if_bwn.c revision 300563
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 300563 2016-05-24 04:58:58Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include "opt_bwn.h"
38#include "opt_wlan.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/malloc.h>
44#include <sys/module.h>
45#include <sys/endian.h>
46#include <sys/errno.h>
47#include <sys/firmware.h>
48#include <sys/lock.h>
49#include <sys/mutex.h>
50#include <machine/bus.h>
51#include <machine/resource.h>
52#include <sys/bus.h>
53#include <sys/rman.h>
54#include <sys/socket.h>
55#include <sys/sockio.h>
56
57#include <net/ethernet.h>
58#include <net/if.h>
59#include <net/if_var.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_llc.h>
63#include <net/if_media.h>
64#include <net/if_types.h>
65
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcireg.h>
68#include <dev/siba/siba_ids.h>
69#include <dev/siba/sibareg.h>
70#include <dev/siba/sibavar.h>
71
72#include <net80211/ieee80211_var.h>
73#include <net80211/ieee80211_radiotap.h>
74#include <net80211/ieee80211_regdomain.h>
75#include <net80211/ieee80211_phy.h>
76#include <net80211/ieee80211_ratectl.h>
77
78#include <dev/bwn/if_bwnreg.h>
79#include <dev/bwn/if_bwnvar.h>
80
81#include <dev/bwn/if_bwn_debug.h>
82#include <dev/bwn/if_bwn_misc.h>
83#include <dev/bwn/if_bwn_util.h>
84#include <dev/bwn/if_bwn_phy_common.h>
85#include <dev/bwn/if_bwn_phy_g.h>
86#include <dev/bwn/if_bwn_phy_lp.h>
87#include <dev/bwn/if_bwn_phy_n.h>
88
89static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90    "Broadcom driver parameters");
91
92/*
93 * Tunable & sysctl variables.
94 */
95
96#ifdef BWN_DEBUG
97static	int bwn_debug = 0;
98SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99    "Broadcom debugging printfs");
100#endif
101
102static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104    "uses Bad Frames Preemption");
105static int	bwn_bluetooth = 1;
106SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107    "turns on Bluetooth Coexistence");
108static int	bwn_hwpctl = 0;
109SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110    "uses H/W power control");
111static int	bwn_msi_disable = 0;		/* MSI disabled  */
112TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113static int	bwn_usedma = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115    "uses DMA");
116TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117static int	bwn_wme = 1;
118SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119    "uses WME support");
120
121static void	bwn_attach_pre(struct bwn_softc *);
122static int	bwn_attach_post(struct bwn_softc *);
123static void	bwn_sprom_bugfixes(device_t);
124static int	bwn_init(struct bwn_softc *);
125static void	bwn_parent(struct ieee80211com *);
126static void	bwn_start(struct bwn_softc *);
127static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128static int	bwn_attach_core(struct bwn_mac *);
129static int	bwn_phy_getinfo(struct bwn_mac *, int);
130static int	bwn_chiptest(struct bwn_mac *);
131static int	bwn_setup_channels(struct bwn_mac *, int, int);
132static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133		    uint16_t);
134static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135		    const struct bwn_channelinfo *, const uint8_t []);
136static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137		    const struct ieee80211_bpf_params *);
138static void	bwn_updateslot(struct ieee80211com *);
139static void	bwn_update_promisc(struct ieee80211com *);
140static void	bwn_wme_init(struct bwn_mac *);
141static int	bwn_wme_update(struct ieee80211com *);
142static void	bwn_wme_clear(struct bwn_softc *);
143static void	bwn_wme_load(struct bwn_mac *);
144static void	bwn_wme_loadparams(struct bwn_mac *,
145		    const struct wmeParams *, uint16_t);
146static void	bwn_scan_start(struct ieee80211com *);
147static void	bwn_scan_end(struct ieee80211com *);
148static void	bwn_set_channel(struct ieee80211com *);
149static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151		    const uint8_t [IEEE80211_ADDR_LEN],
152		    const uint8_t [IEEE80211_ADDR_LEN]);
153static void	bwn_vap_delete(struct ieee80211vap *);
154static void	bwn_stop(struct bwn_softc *);
155static int	bwn_core_init(struct bwn_mac *);
156static void	bwn_core_start(struct bwn_mac *);
157static void	bwn_core_exit(struct bwn_mac *);
158static void	bwn_bt_disable(struct bwn_mac *);
159static int	bwn_chip_init(struct bwn_mac *);
160static void	bwn_set_txretry(struct bwn_mac *, int, int);
161static void	bwn_rate_init(struct bwn_mac *);
162static void	bwn_set_phytxctl(struct bwn_mac *);
163static void	bwn_spu_setdelay(struct bwn_mac *, int);
164static void	bwn_bt_enable(struct bwn_mac *);
165static void	bwn_set_macaddr(struct bwn_mac *);
166static void	bwn_crypt_init(struct bwn_mac *);
167static void	bwn_chip_exit(struct bwn_mac *);
168static int	bwn_fw_fillinfo(struct bwn_mac *);
169static int	bwn_fw_loaducode(struct bwn_mac *);
170static int	bwn_gpio_init(struct bwn_mac *);
171static int	bwn_fw_loadinitvals(struct bwn_mac *);
172static int	bwn_phy_init(struct bwn_mac *);
173static void	bwn_set_txantenna(struct bwn_mac *, int);
174static void	bwn_set_opmode(struct bwn_mac *);
175static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176static uint8_t	bwn_plcp_getcck(const uint8_t);
177static uint8_t	bwn_plcp_getofdm(const uint8_t);
178static void	bwn_pio_init(struct bwn_mac *);
179static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181		    int);
182static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183		    struct bwn_pio_rxqueue *, int);
184static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186		    uint16_t);
187static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190static void	bwn_pio_handle_txeof(struct bwn_mac *,
191		    const struct bwn_txstatus *);
192static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195		    uint16_t);
196static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197		    uint32_t);
198static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199		    struct mbuf *);
200static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204		    uint16_t, uint32_t);
205static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210		    uint16_t, struct bwn_pio_txpkt **);
211static void	bwn_dma_init(struct bwn_mac *);
212static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213static int	bwn_dma_mask2type(uint64_t);
214static uint64_t	bwn_dma_mask(struct bwn_mac *);
215static uint16_t	bwn_dma_base(int, int);
216static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218		    int, struct bwn_dmadesc_generic **,
219		    struct bwn_dmadesc_meta **);
220static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222		    int, int);
223static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229		    int, struct bwn_dmadesc_generic **,
230		    struct bwn_dmadesc_meta **);
231static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233		    int, int);
234static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240static void	bwn_dma_setup(struct bwn_dma_ring *);
241static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245static void	bwn_dma_rx(struct bwn_dma_ring *);
246static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248		    struct bwn_dmadesc_meta *);
249static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250static int	bwn_dma_gettype(struct bwn_mac *);
251static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257		    int);
258static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259		    bus_size_t, int);
260static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261static void	bwn_dma_handle_txeof(struct bwn_mac *,
262		    const struct bwn_txstatus *);
263static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264		    struct mbuf *);
265static int	bwn_dma_getslot(struct bwn_dma_ring *);
266static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267		    uint8_t);
268static int	bwn_dma_attach(struct bwn_mac *);
269static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270		    int, int, int);
271static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272		    const struct bwn_txstatus *, uint16_t, int *);
273static void	bwn_dma_free(struct bwn_mac *);
274static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276		    const char *, struct bwn_fwfile *);
277static void	bwn_release_firmware(struct bwn_mac *);
278static void	bwn_do_release_fw(struct bwn_fwfile *);
279static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280static int	bwn_fwinitvals_write(struct bwn_mac *,
281		    const struct bwn_fwinitvals *, size_t, size_t);
282static uint16_t	bwn_ant2phy(int);
283static void	bwn_mac_write_bssid(struct bwn_mac *);
284static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285		    const uint8_t *);
286static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *, size_t, const uint8_t *);
288static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289		    const uint8_t *);
290static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291		    const uint8_t *);
292static void	bwn_phy_exit(struct bwn_mac *);
293static void	bwn_core_stop(struct bwn_mac *);
294static int	bwn_switch_band(struct bwn_softc *,
295		    struct ieee80211_channel *);
296static void	bwn_phy_reset(struct bwn_mac *);
297static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298static void	bwn_set_pretbtt(struct bwn_mac *);
299static int	bwn_intr(void *);
300static void	bwn_intrtask(void *, int);
301static void	bwn_restart(struct bwn_mac *, const char *);
302static void	bwn_intr_ucode_debug(struct bwn_mac *);
303static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304static void	bwn_intr_atim_end(struct bwn_mac *);
305static void	bwn_intr_beacon(struct bwn_mac *);
306static void	bwn_intr_pmq(struct bwn_mac *);
307static void	bwn_intr_noise(struct bwn_mac *);
308static void	bwn_intr_txeof(struct bwn_mac *);
309static void	bwn_hwreset(void *, int);
310static void	bwn_handle_fwpanic(struct bwn_mac *);
311static void	bwn_load_beacon0(struct bwn_mac *);
312static void	bwn_load_beacon1(struct bwn_mac *);
313static uint32_t	bwn_jssi_read(struct bwn_mac *);
314static void	bwn_noise_gensample(struct bwn_mac *);
315static void	bwn_handle_txeof(struct bwn_mac *,
316		    const struct bwn_txstatus *);
317static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320		    struct mbuf *);
321static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322static int	bwn_set_txhdr(struct bwn_mac *,
323		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324		    uint16_t);
325static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326		    const uint8_t);
327static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328static uint8_t	bwn_get_fbrate(uint8_t);
329static void	bwn_txpwr(void *, int);
330static void	bwn_tasks(void *);
331static void	bwn_task_15s(struct bwn_mac *);
332static void	bwn_task_30s(struct bwn_mac *);
333static void	bwn_task_60s(struct bwn_mac *);
334static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335		    uint8_t);
336static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339		    int, int);
340static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342static void	bwn_watchdog(void *);
343static void	bwn_dma_stop(struct bwn_mac *);
344static void	bwn_pio_stop(struct bwn_mac *);
345static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346static void	bwn_led_attach(struct bwn_mac *);
347static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348static void	bwn_led_event(struct bwn_mac *, int);
349static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350static void	bwn_led_blink_next(void *);
351static void	bwn_led_blink_end(void *);
352static void	bwn_rfswitch(void *);
353static void	bwn_rf_turnon(struct bwn_mac *);
354static void	bwn_rf_turnoff(struct bwn_mac *);
355static void	bwn_sysctl_node(struct bwn_softc *);
356
357static struct resource_spec bwn_res_spec_legacy[] = {
358	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359	{ -1,			0,		0 }
360};
361
362static struct resource_spec bwn_res_spec_msi[] = {
363	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364	{ -1,			0,		0 }
365};
366
367static const struct bwn_channelinfo bwn_chantable_bg = {
368	.channels = {
369		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374	.nchannels = 14
375};
376
377static const struct bwn_channelinfo bwn_chantable_a = {
378	.channels = {
379		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391		{ 6080, 216, 30 } },
392	.nchannels = 37
393};
394
395#if 0
396static const struct bwn_channelinfo bwn_chantable_n = {
397	.channels = {
398		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435	.nchannels = 110
436};
437#endif
438
439#define	VENDOR_LED_ACT(vendor)				\
440{							\
441	.vid = PCI_VENDOR_##vendor,			\
442	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443}
444
445static const struct {
446	uint16_t	vid;
447	uint8_t		led_act[BWN_LED_MAX];
448} bwn_vendor_led_act[] = {
449	VENDOR_LED_ACT(COMPAQ),
450	VENDOR_LED_ACT(ASUSTEK)
451};
452
453static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454	{ BWN_VENDOR_LED_ACT_DEFAULT };
455
456#undef VENDOR_LED_ACT
457
458static const struct {
459	int		on_dur;
460	int		off_dur;
461} bwn_led_duration[109] = {
462	[0]	= { 400, 100 },
463	[2]	= { 150, 75 },
464	[4]	= { 90, 45 },
465	[11]	= { 66, 34 },
466	[12]	= { 53, 26 },
467	[18]	= { 42, 21 },
468	[22]	= { 35, 17 },
469	[24]	= { 32, 16 },
470	[36]	= { 21, 10 },
471	[48]	= { 16, 8 },
472	[72]	= { 11, 5 },
473	[96]	= { 9, 4 },
474	[108]	= { 7, 3 }
475};
476
477static const uint16_t bwn_wme_shm_offsets[] = {
478	[0] = BWN_WME_BESTEFFORT,
479	[1] = BWN_WME_BACKGROUND,
480	[2] = BWN_WME_VOICE,
481	[3] = BWN_WME_VIDEO,
482};
483
484static const struct siba_devid bwn_devs[] = {
485	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495};
496
497static int
498bwn_probe(device_t dev)
499{
500	int i;
501
502	for (i = 0; i < nitems(bwn_devs); i++) {
503		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506			return (BUS_PROBE_DEFAULT);
507	}
508
509	return (ENXIO);
510}
511
512static int
513bwn_attach(device_t dev)
514{
515	struct bwn_mac *mac;
516	struct bwn_softc *sc = device_get_softc(dev);
517	int error, i, msic, reg;
518
519	sc->sc_dev = dev;
520#ifdef BWN_DEBUG
521	sc->sc_debug = bwn_debug;
522#endif
523
524	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525		bwn_attach_pre(sc);
526		bwn_sprom_bugfixes(dev);
527		sc->sc_flags |= BWN_FLAG_ATTACHED;
528	}
529
530	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531		if (siba_get_pci_device(dev) != 0x4313 &&
532		    siba_get_pci_device(dev) != 0x431a &&
533		    siba_get_pci_device(dev) != 0x4321) {
534			device_printf(sc->sc_dev,
535			    "skip 802.11 cores\n");
536			return (ENODEV);
537		}
538	}
539
540	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541	mac->mac_sc = sc;
542	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543	if (bwn_bfp != 0)
544		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545
546	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549
550	error = bwn_attach_core(mac);
551	if (error)
552		goto fail0;
553	bwn_led_attach(mac);
554
555	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560	    mac->mac_phy.rf_rev);
561	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563		    mac->mac_method.dma.dmatype);
564	else
565		device_printf(sc->sc_dev, "PIO\n");
566
567#ifdef	BWN_GPL_PHY
568	device_printf(sc->sc_dev,
569	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570#endif
571
572	/*
573	 * setup PCI resources and interrupt.
