2648	dr->dr_index = controller_index;
2649	if (type == BWN_DMA_64BIT) {
2650		dr->getdesc = bwn_dma_64_getdesc;
2651		dr->setdesc = bwn_dma_64_setdesc;
2652		dr->start_transfer = bwn_dma_64_start_transfer;
2653		dr->suspend = bwn_dma_64_suspend;
2654		dr->resume = bwn_dma_64_resume;
2655		dr->get_curslot = bwn_dma_64_get_curslot;
2656		dr->set_curslot = bwn_dma_64_set_curslot;
2657	} else {
2658		dr->getdesc = bwn_dma_32_getdesc;
2659		dr->setdesc = bwn_dma_32_setdesc;
2660		dr->start_transfer = bwn_dma_32_start_transfer;
2661		dr->suspend = bwn_dma_32_suspend;
2662		dr->resume = bwn_dma_32_resume;
2663		dr->get_curslot = bwn_dma_32_get_curslot;
2664		dr->set_curslot = bwn_dma_32_set_curslot;
2665	}
2666	if (for_tx) {
2667		dr->dr_tx = 1;
2668		dr->dr_curslot = -1;
2669	} else {
2670		if (dr->dr_index == 0) {
2671			switch (mac->mac_fw.fw_hdr_format) {
2672			case BWN_FW_HDR_351:
2673			case BWN_FW_HDR_410:
2674				dr->dr_rx_bufsize =
2675				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2676				dr->dr_frameoffset =
2677				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2678				break;
2679			case BWN_FW_HDR_598:
2680				dr->dr_rx_bufsize =
2681				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2682				dr->dr_frameoffset =
2683				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2684				break;
2685			}
2686		} else
2687			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2688	}
2689
2690	error = bwn_dma_allocringmemory(dr);
2691	if (error)
2692		goto fail2;
2693
2694	if (for_tx) {
2695		/*
2696		 * Assumption: BWN_TXRING_SLOTS can be divided by
2697		 * BWN_TX_SLOTS_PER_FRAME
2698		 */
2699		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2700		    ("%s:%d: fail", __func__, __LINE__));
2701
2702		dr->dr_txhdr_cache = contigmalloc(
2703		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2704		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2705		    0, BUS_SPACE_MAXADDR, 8, 0);
2706		if (dr->dr_txhdr_cache == NULL) {
2707			device_printf(sc->sc_dev,
2708			    "can't allocate TX header DMA memory\n");
2709			goto fail1;
2710		}
2711
2712		/*
2713		 * Create TX ring DMA stuffs
2714		 */
2715		error = bus_dma_tag_create(dma->parent_dtag,
2716				    BWN_ALIGN, 0,
2717				    BUS_SPACE_MAXADDR,
2718				    BUS_SPACE_MAXADDR,
2719				    NULL, NULL,
2720				    BWN_HDRSIZE(mac),
2721				    1,
2722				    BUS_SPACE_MAXSIZE_32BIT,
2723				    0,
2724				    NULL, NULL,
2725				    &dr->dr_txring_dtag);
2726		if (error) {
2727			device_printf(sc->sc_dev,
2728			    "can't create TX ring DMA tag: TODO frees\n");
2729			goto fail2;
2730		}
2731
2732		for (i = 0; i < dr->dr_numslots; i += 2) {
2733			dr->getdesc(dr, i, &desc, &mt);
2734
2735			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2736			mt->mt_m = NULL;
2737			mt->mt_ni = NULL;
2738			mt->mt_islast = 0;
2739			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2740			    &mt->mt_dmap);
2741			if (error) {
2742				device_printf(sc->sc_dev,
2743				     "can't create RX buf DMA map\n");
2744				goto fail2;
2745			}
2746
2747			dr->getdesc(dr, i + 1, &desc, &mt);
2748
2749			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2750			mt->mt_m = NULL;
2751			mt->mt_ni = NULL;
2752			mt->mt_islast = 1;
2753			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2754			    &mt->mt_dmap);
2755			if (error) {
2756				device_printf(sc->sc_dev,
2757				     "can't create RX buf DMA map\n");
2758				goto fail2;
2759			}
2760		}
2761	} else {
2762		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2763		    &dr->dr_spare_dmap);
2764		if (error) {
2765			device_printf(sc->sc_dev,
2766			    "can't create RX buf DMA map\n");
2767			goto out;		/* XXX wrong! */
2768		}
2769
2770		for (i = 0; i < dr->dr_numslots; i++) {
2771			dr->getdesc(dr, i, &desc, &mt);
2772
2773			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2774			    &mt->mt_dmap);
2775			if (error) {
2776				device_printf(sc->sc_dev,
2777				    "can't create RX buf DMA map\n");
2778				goto out;	/* XXX wrong! */
2779			}
2780			error = bwn_dma_newbuf(dr, desc, mt, 1);
2781			if (error) {
2782				device_printf(sc->sc_dev,
2783				    "failed to allocate RX buf\n");
2784				goto out;	/* XXX wrong! */
2785			}
2786		}
2787
2788		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2789		    BUS_DMASYNC_PREWRITE);
2790
2791		dr->dr_usedslot = dr->dr_numslots;
2792	}
2793
2794      out:
2795	return (dr);
2796
2797fail2:
2798	if (dr->dr_txhdr_cache != NULL) {
2799		contigfree(dr->dr_txhdr_cache,
2800		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2801		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2802	}
2803fail1:
2804	free(dr->dr_meta, M_DEVBUF);
2805fail0:
2806	free(dr, M_DEVBUF);
2807	return (NULL);
2808}
2809
2810static void
2811bwn_dma_ringfree(struct bwn_dma_ring **dr)
2812{
2813
2814	if (dr == NULL)
2815		return;
2816
2817	bwn_dma_free_descbufs(*dr);
2818	bwn_dma_free_ringmemory(*dr);
2819
2820	if ((*dr)->dr_txhdr_cache != NULL) {
2821		contigfree((*dr)->dr_txhdr_cache,
2822		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2823		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2824	}
2825	free((*dr)->dr_meta, M_DEVBUF);
2826	free(*dr, M_DEVBUF);
2827
2828	*dr = NULL;
2829}
2830
2831static void
2832bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2833    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2834{
2835	struct bwn_dmadesc32 *desc;
2836
2837	*meta = &(dr->dr_meta[slot]);
2838	desc = dr->dr_ring_descbase;
2839	desc = &(desc[slot]);
2840
2841	*gdesc = (struct bwn_dmadesc_generic *)desc;
2842}
2843
2844static void
2845bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2846    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2847    int start, int end, int irq)
2848{
2849	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2850	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2851	uint32_t addr, addrext, ctl;
2852	int slot;
2853
2854	slot = (int)(&(desc->dma.dma32) - descbase);
2855	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2856	    ("%s:%d: fail", __func__, __LINE__));
2857
2858	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2859	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2860	addr |= siba_dma_translation(sc->sc_dev);
2861	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2862	if (slot == dr->dr_numslots - 1)
2863		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2864	if (start)
2865		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2866	if (end)
2867		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2868	if (irq)
2869		ctl |= BWN_DMA32_DCTL_IRQ;
2870	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2871	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2872
2873	desc->dma.dma32.control = htole32(ctl);
2874	desc->dma.dma32.address = htole32(addr);
2875}
2876
2877static void
2878bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2879{
2880
2881	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2882	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2883}
2884
2885static void
2886bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2887{
2888
2889	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2890	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2891}
2892
2893static void
2894bwn_dma_32_resume(struct bwn_dma_ring *dr)
2895{
2896
2897	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2898	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2899}
2900
2901static int
2902bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2903{
2904	uint32_t val;
2905
2906	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2907	val &= BWN_DMA32_RXDPTR;
2908
2909	return (val / sizeof(struct bwn_dmadesc32));
2910}
2911
2912static void
2913bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2914{
2915
2916	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2917	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2918}
2919
2920static void
2921bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2922    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2923{
2924	struct bwn_dmadesc64 *desc;
2925
2926	*meta = &(dr->dr_meta[slot]);
2927	desc = dr->dr_ring_descbase;
2928	desc = &(desc[slot]);
2929
2930	*gdesc = (struct bwn_dmadesc_generic *)desc;
2931}
2932
2933static void
2934bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2935    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2936    int start, int end, int irq)
2937{
2938	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2939	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2940	int slot;
2941	uint32_t ctl0 = 0, ctl1 = 0;
2942	uint32_t addrlo, addrhi;
2943	uint32_t addrext;
2944
2945	slot = (int)(&(desc->dma.dma64) - descbase);
2946	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2947	    ("%s:%d: fail", __func__, __LINE__));
2948
2949	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2950	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2951	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2952	    30;
2953	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2954	if (slot == dr->dr_numslots - 1)
2955		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2956	if (start)
2957		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2958	if (end)
2959		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2960	if (irq)
2961		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2962	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2963	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2964	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2965
2966	desc->dma.dma64.control0 = htole32(ctl0);
2967	desc->dma.dma64.control1 = htole32(ctl1);
2968	desc->dma.dma64.address_low = htole32(addrlo);
2969	desc->dma.dma64.address_high = htole32(addrhi);
2970}
2971
2972static void
2973bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2974{
2975
2976	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2977	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2978}
2979
2980static void
2981bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2982{
2983
2984	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2985	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2986}
2987
2988static void
2989bwn_dma_64_resume(struct bwn_dma_ring *dr)
2990{
2991
2992	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2993	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2994}
2995
2996static int
2997bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2998{
2999	uint32_t val;
3000
3001	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3002	val &= BWN_DMA64_RXSTATDPTR;
3003
3004	return (val / sizeof(struct bwn_dmadesc64));
3005}
3006
3007static void
3008bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3009{
3010
3011	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3012	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3013}
3014
3015static int
3016bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3017{
3018	struct bwn_mac *mac = dr->dr_mac;
3019	struct bwn_dma *dma = &mac->mac_method.dma;
3020	struct bwn_softc *sc = mac->mac_sc;
3021	int error;
3022
3023	error = bus_dma_tag_create(dma->parent_dtag,
3024			    BWN_ALIGN, 0,
3025			    BUS_SPACE_MAXADDR,
3026			    BUS_SPACE_MAXADDR,
3027			    NULL, NULL,
3028			    BWN_DMA_RINGMEMSIZE,
3029			    1,
3030			    BUS_SPACE_MAXSIZE_32BIT,
3031			    0,
3032			    NULL, NULL,
3033			    &dr->dr_ring_dtag);
3034	if (error) {
3035		device_printf(sc->sc_dev,
3036		    "can't create TX ring DMA tag: TODO frees\n");
3037		return (-1);
3038	}
3039
3040	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3041	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3042	    &dr->dr_ring_dmap);
3043	if (error) {
3044		device_printf(sc->sc_dev,
3045		    "can't allocate DMA mem: TODO frees\n");
3046		return (-1);
3047	}
3048	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3049	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3050	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3051	if (error) {
3052		device_printf(sc->sc_dev,
3053		    "can't load DMA mem: TODO free\n");
3054		return (-1);
3055	}
3056
3057	return (0);
3058}
3059
3060static void
3061bwn_dma_setup(struct bwn_dma_ring *dr)
3062{
3063	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3064	uint64_t ring64;
3065	uint32_t addrext, ring32, value;
3066	uint32_t trans = siba_dma_translation(sc->sc_dev);
3067
3068	if (dr->dr_tx) {
3069		dr->dr_curslot = -1;
3070
3071		if (dr->dr_type == BWN_DMA_64BIT) {
3072			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3073			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3074			    >> 30;
3075			value = BWN_DMA64_TXENABLE;
3076			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3077			    & BWN_DMA64_TXADDREXT_MASK;
3078			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3079			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3080			    (ring64 & 0xffffffff));
3081			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3082			    ((ring64 >> 32) &
3083			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3084		} else {
3085			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3086			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3087			value = BWN_DMA32_TXENABLE;
3088			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3089			    & BWN_DMA32_TXADDREXT_MASK;
3090			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3091			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3092			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3093		}
3094		return;
3095	}
3096
3097	/*
3098	 * set for RX
3099	 */
3100	dr->dr_usedslot = dr->dr_numslots;
3101
3102	if (dr->dr_type == BWN_DMA_64BIT) {
3103		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3104		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3105		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3106		value |= BWN_DMA64_RXENABLE;
3107		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3108		    & BWN_DMA64_RXADDREXT_MASK;
3109		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3110		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3111		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3112		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3113		    | (trans << 1));
3114		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3115		    sizeof(struct bwn_dmadesc64));
3116	} else {
3117		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3118		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3119		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3120		value |= BWN_DMA32_RXENABLE;
3121		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3122		    & BWN_DMA32_RXADDREXT_MASK;
3123		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3124		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3125		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3126		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3127		    sizeof(struct bwn_dmadesc32));
3128	}
3129}
3130
3131static void
3132bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3133{
3134
3135	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3136	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3137	    dr->dr_ring_dmap);
3138}
3139
3140static void
3141bwn_dma_cleanup(struct bwn_dma_ring *dr)
3142{
3143
3144	if (dr->dr_tx) {
3145		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3146		if (dr->dr_type == BWN_DMA_64BIT) {
3147			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3148			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3149		} else
3150			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3151	} else {
3152		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3153		if (dr->dr_type == BWN_DMA_64BIT) {
3154			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3155			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3156		} else
3157			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3158	}
3159}
3160
3161static void
3162bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3163{
3164	struct bwn_dmadesc_generic *desc;
3165	struct bwn_dmadesc_meta *meta;
3166	struct bwn_mac *mac = dr->dr_mac;
3167	struct bwn_dma *dma = &mac->mac_method.dma;
3168	struct bwn_softc *sc = mac->mac_sc;
3169	int i;
3170
3171	if (!dr->dr_usedslot)
3172		return;
3173	for (i = 0; i < dr->dr_numslots; i++) {
3174		dr->getdesc(dr, i, &desc, &meta);
3175
3176		if (meta->mt_m == NULL) {
3177			if (!dr->dr_tx)
3178				device_printf(sc->sc_dev, "%s: not TX?\n",
3179				    __func__);
3180			continue;
3181		}
3182		if (dr->dr_tx) {
3183			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3184				bus_dmamap_unload(dr->dr_txring_dtag,
3185				    meta->mt_dmap);
3186			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3187				bus_dmamap_unload(dma->txbuf_dtag,
3188				    meta->mt_dmap);
3189		} else
3190			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3191		bwn_dma_free_descbuf(dr, meta);
3192	}
3193}
3194
3195static int
3196bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3197    int type)
3198{
3199	struct bwn_softc *sc = mac->mac_sc;
3200	uint32_t value;
3201	int i;
3202	uint16_t offset;
3203
3204	for (i = 0; i < 10; i++) {
3205		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3206		    BWN_DMA32_TXSTATUS;
3207		value = BWN_READ_4(mac, base + offset);
3208		if (type == BWN_DMA_64BIT) {
3209			value &= BWN_DMA64_TXSTAT;
3210			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3211			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3212			    value == BWN_DMA64_TXSTAT_STOPPED)
3213				break;