574	 */
575	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576		msic = pci_msi_count(dev);
577		if (bootverbose)
578			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579	} else
580		msic = 0;
581
582	mac->mac_intr_spec = bwn_res_spec_legacy;
583	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584		if (pci_alloc_msi(dev, &msic) == 0) {
585			device_printf(sc->sc_dev,
586			    "Using %d MSI messages\n", msic);
587			mac->mac_intr_spec = bwn_res_spec_msi;
588			mac->mac_msi = 1;
589		}
590	}
591
592	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593	    mac->mac_res_irq);
594	if (error) {
595		device_printf(sc->sc_dev,
596		    "couldn't allocate IRQ resources (%d)\n", error);
597		goto fail1;
598	}
599
600	if (mac->mac_msi == 0)
601		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603		    &mac->mac_intrhand[0]);
604	else {
605		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608			    &mac->mac_intrhand[i]);
609			if (error != 0) {
610				device_printf(sc->sc_dev,
611				    "couldn't setup interrupt (%d)\n", error);
612				break;
613			}
614		}
615	}
616
617	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618
619	/*
620	 * calls attach-post routine
621	 */
622	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623		bwn_attach_post(sc);
624
625	return (0);
626fail1:
627	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628		pci_release_msi(dev);
629fail0:
630	free(mac, M_DEVBUF);
631	return (error);
632}
633
634static int
635bwn_is_valid_ether_addr(uint8_t *addr)
636{
637	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638
639	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640		return (FALSE);
641
642	return (TRUE);
643}
644
645static int
646bwn_attach_post(struct bwn_softc *sc)
647{
648	struct ieee80211com *ic = &sc->sc_ic;
649
650	ic->ic_softc = sc;
651	ic->ic_name = device_get_nameunit(sc->sc_dev);
652	/* XXX not right but it's not used anywhere important */
653	ic->ic_phytype = IEEE80211_T_OFDM;
654	ic->ic_opmode = IEEE80211_M_STA;
655	ic->ic_caps =
656		  IEEE80211_C_STA		/* station mode supported */
657		| IEEE80211_C_MONITOR		/* monitor mode */
658		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660		| IEEE80211_C_SHSLOT		/* short slot time supported */
661		| IEEE80211_C_WME		/* WME/WMM supported */
662		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663#if 0
664		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665#endif
666		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667		;
668
669	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670
671	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675
676	/* call MI attach routine. */
677	ieee80211_ifattach(ic);
678
679	ic->ic_headroom = sizeof(struct bwn_txhdr);
680
681	/* override default methods */
682	ic->ic_raw_xmit = bwn_raw_xmit;
683	ic->ic_updateslot = bwn_updateslot;
684	ic->ic_update_promisc = bwn_update_promisc;
685	ic->ic_wme.wme_update = bwn_wme_update;
686	ic->ic_scan_start = bwn_scan_start;
687	ic->ic_scan_end = bwn_scan_end;
688	ic->ic_set_channel = bwn_set_channel;
689	ic->ic_vap_create = bwn_vap_create;
690	ic->ic_vap_delete = bwn_vap_delete;
691	ic->ic_transmit = bwn_transmit;
692	ic->ic_parent = bwn_parent;
693
694	ieee80211_radiotap_attach(ic,
695	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696	    BWN_TX_RADIOTAP_PRESENT,
697	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698	    BWN_RX_RADIOTAP_PRESENT);
699
700	bwn_sysctl_node(sc);
701
702	if (bootverbose)
703		ieee80211_announce(ic);
704	return (0);
705}
706
707static void
708bwn_phy_detach(struct bwn_mac *mac)
709{
710
711	if (mac->mac_phy.detach != NULL)
712		mac->mac_phy.detach(mac);
713}
714
715static int
716bwn_detach(device_t dev)
717{
718	struct bwn_softc *sc = device_get_softc(dev);
719	struct bwn_mac *mac = sc->sc_curmac;
720	struct ieee80211com *ic = &sc->sc_ic;
721	int i;
722
723	sc->sc_flags |= BWN_FLAG_INVALID;
724
725	if (device_is_attached(sc->sc_dev)) {
726		BWN_LOCK(sc);
727		bwn_stop(sc);
728		BWN_UNLOCK(sc);
729		bwn_dma_free(mac);
730		callout_drain(&sc->sc_led_blink_ch);
731		callout_drain(&sc->sc_rfswitch_ch);
732		callout_drain(&sc->sc_task_ch);
733		callout_drain(&sc->sc_watchdog_ch);
734		bwn_phy_detach(mac);
735		ieee80211_draintask(ic, &mac->mac_hwreset);
736		ieee80211_draintask(ic, &mac->mac_txpower);
737		ieee80211_ifdetach(ic);
738	}
739	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740	taskqueue_free(sc->sc_tq);
741
742	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743		if (mac->mac_intrhand[i] != NULL) {
744			bus_teardown_intr(dev, mac->mac_res_irq[i],
745			    mac->mac_intrhand[i]);
746			mac->mac_intrhand[i] = NULL;
747		}
748	}
749	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750	if (mac->mac_msi != 0)
751		pci_release_msi(dev);
752	mbufq_drain(&sc->sc_snd);
753	BWN_LOCK_DESTROY(sc);
754	return (0);
755}
756
757static void
758bwn_attach_pre(struct bwn_softc *sc)
759{
760
761	BWN_LOCK_INIT(sc);
762	TAILQ_INIT(&sc->sc_maclist);
763	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
764	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
765	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
766	mbufq_init(&sc->sc_snd, ifqmaxlen);
767	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
768		taskqueue_thread_enqueue, &sc->sc_tq);
769	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
770		"%s taskq", device_get_nameunit(sc->sc_dev));
771}
772
773static void
774bwn_sprom_bugfixes(device_t dev)
775{
776#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
777	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
778	 (siba_get_pci_device(dev) == _device) &&			\
779	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
780	 (siba_get_pci_subdevice(dev) == _subdevice))
781
782	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
783	    siba_get_pci_subdevice(dev) == 0x4e &&
784	    siba_get_pci_revid(dev) > 0x40)
785		siba_sprom_set_bf_lo(dev,
786		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
787	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
788	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
789		siba_sprom_set_bf_lo(dev,
790		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
791	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
792		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
793		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
794		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
795		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
796		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
797		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
798		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
799			siba_sprom_set_bf_lo(dev,
800			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
801	}
802#undef	BWN_ISDEV
803}
804
805static void
806bwn_parent(struct ieee80211com *ic)
807{
808	struct bwn_softc *sc = ic->ic_softc;
809	int startall = 0;
810
811	BWN_LOCK(sc);
812	if (ic->ic_nrunning > 0) {
813		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
814			bwn_init(sc);
815			startall = 1;
816		} else
817			bwn_update_promisc(ic);
818	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
819		bwn_stop(sc);
820	BWN_UNLOCK(sc);
821
822	if (startall)
823		ieee80211_start_all(ic);
824}
825
826static int
827bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
828{
829	struct bwn_softc *sc = ic->ic_softc;
830	int error;
831
832	BWN_LOCK(sc);
833	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
834		BWN_UNLOCK(sc);
835		return (ENXIO);
836	}
837	error = mbufq_enqueue(&sc->sc_snd, m);
838	if (error) {
839		BWN_UNLOCK(sc);
840		return (error);
841	}
842	bwn_start(sc);
843	BWN_UNLOCK(sc);
844	return (0);
845}
846
847static void
848bwn_start(struct bwn_softc *sc)
849{
850	struct bwn_mac *mac = sc->sc_curmac;
851	struct ieee80211_frame *wh;
852	struct ieee80211_node *ni;
853	struct ieee80211_key *k;
854	struct mbuf *m;
855
856	BWN_ASSERT_LOCKED(sc);
857
858	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
859	    mac->mac_status < BWN_MAC_STATUS_STARTED)
860		return;
861
862	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
863		if (bwn_tx_isfull(sc, m))
864			break;
865		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
866		if (ni == NULL) {
867			device_printf(sc->sc_dev, "unexpected NULL ni\n");
868			m_freem(m);
869			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
870			continue;
871		}
872		wh = mtod(m, struct ieee80211_frame *);
873		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
874			k = ieee80211_crypto_encap(ni, m);
875			if (k == NULL) {
876				if_inc_counter(ni->ni_vap->iv_ifp,
877				    IFCOUNTER_OERRORS, 1);
878				ieee80211_free_node(ni);
879				m_freem(m);
880				continue;
881			}
882		}
883		wh = NULL;	/* Catch any invalid use */
884		if (bwn_tx_start(sc, ni, m) != 0) {
885			if (ni != NULL) {
886				if_inc_counter(ni->ni_vap->iv_ifp,
887				    IFCOUNTER_OERRORS, 1);
888				ieee80211_free_node(ni);
889			}
890			continue;
891		}
892		sc->sc_watchdog_timer = 5;
893	}
894}
895
896static int
897bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
898{
899	struct bwn_dma_ring *dr;
900	struct bwn_mac *mac = sc->sc_curmac;
901	struct bwn_pio_txqueue *tq;
902	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
903
904	BWN_ASSERT_LOCKED(sc);
905
906	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
907		dr = bwn_dma_select(mac, M_WME_GETAC(m));
908		if (dr->dr_stop == 1 ||
909		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
910			dr->dr_stop = 1;
911			goto full;
912		}
913	} else {
914		tq = bwn_pio_select(mac, M_WME_GETAC(m));
915		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
916		    pktlen > (tq->tq_size - tq->tq_used))
917			goto full;
918	}
919	return (0);
920full:
921	mbufq_prepend(&sc->sc_snd, m);
922	return (1);
923}
924
925static int
926bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
927{
928	struct bwn_mac *mac = sc->sc_curmac;
929	int error;
930
931	BWN_ASSERT_LOCKED(sc);
932
933	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
934		m_freem(m);
935		return (ENXIO);
936	}
937
938	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
939	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
940	if (error) {
941		m_freem(m);
942		return (error);
943	}
944	return (0);
945}
946
947static int
948bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
949{
950	struct bwn_pio_txpkt *tp;
951	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
952	struct bwn_softc *sc = mac->mac_sc;
953	struct bwn_txhdr txhdr;
954	struct mbuf *m_new;
955	uint32_t ctl32;
956	int error;
957	uint16_t ctl16;
958
959	BWN_ASSERT_LOCKED(sc);
960
961	/* XXX TODO send packets after DTIM */
962
963	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
964	tp = TAILQ_FIRST(&tq->tq_pktlist);
965	tp->tp_ni = ni;
966	tp->tp_m = m;
967
968	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
969	if (error) {
970		device_printf(sc->sc_dev, "tx fail\n");
971		return (error);
972	}
973
974	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
975	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
976	tq->tq_free--;
977
978	if (siba_get_revid(sc->sc_dev) >= 8) {
979		/*
980		 * XXX please removes m_defrag(9)
981		 */
982		m_new = m_defrag(m, M_NOWAIT);
983		if (m_new == NULL) {
984			device_printf(sc->sc_dev,
985			    "%s: can't defrag TX buffer\n",
986			    __func__);
987			return (ENOBUFS);
988		}
989		if (m_new->m_next != NULL)
990			device_printf(sc->sc_dev,
991			    "TODO: fragmented packets for PIO\n");
992		tp->tp_m = m_new;
993
994		/* send HEADER */
995		ctl32 = bwn_pio_write_multi_4(mac, tq,
996		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
997			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
998		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
999		/* send BODY */
1000		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1002		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003		    ctl32 | BWN_PIO8_TXCTL_EOF);
1004	} else {
1005		ctl16 = bwn_pio_write_multi_2(mac, tq,
1006		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011		    ctl16 | BWN_PIO_TXCTL_EOF);
1012	}
1013
1014	return (0);
1015}
1016
1017static struct bwn_pio_txqueue *
1018bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019{
1020
1021	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024	switch (prio) {
1025	case 0:
1026		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027	case 1:
1028		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029	case 2:
1030		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031	case 3:
1032		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033	}
1034	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035	return (NULL);
1036}
1037
1038static int
1039bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040{
1041#define	BWN_GET_TXHDRCACHE(slot)					\
1042	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043	struct bwn_dma *dma = &mac->mac_method.dma;
1044	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045	struct bwn_dmadesc_generic *desc;
1046	struct bwn_dmadesc_meta *mt;
1047	struct bwn_softc *sc = mac->mac_sc;
1048	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051	BWN_ASSERT_LOCKED(sc);
1052	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054	/* XXX send after DTIM */
1055
1056	slot = bwn_dma_getslot(dr);
1057	dr->getdesc(dr, slot, &desc, &mt);
1058	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059	    ("%s:%d: fail", __func__, __LINE__));
1060
1061	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063	    BWN_DMA_COOKIE(dr, slot));
1064	if (error)
1065		goto fail;
1066	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1069	if (error) {
1070		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071		    __func__, error);
1072		goto fail;
1073	}
1074	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075	    BUS_DMASYNC_PREWRITE);
1076	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078	    BUS_DMASYNC_PREWRITE);
1079
1080	slot = bwn_dma_getslot(dr);
1081	dr->getdesc(dr, slot, &desc, &mt);
1082	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084	mt->mt_m = m;
1085	mt->mt_ni = ni;
1086
1087	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089	if (error && error != EFBIG) {
1090		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091		    __func__, error);
1092		goto fail;
1093	}
1094	if (error) {    /* error == EFBIG */
1095		struct mbuf *m_new;
1096
1097		m_new = m_defrag(m, M_NOWAIT);
1098		if (m_new == NULL) {
1099			device_printf(sc->sc_dev,
1100			    "%s: can't defrag TX buffer\n",
1101			    __func__);
1102			error = ENOBUFS;
1103			goto fail;
1104		} else {
1105			m = m_new;
1106		}
1107
1108		mt->mt_m = m;
1109		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111		if (error) {
1112			device_printf(sc->sc_dev,
1113			    "%s: can't load TX buffer (2) %d\n",
1114			    __func__, error);
1115			goto fail;
1116		}
1117	}
1118	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121	    BUS_DMASYNC_PREWRITE);
1122
1123	/* XXX send after DTIM */
1124
1125	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126	return (0);
1127fail:
1128	dr->dr_curslot = backup[0];
1129	dr->dr_usedslot = backup[1];
1130	return (error);
1131#undef BWN_GET_TXHDRCACHE
1132}
1133
1134static void
1135bwn_watchdog(void *arg)
1136{
1137	struct bwn_softc *sc = arg;
1138
1139	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140		device_printf(sc->sc_dev, "device timeout\n");
1141		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142	}
1143	callout_schedule(&sc->sc_watchdog_ch, hz);
1144}
1145
1146static int
1147bwn_attach_core(struct bwn_mac *mac)
1148{
1149	struct bwn_softc *sc = mac->mac_sc;
1150	int error, have_bg = 0, have_a = 0;
1151
1152	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1153	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1154
1155	if (bwn_is_bus_siba(mac)) {
1156		uint32_t high;
1157
1158		siba_powerup(sc->sc_dev, 0);
1159		high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1160		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1161		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1162		if (high & BWN_TGSHIGH_DUALPHY) {
1163			have_bg = 1;
1164			have_a = 1;
1165		}
1166	} else {
1167		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1168		error = ENXIO;
1169		goto fail;
1170	}
1171
1172	/*
1173	 * Guess at whether it has A-PHY or G-PHY.
1174	 * This is just used for resetting the core to probe things;
1175	 * we will re-guess once it's all up and working.
1176	 */
1177	bwn_reset_core(mac, have_bg);
1178
1179	/*
1180	 * Get the PHY version.
1181	 */
1182	error = bwn_phy_getinfo(mac, have_bg);
1183	if (error)
1184		goto fail;
1185
1186#if 0
1187	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1188	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1189	    __func__,
1190	    high,
1191	    have_a,
1192	    have_bg,
1193	    siba_get_pci_device(sc->sc_dev),
1194	    siba_get_chipid(sc->sc_dev));
1195#endif
1196
1197	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1198	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1199	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1200	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1201	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1202		have_a = have_bg = 0;
1203		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1204			have_a = 1;
1205		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1206		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1207		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1208			have_bg = 1;
1209		else
1210			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1211			    mac->mac_phy.type));
1212	}
1213
1214	/*
1215	 * XXX The PHY-G support doesn't do 5GHz operation.
1216	 */
1217	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1218	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1219		device_printf(sc->sc_dev,
1220		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1221		    __func__);
1222		have_a = 0;
1223		have_bg = 1;
1224	}
1225
1226	mac->mac_phy.phy_n = NULL;
1227
1228	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1229		mac->mac_phy.attach = bwn_phy_g_attach;
1230		mac->mac_phy.detach = bwn_phy_g_detach;
1231		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1232		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1233		mac->mac_phy.init = bwn_phy_g_init;
1234		mac->mac_phy.exit = bwn_phy_g_exit;
1235		mac->mac_phy.phy_read = bwn_phy_g_read;
1236		mac->mac_phy.phy_write = bwn_phy_g_write;
1237		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1238		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1239		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1240		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1241		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1242		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1243		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1244		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1245		mac->mac_phy.set_im = bwn_phy_g_im;
1246		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1247		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1248		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1249		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1250	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1251		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1252		mac->mac_phy.init = bwn_phy_lp_init;
1253		mac->mac_phy.phy_read = bwn_phy_lp_read;
1254		mac->mac_phy.phy_write = bwn_phy_lp_write;
1255		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1256		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1257		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1258		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1259		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1260		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1261		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1262		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1263		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1264	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1265		mac->mac_phy.attach = bwn_phy_n_attach;
1266		mac->mac_phy.detach = bwn_phy_n_detach;
1267		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1268		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1269		mac->mac_phy.init = bwn_phy_n_init;
1270		mac->mac_phy.exit = bwn_phy_n_exit;
1271		mac->mac_phy.phy_read = bwn_phy_n_read;
1272		mac->mac_phy.phy_write = bwn_phy_n_write;
1273		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1274		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1275		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1276		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1277		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1278		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1279		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1280		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1281		mac->mac_phy.set_im = bwn_phy_n_im;
1282		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1283		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1284		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1285		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1286	} else {
1287		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1288		    mac->mac_phy.type);
1289		error = ENXIO;
1290		goto fail;
1291	}
1292
1293	mac->mac_phy.gmode = have_bg;
1294	if (mac->mac_phy.attach != NULL) {
1295		error = mac->mac_phy.attach(mac);
1296		if (error) {
1297			device_printf(sc->sc_dev, "failed\n");
1298			goto fail;
1299		}
1300	}
1301
1302	bwn_reset_core(mac, have_bg);
1303
1304	error = bwn_chiptest(mac);
1305	if (error)
1306		goto fail;
1307	error = bwn_setup_channels(mac, have_bg, have_a);
1308	if (error) {
1309		device_printf(sc->sc_dev, "failed to setup channels\n");
1310		goto fail;
1311	}
1312
1313	if (sc->sc_curmac == NULL)
1314		sc->sc_curmac = mac;
1315
1316	error = bwn_dma_attach(mac);
1317	if (error != 0) {
1318		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1319		goto fail;
1320	}
1321
1322	mac->mac_phy.switch_analog(mac, 0);
1323
1324	siba_dev_down(sc->sc_dev, 0);
1325fail:
1326	siba_powerdown(sc->sc_dev);
1327	return (error);
1328}
1329
1330/*
1331 * Reset - SIBA.
1332 *
1333 * XXX TODO: implement BCMA version!
1334 */
1335void
1336bwn_reset_core(struct bwn_mac *mac, int g_mode)
1337{
1338	struct bwn_softc *sc = mac->mac_sc;
1339	uint32_t low, ctl;
1340	uint32_t flags = 0;
1341
1342	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1343
1344	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1345	if (g_mode)
1346		flags |= BWN_TGSLOW_SUPPORT_G;
1347
1348	/* XXX N-PHY only; and hard-code to 20MHz for now */
1349	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1350		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1351
1352	siba_dev_up(sc->sc_dev, flags);
1353	DELAY(2000);
1354
1355	/* Take PHY out of reset */
1356	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1357	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1358	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1359	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1360	DELAY(2000);
1361	low &= ~SIBA_TGSLOW_FGC;
1362	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1363	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1364	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1365	DELAY(2000);
1366
1367	if (mac->mac_phy.switch_analog != NULL)
1368		mac->mac_phy.switch_analog(mac, 1);
1369
1370	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1371	if (g_mode)
1372		ctl |= BWN_MACCTL_GMODE;
1373	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1374}
1375
1376static int
1377bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1378{
1379	struct bwn_phy *phy = &mac->mac_phy;
1380	struct bwn_softc *sc = mac->mac_sc;
1381	uint32_t tmp;
1382
1383	/* PHY */
1384	tmp = BWN_READ_2(mac, BWN_PHYVER);
1385	phy->gmode = gmode;
1386	phy->rf_on = 1;
1387	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1388	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1389	phy->rev = (tmp & BWN_PHYVER_VERSION);
1390	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1391	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1392		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1393	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1394	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1395	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1396		goto unsupphy;
1397
1398	/* RADIO */
1399	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1400		if (siba_get_chiprev(sc->sc_dev) == 0)
1401			tmp = 0x3205017f;
1402		else if (siba_get_chiprev(sc->sc_dev) == 1)
1403			tmp = 0x4205017f;
1404		else
1405			tmp = 0x5205017f;
1406	} else {
1407		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1408		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1409		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1410		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1411	}
1412	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1413	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1414	phy->rf_manuf = (tmp & 0x00000fff);
1415
1416	/*
1417	 * For now, just always do full init (ie, what bwn has traditionally
1418	 * done)
1419	 */
1420	phy->phy_do_full_init = 1;
1421
1422	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1423		goto unsupradio;
1424	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1425	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1426	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1427	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1428	    (phy->type == BWN_PHYTYPE_N &&
1429	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1430	    (phy->type == BWN_PHYTYPE_LP &&
1431	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1432		goto unsupradio;
1433
1434	return (0);
1435unsupphy:
1436	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1437	    "analog %#x)\n",
1438	    phy->type, phy->rev, phy->analog);
1439	return (ENXIO);
1440unsupradio:
1441	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1442	    "rev %#x)\n",
1443	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1444	return (ENXIO);
1445}
1446
1447static int
1448bwn_chiptest(struct bwn_mac *mac)
1449{
1450#define	TESTVAL0	0x55aaaa55
1451#define	TESTVAL1	0xaa5555aa
1452	struct bwn_softc *sc = mac->mac_sc;
1453	uint32_t v, backup;
1454
1455	BWN_LOCK(sc);
1456
1457	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1458
1459	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1460	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1461		goto error;
1462	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1463	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1464		goto error;
1465
1466	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1467
1468	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1469	    (siba_get_revid(sc->sc_dev) <= 10)) {
1470		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1471		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1472		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1473			goto error;
1474		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1475			goto error;
1476	}
1477	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1478
1479	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1480	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1481		goto error;
1482
1483	BWN_UNLOCK(sc);
1484	return (0);
1485error:
1486	BWN_UNLOCK(sc);
1487	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1488	return (ENODEV);
1489}
1490
1491static int
1492bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1493{
1494	struct bwn_softc *sc = mac->mac_sc;
1495	struct ieee80211com *ic = &sc->sc_ic;
1496	uint8_t bands[IEEE80211_MODE_BYTES];
1497
1498	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1499	ic->ic_nchans = 0;
1500
1501	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1502	    __func__,
1503	    have_bg,
1504	    have_a);
1505
1506	if (have_bg) {
1507		memset(bands, 0, sizeof(bands));
1508		setbit(bands, IEEE80211_MODE_11B);
1509		setbit(bands, IEEE80211_MODE_11G);
1510		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1511		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1512	}
1513
1514	if (have_a) {
1515		memset(bands, 0, sizeof(bands));
1516		setbit(bands, IEEE80211_MODE_11A);
1517		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1518		    &ic->ic_nchans, &bwn_chantable_a, bands);
1519	}
1520
1521	mac->mac_phy.supports_2ghz = have_bg;
1522	mac->mac_phy.supports_5ghz = have_a;
1523
1524	return (ic->ic_nchans == 0 ? ENXIO : 0);
1525}
1526
1527uint32_t
1528bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1529{
1530	uint32_t ret;
1531
1532	BWN_ASSERT_LOCKED(mac->mac_sc);
1533
1534	if (way == BWN_SHARED) {
1535		KASSERT((offset & 0x0001) == 0,
1536		    ("%s:%d warn", __func__, __LINE__));
1537		if (offset & 0x0003) {
1538			bwn_shm_ctlword(mac, way, offset >> 2);
1539			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1540			ret <<= 16;
1541			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1542			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1543			goto out;
1544		}
1545		offset >>= 2;
1546	}
1547	bwn_shm_ctlword(mac, way, offset);
1548	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1549out:
1550	return (ret);
1551}
1552
1553uint16_t
1554bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1555{
1556	uint16_t ret;
1557
1558	BWN_ASSERT_LOCKED(mac->mac_sc);
1559
1560	if (way == BWN_SHARED) {
1561		KASSERT((offset & 0x0001) == 0,
1562		    ("%s:%d warn", __func__, __LINE__));
1563		if (offset & 0x0003) {
1564			bwn_shm_ctlword(mac, way, offset >> 2);
1565			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1566			goto out;
1567		}
1568		offset >>= 2;
1569	}
1570	bwn_shm_ctlword(mac, way, offset);
1571	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1572out:
1573
1574	return (ret);
1575}
1576
1577static void
1578bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1579    uint16_t offset)
1580{
1581	uint32_t control;
1582
1583	control = way;
1584	control <<= 16;
1585	control |= offset;
1586	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1587}
1588
1589void
1590bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1591    uint32_t value)
1592{
1593	BWN_ASSERT_LOCKED(mac->mac_sc);
1594
1595	if (way == BWN_SHARED) {
1596		KASSERT((offset & 0x0001) == 0,
1597		    ("%s:%d warn", __func__, __LINE__));
1598		if (offset & 0x0003) {
1599			bwn_shm_ctlword(mac, way, offset >> 2);
1600			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1601				    (value >> 16) & 0xffff);
1602			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1603			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1604			return;
1605		}
1606		offset >>= 2;
1607	}
1608	bwn_shm_ctlword(mac, way, offset);
1609	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1610}
1611
1612void
1613bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1614    uint16_t value)
1615{
1616	BWN_ASSERT_LOCKED(mac->mac_sc);
1617
1618	if (way == BWN_SHARED) {
1619		KASSERT((offset & 0x0001) == 0,
1620		    ("%s:%d warn", __func__, __LINE__));
1621		if (offset & 0x0003) {
1622			bwn_shm_ctlword(mac, way, offset >> 2);
1623			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1624			return;
1625		}
1626		offset >>= 2;
1627	}
1628	bwn_shm_ctlword(mac, way, offset);
1629	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1630}
1631
1632static void
1633bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1634    const struct bwn_channelinfo *ci, const uint8_t bands[])
1635{
1636	int i, error;
1637
1638	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1639		const struct bwn_channel *hc = &ci->channels[i];
1640
1641		error = ieee80211_add_channel(chans, maxchans, nchans,
1642		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1643	}
1644}
1645
1646static int
1647bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1648	const struct ieee80211_bpf_params *params)
1649{
1650	struct ieee80211com *ic = ni->ni_ic;
1651	struct bwn_softc *sc = ic->ic_softc;
1652	struct bwn_mac *mac = sc->sc_curmac;
1653	int error;
1654
1655	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1656	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1657		m_freem(m);
1658		return (ENETDOWN);
1659	}
1660
1661	BWN_LOCK(sc);
1662	if (bwn_tx_isfull(sc, m)) {
1663		m_freem(m);
1664		BWN_UNLOCK(sc);
1665		return (ENOBUFS);
1666	}
1667
1668	error = bwn_tx_start(sc, ni, m);
1669	if (error == 0)
1670		sc->sc_watchdog_timer = 5;
1671	BWN_UNLOCK(sc);
1672	return (error);
1673}
1674
1675/*
1676 * Callback from the 802.11 layer to update the slot time
1677 * based on the current setting.  We use it to notify the
1678 * firmware of ERP changes and the f/w takes care of things
1679 * like slot time and preamble.