3214		} else {
3215			value &= BWN_DMA32_TXSTATE;
3216			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3217			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3218			    value == BWN_DMA32_TXSTAT_STOPPED)
3219				break;
3220		}
3221		DELAY(1000);
3222	}
3223	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3224	BWN_WRITE_4(mac, base + offset, 0);
3225	for (i = 0; i < 10; i++) {
3226		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3227						   BWN_DMA32_TXSTATUS;
3228		value = BWN_READ_4(mac, base + offset);
3229		if (type == BWN_DMA_64BIT) {
3230			value &= BWN_DMA64_TXSTAT;
3231			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3232				i = -1;
3233				break;
3234			}
3235		} else {
3236			value &= BWN_DMA32_TXSTATE;
3237			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3238				i = -1;
3239				break;
3240			}
3241		}
3242		DELAY(1000);
3243	}
3244	if (i != -1) {
3245		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3246		return (ENODEV);
3247	}
3248	DELAY(1000);
3249
3250	return (0);
3251}
3252
3253static int
3254bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3255    int type)
3256{
3257	struct bwn_softc *sc = mac->mac_sc;
3258	uint32_t value;
3259	int i;
3260	uint16_t offset;
3261
3262	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3263	BWN_WRITE_4(mac, base + offset, 0);
3264	for (i = 0; i < 10; i++) {
3265		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3266		    BWN_DMA32_RXSTATUS;
3267		value = BWN_READ_4(mac, base + offset);
3268		if (type == BWN_DMA_64BIT) {
3269			value &= BWN_DMA64_RXSTAT;
3270			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3271				i = -1;
3272				break;
3273			}
3274		} else {
3275			value &= BWN_DMA32_RXSTATE;
3276			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3277				i = -1;
3278				break;
3279			}
3280		}
3281		DELAY(1000);
3282	}
3283	if (i != -1) {
3284		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3285		return (ENODEV);
3286	}
3287
3288	return (0);
3289}
3290
3291static void
3292bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3293    struct bwn_dmadesc_meta *meta)
3294{
3295
3296	if (meta->mt_m != NULL) {
3297		m_freem(meta->mt_m);
3298		meta->mt_m = NULL;
3299	}
3300	if (meta->mt_ni != NULL) {
3301		ieee80211_free_node(meta->mt_ni);
3302		meta->mt_ni = NULL;
3303	}
3304}
3305
3306static void
3307bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3308{
3309	struct bwn_rxhdr4 *rxhdr;
3310	unsigned char *frame;
3311
3312	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3313	rxhdr->frame_len = 0;
3314
3315	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3316	    sizeof(struct bwn_plcp6) + 2,
3317	    ("%s:%d: fail", __func__, __LINE__));
3318	frame = mtod(m, char *) + dr->dr_frameoffset;
3319	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3320}
3321
3322static uint8_t
3323bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3324{
3325	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3326
3327	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3328	    == 0xff);
3329}
3330
3331static void
3332bwn_wme_init(struct bwn_mac *mac)
3333{
3334
3335	bwn_wme_load(mac);
3336
3337	/* enable WME support. */
3338	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3339	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3340	    BWN_IFSCTL_USE_EDCF);
3341}
3342
3343static void
3344bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3345{
3346	struct bwn_softc *sc = mac->mac_sc;
3347	struct ieee80211com *ic = &sc->sc_ic;
3348	uint16_t delay;	/* microsec */
3349
3350	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3351	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3352		delay = 500;
3353	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3354		delay = max(delay, (uint16_t)2400);
3355
3356	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3357}
3358
3359static void
3360bwn_bt_enable(struct bwn_mac *mac)
3361{
3362	struct bwn_softc *sc = mac->mac_sc;
3363	uint64_t hf;
3364
3365	if (bwn_bluetooth == 0)
3366		return;
3367	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3368		return;
3369	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3370		return;
3371
3372	hf = bwn_hf_read(mac);
3373	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3374		hf |= BWN_HF_BT_COEXISTALT;
3375	else
3376		hf |= BWN_HF_BT_COEXIST;
3377	bwn_hf_write(mac, hf);
3378}
3379
3380static void
3381bwn_set_macaddr(struct bwn_mac *mac)
3382{
3383
3384	bwn_mac_write_bssid(mac);
3385	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3386	    mac->mac_sc->sc_ic.ic_macaddr);
3387}
3388
3389static void
3390bwn_clear_keys(struct bwn_mac *mac)
3391{
3392	int i;
3393
3394	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3395		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3396		    ("%s:%d: fail", __func__, __LINE__));
3397
3398		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3399		    NULL, BWN_SEC_KEYSIZE, NULL);
3400		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3401			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3402			    NULL, BWN_SEC_KEYSIZE, NULL);
3403		}
3404		mac->mac_key[i].keyconf = NULL;
3405	}
3406}
3407
3408static void
3409bwn_crypt_init(struct bwn_mac *mac)
3410{
3411	struct bwn_softc *sc = mac->mac_sc;
3412
3413	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3414	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3415	    ("%s:%d: fail", __func__, __LINE__));
3416	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3417	mac->mac_ktp *= 2;
3418	if (siba_get_revid(sc->sc_dev) >= 5)
3419		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3420	bwn_clear_keys(mac);
3421}
3422
3423static void
3424bwn_chip_exit(struct bwn_mac *mac)
3425{
3426	struct bwn_softc *sc = mac->mac_sc;
3427
3428	bwn_phy_exit(mac);
3429	siba_gpio_set(sc->sc_dev, 0);
3430}
3431
3432static int
3433bwn_fw_fillinfo(struct bwn_mac *mac)
3434{
3435	int error;
3436
3437	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3438	if (error == 0)
3439		return (0);
3440	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3441	if (error == 0)
3442		return (0);
3443	return (error);
3444}
3445
3446static int
3447bwn_gpio_init(struct bwn_mac *mac)
3448{
3449	struct bwn_softc *sc = mac->mac_sc;
3450	uint32_t mask = 0x1f, set = 0xf, value;
3451
3452	BWN_WRITE_4(mac, BWN_MACCTL,
3453	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3454	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3455	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3456
3457	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3458		mask |= 0x0060;
3459		set |= 0x0060;
3460	}
3461	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3462		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3463		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3464		mask |= 0x0200;
3465		set |= 0x0200;
3466	}
3467	if (siba_get_revid(sc->sc_dev) >= 2)
3468		mask |= 0x0010;
3469
3470	value = siba_gpio_get(sc->sc_dev);
3471	if (value == -1)
3472		return (0);
3473	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3474
3475	return (0);
3476}
3477
3478static int
3479bwn_fw_loadinitvals(struct bwn_mac *mac)
3480{
3481#define	GETFWOFFSET(fwp, offset)				\
3482	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3483	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3484	const struct bwn_fwhdr *hdr;
3485	struct bwn_fw *fw = &mac->mac_fw;
3486	int error;
3487
3488	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3489	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3490	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3491	if (error)
3492		return (error);
3493	if (fw->initvals_band.fw) {
3494		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3495		error = bwn_fwinitvals_write(mac,
3496		    GETFWOFFSET(fw->initvals_band, hdr_len),
3497		    be32toh(hdr->size),
3498		    fw->initvals_band.fw->datasize - hdr_len);
3499	}
3500	return (error);
3501#undef GETFWOFFSET
3502}
3503
3504static int
3505bwn_phy_init(struct bwn_mac *mac)
3506{
3507	struct bwn_softc *sc = mac->mac_sc;
3508	int error;
3509
3510	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3511	mac->mac_phy.rf_onoff(mac, 1);
3512	error = mac->mac_phy.init(mac);
3513	if (error) {
3514		device_printf(sc->sc_dev, "PHY init failed\n");
3515		goto fail0;
3516	}
3517	error = bwn_switch_channel(mac,
3518	    mac->mac_phy.get_default_chan(mac));
3519	if (error) {
3520		device_printf(sc->sc_dev,
3521		    "failed to switch default channel\n");
3522		goto fail1;
3523	}
3524	return (0);
3525fail1:
3526	if (mac->mac_phy.exit)
3527		mac->mac_phy.exit(mac);
3528fail0:
3529	mac->mac_phy.rf_onoff(mac, 0);
3530
3531	return (error);
3532}
3533
3534static void
3535bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3536{
3537	uint16_t ant;
3538	uint16_t tmp;
3539
3540	ant = bwn_ant2phy(antenna);
3541
3542	/* For ACK/CTS */
3543	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3544	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3545	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3546	/* For Probe Resposes */
3547	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3548	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3549	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3550}
3551
3552static void
3553bwn_set_opmode(struct bwn_mac *mac)
3554{
3555	struct bwn_softc *sc = mac->mac_sc;
3556	struct ieee80211com *ic = &sc->sc_ic;
3557	uint32_t ctl;
3558	uint16_t cfp_pretbtt;
3559
3560	ctl = BWN_READ_4(mac, BWN_MACCTL);
3561	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3562	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3563	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3564	ctl |= BWN_MACCTL_STA;
3565
3566	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3567	    ic->ic_opmode == IEEE80211_M_MBSS)
3568		ctl |= BWN_MACCTL_HOSTAP;
3569	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3570		ctl &= ~BWN_MACCTL_STA;
3571	ctl |= sc->sc_filters;
3572
3573	if (siba_get_revid(sc->sc_dev) <= 4)
3574		ctl |= BWN_MACCTL_PROMISC;
3575
3576	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3577
3578	cfp_pretbtt = 2;
3579	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3580		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3581		    siba_get_chiprev(sc->sc_dev) == 3)
3582			cfp_pretbtt = 100;
3583		else
3584			cfp_pretbtt = 50;
3585	}
3586	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3587}
3588
3589static int
3590bwn_dma_gettype(struct bwn_mac *mac)
3591{
3592	uint32_t tmp;
3593	uint16_t base;
3594
3595	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3596	if (tmp & SIBA_TGSHIGH_DMA64)
3597		return (BWN_DMA_64BIT);
3598	base = bwn_dma_base(0, 0);
3599	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3600	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3601	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3602		return (BWN_DMA_32BIT);
3603
3604	return (BWN_DMA_30BIT);
3605}
3606
3607static void
3608bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3609{
3610	if (!error) {
3611		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3612		*((bus_addr_t *)arg) = seg->ds_addr;
3613	}
3614}
3615
3616void
3617bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3618{
3619	struct bwn_phy *phy = &mac->mac_phy;
3620	struct bwn_softc *sc = mac->mac_sc;
3621	unsigned int i, max_loop;
3622	uint16_t value;
3623	uint32_t buffer[5] = {
3624		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3625	};
3626
3627	if (ofdm) {
3628		max_loop = 0x1e;
3629		buffer[0] = 0x000201cc;
3630	} else {
3631		max_loop = 0xfa;
3632		buffer[0] = 0x000b846e;
3633	}
3634
3635	BWN_ASSERT_LOCKED(mac->mac_sc);
3636
3637	for (i = 0; i < 5; i++)
3638		bwn_ram_write(mac, i * 4, buffer[i]);
3639
3640	BWN_WRITE_2(mac, 0x0568, 0x0000);
3641	BWN_WRITE_2(mac, 0x07c0,
3642	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3643
3644	value = (ofdm ? 0x41 : 0x40);
3645	BWN_WRITE_2(mac, 0x050c, value);
3646
3647	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3648	    phy->type == BWN_PHYTYPE_LCN)
3649		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3650	BWN_WRITE_2(mac, 0x0508, 0x0000);
3651	BWN_WRITE_2(mac, 0x050a, 0x0000);
3652	BWN_WRITE_2(mac, 0x054c, 0x0000);
3653	BWN_WRITE_2(mac, 0x056a, 0x0014);
3654	BWN_WRITE_2(mac, 0x0568, 0x0826);
3655	BWN_WRITE_2(mac, 0x0500, 0x0000);
3656
3657	/* XXX TODO: n phy pa override? */
3658
3659	switch (phy->type) {
3660	case BWN_PHYTYPE_N:
3661	case BWN_PHYTYPE_LCN:
3662		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3663		break;
3664	case BWN_PHYTYPE_LP:
3665		BWN_WRITE_2(mac, 0x0502, 0x0050);
3666		break;
3667	default:
3668		BWN_WRITE_2(mac, 0x0502, 0x0030);
3669		break;
3670	}
3671
3672	/* flush */
3673	BWN_READ_2(mac, 0x0502);
3674
3675	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3676		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3677	for (i = 0x00; i < max_loop; i++) {
3678		value = BWN_READ_2(mac, 0x050e);
3679		if (value & 0x0080)
3680			break;
3681		DELAY(10);
3682	}
3683	for (i = 0x00; i < 0x0a; i++) {
3684		value = BWN_READ_2(mac, 0x050e);
3685		if (value & 0x0400)
3686			break;
3687		DELAY(10);
3688	}
3689	for (i = 0x00; i < 0x19; i++) {
3690		value = BWN_READ_2(mac, 0x0690);
3691		if (!(value & 0x0100))
3692			break;
3693		DELAY(10);
3694	}
3695	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3696		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3697}
3698
3699void
3700bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3701{
3702	uint32_t macctl;
3703
3704	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3705
3706	macctl = BWN_READ_4(mac, BWN_MACCTL);
3707	if (macctl & BWN_MACCTL_BIGENDIAN)
3708		printf("TODO: need swap\n");
3709
3710	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3711	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3712	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3713}
3714
3715void
3716bwn_mac_suspend(struct bwn_mac *mac)
3717{
3718	struct bwn_softc *sc = mac->mac_sc;
3719	int i;
3720	uint32_t tmp;
3721
3722	KASSERT(mac->mac_suspended >= 0,
3723	    ("%s:%d: fail", __func__, __LINE__));
3724
3725	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3726	    __func__, mac->mac_suspended);
3727
3728	if (mac->mac_suspended == 0) {
3729		bwn_psctl(mac, BWN_PS_AWAKE);
3730		BWN_WRITE_4(mac, BWN_MACCTL,
3731			    BWN_READ_4(mac, BWN_MACCTL)
3732			    & ~BWN_MACCTL_ON);
3733		BWN_READ_4(mac, BWN_MACCTL);
3734		for (i = 35; i; i--) {
3735			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3736			if (tmp & BWN_INTR_MAC_SUSPENDED)
3737				goto out;
3738			DELAY(10);
3739		}
3740		for (i = 40; i; i--) {
3741			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3742			if (tmp & BWN_INTR_MAC_SUSPENDED)
3743				goto out;
3744			DELAY(1000);
3745		}
3746		device_printf(sc->sc_dev, "MAC suspend failed\n");
3747	}
3748out:
3749	mac->mac_suspended++;
3750}
3751
3752void
3753bwn_mac_enable(struct bwn_mac *mac)
3754{
3755	struct bwn_softc *sc = mac->mac_sc;
3756	uint16_t state;
3757
3758	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3759	    __func__, mac->mac_suspended);
3760
3761	state = bwn_shm_read_2(mac, BWN_SHARED,
3762	    BWN_SHARED_UCODESTAT);
3763	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3764	    state != BWN_SHARED_UCODESTAT_SLEEP)
3765		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3766
3767	mac->mac_suspended--;
3768	KASSERT(mac->mac_suspended >= 0,
3769	    ("%s:%d: fail", __func__, __LINE__));
3770	if (mac->mac_suspended == 0) {
3771		BWN_WRITE_4(mac, BWN_MACCTL,
3772		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3773		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3774		BWN_READ_4(mac, BWN_MACCTL);
3775		BWN_READ_4(mac, BWN_INTR_REASON);
3776		bwn_psctl(mac, 0);
3777	}
3778}
3779
3780void
3781bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3782{
3783	struct bwn_softc *sc = mac->mac_sc;
3784	int i;
3785	uint16_t ucstat;
3786
3787	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3788	    ("%s:%d: fail", __func__, __LINE__));
3789	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3790	    ("%s:%d: fail", __func__, __LINE__));
3791
3792	/* XXX forcibly awake and hwps-off */
3793
3794	BWN_WRITE_4(mac, BWN_MACCTL,
3795	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3796	    ~BWN_MACCTL_HWPS);
3797	BWN_READ_4(mac, BWN_MACCTL);
3798	if (siba_get_revid(sc->sc_dev) >= 5) {
3799		for (i = 0; i < 100; i++) {
3800			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3801			    BWN_SHARED_UCODESTAT);
3802			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3803				break;
3804			DELAY(10);
3805		}
3806	}
3807	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3808	    ucstat);
3809}
3810
3811static int
3812bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3813{
3814	struct bwn_softc *sc = mac->mac_sc;
3815	struct bwn_fw *fw = &mac->mac_fw;
3816	const uint8_t rev = siba_get_revid(sc->sc_dev);
3817	const char *filename;
3818	uint32_t high;
3819	int error;
3820
3821	/* microcode */
3822	filename = NULL;
3823	switch (rev) {
3824	case 42:
3825		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3826			filename = "ucode42";
3827		break;
3828	case 40:
3829		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3830			filename = "ucode40";
3831		break;
3832	case 33:
3833		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3834			filename = "ucode33_lcn40";
3835		break;
3836	case 30:
3837		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3838			filename = "ucode30_mimo";
3839		break;
3840	case 29:
3841		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3842			filename = "ucode29_mimo";
3843		break;
3844	case 26:
3845		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3846			filename = "ucode26_mimo";
3847		break;
3848	case 28:
3849	case 25:
3850		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3851			filename = "ucode25_mimo";
3852		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3853			filename = "ucode25_lcn";
3854		break;
3855	case 24:
3856		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3857			filename = "ucode24_lcn";
3858		break;
3859	case 23:
3860		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3861			filename = "ucode16_mimo";
3862		break;
3863	case 16:
3864	case 17:
3865	case 18:
3866	case 19:
3867		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3868			filename = "ucode16_mimo";
3869		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3870			filename = "ucode16_lp";
3871		break;
3872	case 15:
3873		filename = "ucode15";
3874		break;
3875	case 14:
3876		filename = "ucode14";
3877		break;
3878	case 13:
3879		filename = "ucode13";
3880		break;
3881	case 12:
3882	case 11:
3883		filename = "ucode11";
3884		break;
3885	case 10:
3886	case 9:
3887	case 8:
3888	case 7:
3889	case 6:
3890	case 5:
3891		filename = "ucode5";
3892		break;
3893	default:
3894		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3895		bwn_release_firmware(mac);
3896		return (EOPNOTSUPP);
3897	}
3898
3899	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3900	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3901	if (error) {
3902		bwn_release_firmware(mac);
3903		return (error);
3904	}
3905
3906	/* PCM */
3907	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3908	if (rev >= 5 && rev <= 10) {
3909		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3910		if (error == ENOENT)
3911			fw->no_pcmfile = 1;
3912		else if (error) {
3913			bwn_release_firmware(mac);
3914			return (error);
3915		}
3916	} else if (rev < 11) {
3917		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3918		return (EOPNOTSUPP);
3919	}
3920
3921	/* initvals */
3922	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3923	switch (mac->mac_phy.type) {
3924	case BWN_PHYTYPE_A:
3925		if (rev < 5 || rev > 10)
3926			goto fail1;
3927		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3928			filename = "a0g1initvals5";
3929		else
3930			filename = "a0g0initvals5";
3931		break;
3932	case BWN_PHYTYPE_G:
3933		if (rev >= 5 && rev <= 10)
3934			filename = "b0g0initvals5";
3935		else if (rev >= 13)
3936			filename = "b0g0initvals13";
3937		else
3938			goto fail1;
3939		break;
3940	case BWN_PHYTYPE_LP:
3941		if (rev == 13)
3942			filename = "lp0initvals13";
3943		else if (rev == 14)
3944			filename = "lp0initvals14";
3945		else if (rev >= 15)
3946			filename = "lp0initvals15";
3947		else
3948			goto fail1;
3949		break;
3950	case BWN_PHYTYPE_N:
3951		if (rev == 30)
3952			filename = "n16initvals30";
3953		else if (rev == 28 || rev == 25)
3954			filename = "n0initvals25";
3955		else if (rev == 24)
3956			filename = "n0initvals24";
3957		else if (rev == 23)
3958			filename = "n0initvals16";
3959		else if (rev >= 16 && rev <= 18)
3960			filename = "n0initvals16";
3961		else if (rev >= 11 && rev <= 12)
3962			filename = "n0initvals11";
3963		else
3964			goto fail1;
3965		break;
3966	default:
3967		goto fail1;
3968	}
3969	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3970	if (error) {
3971		bwn_release_firmware(mac);
3972		return (error);
3973	}
3974
3975	/* bandswitch initvals */
3976	switch (mac->mac_phy.type) {
3977	case BWN_PHYTYPE_A:
3978		if (rev >= 5 && rev <= 10) {
3979			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3980				filename = "a0g1bsinitvals5";
3981			else
3982				filename = "a0g0bsinitvals5";
3983		} else if (rev >= 11)
3984			filename = NULL;
3985		else
3986			goto fail1;
3987		break;
3988	case BWN_PHYTYPE_G:
3989		if (rev >= 5 && rev <= 10)
3990			filename = "b0g0bsinitvals5";
3991		else if (rev >= 11)
3992			filename = NULL;
3993		else
3994			goto fail1;
3995		break;
3996	case BWN_PHYTYPE_LP:
3997		if (rev == 13)
3998			filename = "lp0bsinitvals13";
3999		else if (rev == 14)
4000			filename = "lp0bsinitvals14";
4001		else if (rev >= 15)
4002			filename = "lp0bsinitvals15";
4003		else
4004			goto fail1;
4005		break;
4006	case BWN_PHYTYPE_N:
4007		if (rev == 30)
4008			filename = "n16bsinitvals30";
4009		else if (rev == 28 || rev == 25)
4010			filename = "n0bsinitvals25";
4011		else if (rev == 24)
4012			filename = "n0bsinitvals24";
4013		else if (rev == 23)
4014			filename = "n0bsinitvals16";
4015		else if (rev >= 16 && rev <= 18)
4016			filename = "n0bsinitvals16";
4017		else if (rev >= 11 && rev <= 12)
4018			filename = "n0bsinitvals11";
4019		else
4020			goto fail1;
4021		break;
4022	default:
4023		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4024		    mac->mac_phy.type);
4025		goto fail1;
4026	}
4027	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4028	if (error) {
4029		bwn_release_firmware(mac);
4030		return (error);
4031	}
4032	return (0);
4033fail1:
4034	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4035	    rev, mac->mac_phy.type);
4036	bwn_release_firmware(mac);
4037	return (EOPNOTSUPP);
4038}
4039
4040static int
4041bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4042    const char *name, struct bwn_fwfile *bfw)
4043{
4044	const struct bwn_fwhdr *hdr;
4045	struct bwn_softc *sc = mac->mac_sc;
4046	const struct firmware *fw;
4047	char namebuf[64];
4048
4049	if (name == NULL) {
4050		bwn_do_release_fw(bfw);
4051		return (0);
4052	}
4053	if (bfw->filename != NULL) {
4054		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4055			return (0);
4056		bwn_do_release_fw(bfw);
4057	}
4058
4059	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4060	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4061	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4062	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4063	fw = firmware_get(namebuf);
4064	if (fw == NULL) {
4065		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4066		    namebuf);
4067		return (ENOENT);
4068	}
4069	if (fw->datasize < sizeof(struct bwn_fwhdr))
4070		goto fail;
4071	hdr = (const struct bwn_fwhdr *)(fw->data);
4072	switch (hdr->type) {
4073	case BWN_FWTYPE_UCODE:
4074	case BWN_FWTYPE_PCM:
4075		if (be32toh(hdr->size) !=
4076		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4077			goto fail;
4078		/* FALLTHROUGH */
4079	case BWN_FWTYPE_IV:
4080		if (hdr->ver != 1)
4081			goto fail;
4082		break;
4083	default:
4084		goto fail;
4085	}
4086	bfw->filename = name;
4087	bfw->fw = fw;
4088	bfw->type = type;
4089	return (0);
4090fail:
4091	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4092	if (fw != NULL)
4093		firmware_put(fw, FIRMWARE_UNLOAD);
4094	return (EPROTO);
4095}
4096
4097static void
4098bwn_release_firmware(struct bwn_mac *mac)
4099{
4100
4101	bwn_do_release_fw(&mac->mac_fw.ucode);
4102	bwn_do_release_fw(&mac->mac_fw.pcm);
4103	bwn_do_release_fw(&mac->mac_fw.initvals);
4104	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4105}
4106
4107static void
4108bwn_do_release_fw(struct bwn_fwfile *bfw)
4109{
4110
4111	if (bfw->fw != NULL)
4112		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4113	bfw->fw = NULL;
4114	bfw->filename = NULL;
4115}
4116
4117static int
4118bwn_fw_loaducode(struct bwn_mac *mac)
4119{
4120#define	GETFWOFFSET(fwp, offset)	\
4121	((const uint32_t *)((const char *)fwp.fw->data + offset))
4122#define	GETFWSIZE(fwp, offset)	\
4123	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4124	struct bwn_softc *sc = mac->mac_sc;
4125	const uint32_t *data;
4126	unsigned int i;
4127	uint32_t ctl;
4128	uint16_t date, fwcaps, time;
4129	int error = 0;
4130
4131	ctl = BWN_READ_4(mac, BWN_MACCTL);
4132	ctl |= BWN_MACCTL_MCODE_JMP0;
4133	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4134	    __LINE__));
4135	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4136	for (i = 0; i < 64; i++)
4137		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4138	for (i = 0; i < 4096; i += 2)
4139		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4140
4141	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4142	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4143	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4144	     i++) {
4145		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4146		DELAY(10);
4147	}
4148
4149	if (mac->mac_fw.pcm.fw) {
4150		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4151		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4152		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4153		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4154		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4155		    sizeof(struct bwn_fwhdr)); i++) {
4156			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4157			DELAY(10);
4158		}
4159	}
4160
4161	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4162	BWN_WRITE_4(mac, BWN_MACCTL,
4163	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4164	    BWN_MACCTL_MCODE_RUN);
4165
4166	for (i = 0; i < 21; i++) {
4167		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4168			break;
4169		if (i >= 20) {
4170			device_printf(sc->sc_dev, "ucode timeout\n");
4171			error = ENXIO;
4172			goto error;
4173		}
4174		DELAY(50000);
4175	}
4176	BWN_READ_4(mac, BWN_INTR_REASON);
4177
4178	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4179	if (mac->mac_fw.rev <= 0x128) {
4180		device_printf(sc->sc_dev, "the firmware is too old\n");
4181		error = EOPNOTSUPP;
4182		goto error;
4183	}
4184
4185	/*
4186	 * Determine firmware header version; needed for TX/RX packet
4187	 * handling.
4188	 */
4189	if (mac->mac_fw.rev >= 598)
4190		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4191	else if (mac->mac_fw.rev >= 410)
4192		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4193	else
4194		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4195
4196	/*
4197	 * We don't support rev 598 or later; that requires
4198	 * another round of changes to the TX/RX descriptor
4199	 * and status layout.
4200	 *
4201	 * So, complain this is the case and exit out, rather
4202	 * than attaching and then failing.
4203	 */
4204#if 0
4205	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4206		device_printf(sc->sc_dev,
4207		    "firmware is too new (>=598); not supported\n");
4208		error = EOPNOTSUPP;
4209		goto error;
4210	}
4211#endif
4212
4213	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4214	    BWN_SHARED_UCODE_PATCH);
4215	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4216	mac->mac_fw.opensource = (date == 0xffff);
4217	if (bwn_wme != 0)
4218		mac->mac_flags |= BWN_MAC_FLAG_WME;
4219	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4220
4221	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4222	if (mac->mac_fw.opensource == 0) {
4223		device_printf(sc->sc_dev,
4224		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4225		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4226		if (mac->mac_fw.no_pcmfile)
4227			device_printf(sc->sc_dev,
4228			    "no HW crypto acceleration due to pcm5\n");
4229	} else {
4230		mac->mac_fw.patch = time;
4231		fwcaps = bwn_fwcaps_read(mac);
4232		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4233			device_printf(sc->sc_dev,
4234			    "disabling HW crypto acceleration\n");
4235			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4236		}
4237		if (!(fwcaps & BWN_FWCAPS_WME)) {
4238			device_printf(sc->sc_dev, "disabling WME support\n");
4239			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4240		}
4241	}
4242
4243	if (BWN_ISOLDFMT(mac))
4244		device_printf(sc->sc_dev, "using old firmware image\n");
4245
4246	return (0);
4247
4248error:
4249	BWN_WRITE_4(mac, BWN_MACCTL,
4250	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4251	    BWN_MACCTL_MCODE_JMP0);
4252
4253	return (error);
4254#undef GETFWSIZE
4255#undef GETFWOFFSET
4256}
4257
4258/* OpenFirmware only */
4259static uint16_t
4260bwn_fwcaps_read(struct bwn_mac *mac)
4261{
4262
4263	KASSERT(mac->mac_fw.opensource == 1,
4264	    ("%s:%d: fail", __func__, __LINE__));
4265	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4266}
4267
4268static int
4269bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4270    size_t count, size_t array_size)
4271{
4272#define	GET_NEXTIV16(iv)						\
4273	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4274	    sizeof(uint16_t) + sizeof(uint16_t)))
4275#define	GET_NEXTIV32(iv)						\
4276	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4277	    sizeof(uint16_t) + sizeof(uint32_t)))
4278	struct bwn_softc *sc = mac->mac_sc;
4279	const struct bwn_fwinitvals *iv;
4280	uint16_t offset;
4281	size_t i;
4282	uint8_t bit32;
4283
4284	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4285	    ("%s:%d: fail", __func__, __LINE__));
4286	iv = ivals;
4287	for (i = 0; i < count; i++) {
4288		if (array_size < sizeof(iv->offset_size))
4289			goto fail;
4290		array_size -= sizeof(iv->offset_size);
4291		offset = be16toh(iv->offset_size);
4292		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4293		offset &= BWN_FWINITVALS_OFFSET_MASK;
4294		if (offset >= 0x1000)
4295			goto fail;
4296		if (bit32) {
4297			if (array_size < sizeof(iv->data.d32))
4298				goto fail;
4299			array_size -= sizeof(iv->data.d32);
4300			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4301			iv = GET_NEXTIV32(iv);
4302		} else {
4303
4304			if (array_size < sizeof(iv->data.d16))
4305				goto fail;
4306			array_size -= sizeof(iv->data.d16);
4307			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4308
4309			iv = GET_NEXTIV16(iv);
4310		}
4311	}
4312	if (array_size != 0)
4313		goto fail;
4314	return (0);
4315fail:
4316	device_printf(sc->sc_dev, "initvals: invalid format\n");
4317	return (EPROTO);
4318#undef GET_NEXTIV16
4319#undef GET_NEXTIV32
4320}
4321
4322int
4323bwn_switch_channel(struct bwn_mac *mac, int chan)
4324{
4325	struct bwn_phy *phy = &(mac->mac_phy);
4326	struct bwn_softc *sc = mac->mac_sc;
4327	struct ieee80211com *ic = &sc->sc_ic;
4328	uint16_t channelcookie, savedcookie;
4329	int error;
4330
4331	if (chan == 0xffff)
4332		chan = phy->get_default_chan(mac);
4333
4334	channelcookie = chan;
4335	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4336		channelcookie |= 0x100;
4337	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4338	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4339	error = phy->switch_channel(mac, chan);
4340	if (error)
4341		goto fail;
4342
4343	mac->mac_phy.chan = chan;
4344	DELAY(8000);
4345	return (0);
4346fail:
4347	device_printf(sc->sc_dev, "failed to switch channel\n");
4348	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4349	return (error);
4350}
4351
4352static uint16_t
4353bwn_ant2phy(int antenna)
4354{
4355
4356	switch (antenna) {
4357	case BWN_ANT0:
4358		return (BWN_TX_PHY_ANT0);
4359	case BWN_ANT1:
4360		return (BWN_TX_PHY_ANT1);
4361	case BWN_ANT2:
4362		return (BWN_TX_PHY_ANT2);
4363	case BWN_ANT3:
4364		return (BWN_TX_PHY_ANT3);
4365	case BWN_ANTAUTO:
4366		return (BWN_TX_PHY_ANT01AUTO);
4367	}
4368	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4369	return (0);
4370}
4371
4372static void
4373bwn_wme_load(struct bwn_mac *mac)
4374{
4375	struct bwn_softc *sc = mac->mac_sc;
4376	int i;
4377
4378	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4379	    ("%s:%d: fail", __func__, __LINE__));
4380
4381	bwn_mac_suspend(mac);
4382	for (i = 0; i < N(sc->sc_wmeParams); i++)
4383		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4384		    bwn_wme_shm_offsets[i]);
4385	bwn_mac_enable(mac);
4386}
4387
4388static void
4389bwn_wme_loadparams(struct bwn_mac *mac,
4390    const struct wmeParams *p, uint16_t shm_offset)
4391{
4392#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4393	struct bwn_softc *sc = mac->mac_sc;
4394	uint16_t params[BWN_NR_WMEPARAMS];
4395	int slot, tmp;
4396	unsigned int i;
4397
4398	slot = BWN_READ_2(mac, BWN_RNG) &
4399	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4400
4401	memset(&params, 0, sizeof(params));
4402
4403	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4404	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4405	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4406
4407	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4408	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4409	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4410	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4411	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4412	params[BWN_WMEPARAM_BSLOTS] = slot;
4413	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4414
4415	for (i = 0; i < N(params); i++) {
4416		if (i == BWN_WMEPARAM_STATUS) {
4417			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4418			    shm_offset + (i * 2));
4419			tmp |= 0x100;
4420			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4421			    tmp);
4422		} else {
4423			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4424			    params[i]);
4425		}
4426	}
4427}
4428
4429static void
4430bwn_mac_write_bssid(struct bwn_mac *mac)
4431{
4432	struct bwn_softc *sc = mac->mac_sc;
4433	uint32_t tmp;
4434	int i;
4435	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4436
4437	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4438	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4439	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4440	    IEEE80211_ADDR_LEN);
4441
4442	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4443		tmp = (uint32_t) (mac_bssid[i + 0]);