1680 */
1681static void
1682bwn_updateslot(struct ieee80211com *ic)
1683{
1684	struct bwn_softc *sc = ic->ic_softc;
1685	struct bwn_mac *mac;
1686
1687	BWN_LOCK(sc);
1688	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1689		mac = (struct bwn_mac *)sc->sc_curmac;
1690		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1691	}
1692	BWN_UNLOCK(sc);
1693}
1694
1695/*
1696 * Callback from the 802.11 layer after a promiscuous mode change.
1697 * Note this interface does not check the operating mode as this
1698 * is an internal callback and we are expected to honor the current
1699 * state (e.g. this is used for setting the interface in promiscuous
1700 * mode when operating in hostap mode to do ACS).
1701 */
1702static void
1703bwn_update_promisc(struct ieee80211com *ic)
1704{
1705	struct bwn_softc *sc = ic->ic_softc;
1706	struct bwn_mac *mac = sc->sc_curmac;
1707
1708	BWN_LOCK(sc);
1709	mac = sc->sc_curmac;
1710	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1711		if (ic->ic_promisc > 0)
1712			sc->sc_filters |= BWN_MACCTL_PROMISC;
1713		else
1714			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1715		bwn_set_opmode(mac);
1716	}
1717	BWN_UNLOCK(sc);
1718}
1719
1720/*
1721 * Callback from the 802.11 layer to update WME parameters.
1722 */
1723static int
1724bwn_wme_update(struct ieee80211com *ic)
1725{
1726	struct bwn_softc *sc = ic->ic_softc;
1727	struct bwn_mac *mac = sc->sc_curmac;
1728	struct wmeParams *wmep;
1729	int i;
1730
1731	BWN_LOCK(sc);
1732	mac = sc->sc_curmac;
1733	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1734		bwn_mac_suspend(mac);
1735		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1736			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1737			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1738		}
1739		bwn_mac_enable(mac);
1740	}
1741	BWN_UNLOCK(sc);
1742	return (0);
1743}
1744
1745static void
1746bwn_scan_start(struct ieee80211com *ic)
1747{
1748	struct bwn_softc *sc = ic->ic_softc;
1749	struct bwn_mac *mac;
1750
1751	BWN_LOCK(sc);
1752	mac = sc->sc_curmac;
1753	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1754		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1755		bwn_set_opmode(mac);
1756		/* disable CFP update during scan */
1757		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1758	}
1759	BWN_UNLOCK(sc);
1760}
1761
1762static void
1763bwn_scan_end(struct ieee80211com *ic)
1764{
1765	struct bwn_softc *sc = ic->ic_softc;
1766	struct bwn_mac *mac;
1767
1768	BWN_LOCK(sc);
1769	mac = sc->sc_curmac;
1770	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1771		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1772		bwn_set_opmode(mac);
1773		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1774	}
1775	BWN_UNLOCK(sc);
1776}
1777
1778static void
1779bwn_set_channel(struct ieee80211com *ic)
1780{
1781	struct bwn_softc *sc = ic->ic_softc;
1782	struct bwn_mac *mac = sc->sc_curmac;
1783	struct bwn_phy *phy = &mac->mac_phy;
1784	int chan, error;
1785
1786	BWN_LOCK(sc);
1787
1788	error = bwn_switch_band(sc, ic->ic_curchan);
1789	if (error)
1790		goto fail;
1791	bwn_mac_suspend(mac);
1792	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1793	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1794	if (chan != phy->chan)
1795		bwn_switch_channel(mac, chan);
1796
1797	/* TX power level */
1798	if (ic->ic_curchan->ic_maxpower != 0 &&
1799	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1800		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1801		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1802		    BWN_TXPWR_IGNORE_TSSI);
1803	}
1804
1805	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1806	if (phy->set_antenna)
1807		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1808
1809	if (sc->sc_rf_enabled != phy->rf_on) {
1810		if (sc->sc_rf_enabled) {
1811			bwn_rf_turnon(mac);
1812			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1813				device_printf(sc->sc_dev,
1814				    "please turn on the RF switch\n");
1815		} else
1816			bwn_rf_turnoff(mac);
1817	}
1818
1819	bwn_mac_enable(mac);
1820
1821fail:
1822	/*
1823	 * Setup radio tap channel freq and flags
1824	 */
1825	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1826		htole16(ic->ic_curchan->ic_freq);
1827	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1828		htole16(ic->ic_curchan->ic_flags & 0xffff);
1829
1830	BWN_UNLOCK(sc);
1831}
1832
1833static struct ieee80211vap *
1834bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1835    enum ieee80211_opmode opmode, int flags,
1836    const uint8_t bssid[IEEE80211_ADDR_LEN],
1837    const uint8_t mac[IEEE80211_ADDR_LEN])
1838{
1839	struct ieee80211vap *vap;
1840	struct bwn_vap *bvp;
1841
1842	switch (opmode) {
1843	case IEEE80211_M_HOSTAP:
1844	case IEEE80211_M_MBSS:
1845	case IEEE80211_M_STA:
1846	case IEEE80211_M_WDS:
1847	case IEEE80211_M_MONITOR:
1848	case IEEE80211_M_IBSS:
1849	case IEEE80211_M_AHDEMO:
1850		break;
1851	default:
1852		return (NULL);
1853	}
1854
1855	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1856	vap = &bvp->bv_vap;
1857	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1858	/* override with driver methods */
1859	bvp->bv_newstate = vap->iv_newstate;
1860	vap->iv_newstate = bwn_newstate;
1861
1862	/* override max aid so sta's cannot assoc when we're out of sta id's */
1863	vap->iv_max_aid = BWN_STAID_MAX;
1864
1865	ieee80211_ratectl_init(vap);
1866
1867	/* complete setup */
1868	ieee80211_vap_attach(vap, ieee80211_media_change,
1869	    ieee80211_media_status, mac);
1870	return (vap);
1871}
1872
1873static void
1874bwn_vap_delete(struct ieee80211vap *vap)
1875{
1876	struct bwn_vap *bvp = BWN_VAP(vap);
1877
1878	ieee80211_ratectl_deinit(vap);
1879	ieee80211_vap_detach(vap);
1880	free(bvp, M_80211_VAP);
1881}
1882
1883static int
1884bwn_init(struct bwn_softc *sc)
1885{
1886	struct bwn_mac *mac;
1887	int error;
1888
1889	BWN_ASSERT_LOCKED(sc);
1890
1891	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1892
1893	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1894	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1895	sc->sc_filters = 0;
1896	bwn_wme_clear(sc);
1897	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1898	sc->sc_rf_enabled = 1;
1899
1900	mac = sc->sc_curmac;
1901	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1902		error = bwn_core_init(mac);
1903		if (error != 0)
1904			return (error);
1905	}
1906	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1907		bwn_core_start(mac);
1908
1909	bwn_set_opmode(mac);
1910	bwn_set_pretbtt(mac);
1911	bwn_spu_setdelay(mac, 0);
1912	bwn_set_macaddr(mac);
1913
1914	sc->sc_flags |= BWN_FLAG_RUNNING;
1915	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1916	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1917
1918	return (0);
1919}
1920
1921static void
1922bwn_stop(struct bwn_softc *sc)
1923{
1924	struct bwn_mac *mac = sc->sc_curmac;
1925
1926	BWN_ASSERT_LOCKED(sc);
1927
1928	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1929
1930	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1931		/* XXX FIXME opmode not based on VAP */
1932		bwn_set_opmode(mac);
1933		bwn_set_macaddr(mac);
1934	}
1935
1936	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1937		bwn_core_stop(mac);
1938
1939	callout_stop(&sc->sc_led_blink_ch);
1940	sc->sc_led_blinking = 0;
1941
1942	bwn_core_exit(mac);
1943	sc->sc_rf_enabled = 0;
1944
1945	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1946}
1947
1948static void
1949bwn_wme_clear(struct bwn_softc *sc)
1950{
1951#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1952	struct wmeParams *p;
1953	unsigned int i;
1954
1955	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1956	    ("%s:%d: fail", __func__, __LINE__));
1957
1958	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1959		p = &(sc->sc_wmeParams[i]);
1960
1961		switch (bwn_wme_shm_offsets[i]) {
1962		case BWN_WME_VOICE:
1963			p->wmep_txopLimit = 0;
1964			p->wmep_aifsn = 2;
1965			/* XXX FIXME: log2(cwmin) */
1966			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1967			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1968			break;
1969		case BWN_WME_VIDEO:
1970			p->wmep_txopLimit = 0;
1971			p->wmep_aifsn = 2;
1972			/* XXX FIXME: log2(cwmin) */
1973			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1974			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1975			break;
1976		case BWN_WME_BESTEFFORT:
1977			p->wmep_txopLimit = 0;
1978			p->wmep_aifsn = 3;
1979			/* XXX FIXME: log2(cwmin) */
1980			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1981			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1982			break;
1983		case BWN_WME_BACKGROUND:
1984			p->wmep_txopLimit = 0;
1985			p->wmep_aifsn = 7;
1986			/* XXX FIXME: log2(cwmin) */
1987			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1988			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1989			break;
1990		default:
1991			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1992		}
1993	}
1994}
1995
1996static int
1997bwn_core_init(struct bwn_mac *mac)
1998{
1999	struct bwn_softc *sc = mac->mac_sc;
2000	uint64_t hf;
2001	int error;
2002
2003	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2004	    ("%s:%d: fail", __func__, __LINE__));
2005
2006	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2007
2008	siba_powerup(sc->sc_dev, 0);
2009	if (!siba_dev_isup(sc->sc_dev))
2010		bwn_reset_core(mac, mac->mac_phy.gmode);
2011
2012	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2013	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2014	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2015	BWN_GETTIME(mac->mac_phy.nexttime);
2016	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2017	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2018	mac->mac_stats.link_noise = -95;
2019	mac->mac_reason_intr = 0;
2020	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2021	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2022#ifdef BWN_DEBUG
2023	if (sc->sc_debug & BWN_DEBUG_XMIT)
2024		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2025#endif
2026	mac->mac_suspended = 1;
2027	mac->mac_task_state = 0;
2028	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2029
2030	mac->mac_phy.init_pre(mac);
2031
2032	siba_pcicore_intr(sc->sc_dev);
2033
2034	siba_fix_imcfglobug(sc->sc_dev);
2035	bwn_bt_disable(mac);
2036	if (mac->mac_phy.prepare_hw) {
2037		error = mac->mac_phy.prepare_hw(mac);
2038		if (error)
2039			goto fail0;
2040	}
2041	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2042	error = bwn_chip_init(mac);
2043	if (error)
2044		goto fail0;
2045	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2046	    siba_get_revid(sc->sc_dev));
2047	hf = bwn_hf_read(mac);
2048	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2049		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2050		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2051			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2052		if (mac->mac_phy.rev == 1)
2053			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2054	}
2055	if (mac->mac_phy.rf_ver == 0x2050) {
2056		if (mac->mac_phy.rf_rev < 6)
2057			hf |= BWN_HF_FORCE_VCO_RECALC;
2058		if (mac->mac_phy.rf_rev == 6)
2059			hf |= BWN_HF_4318_TSSI;
2060	}
2061	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2062		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2063	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2064	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2065		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2066	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2067	bwn_hf_write(mac, hf);
2068
2069	/* Tell the firmware about the MAC capabilities */
2070	if (siba_get_revid(sc->sc_dev) >= 13) {
2071		uint32_t cap;
2072		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2073		DPRINTF(sc, BWN_DEBUG_RESET,
2074		    "%s: hw capabilities: 0x%08x\n",
2075		    __func__, cap);
2076		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2077		    cap & 0xffff);
2078		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2079		    (cap >> 16) & 0xffff);
2080	}
2081
2082	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2083	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2084	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2085	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2086
2087	bwn_rate_init(mac);
2088	bwn_set_phytxctl(mac);
2089
2090	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2091	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2092	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2093
2094	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2095		bwn_pio_init(mac);
2096	else
2097		bwn_dma_init(mac);
2098	bwn_wme_init(mac);
2099	bwn_spu_setdelay(mac, 1);
2100	bwn_bt_enable(mac);
2101
2102	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2103	siba_powerup(sc->sc_dev,
2104	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2105	bwn_set_macaddr(mac);
2106	bwn_crypt_init(mac);
2107
2108	/* XXX LED initializatin */
2109
2110	mac->mac_status = BWN_MAC_STATUS_INITED;
2111
2112	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2113	return (error);
2114
2115fail0:
2116	siba_powerdown(sc->sc_dev);
2117	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2118	    ("%s:%d: fail", __func__, __LINE__));
2119	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2120	return (error);
2121}
2122
2123static void
2124bwn_core_start(struct bwn_mac *mac)
2125{
2126	struct bwn_softc *sc = mac->mac_sc;
2127	uint32_t tmp;
2128
2129	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2130	    ("%s:%d: fail", __func__, __LINE__));
2131
2132	if (siba_get_revid(sc->sc_dev) < 5)
2133		return;
2134
2135	while (1) {
2136		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2137		if (!(tmp & 0x00000001))
2138			break;
2139		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2140	}
2141
2142	bwn_mac_enable(mac);
2143	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2144	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2145
2146	mac->mac_status = BWN_MAC_STATUS_STARTED;
2147}
2148
2149static void
2150bwn_core_exit(struct bwn_mac *mac)
2151{
2152	struct bwn_softc *sc = mac->mac_sc;
2153	uint32_t macctl;
2154
2155	BWN_ASSERT_LOCKED(mac->mac_sc);
2156
2157	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2158	    ("%s:%d: fail", __func__, __LINE__));
2159
2160	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2161		return;
2162	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2163
2164	macctl = BWN_READ_4(mac, BWN_MACCTL);
2165	macctl &= ~BWN_MACCTL_MCODE_RUN;
2166	macctl |= BWN_MACCTL_MCODE_JMP0;