4444		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4445		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4446		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4447		bwn_ram_write(mac, 0x20 + i, tmp);
4448	}
4449}
4450
4451static void
4452bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4453    const uint8_t *macaddr)
4454{
4455	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4456	uint16_t data;
4457
4458	if (!mac)
4459		macaddr = zero;
4460
4461	offset |= 0x0020;
4462	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4463
4464	data = macaddr[0];
4465	data |= macaddr[1] << 8;
4466	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4467	data = macaddr[2];
4468	data |= macaddr[3] << 8;
4469	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4470	data = macaddr[4];
4471	data |= macaddr[5] << 8;
4472	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4473}
4474
4475static void
4476bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4477    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4478{
4479	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4480	uint8_t per_sta_keys_start = 8;
4481
4482	if (BWN_SEC_NEWAPI(mac))
4483		per_sta_keys_start = 4;
4484
4485	KASSERT(index < mac->mac_max_nr_keys,
4486	    ("%s:%d: fail", __func__, __LINE__));
4487	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4488	    ("%s:%d: fail", __func__, __LINE__));
4489
4490	if (index >= per_sta_keys_start)
4491		bwn_key_macwrite(mac, index, NULL);
4492	if (key)
4493		memcpy(buf, key, key_len);
4494	bwn_key_write(mac, index, algorithm, buf);
4495	if (index >= per_sta_keys_start)
4496		bwn_key_macwrite(mac, index, mac_addr);
4497
4498	mac->mac_key[index].algorithm = algorithm;
4499}
4500
4501static void
4502bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4503{
4504	struct bwn_softc *sc = mac->mac_sc;
4505	uint32_t addrtmp[2] = { 0, 0 };
4506	uint8_t start = 8;
4507
4508	if (BWN_SEC_NEWAPI(mac))
4509		start = 4;
4510
4511	KASSERT(index >= start,
4512	    ("%s:%d: fail", __func__, __LINE__));
4513	index -= start;
4514
4515	if (addr) {
4516		addrtmp[0] = addr[0];
4517		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4518		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4519		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4520		addrtmp[1] = addr[4];
4521		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4522	}
4523
4524	if (siba_get_revid(sc->sc_dev) >= 5) {
4525		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4526		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4527	} else {
4528		if (index >= 8) {
4529			bwn_shm_write_4(mac, BWN_SHARED,
4530			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4531			bwn_shm_write_2(mac, BWN_SHARED,
4532			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4533		}
4534	}
4535}
4536
4537static void
4538bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4539    const uint8_t *key)
4540{
4541	unsigned int i;
4542	uint32_t offset;
4543	uint16_t kidx, value;
4544
4545	kidx = BWN_SEC_KEY2FW(mac, index);
4546	bwn_shm_write_2(mac, BWN_SHARED,
4547	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4548
4549	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4550	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4551		value = key[i];
4552		value |= (uint16_t)(key[i + 1]) << 8;
4553		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4554	}
4555}
4556
4557static void
4558bwn_phy_exit(struct bwn_mac *mac)
4559{
4560
4561	mac->mac_phy.rf_onoff(mac, 0);
4562	if (mac->mac_phy.exit != NULL)
4563		mac->mac_phy.exit(mac);
4564}
4565
4566static void
4567bwn_dma_free(struct bwn_mac *mac)
4568{
4569	struct bwn_dma *dma;
4570
4571	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4572		return;
4573	dma = &mac->mac_method.dma;
4574
4575	bwn_dma_ringfree(&dma->rx);
4576	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4577	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4578	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4579	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4580	bwn_dma_ringfree(&dma->mcast);
4581}
4582
4583static void
4584bwn_core_stop(struct bwn_mac *mac)
4585{
4586	struct bwn_softc *sc = mac->mac_sc;
4587
4588	BWN_ASSERT_LOCKED(sc);
4589
4590	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4591		return;
4592
4593	callout_stop(&sc->sc_rfswitch_ch);
4594	callout_stop(&sc->sc_task_ch);
4595	callout_stop(&sc->sc_watchdog_ch);
4596	sc->sc_watchdog_timer = 0;
4597	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4598	BWN_READ_4(mac, BWN_INTR_MASK);
4599	bwn_mac_suspend(mac);
4600
4601	mac->mac_status = BWN_MAC_STATUS_INITED;
4602}
4603
4604static int
4605bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4606{
4607	struct bwn_mac *up_dev = NULL;
4608	struct bwn_mac *down_dev;
4609	struct bwn_mac *mac;
4610	int err, status;
4611	uint8_t gmode;
4612
4613	BWN_ASSERT_LOCKED(sc);
4614
4615	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4616		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4617		    mac->mac_phy.supports_2ghz) {
4618			up_dev = mac;
4619			gmode = 1;
4620		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4621		    mac->mac_phy.supports_5ghz) {
4622			up_dev = mac;
4623			gmode = 0;
4624		} else {
4625			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4626			return (EINVAL);
4627		}
4628		if (up_dev != NULL)
4629			break;
4630	}
4631	if (up_dev == NULL) {
4632		device_printf(sc->sc_dev, "Could not find a device\n");
4633		return (ENODEV);
4634	}
4635	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4636		return (0);
4637
4638	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4639	    "switching to %s-GHz band\n",
4640	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4641
4642	down_dev = sc->sc_curmac;
4643	status = down_dev->mac_status;
4644	if (status >= BWN_MAC_STATUS_STARTED)
4645		bwn_core_stop(down_dev);
4646	if (status >= BWN_MAC_STATUS_INITED)
4647		bwn_core_exit(down_dev);
4648
4649	if (down_dev != up_dev)
4650		bwn_phy_reset(down_dev);
4651
4652	up_dev->mac_phy.gmode = gmode;
4653	if (status >= BWN_MAC_STATUS_INITED) {
4654		err = bwn_core_init(up_dev);
4655		if (err) {
4656			device_printf(sc->sc_dev,
4657			    "fatal: failed to initialize for %s-GHz\n",
4658			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4659			goto fail;
4660		}
4661	}
4662	if (status >= BWN_MAC_STATUS_STARTED)
4663		bwn_core_start(up_dev);
4664	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4665	sc->sc_curmac = up_dev;
4666
4667	return (0);
4668fail:
4669	sc->sc_curmac = NULL;
4670	return (err);
4671}
4672
4673static void
4674bwn_rf_turnon(struct bwn_mac *mac)
4675{
4676
4677	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4678
4679	bwn_mac_suspend(mac);
4680	mac->mac_phy.rf_onoff(mac, 1);
4681	mac->mac_phy.rf_on = 1;
4682	bwn_mac_enable(mac);
4683}
4684
4685static void
4686bwn_rf_turnoff(struct bwn_mac *mac)
4687{
4688
4689	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4690
4691	bwn_mac_suspend(mac);
4692	mac->mac_phy.rf_onoff(mac, 0);
4693	mac->mac_phy.rf_on = 0;
4694	bwn_mac_enable(mac);
4695}
4696
4697/*
4698 * SSB PHY reset.
4699 *
4700 * XXX TODO: BCMA PHY reset.
4701 */
4702static void
4703bwn_phy_reset(struct bwn_mac *mac)
4704{
4705	struct bwn_softc *sc = mac->mac_sc;
4706
4707	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4708	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4709	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4710	DELAY(1000);
4711	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4712	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4713	DELAY(1000);
4714}
4715
4716static int
4717bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4718{
4719	struct bwn_vap *bvp = BWN_VAP(vap);
4720	struct ieee80211com *ic= vap->iv_ic;
4721	enum ieee80211_state ostate = vap->iv_state;
4722	struct bwn_softc *sc = ic->ic_softc;
4723	struct bwn_mac *mac = sc->sc_curmac;
4724	int error;
4725
4726	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4727	    ieee80211_state_name[vap->iv_state],
4728	    ieee80211_state_name[nstate]);
4729
4730	error = bvp->bv_newstate(vap, nstate, arg);
4731	if (error != 0)
4732		return (error);
4733
4734	BWN_LOCK(sc);
4735
4736	bwn_led_newstate(mac, nstate);
4737
4738	/*
4739	 * Clear the BSSID when we stop a STA
4740	 */
4741	if (vap->iv_opmode == IEEE80211_M_STA) {
4742		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4743			/*
4744			 * Clear out the BSSID.  If we reassociate to
4745			 * the same AP, this will reinialize things
4746			 * correctly...
4747			 */
4748			if (ic->ic_opmode == IEEE80211_M_STA &&
4749			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4750				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4751				bwn_set_macaddr(mac);
4752			}
4753		}
4754	}
4755
4756	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4757	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4758		/* XXX nothing to do? */
4759	} else if (nstate == IEEE80211_S_RUN) {
4760		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4761		bwn_set_opmode(mac);
4762		bwn_set_pretbtt(mac);
4763		bwn_spu_setdelay(mac, 0);
4764		bwn_set_macaddr(mac);
4765	}
4766
4767	BWN_UNLOCK(sc);
4768
4769	return (error);
4770}
4771
4772static void
4773bwn_set_pretbtt(struct bwn_mac *mac)
4774{
4775	struct bwn_softc *sc = mac->mac_sc;
4776	struct ieee80211com *ic = &sc->sc_ic;
4777	uint16_t pretbtt;
4778
4779	if (ic->ic_opmode == IEEE80211_M_IBSS)
4780		pretbtt = 2;
4781	else
4782		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4783	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4784	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4785}
4786
4787static int
4788bwn_intr(void *arg)
4789{
4790	struct bwn_mac *mac = arg;
4791	struct bwn_softc *sc = mac->mac_sc;
4792	uint32_t reason;
4793
4794	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4795	    (sc->sc_flags & BWN_FLAG_INVALID))
4796		return (FILTER_STRAY);
4797
4798	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4799
4800	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4801	if (reason == 0xffffffff)	/* shared IRQ */
4802		return (FILTER_STRAY);
4803	reason &= mac->mac_intr_mask;
4804	if (reason == 0)
4805		return (FILTER_HANDLED);
4806	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4807
4808	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4809	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4810	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4811	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4812	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4813	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4814	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4815	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4816	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4817	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4818	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4819
4820	/* Disable interrupts. */
4821	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4822
4823	mac->mac_reason_intr = reason;
4824
4825	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4826	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4827
4828	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4829	return (FILTER_HANDLED);
4830}
4831
4832static void
4833bwn_intrtask(void *arg, int npending)
4834{
4835	struct bwn_mac *mac = arg;
4836	struct bwn_softc *sc = mac->mac_sc;
4837	uint32_t merged = 0;
4838	int i, tx = 0, rx = 0;
4839
4840	BWN_LOCK(sc);
4841	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4842	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4843		BWN_UNLOCK(sc);
4844		return;
4845	}
4846
4847	for (i = 0; i < N(mac->mac_reason); i++)
4848		merged |= mac->mac_reason[i];
4849
4850	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4851		device_printf(sc->sc_dev, "MAC trans error\n");
4852
4853	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4854		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4855		mac->mac_phy.txerrors--;
4856		if (mac->mac_phy.txerrors == 0) {
4857			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4858			bwn_restart(mac, "PHY TX errors");
4859		}
4860	}
4861
4862	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4863		if (merged & BWN_DMAINTR_FATALMASK) {
4864			device_printf(sc->sc_dev,
4865			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4866			    mac->mac_reason[0], mac->mac_reason[1],
4867			    mac->mac_reason[2], mac->mac_reason[3],
4868			    mac->mac_reason[4], mac->mac_reason[5]);
4869			bwn_restart(mac, "DMA error");
4870			BWN_UNLOCK(sc);
4871			return;
4872		}
4873		if (merged & BWN_DMAINTR_NONFATALMASK) {
4874			device_printf(sc->sc_dev,
4875			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4876			    mac->mac_reason[0], mac->mac_reason[1],
4877			    mac->mac_reason[2], mac->mac_reason[3],
4878			    mac->mac_reason[4], mac->mac_reason[5]);
4879		}
4880	}
4881
4882	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4883		bwn_intr_ucode_debug(mac);
4884	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4885		bwn_intr_tbtt_indication(mac);
4886	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4887		bwn_intr_atim_end(mac);
4888	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4889		bwn_intr_beacon(mac);
4890	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4891		bwn_intr_pmq(mac);
4892	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4893		bwn_intr_noise(mac);
4894
4895	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4896		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4897			bwn_dma_rx(mac->mac_method.dma.rx);
4898			rx = 1;
4899		}
4900	} else
4901		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4902
4903	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4904	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4905	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4906	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4907	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4908
4909	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4910		bwn_intr_txeof(mac);
4911		tx = 1;
4912	}
4913
4914	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4915
4916	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4917		int evt = BWN_LED_EVENT_NONE;
4918
4919		if (tx && rx) {
4920			if (sc->sc_rx_rate > sc->sc_tx_rate)
4921				evt = BWN_LED_EVENT_RX;
4922			else
4923				evt = BWN_LED_EVENT_TX;
4924		} else if (tx) {
4925			evt = BWN_LED_EVENT_TX;
4926		} else if (rx) {
4927			evt = BWN_LED_EVENT_RX;
4928		} else if (rx == 0) {
4929			evt = BWN_LED_EVENT_POLL;
4930		}
4931
4932		if (evt != BWN_LED_EVENT_NONE)
4933			bwn_led_event(mac, evt);
4934       }
4935
4936	if (mbufq_first(&sc->sc_snd) != NULL)
4937		bwn_start(sc);
4938
4939	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4940	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4941
4942	BWN_UNLOCK(sc);
4943}
4944
4945static void
4946bwn_restart(struct bwn_mac *mac, const char *msg)
4947{
4948	struct bwn_softc *sc = mac->mac_sc;
4949	struct ieee80211com *ic = &sc->sc_ic;
4950
4951	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4952		return;
4953
4954	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4955	ieee80211_runtask(ic, &mac->mac_hwreset);
4956}
4957
4958static void
4959bwn_intr_ucode_debug(struct bwn_mac *mac)
4960{
4961	struct bwn_softc *sc = mac->mac_sc;
4962	uint16_t reason;
4963
4964	if (mac->mac_fw.opensource == 0)
4965		return;
4966
4967	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4968	switch (reason) {
4969	case BWN_DEBUGINTR_PANIC:
4970		bwn_handle_fwpanic(mac);
4971		break;
4972	case BWN_DEBUGINTR_DUMP_SHM:
4973		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4974		break;
4975	case BWN_DEBUGINTR_DUMP_REGS:
4976		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4977		break;
4978	case BWN_DEBUGINTR_MARKER:
4979		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4980		break;
4981	default:
4982		device_printf(sc->sc_dev,
4983		    "ucode debug unknown reason: %#x\n", reason);
4984	}
4985
4986	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4987	    BWN_DEBUGINTR_ACK);
4988}
4989
4990static void
4991bwn_intr_tbtt_indication(struct bwn_mac *mac)
4992{
4993	struct bwn_softc *sc = mac->mac_sc;
4994	struct ieee80211com *ic = &sc->sc_ic;
4995
4996	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4997		bwn_psctl(mac, 0);
4998	if (ic->ic_opmode == IEEE80211_M_IBSS)
4999		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5000}
5001
5002static void
5003bwn_intr_atim_end(struct bwn_mac *mac)
5004{
5005
5006	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5007		BWN_WRITE_4(mac, BWN_MACCMD,
5008		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5009		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5010	}
5011}
5012
5013static void
5014bwn_intr_beacon(struct bwn_mac *mac)
5015{
5016	struct bwn_softc *sc = mac->mac_sc;
5017	struct ieee80211com *ic = &sc->sc_ic;
5018	uint32_t cmd, beacon0, beacon1;
5019
5020	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5021	    ic->ic_opmode == IEEE80211_M_MBSS)
5022		return;
5023
5024	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5025
5026	cmd = BWN_READ_4(mac, BWN_MACCMD);
5027	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5028	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5029
5030	if (beacon0 && beacon1) {
5031		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5032		mac->mac_intr_mask |= BWN_INTR_BEACON;
5033		return;
5034	}
5035
5036	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5037		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5038		bwn_load_beacon0(mac);
5039		bwn_load_beacon1(mac);
5040		cmd = BWN_READ_4(mac, BWN_MACCMD);
5041		cmd |= BWN_MACCMD_BEACON0_VALID;
5042		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5043	} else {
5044		if (!beacon0) {
5045			bwn_load_beacon0(mac);
5046			cmd = BWN_READ_4(mac, BWN_MACCMD);
5047			cmd |= BWN_MACCMD_BEACON0_VALID;
5048			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5049		} else if (!beacon1) {
5050			bwn_load_beacon1(mac);
5051			cmd = BWN_READ_4(mac, BWN_MACCMD);
5052			cmd |= BWN_MACCMD_BEACON1_VALID;
5053			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5054		}
5055	}
5056}
5057
5058static void
5059bwn_intr_pmq(struct bwn_mac *mac)
5060{
5061	uint32_t tmp;
5062
5063	while (1) {
5064		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5065		if (!(tmp & 0x00000008))
5066			break;
5067	}
5068	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5069}
5070
5071static void
5072bwn_intr_noise(struct bwn_mac *mac)
5073{
5074	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5075	uint16_t tmp;
5076	uint8_t noise[4];
5077	uint8_t i, j;
5078	int32_t average;
5079
5080	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5081		return;
5082
5083	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5084	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5085	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5086	    noise[3] == 0x7f)
5087		goto new;
5088
5089	KASSERT(mac->mac_noise.noi_nsamples < 8,
5090	    ("%s:%d: fail", __func__, __LINE__));
5091	i = mac->mac_noise.noi_nsamples;
5092	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5093	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5094	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5095	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5096	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5097	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5098	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5099	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5100	mac->mac_noise.noi_nsamples++;
5101	if (mac->mac_noise.noi_nsamples == 8) {
5102		average = 0;
5103		for (i = 0; i < 8; i++) {
5104			for (j = 0; j < 4; j++)
5105				average += mac->mac_noise.noi_samples[i][j];
5106		}
5107		average = (((average / 32) * 125) + 64) / 128;
5108		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5109		if (tmp >= 8)
5110			average += 2;
5111		else
5112			average -= 25;
5113		average -= (tmp == 8) ? 72 : 48;
5114
5115		mac->mac_stats.link_noise = average;
5116		mac->mac_noise.noi_running = 0;
5117		return;
5118	}
5119new:
5120	bwn_noise_gensample(mac);
5121}
5122
5123static int
5124bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5125{
5126	struct bwn_mac *mac = prq->prq_mac;
5127	struct bwn_softc *sc = mac->mac_sc;
5128	unsigned int i;
5129
5130	BWN_ASSERT_LOCKED(sc);
5131
5132	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5133		return (0);
5134
5135	for (i = 0; i < 5000; i++) {
5136		if (bwn_pio_rxeof(prq) == 0)
5137			break;
5138	}
5139	if (i >= 5000)
5140		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5141	return ((i > 0) ? 1 : 0);
5142}
5143
5144static void
5145bwn_dma_rx(struct bwn_dma_ring *dr)
5146{
5147	int slot, curslot;
5148
5149	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5150	curslot = dr->get_curslot(dr);
5151	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5152	    ("%s:%d: fail", __func__, __LINE__));
5153
5154	slot = dr->dr_curslot;
5155	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5156		bwn_dma_rxeof(dr, &slot);
5157
5158	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5159	    BUS_DMASYNC_PREWRITE);
5160
5161	dr->set_curslot(dr, slot);
5162	dr->dr_curslot = slot;
5163}
5164
5165static void
5166bwn_intr_txeof(struct bwn_mac *mac)
5167{
5168	struct bwn_txstatus stat;
5169	uint32_t stat0, stat1;
5170	uint16_t tmp;
5171
5172	BWN_ASSERT_LOCKED(mac->mac_sc);
5173
5174	while (1) {
5175		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5176		if (!(stat0 & 0x00000001))
5177			break;
5178		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5179
5180		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5181		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5182		    __func__,
5183		    stat0,
5184		    stat1);
5185
5186		stat.cookie = (stat0 >> 16);
5187		stat.seq = (stat1 & 0x0000ffff);
5188		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5189		tmp = (stat0 & 0x0000ffff);
5190		stat.framecnt = ((tmp & 0xf000) >> 12);
5191		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5192		stat.sreason = ((tmp & 0x001c) >> 2);
5193		stat.pm = (tmp & 0x0080) ? 1 : 0;
5194		stat.im = (tmp & 0x0040) ? 1 : 0;
5195		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5196		stat.ack = (tmp & 0x0002) ? 1 : 0;
5197
5198		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5199		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5200		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5201		    __func__,
5202		    stat.cookie,
5203		    stat.seq,
5204		    stat.phy_stat,
5205		    stat.framecnt,
5206		    stat.rtscnt,
5207		    stat.sreason,
5208		    stat.pm,
5209		    stat.im,
5210		    stat.ampdu,
5211		    stat.ack);
5212
5213		bwn_handle_txeof(mac, &stat);
5214	}
5215}
5216
5217static void
5218bwn_hwreset(void *arg, int npending)
5219{
5220	struct bwn_mac *mac = arg;
5221	struct bwn_softc *sc = mac->mac_sc;
5222	int error = 0;
5223	int prev_status;
5224
5225	BWN_LOCK(sc);
5226
5227	prev_status = mac->mac_status;
5228	if (prev_status >= BWN_MAC_STATUS_STARTED)
5229		bwn_core_stop(mac);
5230	if (prev_status >= BWN_MAC_STATUS_INITED)
5231		bwn_core_exit(mac);
5232
5233	if (prev_status >= BWN_MAC_STATUS_INITED) {
5234		error = bwn_core_init(mac);
5235		if (error)
5236			goto out;
5237	}
5238	if (prev_status >= BWN_MAC_STATUS_STARTED)
5239		bwn_core_start(mac);
5240out:
5241	if (error) {
5242		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5243		sc->sc_curmac = NULL;
5244	}
5245	BWN_UNLOCK(sc);
5246}
5247
5248static void
5249bwn_handle_fwpanic(struct bwn_mac *mac)
5250{
5251	struct bwn_softc *sc = mac->mac_sc;
5252	uint16_t reason;
5253
5254	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5255	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5256
5257	if (reason == BWN_FWPANIC_RESTART)
5258		bwn_restart(mac, "ucode panic");
5259}
5260
5261static void
5262bwn_load_beacon0(struct bwn_mac *mac)
5263{
5264
5265	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5266}
5267
5268static void
5269bwn_load_beacon1(struct bwn_mac *mac)
5270{
5271
5272	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5273}
5274
5275static uint32_t
5276bwn_jssi_read(struct bwn_mac *mac)
5277{
5278	uint32_t val = 0;
5279
5280	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5281	val <<= 16;
5282	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5283
5284	return (val);
5285}
5286
5287static void
5288bwn_noise_gensample(struct bwn_mac *mac)
5289{
5290	uint32_t jssi = 0x7f7f7f7f;
5291
5292	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5293	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5294	BWN_WRITE_4(mac, BWN_MACCMD,
5295	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5296}
5297
5298static int
5299bwn_dma_freeslot(struct bwn_dma_ring *dr)
5300{
5301	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5302
5303	return (dr->dr_numslots - dr->dr_usedslot);
5304}
5305
5306static int
5307bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5308{
5309	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5310
5311	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5312	    ("%s:%d: fail", __func__, __LINE__));
5313	if (slot == dr->dr_numslots - 1)
5314		return (0);
5315	return (slot + 1);
5316}
5317
5318static void
5319bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5320{
5321	struct bwn_mac *mac = dr->dr_mac;
5322	struct bwn_softc *sc = mac->mac_sc;
5323	struct bwn_dma *dma = &mac->mac_method.dma;
5324	struct bwn_dmadesc_generic *desc;
5325	struct bwn_dmadesc_meta *meta;
5326	struct bwn_rxhdr4 *rxhdr;
5327	struct mbuf *m;
5328	uint32_t macstat;
5329	int32_t tmp;
5330	int cnt = 0;
5331	uint16_t len;
5332
5333	dr->getdesc(dr, *slot, &desc, &meta);
5334
5335	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5336	m = meta->mt_m;
5337
5338	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5339		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5340		return;
5341	}
5342
5343	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5344	len = le16toh(rxhdr->frame_len);
5345	if (len <= 0) {
5346		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5347		return;
5348	}
5349	if (bwn_dma_check_redzone(dr, m)) {
5350		device_printf(sc->sc_dev, "redzone error.\n");
5351		bwn_dma_set_redzone(dr, m);
5352		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5353		    BUS_DMASYNC_PREWRITE);
5354		return;
5355	}
5356	if (len > dr->dr_rx_bufsize) {
5357		tmp = len;
5358		while (1) {
5359			dr->getdesc(dr, *slot, &desc, &meta);
5360			bwn_dma_set_redzone(dr, meta->mt_m);
5361			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5362			    BUS_DMASYNC_PREWRITE);
5363			*slot = bwn_dma_nextslot(dr, *slot);
5364			cnt++;
5365			tmp -= dr->dr_rx_bufsize;
5366			if (tmp <= 0)
5367				break;
5368		}
5369		device_printf(sc->sc_dev, "too small buffer "
5370		       "(len %u buffer %u dropped %d)\n",
5371		       len, dr->dr_rx_bufsize, cnt);
5372		return;
5373	}
5374
5375	switch (mac->mac_fw.fw_hdr_format) {
5376	case BWN_FW_HDR_351:
5377	case BWN_FW_HDR_410:
5378		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5379		break;
5380	case BWN_FW_HDR_598:
5381		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5382		break;
5383	}
5384
5385	if (macstat & BWN_RX_MAC_FCSERR) {
5386		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5387			device_printf(sc->sc_dev, "RX drop\n");
5388			return;
5389		}
5390	}
5391
5392	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5393	m_adj(m, dr->dr_frameoffset);
5394
5395	bwn_rxeof(dr->dr_mac, m, rxhdr);
5396}
5397
5398static void
5399bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5400{
5401	struct bwn_softc *sc = mac->mac_sc;
5402	struct bwn_stats *stats = &mac->mac_stats;
5403
5404	BWN_ASSERT_LOCKED(mac->mac_sc);
5405
5406	if (status->im)
5407		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5408	if (status->ampdu)
5409		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5410	if (status->rtscnt) {
5411		if (status->rtscnt == 0xf)
5412			stats->rtsfail++;
5413		else
5414			stats->rts++;
5415	}
5416
5417	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5418		bwn_dma_handle_txeof(mac, status);
5419	} else {
5420		bwn_pio_handle_txeof(mac, status);
5421	}
5422
5423	bwn_phy_txpower_check(mac, 0);
5424}
5425
5426static uint8_t
5427bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5428{
5429	struct bwn_mac *mac = prq->prq_mac;
5430	struct bwn_softc *sc = mac->mac_sc;
5431	struct bwn_rxhdr4 rxhdr;
5432	struct mbuf *m;
5433	uint32_t ctl32, macstat, v32;
5434	unsigned int i, padding;
5435	uint16_t ctl16, len, totlen, v16;
5436	unsigned char *mp;
5437	char *data;
5438
5439	memset(&rxhdr, 0, sizeof(rxhdr));
5440
5441	if (prq->prq_rev >= 8) {
5442		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5443		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5444			return (0);
5445		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5446		    BWN_PIO8_RXCTL_FRAMEREADY);
5447		for (i = 0; i < 10; i++) {
5448			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5449			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5450				goto ready;
5451			DELAY(10);
5452		}
5453	} else {
5454		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5455		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5456			return (0);
5457		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5458		    BWN_PIO_RXCTL_FRAMEREADY);
5459		for (i = 0; i < 10; i++) {
5460			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5461			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5462				goto ready;
5463			DELAY(10);
5464		}
5465	}
5466	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5467	return (1);
5468ready:
5469	if (prq->prq_rev >= 8)
5470		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5471		    prq->prq_base + BWN_PIO8_RXDATA);
5472	else
5473		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5474		    prq->prq_base + BWN_PIO_RXDATA);
5475	len = le16toh(rxhdr.frame_len);
5476	if (len > 0x700) {
5477		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5478		goto error;
5479	}
5480	if (len == 0) {
5481		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5482		goto error;
5483	}
5484
5485	switch (mac->mac_fw.fw_hdr_format) {
5486	case BWN_FW_HDR_351:
5487	case BWN_FW_HDR_410:
5488		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5489		break;
5490	case BWN_FW_HDR_598:
5491		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5492		break;
5493	}
5494
5495	if (macstat & BWN_RX_MAC_FCSERR) {
5496		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5497			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5498			goto error;
5499		}
5500	}
5501
5502	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5503	totlen = len + padding;
5504	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5505	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5506	if (m == NULL) {
5507		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5508		goto error;
5509	}
5510	mp = mtod(m, unsigned char *);
5511	if (prq->prq_rev >= 8) {
5512		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5513		    prq->prq_base + BWN_PIO8_RXDATA);
5514		if (totlen & 3) {
5515			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5516			data = &(mp[totlen - 1]);
5517			switch (totlen & 3) {
5518			case 3:
5519				*data = (v32 >> 16);
5520				data--;
5521			case 2:
5522				*data = (v32 >> 8);
5523				data--;
5524			case 1:
5525				*data = v32;
5526			}
5527		}
5528	} else {
5529		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5530		    prq->prq_base + BWN_PIO_RXDATA);
5531		if (totlen & 1) {
5532			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5533			mp[totlen - 1] = v16;
5534		}
5535	}
5536
5537	m->m_len = m->m_pkthdr.len = totlen;
5538
5539	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5540
5541	return (1);
5542error:
5543	if (prq->prq_rev >= 8)
5544		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5545		    BWN_PIO8_RXCTL_DATAREADY);
5546	else
5547		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5548	return (1);
5549}
5550
5551static int
5552bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5553    struct bwn_dmadesc_meta *meta, int init)
5554{
5555	struct bwn_mac *mac = dr->dr_mac;
5556	struct bwn_dma *dma = &mac->mac_method.dma;
5557	struct bwn_rxhdr4 *hdr;
5558	bus_dmamap_t map;
5559	bus_addr_t paddr;
5560	struct mbuf *m;
5561	int error;
5562
5563	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5564	if (m == NULL) {
5565		error = ENOBUFS;
5566
5567		/*
5568		 * If the NIC is up and running, we need to:
5569		 * - Clear RX buffer's header.
5570		 * - Restore RX descriptor settings.
5571		 */
5572		if (init)
5573			return (error);
5574		else
5575			goto back;
5576	}
5577	m->m_len = m->m_pkthdr.len = MCLBYTES;
5578
5579	bwn_dma_set_redzone(dr, m);
5580
5581	/*
5582	 * Try to load RX buf into temporary DMA map
5583	 */
5584	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5585	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5586	if (error) {
5587		m_freem(m);
5588
5589		/*
5590		 * See the comment above
5591		 */
5592		if (init)
5593			return (error);
5594		else
5595			goto back;
5596	}
5597
5598	if (!init)
5599		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5600	meta->mt_m = m;
5601	meta->mt_paddr = paddr;
5602
5603	/*
5604	 * Swap RX buf's DMA map with the loaded temporary one
5605	 */
5606	map = meta->mt_dmap;
5607	meta->mt_dmap = dr->dr_spare_dmap;
5608	dr->dr_spare_dmap = map;
5609
5610back:
5611	/*
5612	 * Clear RX buf header
5613	 */
5614	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5615	bzero(hdr, sizeof(*hdr));
5616	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5617	    BUS_DMASYNC_PREWRITE);
5618
5619	/*
5620	 * Setup RX buf descriptor
5621	 */
5622	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5623	    sizeof(*hdr), 0, 0, 0);
5624	return (error);
5625}
5626
5627static void
5628bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5629		 bus_size_t mapsz __unused, int error)
5630{
5631
5632	if (!error) {
5633		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5634		*((bus_addr_t *)arg) = seg->ds_addr;
5635	}
5636}
5637
5638static int
5639bwn_hwrate2ieeerate(int rate)
5640{
5641
5642	switch (rate) {
5643	case BWN_CCK_RATE_1MB:
5644		return (2);
5645	case BWN_CCK_RATE_2MB:
5646		return (4);
5647	case BWN_CCK_RATE_5MB:
5648		return (11);
5649	case BWN_CCK_RATE_11MB:
5650		return (22);
5651	case BWN_OFDM_RATE_6MB:
5652		return (12);
5653	case BWN_OFDM_RATE_9MB:
5654		return (18);
5655	case BWN_OFDM_RATE_12MB:
5656		return (24);
5657	case BWN_OFDM_RATE_18MB:
5658		return (36);
5659	case BWN_OFDM_RATE_24MB:
5660		return (48);
5661	case BWN_OFDM_RATE_36MB:
5662		return (72);
5663	case BWN_OFDM_RATE_48MB:
5664		return (96);
5665	case BWN_OFDM_RATE_54MB:
5666		return (108);
5667	default:
5668		printf("Ooops\n");
5669		return (0);
5670	}
5671}
5672
5673/*
5674 * Post process the RX provided RSSI.
5675 *
5676 * Valid for A, B, G, LP PHYs.