2167	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2168
2169	bwn_dma_stop(mac);
2170	bwn_pio_stop(mac);
2171	bwn_chip_exit(mac);
2172	mac->mac_phy.switch_analog(mac, 0);
2173	siba_dev_down(sc->sc_dev, 0);
2174	siba_powerdown(sc->sc_dev);
2175}
2176
2177static void
2178bwn_bt_disable(struct bwn_mac *mac)
2179{
2180	struct bwn_softc *sc = mac->mac_sc;
2181
2182	(void)sc;
2183	/* XXX do nothing yet */
2184}
2185
2186static int
2187bwn_chip_init(struct bwn_mac *mac)
2188{
2189	struct bwn_softc *sc = mac->mac_sc;
2190	struct bwn_phy *phy = &mac->mac_phy;
2191	uint32_t macctl;
2192	int error;
2193
2194	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2195	if (phy->gmode)
2196		macctl |= BWN_MACCTL_GMODE;
2197	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2198
2199	error = bwn_fw_fillinfo(mac);
2200	if (error)
2201		return (error);
2202	error = bwn_fw_loaducode(mac);
2203	if (error)
2204		return (error);
2205
2206	error = bwn_gpio_init(mac);
2207	if (error)
2208		return (error);
2209
2210	error = bwn_fw_loadinitvals(mac);
2211	if (error) {
2212		siba_gpio_set(sc->sc_dev, 0);
2213		return (error);
2214	}
2215	phy->switch_analog(mac, 1);
2216	error = bwn_phy_init(mac);
2217	if (error) {
2218		siba_gpio_set(sc->sc_dev, 0);
2219		return (error);
2220	}
2221	if (phy->set_im)
2222		phy->set_im(mac, BWN_IMMODE_NONE);
2223	if (phy->set_antenna)
2224		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2225	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2226
2227	if (phy->type == BWN_PHYTYPE_B)
2228		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2229	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2230	if (siba_get_revid(sc->sc_dev) < 5)
2231		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2232
2233	BWN_WRITE_4(mac, BWN_MACCTL,
2234	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2235	BWN_WRITE_4(mac, BWN_MACCTL,
2236	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2237	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2238
2239	bwn_set_opmode(mac);
2240	if (siba_get_revid(sc->sc_dev) < 3) {
2241		BWN_WRITE_2(mac, 0x060e, 0x0000);
2242		BWN_WRITE_2(mac, 0x0610, 0x8000);
2243		BWN_WRITE_2(mac, 0x0604, 0x0000);
2244		BWN_WRITE_2(mac, 0x0606, 0x0200);
2245	} else {
2246		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2247		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2248	}
2249	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2250	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2251	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2252	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2253	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2254	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2255	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2256
2257	bwn_mac_phy_clock_set(mac, true);
2258
2259	/* SIBA powerup */
2260	/* XXX TODO: BCMA powerup */
2261	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2262	return (error);
2263}
2264
2265/* read hostflags */
2266uint64_t
2267bwn_hf_read(struct bwn_mac *mac)
2268{
2269	uint64_t ret;
2270
2271	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2272	ret <<= 16;
2273	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2274	ret <<= 16;
2275	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2276	return (ret);
2277}
2278
2279void
2280bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2281{
2282
2283	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2284	    (value & 0x00000000ffffull));
2285	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2286	    (value & 0x0000ffff0000ull) >> 16);
2287	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2288	    (value & 0xffff00000000ULL) >> 32);
2289}
2290
2291static void
2292bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2293{
2294
2295	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2296	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2297}
2298
2299static void
2300bwn_rate_init(struct bwn_mac *mac)
2301{
2302
2303	switch (mac->mac_phy.type) {
2304	case BWN_PHYTYPE_A:
2305	case BWN_PHYTYPE_G:
2306	case BWN_PHYTYPE_LP:
2307	case BWN_PHYTYPE_N:
2308		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2309		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2310		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2311		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2312		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2313		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2314		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2315		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2316			break;
2317		/* FALLTHROUGH */
2318	case BWN_PHYTYPE_B:
2319		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2320		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2321		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2322		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2323		break;
2324	default:
2325		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2326	}
2327}
2328
2329static void
2330bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2331{
2332	uint16_t offset;
2333
2334	if (ofdm) {
2335		offset = 0x480;
2336		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2337	} else {
2338		offset = 0x4c0;
2339		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2340	}
2341	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2342	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2343}
2344
2345static uint8_t
2346bwn_plcp_getcck(const uint8_t bitrate)
2347{
2348
2349	switch (bitrate) {
2350	case BWN_CCK_RATE_1MB:
2351		return (0x0a);
2352	case BWN_CCK_RATE_2MB:
2353		return (0x14);
2354	case BWN_CCK_RATE_5MB:
2355		return (0x37);
2356	case BWN_CCK_RATE_11MB:
2357		return (0x6e);
2358	}
2359	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2360	return (0);
2361}
2362
2363static uint8_t
2364bwn_plcp_getofdm(const uint8_t bitrate)
2365{
2366
2367	switch (bitrate) {
2368	case BWN_OFDM_RATE_6MB:
2369		return (0xb);
2370	case BWN_OFDM_RATE_9MB:
2371		return (0xf);
2372	case BWN_OFDM_RATE_12MB:
2373		return (0xa);
2374	case BWN_OFDM_RATE_18MB:
2375		return (0xe);
2376	case BWN_OFDM_RATE_24MB:
2377		return (0x9);
2378	case BWN_OFDM_RATE_36MB:
2379		return (0xd);
2380	case BWN_OFDM_RATE_48MB:
2381		return (0x8);
2382	case BWN_OFDM_RATE_54MB:
2383		return (0xc);
2384	}
2385	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2386	return (0);
2387}
2388
2389static void
2390bwn_set_phytxctl(struct bwn_mac *mac)
2391{
2392	uint16_t ctl;
2393
2394	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2395	    BWN_TX_PHY_TXPWR);
2396	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2397	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2398	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2399}
2400
2401static void
2402bwn_pio_init(struct bwn_mac *mac)
2403{
2404	struct bwn_pio *pio = &mac->mac_method.pio;
2405
2406	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2407	    & ~BWN_MACCTL_BIGENDIAN);
2408	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2409
2410	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2411	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2412	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2413	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2414	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2415	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2416}
2417
2418static void
2419bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2420    int index)
2421{
2422	struct bwn_pio_txpkt *tp;
2423	struct bwn_softc *sc = mac->mac_sc;
2424	unsigned int i;
2425
2426	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2427	tq->tq_index = index;
2428
2429	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2430	if (siba_get_revid(sc->sc_dev) >= 8)
2431		tq->tq_size = 1920;
2432	else {
2433		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2434		tq->tq_size -= 80;
2435	}
2436
2437	TAILQ_INIT(&tq->tq_pktlist);
2438	for (i = 0; i < N(tq->tq_pkts); i++) {
2439		tp = &(tq->tq_pkts[i]);
2440		tp->tp_index = i;
2441		tp->tp_queue = tq;
2442		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2443	}
2444}
2445
2446static uint16_t
2447bwn_pio_idx2base(struct bwn_mac *mac, int index)
2448{
2449	struct bwn_softc *sc = mac->mac_sc;
2450	static const uint16_t bases[] = {
2451		BWN_PIO_BASE0,
2452		BWN_PIO_BASE1,
2453		BWN_PIO_BASE2,
2454		BWN_PIO_BASE3,
2455		BWN_PIO_BASE4,
2456		BWN_PIO_BASE5,
2457		BWN_PIO_BASE6,
2458		BWN_PIO_BASE7,
2459	};
2460	static const uint16_t bases_rev11[] = {
2461		BWN_PIO11_BASE0,
2462		BWN_PIO11_BASE1,
2463		BWN_PIO11_BASE2,
2464		BWN_PIO11_BASE3,
2465		BWN_PIO11_BASE4,
2466		BWN_PIO11_BASE5,
2467	};
2468
2469	if (siba_get_revid(sc->sc_dev) >= 11) {
2470		if (index >= N(bases_rev11))
2471			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2472		return (bases_rev11[index]);
2473	}
2474	if (index >= N(bases))
2475		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2476	return (bases[index]);
2477}
2478
2479static void
2480bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2481    int index)
2482{
2483	struct bwn_softc *sc = mac->mac_sc;
2484
2485	prq->prq_mac = mac;
2486	prq->prq_rev = siba_get_revid(sc->sc_dev);
2487	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2488	bwn_dma_rxdirectfifo(mac, index, 1);
2489}
2490
2491static void
2492bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2493{
2494	if (tq == NULL)
2495		return;
2496	bwn_pio_cancel_tx_packets(tq);
2497}
2498
2499static void
2500bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2501{
2502
2503	bwn_destroy_pioqueue_tx(pio);
2504}
2505
2506static uint16_t
2507bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2508    uint16_t offset)
2509{
2510
2511	return (BWN_READ_2(mac, tq->tq_base + offset));
2512}
2513
2514static void
2515bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2516{
2517	uint32_t ctl;
2518	int type;
2519	uint16_t base;
2520
2521	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2522	base = bwn_dma_base(type, idx);
2523	if (type == BWN_DMA_64BIT) {
2524		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2525		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2526		if (enable)
2527			ctl |= BWN_DMA64_RXDIRECTFIFO;
2528		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2529	} else {
2530		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2531		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2532		if (enable)
2533			ctl |= BWN_DMA32_RXDIRECTFIFO;
2534		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2535	}
2536}
2537
2538static uint64_t
2539bwn_dma_mask(struct bwn_mac *mac)
2540{
2541	uint32_t tmp;
2542	uint16_t base;
2543
2544	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2545	if (tmp & SIBA_TGSHIGH_DMA64)
2546		return (BWN_DMA_BIT_MASK(64));
2547	base = bwn_dma_base(0, 0);
2548	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2549	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2550	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2551		return (BWN_DMA_BIT_MASK(32));
2552
2553	return (BWN_DMA_BIT_MASK(30));
2554}
2555
2556static int
2557bwn_dma_mask2type(uint64_t dmamask)
2558{
2559
2560	if (dmamask == BWN_DMA_BIT_MASK(30))
2561		return (BWN_DMA_30BIT);
2562	if (dmamask == BWN_DMA_BIT_MASK(32))
2563		return (BWN_DMA_32BIT);
2564	if (dmamask == BWN_DMA_BIT_MASK(64))
2565		return (BWN_DMA_64BIT);
2566	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2567	return (BWN_DMA_30BIT);
2568}
2569
2570static void
2571bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2572{
2573	struct bwn_pio_txpkt *tp;
2574	unsigned int i;
2575
2576	for (i = 0; i < N(tq->tq_pkts); i++) {
2577		tp = &(tq->tq_pkts[i]);
2578		if (tp->tp_m) {
2579			m_freem(tp->tp_m);
2580			tp->tp_m = NULL;
2581		}
2582	}
2583}
2584
2585static uint16_t
2586bwn_dma_base(int type, int controller_idx)
2587{
2588	static const uint16_t map64[] = {
2589		BWN_DMA64_BASE0,
2590		BWN_DMA64_BASE1,
2591		BWN_DMA64_BASE2,
2592		BWN_DMA64_BASE3,
2593		BWN_DMA64_BASE4,
2594		BWN_DMA64_BASE5,
2595	};
2596	static const uint16_t map32[] = {
2597		BWN_DMA32_BASE0,
2598		BWN_DMA32_BASE1,
2599		BWN_DMA32_BASE2,
2600		BWN_DMA32_BASE3,
2601		BWN_DMA32_BASE4,
2602		BWN_DMA32_BASE5,
2603	};
2604
2605	if (type == BWN_DMA_64BIT) {
2606		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2607		    ("%s:%d: fail", __func__, __LINE__));
2608		return (map64[controller_idx]);
2609	}
2610	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2611	    ("%s:%d: fail", __func__, __LINE__));
2612	return (map32[controller_idx]);
2613}
2614
2615static void
2616bwn_dma_init(struct bwn_mac *mac)
2617{
2618	struct bwn_dma *dma = &mac->mac_method.dma;
2619
2620	/* setup TX DMA channels. */
2621	bwn_dma_setup(dma->wme[WME_AC_BK]);
2622	bwn_dma_setup(dma->wme[WME_AC_BE]);
2623	bwn_dma_setup(dma->wme[WME_AC_VI]);
2624	bwn_dma_setup(dma->wme[WME_AC_VO]);
2625	bwn_dma_setup(dma->mcast);
2626	/* setup RX DMA channel. */
2627	bwn_dma_setup(dma->rx);
2628}
2629
2630static struct bwn_dma_ring *
2631bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2632    int for_tx, int type)
2633{
2634	struct bwn_dma *dma = &mac->mac_method.dma;
2635	struct bwn_dma_ring *dr;
2636	struct bwn_dmadesc_generic *desc;
2637	struct bwn_dmadesc_meta *mt;
2638	struct bwn_softc *sc = mac->mac_sc;
2639	int error, i;
2640
2641	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2642	if (dr == NULL)
2643		goto out;
2644	dr->dr_numslots = BWN_RXRING_SLOTS;
2645	if (for_tx)
2646		dr->dr_numslots = BWN_TXRING_SLOTS;
2647
2648	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2649	    M_DEVBUF, M_NOWAIT | M_ZERO);
2650	if (dr->dr_meta == NULL)
2651		goto fail0;
2652
2653	dr->dr_type = type;
2654	dr->dr_mac = mac;
2655	dr->dr_base = bwn_dma_base(type, controller_index);
2656	dr->dr_index = controller_index;
2657	if (type == BWN_DMA_64BIT) {
2658		dr->getdesc = bwn_dma_64_getdesc;
2659		dr->setdesc = bwn_dma_64_setdesc;
2660		dr->start_transfer = bwn_dma_64_start_transfer;
2661		dr->suspend = bwn_dma_64_suspend;
2662		dr->resume = bwn_dma_64_resume;
2663		dr->get_curslot = bwn_dma_64_get_curslot;
2664		dr->set_curslot = bwn_dma_64_set_curslot;
2665	} else {
2666		dr->getdesc = bwn_dma_32_getdesc;
2667		dr->setdesc = bwn_dma_32_setdesc;
2668		dr->start_transfer = bwn_dma_32_start_transfer;
2669		dr->suspend = bwn_dma_32_suspend;
2670		dr->resume = bwn_dma_32_resume;
2671		dr->get_curslot = bwn_dma_32_get_curslot;
2672		dr->set_curslot = bwn_dma_32_set_curslot;
2673	}
2674	if (for_tx) {
2675		dr->dr_tx = 1;
2676		dr->dr_curslot = -1;
2677	} else {
2678		if (dr->dr_index == 0) {
2679			switch (mac->mac_fw.fw_hdr_format) {
2680			case BWN_FW_HDR_351:
2681			case BWN_FW_HDR_410:
2682				dr->dr_rx_bufsize =
2683				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2684				dr->dr_frameoffset =
2685				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2686				break;
2687			case BWN_FW_HDR_598:
2688				dr->dr_rx_bufsize =
2689				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2690				dr->dr_frameoffset =
2691				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2692				break;
2693			}
2694		} else
2695			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2696	}
2697
2698	error = bwn_dma_allocringmemory(dr);
2699	if (error)
2700		goto fail2;
2701
2702	if (for_tx) {
2703		/*
2704		 * Assumption: BWN_TXRING_SLOTS can be divided by
2705		 * BWN_TX_SLOTS_PER_FRAME
2706		 */
2707		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2708		    ("%s:%d: fail", __func__, __LINE__));
2709
2710		dr->dr_txhdr_cache = contigmalloc(
2711		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2712		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2713		    0, BUS_SPACE_MAXADDR, 8, 0);
2714		if (dr->dr_txhdr_cache == NULL) {
2715			device_printf(sc->sc_dev,
2716			    "can't allocate TX header DMA memory\n");
2717			goto fail1;
2718		}
2719
2720		/*
2721		 * Create TX ring DMA stuffs
2722		 */
2723		error = bus_dma_tag_create(dma->parent_dtag,
2724				    BWN_ALIGN, 0,
2725				    BUS_SPACE_MAXADDR,
2726				    BUS_SPACE_MAXADDR,
2727				    NULL, NULL,
2728				    BWN_HDRSIZE(mac),
2729				    1,
2730				    BUS_SPACE_MAXSIZE_32BIT,
2731				    0,
2732				    NULL, NULL,
2733				    &dr->dr_txring_dtag);
2734		if (error) {
2735			device_printf(sc->sc_dev,
2736			    "can't create TX ring DMA tag: TODO frees\n");
2737			goto fail2;
2738		}
2739
2740		for (i = 0; i < dr->dr_numslots; i += 2) {
2741			dr->getdesc(dr, i, &desc, &mt);
2742
2743			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2744			mt->mt_m = NULL;
2745			mt->mt_ni = NULL;
2746			mt->mt_islast = 0;
2747			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2748			    &mt->mt_dmap);
2749			if (error) {
2750				device_printf(sc->sc_dev,
2751				     "can't create RX buf DMA map\n");
2752				goto fail2;
2753			}
2754
2755			dr->getdesc(dr, i + 1, &desc, &mt);
2756
2757			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2758			mt->mt_m = NULL;
2759			mt->mt_ni = NULL;
2760			mt->mt_islast = 1;
2761			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2762			    &mt->mt_dmap);
2763			if (error) {
2764				device_printf(sc->sc_dev,
2765				     "can't create RX buf DMA map\n");
2766				goto fail2;
2767			}
2768		}
2769	} else {
2770		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2771		    &dr->dr_spare_dmap);
2772		if (error) {
2773			device_printf(sc->sc_dev,
2774			    "can't create RX buf DMA map\n");
2775			goto out;		/* XXX wrong! */
2776		}
2777
2778		for (i = 0; i < dr->dr_numslots; i++) {
2779			dr->getdesc(dr, i, &desc, &mt);
2780
2781			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2782			    &mt->mt_dmap);
2783			if (error) {
2784				device_printf(sc->sc_dev,
2785				    "can't create RX buf DMA map\n");
2786				goto out;	/* XXX wrong! */
2787			}
2788			error = bwn_dma_newbuf(dr, desc, mt, 1);
2789			if (error) {
2790				device_printf(sc->sc_dev,
2791				    "failed to allocate RX buf\n");
2792				goto out;	/* XXX wrong! */
2793			}
2794		}
2795
2796		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2797		    BUS_DMASYNC_PREWRITE);
2798
2799		dr->dr_usedslot = dr->dr_numslots;
2800	}
2801
2802      out:
2803	return (dr);
2804
2805fail2:
2806	if (dr->dr_txhdr_cache != NULL) {
2807		contigfree(dr->dr_txhdr_cache,
2808		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2809		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2810	}
2811fail1:
2812	free(dr->dr_meta, M_DEVBUF);
2813fail0:
2814	free(dr, M_DEVBUF);
2815	return (NULL);
2816}
2817
2818static void
2819bwn_dma_ringfree(struct bwn_dma_ring **dr)
2820{
2821
2822	if (dr == NULL)
2823		return;
2824
2825	bwn_dma_free_descbufs(*dr);
2826	bwn_dma_free_ringmemory(*dr);
2827
2828	if ((*dr)->dr_txhdr_cache != NULL) {
2829		contigfree((*dr)->dr_txhdr_cache,
2830		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2831		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2832	}
2833	free((*dr)->dr_meta, M_DEVBUF);
2834	free(*dr, M_DEVBUF);
2835
2836	*dr = NULL;
2837}
2838
2839static void
2840bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2841    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2842{
2843	struct bwn_dmadesc32 *desc;
2844
2845	*meta = &(dr->dr_meta[slot]);
2846	desc = dr->dr_ring_descbase;
2847	desc = &(desc[slot]);
2848
2849	*gdesc = (struct bwn_dmadesc_generic *)desc;
2850}
2851
2852static void
2853bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2854    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2855    int start, int end, int irq)
2856{
2857	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2858	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2859	uint32_t addr, addrext, ctl;
2860	int slot;
2861
2862	slot = (int)(&(desc->dma.dma32) - descbase);
2863	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2864	    ("%s:%d: fail", __func__, __LINE__));
2865
2866	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2867	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2868	addr |= siba_dma_translation(sc->sc_dev);
2869	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2870	if (slot == dr->dr_numslots - 1)
2871		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2872	if (start)
2873		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2874	if (end)
2875		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2876	if (irq)
2877		ctl |= BWN_DMA32_DCTL_IRQ;
2878	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2879	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2880
2881	desc->dma.dma32.control = htole32(ctl);
2882	desc->dma.dma32.address = htole32(addr);
2883}
2884
2885static void
2886bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2887{
2888
2889	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2890	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2891}
2892
2893static void
2894bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2895{
2896
2897	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2898	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2899}
2900
2901static void
2902bwn_dma_32_resume(struct bwn_dma_ring *dr)
2903{
2904
2905	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2906	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2907}
2908
2909static int
2910bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2911{
2912	uint32_t val;
2913
2914	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2915	val &= BWN_DMA32_RXDPTR;
2916
2917	return (val / sizeof(struct bwn_dmadesc32));
2918}
2919
2920static void
2921bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2922{
2923
2924	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2925	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2926}
2927
2928static void
2929bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2930    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2931{
2932	struct bwn_dmadesc64 *desc;
2933
2934	*meta = &(dr->dr_meta[slot]);
2935	desc = dr->dr_ring_descbase;
2936	desc = &(desc[slot]);
2937
2938	*gdesc = (struct bwn_dmadesc_generic *)desc;
2939}
2940
2941static void
2942bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2943    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2944    int start, int end, int irq)
2945{
2946	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2947	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2948	int slot;
2949	uint32_t ctl0 = 0, ctl1 = 0;
2950	uint32_t addrlo, addrhi;
2951	uint32_t addrext;
2952
2953	slot = (int)(&(desc->dma.dma64) - descbase);
2954	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2955	    ("%s:%d: fail", __func__, __LINE__));
2956
2957	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2958	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2959	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2960	    30;
2961	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2962	if (slot == dr->dr_numslots - 1)
2963		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2964	if (start)
2965		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2966	if (end)
2967		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2968	if (irq)
2969		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2970	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2971	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2972	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2973
2974	desc->dma.dma64.control0 = htole32(ctl0);
2975	desc->dma.dma64.control1 = htole32(ctl1);
2976	desc->dma.dma64.address_low = htole32(addrlo);
2977	desc->dma.dma64.address_high = htole32(addrhi);
2978}
2979
2980static void
2981bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2982{
2983
2984	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2985	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2986}
2987
2988static void
2989bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2990{
2991
2992	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2993	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2994}
2995
2996static void
2997bwn_dma_64_resume(struct bwn_dma_ring *dr)
2998{
2999
3000	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3001	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3002}
3003
3004static int
3005bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3006{
3007	uint32_t val;
3008
3009	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3010	val &= BWN_DMA64_RXSTATDPTR;
3011
3012	return (val / sizeof(struct bwn_dmadesc64));
3013}
3014
3015static void
3016bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3017{
3018
3019	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3020	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3021}
3022
3023static int
3024bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3025{
3026	struct bwn_mac *mac = dr->dr_mac;
3027	struct bwn_dma *dma = &mac->mac_method.dma;
3028	struct bwn_softc *sc = mac->mac_sc;
3029	int error;
3030
3031	error = bus_dma_tag_create(dma->parent_dtag,
3032			    BWN_ALIGN, 0,
3033			    BUS_SPACE_MAXADDR,
3034			    BUS_SPACE_MAXADDR,
3035			    NULL, NULL,
3036			    BWN_DMA_RINGMEMSIZE,
3037			    1,
3038			    BUS_SPACE_MAXSIZE_32BIT,
3039			    0,
3040			    NULL, NULL,
3041			    &dr->dr_ring_dtag);
3042	if (error) {
3043		device_printf(sc->sc_dev,
3044		    "can't create TX ring DMA tag: TODO frees\n");
3045		return (-1);
3046	}
3047
3048	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3049	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3050	    &dr->dr_ring_dmap);
3051	if (error) {
3052		device_printf(sc->sc_dev,
3053		    "can't allocate DMA mem: TODO frees\n");
3054		return (-1);
3055	}
3056	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3057	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3058	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3059	if (error) {
3060		device_printf(sc->sc_dev,
3061		    "can't load DMA mem: TODO free\n");
3062		return (-1);
3063	}
3064
3065	return (0);
3066}
3067
3068static void
3069bwn_dma_setup(struct bwn_dma_ring *dr)
3070{
3071	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3072	uint64_t ring64;
3073	uint32_t addrext, ring32, value;
3074	uint32_t trans = siba_dma_translation(sc->sc_dev);
3075
3076	if (dr->dr_tx) {
3077		dr->dr_curslot = -1;
3078
3079		if (dr->dr_type == BWN_DMA_64BIT) {
3080			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3081			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3082			    >> 30;
3083			value = BWN_DMA64_TXENABLE;
3084			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3085			    & BWN_DMA64_TXADDREXT_MASK;
3086			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3087			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3088			    (ring64 & 0xffffffff));
3089			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3090			    ((ring64 >> 32) &
3091			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3092		} else {
3093			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3094			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3095			value = BWN_DMA32_TXENABLE;
3096			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3097			    & BWN_DMA32_TXADDREXT_MASK;
3098			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3099			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3100			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3101		}
3102		return;
3103	}
3104
3105	/*
3106	 * set for RX
3107	 */
3108	dr->dr_usedslot = dr->dr_numslots;
3109
3110	if (dr->dr_type == BWN_DMA_64BIT) {
3111		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3112		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3113		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3114		value |= BWN_DMA64_RXENABLE;
3115		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3116		    & BWN_DMA64_RXADDREXT_MASK;
3117		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3118		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3119		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3120		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3121		    | (trans << 1));
3122		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3123		    sizeof(struct bwn_dmadesc64));
3124	} else {
3125		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3126		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3127		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3128		value |= BWN_DMA32_RXENABLE;
3129		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3130		    & BWN_DMA32_RXADDREXT_MASK;
3131		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3132		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3133		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3134		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3135		    sizeof(struct bwn_dmadesc32));
3136	}
3137}
3138
3139static void
3140bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3141{
3142
3143	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3144	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3145	    dr->dr_ring_dmap);
3146}
3147
3148static void
3149bwn_dma_cleanup(struct bwn_dma_ring *dr)
3150{
3151
3152	if (dr->dr_tx) {
3153		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3154		if (dr->dr_type == BWN_DMA_64BIT) {
3155			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3156			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3157		} else