5677 */
5678static int8_t
5679bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5680    int ofdm, int adjust_2053, int adjust_2050)
5681{
5682	struct bwn_phy *phy = &mac->mac_phy;
5683	struct bwn_phy_g *gphy = &phy->phy_g;
5684	int tmp;
5685
5686	switch (phy->rf_ver) {
5687	case 0x2050:
5688		if (ofdm) {
5689			tmp = in_rssi;
5690			if (tmp > 127)
5691				tmp -= 256;
5692			tmp = tmp * 73 / 64;
5693			if (adjust_2050)
5694				tmp += 25;
5695			else
5696				tmp -= 3;
5697		} else {
5698			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5699			    & BWN_BFL_RSSI) {
5700				if (in_rssi > 63)
5701					in_rssi = 63;
5702				tmp = gphy->pg_nrssi_lt[in_rssi];
5703				tmp = (31 - tmp) * -131 / 128 - 57;
5704			} else {
5705				tmp = in_rssi;
5706				tmp = (31 - tmp) * -149 / 128 - 68;
5707			}
5708			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5709				tmp += 25;
5710		}
5711		break;
5712	case 0x2060:
5713		if (in_rssi > 127)
5714			tmp = in_rssi - 256;
5715		else
5716			tmp = in_rssi;
5717		break;
5718	default:
5719		tmp = in_rssi;
5720		tmp = (tmp - 11) * 103 / 64;
5721		if (adjust_2053)
5722			tmp -= 109;
5723		else
5724			tmp -= 83;
5725	}
5726
5727	return (tmp);
5728}
5729
5730static void
5731bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5732{
5733	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5734	struct bwn_plcp6 *plcp;
5735	struct bwn_softc *sc = mac->mac_sc;
5736	struct ieee80211_frame_min *wh;
5737	struct ieee80211_node *ni;
5738	struct ieee80211com *ic = &sc->sc_ic;
5739	uint32_t macstat;
5740	int padding, rate, rssi = 0, noise = 0, type;
5741	uint16_t phytype, phystat0, phystat3, chanstat;
5742	unsigned char *mp = mtod(m, unsigned char *);
5743	static int rx_mac_dec_rpt = 0;
5744
5745	BWN_ASSERT_LOCKED(sc);
5746
5747	phystat0 = le16toh(rxhdr->phy_status0);
5748
5749	/*
5750	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5751	 * used for LP-PHY.
5752	 */
5753	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5754
5755	switch (mac->mac_fw.fw_hdr_format) {
5756	case BWN_FW_HDR_351:
5757	case BWN_FW_HDR_410:
5758		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5759		chanstat = le16toh(rxhdr->ps4.r351.channel);
5760		break;
5761	case BWN_FW_HDR_598:
5762		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5763		chanstat = le16toh(rxhdr->ps4.r598.channel);
5764		break;
5765	}
5766
5767
5768	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5769
5770	if (macstat & BWN_RX_MAC_FCSERR)
5771		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5772	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5773		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5774	if (macstat & BWN_RX_MAC_DECERR)
5775		goto drop;
5776
5777	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5778	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5779		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5780		    m->m_pkthdr.len);
5781		goto drop;
5782	}
5783	plcp = (struct bwn_plcp6 *)(mp + padding);
5784	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5785	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5786		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5787		    m->m_pkthdr.len);
5788		goto drop;
5789	}
5790	wh = mtod(m, struct ieee80211_frame_min *);
5791
5792	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5793		device_printf(sc->sc_dev,
5794		    "RX decryption attempted (old %d keyidx %#x)\n",
5795		    BWN_ISOLDFMT(mac),
5796		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5797
5798	if (phystat0 & BWN_RX_PHYST0_OFDM)
5799		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5800		    phytype == BWN_PHYTYPE_A);
5801	else
5802		rate = bwn_plcp_get_cckrate(mac, plcp);
5803	if (rate == -1) {
5804		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5805			goto drop;
5806	}
5807	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5808
5809	/* rssi/noise */
5810	switch (phytype) {
5811	case BWN_PHYTYPE_A:
5812	case BWN_PHYTYPE_B:
5813	case BWN_PHYTYPE_G:
5814	case BWN_PHYTYPE_LP:
5815		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5816		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5817		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5818		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5819		break;
5820	case BWN_PHYTYPE_N:
5821		/* Broadcom has code for min/avg, but always used max */
5822		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5823			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5824		else
5825			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5826#if 0
5827		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5828		    "%s: power0=%d, power1=%d, power2=%d\n",
5829		    __func__,
5830		    rxhdr->phy.n.power0,
5831		    rxhdr->phy.n.power1,
5832		    rxhdr->ps2.n.power2);
5833#endif
5834		break;
5835	default:
5836		/* XXX TODO: implement rssi for other PHYs */
5837		break;
5838	}
5839
5840	/*
5841	 * RSSI here is absolute, not relative to the noise floor.
5842	 */
5843	noise = mac->mac_stats.link_noise;
5844	rssi = rssi - noise;
5845
5846	/* RX radio tap */
5847	if (ieee80211_radiotap_active(ic))
5848		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5849	m_adj(m, -IEEE80211_CRC_LEN);
5850
5851	BWN_UNLOCK(sc);
5852
5853	ni = ieee80211_find_rxnode(ic, wh);
5854	if (ni != NULL) {
5855		type = ieee80211_input(ni, m, rssi, noise);
5856		ieee80211_free_node(ni);
5857	} else
5858		type = ieee80211_input_all(ic, m, rssi, noise);
5859
5860	BWN_LOCK(sc);
5861	return;
5862drop:
5863	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5864}
5865
5866static void
5867bwn_dma_handle_txeof(struct bwn_mac *mac,
5868    const struct bwn_txstatus *status)
5869{
5870	struct bwn_dma *dma = &mac->mac_method.dma;
5871	struct bwn_dma_ring *dr;
5872	struct bwn_dmadesc_generic *desc;
5873	struct bwn_dmadesc_meta *meta;
5874	struct bwn_softc *sc = mac->mac_sc;
5875	int slot;
5876	int retrycnt = 0;
5877
5878	BWN_ASSERT_LOCKED(sc);
5879
5880	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5881	if (dr == NULL) {
5882		device_printf(sc->sc_dev, "failed to parse cookie\n");
5883		return;
5884	}
5885	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5886
5887	while (1) {
5888		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5889		    ("%s:%d: fail", __func__, __LINE__));
5890		dr->getdesc(dr, slot, &desc, &meta);
5891
5892		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5893			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5894		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5895			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5896
5897		if (meta->mt_islast) {
5898			KASSERT(meta->mt_m != NULL,
5899			    ("%s:%d: fail", __func__, __LINE__));
5900
5901			/*
5902			 * If we don't get an ACK, then we should log the
5903			 * full framecnt.  That may be 0 if it's a PHY
5904			 * failure, so ensure that gets logged as some
5905			 * retry attempt.
5906			 */
5907			if (status->ack) {
5908				retrycnt = status->framecnt - 1;
5909			} else {
5910				retrycnt = status->framecnt;
5911				if (retrycnt == 0)
5912					retrycnt = 1;
5913			}
5914			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5915			    status->ack ?
5916			      IEEE80211_RATECTL_TX_SUCCESS :
5917			      IEEE80211_RATECTL_TX_FAILURE,
5918			    &retrycnt, 0);
5919			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5920			meta->mt_ni = NULL;
5921			meta->mt_m = NULL;
5922		} else
5923			KASSERT(meta->mt_m == NULL,
5924			    ("%s:%d: fail", __func__, __LINE__));
5925
5926		dr->dr_usedslot--;
5927		if (meta->mt_islast)
5928			break;
5929		slot = bwn_dma_nextslot(dr, slot);
5930	}
5931	sc->sc_watchdog_timer = 0;
5932	if (dr->dr_stop) {
5933		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5934		    ("%s:%d: fail", __func__, __LINE__));
5935		dr->dr_stop = 0;
5936	}
5937}
5938
5939static void
5940bwn_pio_handle_txeof(struct bwn_mac *mac,
5941    const struct bwn_txstatus *status)
5942{
5943	struct bwn_pio_txqueue *tq;
5944	struct bwn_pio_txpkt *tp = NULL;
5945	struct bwn_softc *sc = mac->mac_sc;
5946	int retrycnt = 0;
5947
5948	BWN_ASSERT_LOCKED(sc);
5949
5950	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5951	if (tq == NULL)
5952		return;
5953
5954	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5955	tq->tq_free++;
5956
5957	if (tp->tp_ni != NULL) {
5958		/*
5959		 * Do any tx complete callback.  Note this must
5960		 * be done before releasing the node reference.
5961		 */
5962
5963		/*
5964		 * If we don't get an ACK, then we should log the
5965		 * full framecnt.  That may be 0 if it's a PHY
5966		 * failure, so ensure that gets logged as some
5967		 * retry attempt.
5968		 */
5969		if (status->ack) {
5970			retrycnt = status->framecnt - 1;
5971		} else {
5972			retrycnt = status->framecnt;
5973			if (retrycnt == 0)
5974				retrycnt = 1;
5975		}
5976		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5977		    status->ack ?
5978		      IEEE80211_RATECTL_TX_SUCCESS :
5979		      IEEE80211_RATECTL_TX_FAILURE,
5980		    &retrycnt, 0);
5981
5982		if (tp->tp_m->m_flags & M_TXCB)
5983			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5984		ieee80211_free_node(tp->tp_ni);
5985		tp->tp_ni = NULL;
5986	}
5987	m_freem(tp->tp_m);
5988	tp->tp_m = NULL;
5989	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5990
5991	sc->sc_watchdog_timer = 0;
5992}
5993
5994static void
5995bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5996{
5997	struct bwn_softc *sc = mac->mac_sc;
5998	struct bwn_phy *phy = &mac->mac_phy;
5999	struct ieee80211com *ic = &sc->sc_ic;
6000	unsigned long now;
6001	bwn_txpwr_result_t result;
6002
6003	BWN_GETTIME(now);
6004
6005	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6006		return;
6007	phy->nexttime = now + 2 * 1000;
6008
6009	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6010	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6011		return;
6012
6013	if (phy->recalc_txpwr != NULL) {
6014		result = phy->recalc_txpwr(mac,
6015		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6016		if (result == BWN_TXPWR_RES_DONE)
6017			return;
6018		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6019		    ("%s: fail", __func__));
6020		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6021
6022		ieee80211_runtask(ic, &mac->mac_txpower);
6023	}
6024}
6025
6026static uint16_t
6027bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6028{
6029
6030	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6031}
6032
6033static uint32_t
6034bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6035{
6036
6037	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6038}
6039
6040static void
6041bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6042{
6043
6044	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6045}
6046
6047static void
6048bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6049{
6050
6051	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6052}
6053
6054static int
6055bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6056{
6057
6058	switch (rate) {
6059	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6060	case 12:
6061		return (BWN_OFDM_RATE_6MB);
6062	case 18:
6063		return (BWN_OFDM_RATE_9MB);
6064	case 24:
6065		return (BWN_OFDM_RATE_12MB);
6066	case 36:
6067		return (BWN_OFDM_RATE_18MB);
6068	case 48:
6069		return (BWN_OFDM_RATE_24MB);
6070	case 72:
6071		return (BWN_OFDM_RATE_36MB);
6072	case 96:
6073		return (BWN_OFDM_RATE_48MB);
6074	case 108:
6075		return (BWN_OFDM_RATE_54MB);
6076	/* CCK rates (NB: not IEEE std, device-specific) */
6077	case 2:
6078		return (BWN_CCK_RATE_1MB);
6079	case 4:
6080		return (BWN_CCK_RATE_2MB);
6081	case 11:
6082		return (BWN_CCK_RATE_5MB);
6083	case 22:
6084		return (BWN_CCK_RATE_11MB);
6085	}
6086
6087	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6088	return (BWN_CCK_RATE_1MB);
6089}
6090
6091static uint16_t
6092bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6093{
6094	struct bwn_phy *phy = &mac->mac_phy;
6095	uint16_t control = 0;
6096	uint16_t bw;
6097
6098	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6099	bw = BWN_TXH_PHY1_BW_20;
6100
6101	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6102		control = bw;
6103	} else {
6104		control = bw;
6105		/* Figure out coding rate and modulation */
6106		/* XXX TODO: table-ize, for MCS transmit */
6107		/* Note: this is BWN_*_RATE values */
6108		switch (bitrate) {
6109		case BWN_CCK_RATE_1MB:
6110			control |= 0;
6111			break;
6112		case BWN_CCK_RATE_2MB:
6113			control |= 1;
6114			break;
6115		case BWN_CCK_RATE_5MB:
6116			control |= 2;
6117			break;
6118		case BWN_CCK_RATE_11MB:
6119			control |= 3;
6120			break;
6121		case BWN_OFDM_RATE_6MB:
6122			control |= BWN_TXH_PHY1_CRATE_1_2;
6123			control |= BWN_TXH_PHY1_MODUL_BPSK;
6124			break;
6125		case BWN_OFDM_RATE_9MB:
6126			control |= BWN_TXH_PHY1_CRATE_3_4;
6127			control |= BWN_TXH_PHY1_MODUL_BPSK;
6128			break;
6129		case BWN_OFDM_RATE_12MB:
6130			control |= BWN_TXH_PHY1_CRATE_1_2;
6131			control |= BWN_TXH_PHY1_MODUL_QPSK;
6132			break;
6133		case BWN_OFDM_RATE_18MB:
6134			control |= BWN_TXH_PHY1_CRATE_3_4;
6135			control |= BWN_TXH_PHY1_MODUL_QPSK;
6136			break;
6137		case BWN_OFDM_RATE_24MB:
6138			control |= BWN_TXH_PHY1_CRATE_1_2;
6139			control |= BWN_TXH_PHY1_MODUL_QAM16;
6140			break;
6141		case BWN_OFDM_RATE_36MB:
6142			control |= BWN_TXH_PHY1_CRATE_3_4;
6143			control |= BWN_TXH_PHY1_MODUL_QAM16;
6144			break;
6145		case BWN_OFDM_RATE_48MB:
6146			control |= BWN_TXH_PHY1_CRATE_1_2;
6147			control |= BWN_TXH_PHY1_MODUL_QAM64;
6148			break;
6149		case BWN_OFDM_RATE_54MB:
6150			control |= BWN_TXH_PHY1_CRATE_3_4;
6151			control |= BWN_TXH_PHY1_MODUL_QAM64;
6152			break;
6153		default:
6154			break;
6155		}
6156		control |= BWN_TXH_PHY1_MODE_SISO;
6157	}
6158
6159	return control;
6160}
6161
6162static int
6163bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6164    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6165{
6166	const struct bwn_phy *phy = &mac->mac_phy;
6167	struct bwn_softc *sc = mac->mac_sc;
6168	struct ieee80211_frame *wh;
6169	struct ieee80211_frame *protwh;
6170	struct ieee80211_frame_cts *cts;
6171	struct ieee80211_frame_rts *rts;
6172	const struct ieee80211_txparam *tp;
6173	struct ieee80211vap *vap = ni->ni_vap;
6174	struct ieee80211com *ic = &sc->sc_ic;
6175	struct mbuf *mprot;
6176	unsigned int len;
6177	uint32_t macctl = 0;
6178	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6179	uint16_t phyctl = 0;
6180	uint8_t rate, rate_fb;
6181	int fill_phy_ctl1 = 0;
6182
6183	wh = mtod(m, struct ieee80211_frame *);
6184	memset(txhdr, 0, sizeof(*txhdr));
6185
6186	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6187	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6188	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6189
6190	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6191	    || (phy->type == BWN_PHYTYPE_HT))
6192		fill_phy_ctl1 = 1;
6193
6194	/*
6195	 * Find TX rate
6196	 */
6197	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6198	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6199		rate = rate_fb = tp->mgmtrate;
6200	else if (ismcast)
6201		rate = rate_fb = tp->mcastrate;
6202	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6203		rate = rate_fb = tp->ucastrate;
6204	else {
6205		/* XXX TODO: don't fall back to CCK rates for OFDM */
6206		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6207		rate = ni->ni_txrate;
6208
6209		if (rix > 0)
6210			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6211			    IEEE80211_RATE_VAL;
6212		else
6213			rate_fb = rate;
6214	}
6215
6216	sc->sc_tx_rate = rate;
6217
6218	/* Note: this maps the select ieee80211 rate to hardware rate */
6219	rate = bwn_ieeerate2hwrate(sc, rate);
6220	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6221
6222	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6223	    bwn_plcp_getcck(rate);
6224	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6225	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6226
6227	/* XXX rate/rate_fb is the hardware rate */
6228	if ((rate_fb == rate) ||
6229	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6230	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6231		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6232	else
6233		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6234		    m->m_pkthdr.len, rate, isshort);
6235
6236	/* XXX TX encryption */
6237
6238	switch (mac->mac_fw.fw_hdr_format) {
6239	case BWN_FW_HDR_351:
6240		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6241		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6242		break;
6243	case BWN_FW_HDR_410:
6244		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6245		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6246		break;
6247	case BWN_FW_HDR_598:
6248		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6249		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6250		break;
6251	}
6252
6253	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6254	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6255
6256	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6257	    BWN_TX_EFT_FB_CCK;
6258	txhdr->chan = phy->chan;
6259	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6260	    BWN_TX_PHY_ENC_CCK;
6261	/* XXX preamble? obey net80211 */
6262	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6263	     rate == BWN_CCK_RATE_11MB))
6264		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6265
6266	if (! phy->gmode)
6267		macctl |= BWN_TX_MAC_5GHZ;
6268
6269	/* XXX TX antenna selection */
6270
6271	switch (bwn_antenna_sanitize(mac, 0)) {
6272	case 0:
6273		phyctl |= BWN_TX_PHY_ANT01AUTO;
6274		break;
6275	case 1:
6276		phyctl |= BWN_TX_PHY_ANT0;
6277		break;
6278	case 2:
6279		phyctl |= BWN_TX_PHY_ANT1;
6280		break;
6281	case 3:
6282		phyctl |= BWN_TX_PHY_ANT2;
6283		break;
6284	case 4:
6285		phyctl |= BWN_TX_PHY_ANT3;
6286		break;
6287	default:
6288		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6289	}
6290
6291	if (!ismcast)
6292		macctl |= BWN_TX_MAC_ACK;
6293
6294	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6295	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6296	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6297		macctl |= BWN_TX_MAC_LONGFRAME;
6298
6299	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6300		/* XXX RTS rate is always 1MB??? */
6301		/* XXX TODO: don't fall back to CCK rates for OFDM */
6302		rts_rate = BWN_CCK_RATE_1MB;
6303		rts_rate_fb = bwn_get_fbrate(rts_rate);
6304
6305		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6306		protdur = ieee80211_compute_duration(ic->ic_rt,
6307		    m->m_pkthdr.len, rate, isshort) +
6308		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6309
6310		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6311
6312			switch (mac->mac_fw.fw_hdr_format) {
6313			case BWN_FW_HDR_351:
6314				cts = (struct ieee80211_frame_cts *)
6315				    txhdr->body.r351.rts_frame;
6316				break;
6317			case BWN_FW_HDR_410:
6318				cts = (struct ieee80211_frame_cts *)
6319				    txhdr->body.r410.rts_frame;
6320				break;
6321			case BWN_FW_HDR_598:
6322				cts = (struct ieee80211_frame_cts *)
6323				    txhdr->body.r598.rts_frame;
6324				break;
6325			}
6326
6327			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6328			    protdur);
6329			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6330			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6331			    mprot->m_pkthdr.len);
6332			m_freem(mprot);
6333			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6334			len = sizeof(struct ieee80211_frame_cts);
6335		} else {
6336			switch (mac->mac_fw.fw_hdr_format) {
6337			case BWN_FW_HDR_351:
6338				rts = (struct ieee80211_frame_rts *)
6339				    txhdr->body.r351.rts_frame;
6340				break;
6341			case BWN_FW_HDR_410:
6342				rts = (struct ieee80211_frame_rts *)
6343				    txhdr->body.r410.rts_frame;
6344				break;
6345			case BWN_FW_HDR_598:
6346				rts = (struct ieee80211_frame_rts *)
6347				    txhdr->body.r598.rts_frame;
6348				break;
6349			}
6350
6351			/* XXX rate/rate_fb is the hardware rate */
6352			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6353			    isshort);
6354			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6355			    wh->i_addr2, protdur);
6356			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6357			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6358			    mprot->m_pkthdr.len);
6359			m_freem(mprot);
6360			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6361			len = sizeof(struct ieee80211_frame_rts);
6362		}
6363		len += IEEE80211_CRC_LEN;
6364
6365		switch (mac->mac_fw.fw_hdr_format) {
6366		case BWN_FW_HDR_351:
6367			bwn_plcp_genhdr((struct bwn_plcp4 *)
6368			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6369			break;
6370		case BWN_FW_HDR_410:
6371			bwn_plcp_genhdr((struct bwn_plcp4 *)
6372			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6373			break;
6374		case BWN_FW_HDR_598:
6375			bwn_plcp_genhdr((struct bwn_plcp4 *)
6376			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6377			break;
6378		}
6379
6380		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6381		    rts_rate_fb);
6382
6383		switch (mac->mac_fw.fw_hdr_format) {
6384		case BWN_FW_HDR_351:
6385			protwh = (struct ieee80211_frame *)
6386			    &txhdr->body.r351.rts_frame;
6387			break;
6388		case BWN_FW_HDR_410:
6389			protwh = (struct ieee80211_frame *)
6390			    &txhdr->body.r410.rts_frame;
6391			break;
6392		case BWN_FW_HDR_598:
6393			protwh = (struct ieee80211_frame *)
6394			    &txhdr->body.r598.rts_frame;
6395			break;
6396		}
6397
6398		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6399
6400		if (BWN_ISOFDMRATE(rts_rate)) {
6401			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6402			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6403		} else {
6404			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6405			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6406		}
6407		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6408		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6409
6410		if (fill_phy_ctl1) {
6411			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6412			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6413		}
6414	}
6415
6416	if (fill_phy_ctl1) {
6417		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6418		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6419	}
6420
6421	switch (mac->mac_fw.fw_hdr_format) {
6422	case BWN_FW_HDR_351:
6423		txhdr->body.r351.cookie = htole16(cookie);
6424		break;
6425	case BWN_FW_HDR_410:
6426		txhdr->body.r410.cookie = htole16(cookie);
6427		break;
6428	case BWN_FW_HDR_598:
6429		txhdr->body.r598.cookie = htole16(cookie);
6430		break;
6431	}
6432
6433	txhdr->macctl = htole32(macctl);
6434	txhdr->phyctl = htole16(phyctl);
6435
6436	/*
6437	 * TX radio tap
6438	 */
6439	if (ieee80211_radiotap_active_vap(vap)) {
6440		sc->sc_tx_th.wt_flags = 0;
6441		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6442			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6443		if (isshort &&
6444		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6445		     rate == BWN_CCK_RATE_11MB))
6446			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6447		sc->sc_tx_th.wt_rate = rate;
6448
6449		ieee80211_radiotap_tx(vap, m);
6450	}
6451
6452	return (0);
6453}
6454
6455static void
6456bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6457    const uint8_t rate)
6458{
6459	uint32_t d, plen;
6460	uint8_t *raw = plcp->o.raw;
6461
6462	if (BWN_ISOFDMRATE(rate)) {
6463		d = bwn_plcp_getofdm(rate);
6464		KASSERT(!(octets & 0xf000),
6465		    ("%s:%d: fail", __func__, __LINE__));
6466		d |= (octets << 5);
6467		plcp->o.data = htole32(d);
6468	} else {
6469		plen = octets * 16 / rate;
6470		if ((octets * 16 % rate) > 0) {
6471			plen++;
6472			if ((rate == BWN_CCK_RATE_11MB)
6473			    && ((octets * 8 % 11) < 4)) {
6474				raw[1] = 0x84;
6475			} else
6476				raw[1] = 0x04;
6477		} else
6478			raw[1] = 0x04;
6479		plcp->o.data |= htole32(plen << 16);
6480		raw[0] = bwn_plcp_getcck(rate);
6481	}
6482}
6483
6484static uint8_t
6485bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6486{
6487	struct bwn_softc *sc = mac->mac_sc;
6488	uint8_t mask;
6489
6490	if (n == 0)
6491		return (0);
6492	if (mac->mac_phy.gmode)
6493		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6494	else
6495		mask = siba_sprom_get_ant_a(sc->sc_dev);
6496	if (!(mask & (1 << (n - 1))))
6497		return (0);
6498	return (n);
6499}
6500
6501/*
6502 * Return a fallback rate for the given rate.
6503 *
6504 * Note: Don't fall back from OFDM to CCK.
6505 */
6506static uint8_t
6507bwn_get_fbrate(uint8_t bitrate)
6508{
6509	switch (bitrate) {
6510	/* CCK */
6511	case BWN_CCK_RATE_1MB:
6512		return (BWN_CCK_RATE_1MB);
6513	case BWN_CCK_RATE_2MB:
6514		return (BWN_CCK_RATE_1MB);
6515	case BWN_CCK_RATE_5MB:
6516		return (BWN_CCK_RATE_2MB);
6517	case BWN_CCK_RATE_11MB:
6518		return (BWN_CCK_RATE_5MB);
6519
6520	/* OFDM */
6521	case BWN_OFDM_RATE_6MB:
6522		return (BWN_OFDM_RATE_6MB);
6523	case BWN_OFDM_RATE_9MB:
6524		return (BWN_OFDM_RATE_6MB);
6525	case BWN_OFDM_RATE_12MB:
6526		return (BWN_OFDM_RATE_9MB);
6527	case BWN_OFDM_RATE_18MB:
6528		return (BWN_OFDM_RATE_12MB);
6529	case BWN_OFDM_RATE_24MB:
6530		return (BWN_OFDM_RATE_18MB);
6531	case BWN_OFDM_RATE_36MB:
6532		return (BWN_OFDM_RATE_24MB);
6533	case BWN_OFDM_RATE_48MB:
6534		return (BWN_OFDM_RATE_36MB);
6535	case BWN_OFDM_RATE_54MB:
6536		return (BWN_OFDM_RATE_48MB);
6537	}
6538	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6539	return (0);
6540}
6541
6542static uint32_t
6543bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6544    uint32_t ctl, const void *_data, int len)
6545{
6546	struct bwn_softc *sc = mac->mac_sc;
6547	uint32_t value = 0;
6548	const uint8_t *data = _data;
6549
6550	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6551	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6552	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6553
6554	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6555	    tq->tq_base + BWN_PIO8_TXDATA);
6556	if (len & 3) {
6557		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6558		    BWN_PIO8_TXCTL_24_31);
6559		data = &(data[len - 1]);
6560		switch (len & 3) {
6561		case 3:
6562			ctl |= BWN_PIO8_TXCTL_16_23;
6563			value |= (uint32_t)(*data) << 16;
6564			data--;
6565		case 2:
6566			ctl |= BWN_PIO8_TXCTL_8_15;
6567			value |= (uint32_t)(*data) << 8;
6568			data--;
6569		case 1:
6570			value |= (uint32_t)(*data);
6571		}
6572		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6573		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6574	}
6575
6576	return (ctl);
6577}
6578
6579static void
6580bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6581    uint16_t offset, uint32_t value)
6582{
6583
6584	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6585}
6586
6587static uint16_t
6588bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6589    uint16_t ctl, const void *_data, int len)
6590{
6591	struct bwn_softc *sc = mac->mac_sc;
6592	const uint8_t *data = _data;
6593
6594	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6595	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6596
6597	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6598	    tq->tq_base + BWN_PIO_TXDATA);
6599	if (len & 1) {
6600		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6601		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6602		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6603	}
6604
6605	return (ctl);
6606}
6607
6608static uint16_t
6609bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6610    uint16_t ctl, struct mbuf *m0)
6611{
6612	int i, j = 0;
6613	uint16_t data = 0;
6614	const uint8_t *buf;
6615	struct mbuf *m = m0;
6616
6617	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6618	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6619
6620	for (; m != NULL; m = m->m_next) {
6621		buf = mtod(m, const uint8_t *);
6622		for (i = 0; i < m->m_len; i++) {
6623			if (!((j++) % 2))
6624				data |= buf[i];
6625			else {
6626				data |= (buf[i] << 8);
6627				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6628				data = 0;
6629			}
6630		}
6631	}
6632	if (m0->m_pkthdr.len % 2) {
6633		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6634		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6635		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6636	}
6637
6638	return (ctl);
6639}
6640
6641static void
6642bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6643{
6644
6645	/* XXX should exit if 5GHz band .. */
6646	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6647		return;
6648
6649	BWN_WRITE_2(mac, 0x684, 510 + time);
6650	/* Disabled in Linux b43, can adversely effect performance */
6651#if 0
6652	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6653#endif
6654}
6655
6656static struct bwn_dma_ring *
6657bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6658{
6659
6660	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6661		return (mac->mac_method.dma.wme[WME_AC_BE]);
6662
6663	switch (prio) {
6664	case 3:
6665		return (mac->mac_method.dma.wme[WME_AC_VO]);
6666	case 2:
6667		return (mac->mac_method.dma.wme[WME_AC_VI]);
6668	case 0:
6669		return (mac->mac_method.dma.wme[WME_AC_BE]);
6670	case 1:
6671		return (mac->mac_method.dma.wme[WME_AC_BK]);
6672	}
6673	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6674	return (NULL);
6675}
6676
6677static int
6678bwn_dma_getslot(struct bwn_dma_ring *dr)
6679{
6680	int slot;
6681
6682	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6683
6684	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6685	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6686	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6687
6688	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6689	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6690	dr->dr_curslot = slot;
6691	dr->dr_usedslot++;
6692
6693	return (slot);
6694}
6695
6696static struct bwn_pio_txqueue *
6697bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6698    struct bwn_pio_txpkt **pack)
6699{
6700	struct bwn_pio *pio = &mac->mac_method.pio;
6701	struct bwn_pio_txqueue *tq = NULL;
6702	unsigned int index;
6703
6704	switch (cookie & 0xf000) {
6705	case 0x1000:
6706		tq = &pio->wme[WME_AC_BK];
6707		break;
6708	case 0x2000:
6709		tq = &pio->wme[WME_AC_BE];
6710		break;
6711	case 0x3000:
6712		tq = &pio->wme[WME_AC_VI];
6713		break;
6714	case 0x4000:
6715		tq = &pio->wme[WME_AC_VO];
6716		break;
6717	case 0x5000:
6718		tq = &pio->mcast;
6719		break;
6720	}
6721	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6722	if (tq == NULL)
6723		return (NULL);
6724	index = (cookie & 0x0fff);
6725	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6726	if (index >= N(tq->tq_pkts))
6727		return (NULL);
6728	*pack = &tq->tq_pkts[index];
6729	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6730	return (tq);
6731}
6732
6733static void
6734bwn_txpwr(void *arg, int npending)
6735{
6736	struct bwn_mac *mac = arg;
6737	struct bwn_softc *sc = mac->mac_sc;
6738
6739	BWN_LOCK(sc);
6740	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6741	    mac->mac_phy.set_txpwr != NULL)
6742		mac->mac_phy.set_txpwr(mac);
6743	BWN_UNLOCK(sc);
6744}
6745
6746static void
6747bwn_task_15s(struct bwn_mac *mac)
6748{
6749	uint16_t reg;
6750
6751	if (mac->mac_fw.opensource) {
6752		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6753		if (reg) {
6754			bwn_restart(mac, "fw watchdog");
6755			return;
6756		}
6757		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6758	}
6759	if (mac->mac_phy.task_15s)
6760		mac->mac_phy.task_15s(mac);
6761
6762	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6763}
6764
6765static void
6766bwn_task_30s(struct bwn_mac *mac)
6767{
6768
6769	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6770		return;
6771	mac->mac_noise.noi_running = 1;
6772	mac->mac_noise.noi_nsamples = 0;
6773
6774	bwn_noise_gensample(mac);
6775}
6776
6777static void
6778bwn_task_60s(struct bwn_mac *mac)
6779{
6780
6781	if (mac->mac_phy.task_60s)
6782		mac->mac_phy.task_60s(mac);
6783	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6784}
6785
6786static void
6787bwn_tasks(void *arg)
6788{
6789	struct bwn_mac *mac = arg;
6790	struct bwn_softc *sc = mac->mac_sc;
6791
6792	BWN_ASSERT_LOCKED(sc);
6793	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6794		return;
6795
6796	if (mac->mac_task_state % 4 == 0)
6797		bwn_task_60s(mac);
6798	if (mac->mac_task_state % 2 == 0)
6799		bwn_task_30s(mac);
6800	bwn_task_15s(mac);
6801
6802	mac->mac_task_state++;
6803	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6804}
6805
6806static int
6807bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6808{
6809	struct bwn_softc *sc = mac->mac_sc;
6810
6811	KASSERT(a == 0, ("not support APHY\n"));
6812
6813	switch (plcp->o.raw[0] & 0xf) {
6814	case 0xb:
6815		return (BWN_OFDM_RATE_6MB);
6816	case 0xf:
6817		return (BWN_OFDM_RATE_9MB);
6818	case 0xa:
6819		return (BWN_OFDM_RATE_12MB);
6820	case 0xe:
6821		return (BWN_OFDM_RATE_18MB);
6822	case 0x9:
6823		return (BWN_OFDM_RATE_24MB);
6824	case 0xd:
6825		return (BWN_OFDM_RATE_36MB);
6826	case 0x8:
6827		return (BWN_OFDM_RATE_48MB);
6828	case 0xc:
6829		return (BWN_OFDM_RATE_54MB);
6830	}
6831	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6832	    plcp->o.raw[0] & 0xf);
6833	return (-1);
6834}
6835
6836static int
6837bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6838{
6839	struct bwn_softc *sc = mac->mac_sc;
6840
6841	switch (plcp->o.raw[0]) {
6842	case 0x0a:
6843		return (BWN_CCK_RATE_1MB);
6844	case 0x14:
6845		return (BWN_CCK_RATE_2MB);
6846	case 0x37:
6847		return (BWN_CCK_RATE_5MB);
6848	case 0x6e:
6849		return (BWN_CCK_RATE_11MB);
6850	}
6851	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6852	return (-1);
6853}
6854
6855static void
6856bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6857    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6858    int rssi, int noise)
6859{
6860	struct bwn_softc *sc = mac->mac_sc;
6861	const struct ieee80211_frame_min *wh;
6862	uint64_t tsf;
6863	uint16_t low_mactime_now;
6864	uint16_t mt;
6865
6866	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6867		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6868
6869	wh = mtod(m, const struct ieee80211_frame_min *);
6870	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6871		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6872
6873	bwn_tsf_read(mac, &tsf);
6874	low_mactime_now = tsf;
6875	tsf = tsf & ~0xffffULL;
6876
6877	switch (mac->mac_fw.fw_hdr_format) {
6878	case BWN_FW_HDR_351:
6879	case BWN_FW_HDR_410:
6880		mt = le16toh(rxhdr->ps4.r351.mac_time);
6881		break;
6882	case BWN_FW_HDR_598:
6883		mt = le16toh(rxhdr->ps4.r598.mac_time);
6884		break;
6885	}
6886
6887	tsf += mt;
6888	if (low_mactime_now < mt)
6889		tsf -= 0x10000;
6890
6891	sc->sc_rx_th.wr_tsf = tsf;
6892	sc->sc_rx_th.wr_rate = rate;
6893	sc->sc_rx_th.wr_antsignal = rssi;
6894	sc->sc_rx_th.wr_antnoise = noise;
6895}
6896
6897static void
6898bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6899{
6900	uint32_t low, high;
6901
6902	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6903	    ("%s:%d: fail", __func__, __LINE__));
6904
6905	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6906	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6907	*tsf = high;
6908	*tsf <<= 32;
6909	*tsf |= low;
6910}
6911
6912static int
6913bwn_dma_attach(struct bwn_mac *mac)
6914{
6915	struct bwn_dma *dma = &mac->mac_method.dma;
6916	struct bwn_softc *sc = mac->mac_sc;
6917	bus_addr_t lowaddr = 0;
6918	int error;
6919
6920	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6921		return (0);
6922
6923	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6924
6925	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6926
6927	dma->dmatype = bwn_dma_gettype(mac);
6928	if (dma->dmatype == BWN_DMA_30BIT)
6929		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6930	else if (dma->dmatype == BWN_DMA_32BIT)
6931		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6932	else
6933		lowaddr = BUS_SPACE_MAXADDR;
6934
6935	/*
6936	 * Create top level DMA tag
6937	 */
6938	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6939			       BWN_ALIGN, 0,		/* alignment, bounds */
6940			       lowaddr,			/* lowaddr */
6941			       BUS_SPACE_MAXADDR,	/* highaddr */
6942			       NULL, NULL,		/* filter, filterarg */
6943			       BUS_SPACE_MAXSIZE,	/* maxsize */
6944			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6945			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6946			       0,			/* flags */
6947			       NULL, NULL,		/* lockfunc, lockarg */
6948			       &dma->parent_dtag);
6949	if (error) {
6950		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6951		return (error);
6952	}
6953
6954	/*
6955	 * Create TX/RX mbuf DMA tag
6956	 */
6957	error = bus_dma_tag_create(dma->parent_dtag,
6958				1,
6959				0,
6960				BUS_SPACE_MAXADDR,
6961				BUS_SPACE_MAXADDR,
6962				NULL, NULL,
6963				MCLBYTES,
6964				1,
6965				BUS_SPACE_MAXSIZE_32BIT,
6966				0,
6967				NULL, NULL,
6968				&dma->rxbuf_dtag);
6969	if (error) {
6970		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6971		goto fail0;
6972	}
6973	error = bus_dma_tag_create(dma->parent_dtag,
6974				1,
6975				0,
6976				BUS_SPACE_MAXADDR,
6977				BUS_SPACE_MAXADDR,
6978				NULL, NULL,
6979				MCLBYTES,
6980				1,
6981				BUS_SPACE_MAXSIZE_32BIT,
6982				0,
6983				NULL, NULL,
6984				&dma->txbuf_dtag);
6985	if (error) {
6986		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6987		goto fail1;
6988	}
6989
6990	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6991	if (!dma->wme[WME_AC_BK])
6992		goto fail2;
6993
6994	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6995	if (!dma->wme[WME_AC_BE])
6996		goto fail3;
6997
6998	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6999	if (!dma->wme[WME_AC_VI])
7000		goto fail4;
7001
7002	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7003	if (!dma->wme[WME_AC_VO])
7004		goto fail5;
7005
7006	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7007	if (!dma->mcast)
7008		goto fail6;
7009	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7010	if (!dma->rx)
7011		goto fail7;
7012
7013	return (error);
7014
7015fail7:	bwn_dma_ringfree(&dma->mcast);
7016fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7017fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7018fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7019fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7020fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7021fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7022fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7023	return (error);
7024}
7025
7026static struct bwn_dma_ring *
7027bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7028    uint16_t cookie, int *slot)
7029{
7030	struct bwn_dma *dma = &mac->mac_method.dma;
7031	struct bwn_dma_ring *dr;
7032	struct bwn_softc *sc = mac->mac_sc;
7033
7034	BWN_ASSERT_LOCKED(mac->mac_sc);
7035
7036	switch (cookie & 0xf000) {
7037	case 0x1000:
7038		dr = dma->wme[WME_AC_BK];
7039		break;
7040	case 0x2000:
7041		dr = dma->wme[WME_AC_BE];
7042		break;
7043	case 0x3000:
7044		dr = dma->wme[WME_AC_VI];
7045		break;
7046	case 0x4000:
7047		dr = dma->wme[WME_AC_VO];
7048		break;
7049	case 0x5000:
7050		dr = dma->mcast;
7051		break;
7052	default:
7053		dr = NULL;
7054		KASSERT(0 == 1,
7055		    ("invalid cookie value %d", cookie & 0xf000));
7056	}
7057	*slot = (cookie & 0x0fff);
7058	if (*slot < 0 || *slot >= dr->dr_numslots) {
7059		/*
7060		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7061		 * that it occurs events which have same H/W sequence numbers.
7062		 * When it's occurred just prints a WARNING msgs and ignores.
7063		 */
7064		KASSERT(status->seq == dma->lastseq,
7065		    ("%s:%d: fail", __func__, __LINE__));
7066		device_printf(sc->sc_dev,
7067		    "out of slot ranges (0 < %d < %d)\n", *slot,
7068		    dr->dr_numslots);
7069		return (NULL);
7070	}
7071	dma->lastseq = status->seq;
7072	return (dr);
7073}
7074
7075static void
7076bwn_dma_stop(struct bwn_mac *mac)
7077{
7078	struct bwn_dma *dma;
7079
7080	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7081		return;
7082	dma = &mac->mac_method.dma;
7083
7084	bwn_dma_ringstop(&dma->rx);
7085	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7086	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7087	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7088	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7089	bwn_dma_ringstop(&dma->mcast);
7090}
7091
7092static void
7093bwn_dma_ringstop(struct bwn_dma_ring **dr)
7094{
7095
7096	if (dr == NULL)
7097		return;
7098
7099	bwn_dma_cleanup(*dr);
7100}
7101
7102static void
7103bwn_pio_stop(struct bwn_mac *mac)
7104{
7105	struct bwn_pio *pio;
7106
7107	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7108		return;
7109	pio = &mac->mac_method.pio;
7110
7111	bwn_destroy_queue_tx(&pio->mcast);
7112	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7113	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7114	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7115	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7116}
7117
7118static void
7119bwn_led_attach(struct bwn_mac *mac)
7120{
7121	struct bwn_softc *sc = mac->mac_sc;
7122	const uint8_t *led_act = NULL;
7123	uint16_t val[BWN_LED_MAX];
7124	int i;
7125
7126	sc->sc_led_idle = (2350 * hz) / 1000;
7127	sc->sc_led_blink = 1;
7128
7129	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7130		if (siba_get_pci_subvendor(sc->sc_dev) ==
7131		    bwn_vendor_led_act[i].vid) {
7132			led_act = bwn_vendor_led_act[i].led_act;
7133			break;
7134		}
7135	}
7136	if (led_act == NULL)
7137		led_act = bwn_default_led_act;
7138
7139	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7140	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7141	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7142	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7143
7144	for (i = 0; i < BWN_LED_MAX; ++i) {
7145		struct bwn_led *led = &sc->sc_leds[i];
7146
7147		if (val[i] == 0xff) {
7148			led->led_act = led_act[i];
7149		} else {
7150			if (val[i] & BWN_LED_ACT_LOW)
7151				led->led_flags |= BWN_LED_F_ACTLOW;
7152			led->led_act = val[i] & BWN_LED_ACT_MASK;
7153		}
7154		led->led_mask = (1 << i);
7155
7156		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7157		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7158		    led->led_act == BWN_LED_ACT_BLINK) {
7159			led->led_flags |= BWN_LED_F_BLINK;
7160			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7161				led->led_flags |= BWN_LED_F_POLLABLE;
7162			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7163				led->led_flags |= BWN_LED_F_SLOW;
7164
7165			if (sc->sc_blink_led == NULL) {
7166				sc->sc_blink_led = led;
7167				if (led->led_flags & BWN_LED_F_SLOW)
7168					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7169			}
7170		}
7171
7172		DPRINTF(sc, BWN_DEBUG_LED,
7173		    "%dth led, act %d, lowact %d\n", i,
7174		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7175	}
7176	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7177}
7178
7179static __inline uint16_t
7180bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7181{
7182
7183	if (led->led_flags & BWN_LED_F_ACTLOW)
7184		on = !on;
7185	if (on)
7186		val |= led->led_mask;
7187	else
7188		val &= ~led->led_mask;
7189	return val;
7190}
7191
7192static void
7193bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7194{
7195	struct bwn_softc *sc = mac->mac_sc;
7196	struct ieee80211com *ic = &sc->sc_ic;
7197	uint16_t val;
7198	int i;
7199
7200	if (nstate == IEEE80211_S_INIT) {
7201		callout_stop(&sc->sc_led_blink_ch);
7202		sc->sc_led_blinking = 0;
7203	}
7204
7205	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7206		return;
7207
7208	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7209	for (i = 0; i < BWN_LED_MAX; ++i) {
7210		struct bwn_led *led = &sc->sc_leds[i];
7211		int on;
7212
7213		if (led->led_act == BWN_LED_ACT_UNKN ||
7214		    led->led_act == BWN_LED_ACT_NULL)
7215			continue;
7216
7217		if ((led->led_flags & BWN_LED_F_BLINK) &&
7218		    nstate != IEEE80211_S_INIT)
7219			continue;
7220
7221		switch (led->led_act) {
7222		case BWN_LED_ACT_ON:    /* Always on */
7223			on = 1;
7224			break;
7225		case BWN_LED_ACT_OFF:   /* Always off */
7226		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7227			on = 0;
7228			break;
7229		default:
7230			on = 1;
7231			switch (nstate) {
7232			case IEEE80211_S_INIT:
7233				on = 0;
7234				break;
7235			case IEEE80211_S_RUN:
7236				if (led->led_act == BWN_LED_ACT_11G &&
7237				    ic->ic_curmode != IEEE80211_MODE_11G)
7238					on = 0;
7239				break;
7240			default:
7241				if (led->led_act == BWN_LED_ACT_ASSOC)
7242					on = 0;
7243				break;
7244			}
7245			break;
7246		}
7247
7248		val = bwn_led_onoff(led, val, on);
7249	}
7250	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7251}
7252
7253static void
7254bwn_led_event(struct bwn_mac *mac, int event)
7255{
7256	struct bwn_softc *sc = mac->mac_sc;
7257	struct bwn_led *led = sc->sc_blink_led;
7258	int rate;
7259
7260	if (event == BWN_LED_EVENT_POLL) {
7261		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7262			return;
7263		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7264			return;
7265	}
7266
7267	sc->sc_led_ticks = ticks;
7268	if (sc->sc_led_blinking)
7269		return;
7270
7271	switch (event) {
7272	case BWN_LED_EVENT_RX:
7273		rate = sc->sc_rx_rate;
7274		break;
7275	case BWN_LED_EVENT_TX:
7276		rate = sc->sc_tx_rate;
7277		break;
7278	case BWN_LED_EVENT_POLL:
7279		rate = 0;
7280		break;
7281	default:
7282		panic("unknown LED event %d\n", event);
7283		break;
7284	}
7285	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7286	    bwn_led_duration[rate].off_dur);
7287}
7288
7289static void
7290bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7291{
7292	struct bwn_softc *sc = mac->mac_sc;
7293	struct bwn_led *led = sc->sc_blink_led;
7294	uint16_t val;
7295
7296	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7297	val = bwn_led_onoff(led, val, 1);
7298	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7299
7300	if (led->led_flags & BWN_LED_F_SLOW) {
7301		BWN_LED_SLOWDOWN(on_dur);
7302		BWN_LED_SLOWDOWN(off_dur);
7303	}
7304
7305	sc->sc_led_blinking = 1;
7306	sc->sc_led_blink_offdur = off_dur;
7307
7308	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7309}
7310
7311static void
7312bwn_led_blink_next(void *arg)
7313{
7314	struct bwn_mac *mac = arg;
7315	struct bwn_softc *sc = mac->mac_sc;
7316	uint16_t val;
7317
7318	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7319	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7320	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7321
7322	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7323	    bwn_led_blink_end, mac);
7324}
7325
7326static void
7327bwn_led_blink_end(void *arg)
7328{
7329	struct bwn_mac *mac = arg;
7330	struct bwn_softc *sc = mac->mac_sc;
7331
7332	sc->sc_led_blinking = 0;
7333}
7334
7335static int
7336bwn_suspend(device_t dev)
7337{
7338	struct bwn_softc *sc = device_get_softc(dev);
7339
7340	BWN_LOCK(sc);
7341	bwn_stop(sc);
7342	BWN_UNLOCK(sc);
7343	return (0);
7344}
7345
7346static int
7347bwn_resume(device_t dev)
7348{
7349	struct bwn_softc *sc = device_get_softc(dev);
7350	int error = EDOOFUS;
7351
7352	BWN_LOCK(sc);
7353	if (sc->sc_ic.ic_nrunning > 0)
7354		error = bwn_init(sc);
7355	BWN_UNLOCK(sc);
7356	if (error == 0)
7357		ieee80211_start_all(&sc->sc_ic);
7358	return (0);
7359}
7360
7361static void
7362bwn_rfswitch(void *arg)
7363{
7364	struct bwn_softc *sc = arg;
7365	struct bwn_mac *mac = sc->sc_curmac;
7366	int cur = 0, prev = 0;
7367
7368	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7369	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7370
7371	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7372	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7373		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7374			& BWN_RF_HWENABLED_HI_MASK))
7375			cur = 1;
7376	} else {
7377		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7378		    & BWN_RF_HWENABLED_LO_MASK)
7379			cur = 1;
7380	}
7381
7382	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7383		prev = 1;
7384
7385	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7386	    __func__, cur, prev);
7387
7388	if (cur != prev) {
7389		if (cur)
7390			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7391		else
7392			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7393
7394		device_printf(sc->sc_dev,
7395		    "status of RF switch is changed to %s\n",
7396		    cur ? "ON" : "OFF");
7397		if (cur != mac->mac_phy.rf_on) {
7398			if (cur)
7399				bwn_rf_turnon(mac);
7400			else
7401				bwn_rf_turnoff(mac);
7402		}
7403	}
7404
7405	callout_schedule(&sc->sc_rfswitch_ch, hz);
7406}
7407
7408static void
7409bwn_sysctl_node(struct bwn_softc *sc)
7410{
7411	device_t dev = sc->sc_dev;
7412	struct bwn_mac *mac;
7413	struct bwn_stats *stats;
7414
7415	/* XXX assume that count of MAC is only 1. */
7416
7417	if ((mac = sc->sc_curmac) == NULL)
7418		return;
7419	stats = &mac->mac_stats;
7420
7421	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7422	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7423	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7424	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7425	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7426	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7427	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7428	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7429	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7430
7431#ifdef BWN_DEBUG
7432	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7433	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7434	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7435#endif
7436}
7437
7438static device_method_t bwn_methods[] = {
7439	/* Device interface */
7440	DEVMETHOD(device_probe,		bwn_probe),
7441	DEVMETHOD(device_attach,	bwn_attach),
7442	DEVMETHOD(device_detach,	bwn_detach),
7443	DEVMETHOD(device_suspend,	bwn_suspend),
7444	DEVMETHOD(device_resume,	bwn_resume),
7445	DEVMETHOD_END
7446};
7447static driver_t bwn_driver = {
7448	"bwn",
7449	bwn_methods,
7450	sizeof(struct bwn_softc)
7451};
7452static devclass_t bwn_devclass;
7453DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7454MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7455MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7456MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7457MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7458MODULE_VERSION(bwn, 1);
7459