3158			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3159	} else {
3160		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3161		if (dr->dr_type == BWN_DMA_64BIT) {
3162			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3163			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3164		} else
3165			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3166	}
3167}
3168
3169static void
3170bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3171{
3172	struct bwn_dmadesc_generic *desc;
3173	struct bwn_dmadesc_meta *meta;
3174	struct bwn_mac *mac = dr->dr_mac;
3175	struct bwn_dma *dma = &mac->mac_method.dma;
3176	struct bwn_softc *sc = mac->mac_sc;
3177	int i;
3178
3179	if (!dr->dr_usedslot)
3180		return;
3181	for (i = 0; i < dr->dr_numslots; i++) {
3182		dr->getdesc(dr, i, &desc, &meta);
3183
3184		if (meta->mt_m == NULL) {
3185			if (!dr->dr_tx)
3186				device_printf(sc->sc_dev, "%s: not TX?\n",
3187				    __func__);
3188			continue;
3189		}
3190		if (dr->dr_tx) {
3191			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3192				bus_dmamap_unload(dr->dr_txring_dtag,
3193				    meta->mt_dmap);
3194			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3195				bus_dmamap_unload(dma->txbuf_dtag,
3196				    meta->mt_dmap);
3197		} else
3198			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3199		bwn_dma_free_descbuf(dr, meta);
3200	}
3201}
3202
3203static int
3204bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3205    int type)
3206{
3207	struct bwn_softc *sc = mac->mac_sc;
3208	uint32_t value;
3209	int i;
3210	uint16_t offset;
3211
3212	for (i = 0; i < 10; i++) {
3213		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3214		    BWN_DMA32_TXSTATUS;
3215		value = BWN_READ_4(mac, base + offset);
3216		if (type == BWN_DMA_64BIT) {
3217			value &= BWN_DMA64_TXSTAT;
3218			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3219			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3220			    value == BWN_DMA64_TXSTAT_STOPPED)
3221				break;
3222		} else {
3223			value &= BWN_DMA32_TXSTATE;
3224			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3225			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3226			    value == BWN_DMA32_TXSTAT_STOPPED)
3227				break;
3228		}
3229		DELAY(1000);
3230	}
3231	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3232	BWN_WRITE_4(mac, base + offset, 0);
3233	for (i = 0; i < 10; i++) {
3234		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3235						   BWN_DMA32_TXSTATUS;
3236		value = BWN_READ_4(mac, base + offset);
3237		if (type == BWN_DMA_64BIT) {
3238			value &= BWN_DMA64_TXSTAT;
3239			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3240				i = -1;
3241				break;
3242			}
3243		} else {
3244			value &= BWN_DMA32_TXSTATE;
3245			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3246				i = -1;
3247				break;
3248			}
3249		}
3250		DELAY(1000);
3251	}
3252	if (i != -1) {
3253		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3254		return (ENODEV);
3255	}
3256	DELAY(1000);
3257
3258	return (0);
3259}
3260
3261static int
3262bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3263    int type)
3264{
3265	struct bwn_softc *sc = mac->mac_sc;
3266	uint32_t value;
3267	int i;
3268	uint16_t offset;
3269
3270	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3271	BWN_WRITE_4(mac, base + offset, 0);
3272	for (i = 0; i < 10; i++) {
3273		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3274		    BWN_DMA32_RXSTATUS;
3275		value = BWN_READ_4(mac, base + offset);
3276		if (type == BWN_DMA_64BIT) {
3277			value &= BWN_DMA64_RXSTAT;
3278			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3279				i = -1;
3280				break;
3281			}
3282		} else {
3283			value &= BWN_DMA32_RXSTATE;
3284			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3285				i = -1;
3286				break;
3287			}
3288		}
3289		DELAY(1000);
3290	}
3291	if (i != -1) {
3292		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3293		return (ENODEV);
3294	}
3295
3296	return (0);
3297}
3298
3299static void
3300bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3301    struct bwn_dmadesc_meta *meta)
3302{
3303
3304	if (meta->mt_m != NULL) {
3305		m_freem(meta->mt_m);
3306		meta->mt_m = NULL;
3307	}
3308	if (meta->mt_ni != NULL) {
3309		ieee80211_free_node(meta->mt_ni);
3310		meta->mt_ni = NULL;
3311	}
3312}
3313
3314static void
3315bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3316{
3317	struct bwn_rxhdr4 *rxhdr;
3318	unsigned char *frame;
3319
3320	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3321	rxhdr->frame_len = 0;
3322
3323	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3324	    sizeof(struct bwn_plcp6) + 2,
3325	    ("%s:%d: fail", __func__, __LINE__));
3326	frame = mtod(m, char *) + dr->dr_frameoffset;
3327	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3328}
3329
3330static uint8_t
3331bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3332{
3333	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3334
3335	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3336	    == 0xff);
3337}
3338
3339static void
3340bwn_wme_init(struct bwn_mac *mac)
3341{
3342
3343	bwn_wme_load(mac);
3344
3345	/* enable WME support. */
3346	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3347	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3348	    BWN_IFSCTL_USE_EDCF);
3349}
3350
3351static void
3352bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3353{
3354	struct bwn_softc *sc = mac->mac_sc;
3355	struct ieee80211com *ic = &sc->sc_ic;
3356	uint16_t delay;	/* microsec */
3357
3358	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3359	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3360		delay = 500;
3361	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3362		delay = max(delay, (uint16_t)2400);
3363
3364	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3365}
3366
3367static void
3368bwn_bt_enable(struct bwn_mac *mac)
3369{
3370	struct bwn_softc *sc = mac->mac_sc;
3371	uint64_t hf;
3372
3373	if (bwn_bluetooth == 0)
3374		return;
3375	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3376		return;
3377	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3378		return;
3379
3380	hf = bwn_hf_read(mac);
3381	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3382		hf |= BWN_HF_BT_COEXISTALT;
3383	else
3384		hf |= BWN_HF_BT_COEXIST;
3385	bwn_hf_write(mac, hf);
3386}
3387
3388static void
3389bwn_set_macaddr(struct bwn_mac *mac)
3390{
3391
3392	bwn_mac_write_bssid(mac);
3393	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3394	    mac->mac_sc->sc_ic.ic_macaddr);
3395}
3396
3397static void
3398bwn_clear_keys(struct bwn_mac *mac)
3399{
3400	int i;
3401
3402	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3403		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3404		    ("%s:%d: fail", __func__, __LINE__));
3405
3406		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3407		    NULL, BWN_SEC_KEYSIZE, NULL);
3408		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3409			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3410			    NULL, BWN_SEC_KEYSIZE, NULL);
3411		}
3412		mac->mac_key[i].keyconf = NULL;
3413	}
3414}
3415
3416static void
3417bwn_crypt_init(struct bwn_mac *mac)
3418{
3419	struct bwn_softc *sc = mac->mac_sc;
3420
3421	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3422	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3423	    ("%s:%d: fail", __func__, __LINE__));
3424	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3425	mac->mac_ktp *= 2;
3426	if (siba_get_revid(sc->sc_dev) >= 5)
3427		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3428	bwn_clear_keys(mac);
3429}
3430
3431static void
3432bwn_chip_exit(struct bwn_mac *mac)
3433{
3434	struct bwn_softc *sc = mac->mac_sc;
3435
3436	bwn_phy_exit(mac);
3437	siba_gpio_set(sc->sc_dev, 0);
3438}
3439
3440static int
3441bwn_fw_fillinfo(struct bwn_mac *mac)
3442{
3443	int error;
3444
3445	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3446	if (error == 0)
3447		return (0);
3448	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3449	if (error == 0)
3450		return (0);
3451	return (error);
3452}
3453
3454static int
3455bwn_gpio_init(struct bwn_mac *mac)
3456{
3457	struct bwn_softc *sc = mac->mac_sc;
3458	uint32_t mask = 0x1f, set = 0xf, value;
3459
3460	BWN_WRITE_4(mac, BWN_MACCTL,
3461	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3462	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3463	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3464
3465	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3466		mask |= 0x0060;
3467		set |= 0x0060;
3468	}
3469	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3470		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3471		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3472		mask |= 0x0200;
3473		set |= 0x0200;
3474	}
3475	if (siba_get_revid(sc->sc_dev) >= 2)
3476		mask |= 0x0010;
3477
3478	value = siba_gpio_get(sc->sc_dev);
3479	if (value == -1)
3480		return (0);
3481	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3482
3483	return (0);
3484}
3485
3486static int
3487bwn_fw_loadinitvals(struct bwn_mac *mac)
3488{
3489#define	GETFWOFFSET(fwp, offset)				\
3490	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3491	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3492	const struct bwn_fwhdr *hdr;
3493	struct bwn_fw *fw = &mac->mac_fw;
3494	int error;
3495
3496	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3497	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3498	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3499	if (error)
3500		return (error);
3501	if (fw->initvals_band.fw) {
3502		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3503		error = bwn_fwinitvals_write(mac,
3504		    GETFWOFFSET(fw->initvals_band, hdr_len),
3505		    be32toh(hdr->size),
3506		    fw->initvals_band.fw->datasize - hdr_len);
3507	}
3508	return (error);
3509#undef GETFWOFFSET
3510}
3511
3512static int
3513bwn_phy_init(struct bwn_mac *mac)
3514{
3515	struct bwn_softc *sc = mac->mac_sc;
3516	int error;
3517
3518	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3519	mac->mac_phy.rf_onoff(mac, 1);
3520	error = mac->mac_phy.init(mac);
3521	if (error) {
3522		device_printf(sc->sc_dev, "PHY init failed\n");
3523		goto fail0;
3524	}
3525	error = bwn_switch_channel(mac,
3526	    mac->mac_phy.get_default_chan(mac));
3527	if (error) {
3528		device_printf(sc->sc_dev,
3529		    "failed to switch default channel\n");
3530		goto fail1;
3531	}
3532	return (0);
3533fail1:
3534	if (mac->mac_phy.exit)
3535		mac->mac_phy.exit(mac);
3536fail0:
3537	mac->mac_phy.rf_onoff(mac, 0);
3538
3539	return (error);
3540}
3541
3542static void
3543bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3544{
3545	uint16_t ant;
3546	uint16_t tmp;
3547
3548	ant = bwn_ant2phy(antenna);
3549
3550	/* For ACK/CTS */
3551	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3552	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3553	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3554	/* For Probe Resposes */
3555	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3556	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3557	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3558}
3559
3560static void
3561bwn_set_opmode(struct bwn_mac *mac)
3562{
3563	struct bwn_softc *sc = mac->mac_sc;
3564	struct ieee80211com *ic = &sc->sc_ic;
3565	uint32_t ctl;
3566	uint16_t cfp_pretbtt;
3567
3568	ctl = BWN_READ_4(mac, BWN_MACCTL);
3569	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3570	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3571	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3572	ctl |= BWN_MACCTL_STA;
3573
3574	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3575	    ic->ic_opmode == IEEE80211_M_MBSS)
3576		ctl |= BWN_MACCTL_HOSTAP;
3577	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3578		ctl &= ~BWN_MACCTL_STA;
3579	ctl |= sc->sc_filters;
3580
3581	if (siba_get_revid(sc->sc_dev) <= 4)
3582		ctl |= BWN_MACCTL_PROMISC;
3583
3584	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3585
3586	cfp_pretbtt = 2;
3587	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3588		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3589		    siba_get_chiprev(sc->sc_dev) == 3)
3590			cfp_pretbtt = 100;
3591		else
3592			cfp_pretbtt = 50;
3593	}
3594	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3595}
3596
3597static int
3598bwn_dma_gettype(struct bwn_mac *mac)
3599{
3600	uint32_t tmp;
3601	uint16_t base;
3602
3603	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3604	if (tmp & SIBA_TGSHIGH_DMA64)
3605		return (BWN_DMA_64BIT);
3606	base = bwn_dma_base(0, 0);
3607	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3608	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3609	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3610		return (BWN_DMA_32BIT);
3611
3612	return (BWN_DMA_30BIT);
3613}
3614
3615static void
3616bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3617{
3618	if (!error) {
3619		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3620		*((bus_addr_t *)arg) = seg->ds_addr;
3621	}
3622}
3623
3624void
3625bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3626{
3627	struct bwn_phy *phy = &mac->mac_phy;
3628	struct bwn_softc *sc = mac->mac_sc;
3629	unsigned int i, max_loop;
3630	uint16_t value;
3631	uint32_t buffer[5] = {
3632		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3633	};
3634
3635	if (ofdm) {
3636		max_loop = 0x1e;
3637		buffer[0] = 0x000201cc;
3638	} else {
3639		max_loop = 0xfa;
3640		buffer[0] = 0x000b846e;
3641	}
3642
3643	BWN_ASSERT_LOCKED(mac->mac_sc);
3644
3645	for (i = 0; i < 5; i++)
3646		bwn_ram_write(mac, i * 4, buffer[i]);
3647
3648	BWN_WRITE_2(mac, 0x0568, 0x0000);
3649	BWN_WRITE_2(mac, 0x07c0,
3650	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3651
3652	value = (ofdm ? 0x41 : 0x40);
3653	BWN_WRITE_2(mac, 0x050c, value);
3654
3655	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3656	    phy->type == BWN_PHYTYPE_LCN)
3657		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3658	BWN_WRITE_2(mac, 0x0508, 0x0000);
3659	BWN_WRITE_2(mac, 0x050a, 0x0000);
3660	BWN_WRITE_2(mac, 0x054c, 0x0000);
3661	BWN_WRITE_2(mac, 0x056a, 0x0014);
3662	BWN_WRITE_2(mac, 0x0568, 0x0826);
3663	BWN_WRITE_2(mac, 0x0500, 0x0000);
3664
3665	/* XXX TODO: n phy pa override? */
3666
3667	switch (phy->type) {
3668	case BWN_PHYTYPE_N:
3669	case BWN_PHYTYPE_LCN:
3670		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3671		break;
3672	case BWN_PHYTYPE_LP:
3673		BWN_WRITE_2(mac, 0x0502, 0x0050);
3674		break;
3675	default:
3676		BWN_WRITE_2(mac, 0x0502, 0x0030);
3677		break;
3678	}
3679
3680	/* flush */
3681	BWN_READ_2(mac, 0x0502);
3682
3683	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3684		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3685	for (i = 0x00; i < max_loop; i++) {
3686		value = BWN_READ_2(mac, 0x050e);
3687		if (value & 0x0080)
3688			break;
3689		DELAY(10);
3690	}
3691	for (i = 0x00; i < 0x0a; i++) {
3692		value = BWN_READ_2(mac, 0x050e);
3693		if (value & 0x0400)
3694			break;
3695		DELAY(10);
3696	}
3697	for (i = 0x00; i < 0x19; i++) {
3698		value = BWN_READ_2(mac, 0x0690);
3699		if (!(value & 0x0100))
3700			break;
3701		DELAY(10);
3702	}
3703	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3704		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3705}
3706
3707void
3708bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3709{
3710	uint32_t macctl;
3711
3712	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3713
3714	macctl = BWN_READ_4(mac, BWN_MACCTL);
3715	if (macctl & BWN_MACCTL_BIGENDIAN)
3716		printf("TODO: need swap\n");
3717
3718	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3719	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3720	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3721}
3722
3723void
3724bwn_mac_suspend(struct bwn_mac *mac)
3725{
3726	struct bwn_softc *sc = mac->mac_sc;
3727	int i;
3728	uint32_t tmp;
3729
3730	KASSERT(mac->mac_suspended >= 0,
3731	    ("%s:%d: fail", __func__, __LINE__));
3732
3733	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3734	    __func__, mac->mac_suspended);
3735
3736	if (mac->mac_suspended == 0) {
3737		bwn_psctl(mac, BWN_PS_AWAKE);
3738		BWN_WRITE_4(mac, BWN_MACCTL,
3739			    BWN_READ_4(mac, BWN_MACCTL)
3740			    & ~BWN_MACCTL_ON);
3741		BWN_READ_4(mac, BWN_MACCTL);
3742		for (i = 35; i; i--) {
3743			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3744			if (tmp & BWN_INTR_MAC_SUSPENDED)
3745				goto out;
3746			DELAY(10);
3747		}
3748		for (i = 40; i; i--) {
3749			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3750			if (tmp & BWN_INTR_MAC_SUSPENDED)
3751				goto out;
3752			DELAY(1000);
3753		}
3754		device_printf(sc->sc_dev, "MAC suspend failed\n");
3755	}
3756out:
3757	mac->mac_suspended++;
3758}
3759
3760void
3761bwn_mac_enable(struct bwn_mac *mac)
3762{
3763	struct bwn_softc *sc = mac->mac_sc;
3764	uint16_t state;
3765
3766	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3767	    __func__, mac->mac_suspended);
3768
3769	state = bwn_shm_read_2(mac, BWN_SHARED,
3770	    BWN_SHARED_UCODESTAT);
3771	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3772	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3773		DPRINTF(sc, BWN_DEBUG_FW,
3774		    "%s: warn: firmware state (%d)\n",
3775		    __func__, state);
3776	}
3777
3778	mac->mac_suspended--;
3779	KASSERT(mac->mac_suspended >= 0,
3780	    ("%s:%d: fail", __func__, __LINE__));
3781	if (mac->mac_suspended == 0) {
3782		BWN_WRITE_4(mac, BWN_MACCTL,
3783		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3784		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3785		BWN_READ_4(mac, BWN_MACCTL);
3786		BWN_READ_4(mac, BWN_INTR_REASON);
3787		bwn_psctl(mac, 0);
3788	}
3789}
3790
3791void
3792bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3793{
3794	struct bwn_softc *sc = mac->mac_sc;
3795	int i;
3796	uint16_t ucstat;
3797
3798	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3799	    ("%s:%d: fail", __func__, __LINE__));
3800	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3801	    ("%s:%d: fail", __func__, __LINE__));
3802
3803	/* XXX forcibly awake and hwps-off */
3804
3805	BWN_WRITE_4(mac, BWN_MACCTL,
3806	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3807	    ~BWN_MACCTL_HWPS);
3808	BWN_READ_4(mac, BWN_MACCTL);
3809	if (siba_get_revid(sc->sc_dev) >= 5) {
3810		for (i = 0; i < 100; i++) {
3811			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3812			    BWN_SHARED_UCODESTAT);
3813			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3814				break;
3815			DELAY(10);
3816		}
3817	}
3818	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3819	    ucstat);
3820}
3821
3822static int
3823bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3824{
3825	struct bwn_softc *sc = mac->mac_sc;
3826	struct bwn_fw *fw = &mac->mac_fw;
3827	const uint8_t rev = siba_get_revid(sc->sc_dev);
3828	const char *filename;
3829	uint32_t high;
3830	int error;
3831
3832	/* microcode */
3833	filename = NULL;
3834	switch (rev) {
3835	case 42:
3836		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3837			filename = "ucode42";
3838		break;
3839	case 40:
3840		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3841			filename = "ucode40";
3842		break;
3843	case 33:
3844		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3845			filename = "ucode33_lcn40";
3846		break;
3847	case 30:
3848		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3849			filename = "ucode30_mimo";
3850		break;
3851	case 29:
3852		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3853			filename = "ucode29_mimo";
3854		break;
3855	case 26:
3856		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3857			filename = "ucode26_mimo";
3858		break;
3859	case 28:
3860	case 25:
3861		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3862			filename = "ucode25_mimo";
3863		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3864			filename = "ucode25_lcn";
3865		break;
3866	case 24:
3867		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3868			filename = "ucode24_lcn";
3869		break;
3870	case 23:
3871		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3872			filename = "ucode16_mimo";
3873		break;
3874	case 16:
3875	case 17:
3876	case 18:
3877	case 19:
3878		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3879			filename = "ucode16_mimo";
3880		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3881			filename = "ucode16_lp";
3882		break;
3883	case 15:
3884		filename = "ucode15";
3885		break;
3886	case 14:
3887		filename = "ucode14";
3888		break;
3889	case 13:
3890		filename = "ucode13";
3891		break;
3892	case 12:
3893	case 11:
3894		filename = "ucode11";
3895		break;
3896	case 10:
3897	case 9:
3898	case 8:
3899	case 7:
3900	case 6:
3901	case 5:
3902		filename = "ucode5";
3903		break;
3904	default:
3905		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3906		bwn_release_firmware(mac);
3907		return (EOPNOTSUPP);
3908	}
3909
3910	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3911	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3912	if (error) {
3913		bwn_release_firmware(mac);
3914		return (error);
3915	}
3916
3917	/* PCM */
3918	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3919	if (rev >= 5 && rev <= 10) {
3920		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3921		if (error == ENOENT)
3922			fw->no_pcmfile = 1;
3923		else if (error) {
3924			bwn_release_firmware(mac);
3925			return (error);
3926		}
3927	} else if (rev < 11) {
3928		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3929		return (EOPNOTSUPP);
3930	}
3931
3932	/* initvals */
3933	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3934	switch (mac->mac_phy.type) {
3935	case BWN_PHYTYPE_A:
3936		if (rev < 5 || rev > 10)
3937			goto fail1;
3938		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3939			filename = "a0g1initvals5";
3940		else
3941			filename = "a0g0initvals5";
3942		break;
3943	case BWN_PHYTYPE_G:
3944		if (rev >= 5 && rev <= 10)
3945			filename = "b0g0initvals5";
3946		else if (rev >= 13)
3947			filename = "b0g0initvals13";
3948		else
3949			goto fail1;
3950		break;
3951	case BWN_PHYTYPE_LP:
3952		if (rev == 13)
3953			filename = "lp0initvals13";
3954		else if (rev == 14)
3955			filename = "lp0initvals14";
3956		else if (rev >= 15)
3957			filename = "lp0initvals15";
3958		else
3959			goto fail1;
3960		break;
3961	case BWN_PHYTYPE_N:
3962		if (rev == 30)
3963			filename = "n16initvals30";
3964		else if (rev == 28 || rev == 25)
3965			filename = "n0initvals25";
3966		else if (rev == 24)
3967			filename = "n0initvals24";
3968		else if (rev == 23)
3969			filename = "n0initvals16";
3970		else if (rev >= 16 && rev <= 18)
3971			filename = "n0initvals16";
3972		else if (rev >= 11 && rev <= 12)
3973			filename = "n0initvals11";
3974		else
3975			goto fail1;
3976		break;
3977	default:
3978		goto fail1;
3979	}
3980	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3981	if (error) {
3982		bwn_release_firmware(mac);
3983		return (error);
3984	}
3985
3986	/* bandswitch initvals */
3987	switch (mac->mac_phy.type) {
3988	case BWN_PHYTYPE_A:
3989		if (rev >= 5 && rev <= 10) {
3990			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3991				filename = "a0g1bsinitvals5";
3992			else
3993				filename = "a0g0bsinitvals5";
3994		} else if (rev >= 11)
3995			filename = NULL;
3996		else
3997			goto fail1;
3998		break;
3999	case BWN_PHYTYPE_G:
4000		if (rev >= 5 && rev <= 10)
4001			filename = "b0g0bsinitvals5";
4002		else if (rev >= 11)
4003			filename = NULL;
4004		else
4005			goto fail1;
4006		break;
4007	case BWN_PHYTYPE_LP:
4008		if (rev == 13)
4009			filename = "lp0bsinitvals13";
4010		else if (rev == 14)
4011			filename = "lp0bsinitvals14";
4012		else if (rev >= 15)
4013			filename = "lp0bsinitvals15";
4014		else
4015			goto fail1;
4016		break;
4017	case BWN_PHYTYPE_N:
4018		if (rev == 30)
4019			filename = "n16bsinitvals30";
4020		else if (rev == 28 || rev == 25)
4021			filename = "n0bsinitvals25";
4022		else if (rev == 24)
4023			filename = "n0bsinitvals24";
4024		else if (rev == 23)
4025			filename = "n0bsinitvals16";
4026		else if (rev >= 16 && rev <= 18)
4027			filename = "n0bsinitvals16";
4028		else if (rev >= 11 && rev <= 12)
4029			filename = "n0bsinitvals11";
4030		else
4031			goto fail1;
4032		break;
4033	default:
4034		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4035		    mac->mac_phy.type);
4036		goto fail1;
4037	}
4038	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4039	if (error) {
4040		bwn_release_firmware(mac);
4041		return (error);
4042	}
4043	return (0);
4044fail1:
4045	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4046	    rev, mac->mac_phy.type);
4047	bwn_release_firmware(mac);
4048	return (EOPNOTSUPP);
4049}
4050
4051static int
4052bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4053    const char *name, struct bwn_fwfile *bfw)
4054{
4055	const struct bwn_fwhdr *hdr;
4056	struct bwn_softc *sc = mac->mac_sc;
4057	const struct firmware *fw;
4058	char namebuf[64];
4059
4060	if (name == NULL) {
4061		bwn_do_release_fw(bfw);
4062		return (0);
4063	}
4064	if (bfw->filename != NULL) {
4065		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4066			return (0);
4067		bwn_do_release_fw(bfw);
4068	}
4069
4070	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4071	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4072	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4073	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4074	fw = firmware_get(namebuf);
4075	if (fw == NULL) {
4076		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4077		    namebuf);
4078		return (ENOENT);
4079	}
4080	if (fw->datasize < sizeof(struct bwn_fwhdr))
4081		goto fail;
4082	hdr = (const struct bwn_fwhdr *)(fw->data);
4083	switch (hdr->type) {
4084	case BWN_FWTYPE_UCODE:
4085	case BWN_FWTYPE_PCM:
4086		if (be32toh(hdr->size) !=
4087		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4088			goto fail;
4089		/* FALLTHROUGH */
4090	case BWN_FWTYPE_IV:
4091		if (hdr->ver != 1)
4092			goto fail;
4093		break;
4094	default:
4095		goto fail;
4096	}
4097	bfw->filename = name;
4098	bfw->fw = fw;
4099	bfw->type = type;
4100	return (0);
4101fail:
4102	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4103	if (fw != NULL)
4104		firmware_put(fw, FIRMWARE_UNLOAD);
4105	return (EPROTO);
4106}
4107
4108static void
4109bwn_release_firmware(struct bwn_mac *mac)
4110{
4111
4112	bwn_do_release_fw(&mac->mac_fw.ucode);
4113	bwn_do_release_fw(&mac->mac_fw.pcm);
4114	bwn_do_release_fw(&mac->mac_fw.initvals);
4115	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4116}
4117
4118static void
4119bwn_do_release_fw(struct bwn_fwfile *bfw)
4120{
4121
4122	if (bfw->fw != NULL)
4123		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4124	bfw->fw = NULL;
4125	bfw->filename = NULL;
4126}
4127
4128static int
4129bwn_fw_loaducode(struct bwn_mac *mac)
4130{
4131#define	GETFWOFFSET(fwp, offset)	\
4132	((const uint32_t *)((const char *)fwp.fw->data + offset))
4133#define	GETFWSIZE(fwp, offset)	\
4134	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4135	struct bwn_softc *sc = mac->mac_sc;
4136	const uint32_t *data;
4137	unsigned int i;
4138	uint32_t ctl;
4139	uint16_t date, fwcaps, time;
4140	int error = 0;
4141
4142	ctl = BWN_READ_4(mac, BWN_MACCTL);
4143	ctl |= BWN_MACCTL_MCODE_JMP0;
4144	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4145	    __LINE__));
4146	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4147	for (i = 0; i < 64; i++)
4148		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4149	for (i = 0; i < 4096; i += 2)
4150		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4151
4152	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4153	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4154	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4155	     i++) {
4156		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4157		DELAY(10);
4158	}
4159
4160	if (mac->mac_fw.pcm.fw) {
4161		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4162		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4163		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4164		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4165		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4166		    sizeof(struct bwn_fwhdr)); i++) {
4167			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4168			DELAY(10);
4169		}
4170	}
4171
4172	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4173	BWN_WRITE_4(mac, BWN_MACCTL,
4174	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4175	    BWN_MACCTL_MCODE_RUN);
4176
4177	for (i = 0; i < 21; i++) {
4178		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4179			break;
4180		if (i >= 20) {
4181			device_printf(sc->sc_dev, "ucode timeout\n");
4182			error = ENXIO;
4183			goto error;
4184		}
4185		DELAY(50000);
4186	}
4187	BWN_READ_4(mac, BWN_INTR_REASON);
4188
4189	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4190	if (mac->mac_fw.rev <= 0x128) {
4191		device_printf(sc->sc_dev, "the firmware is too old\n");
4192		error = EOPNOTSUPP;
4193		goto error;
4194	}
4195
4196	/*
4197	 * Determine firmware header version; needed for TX/RX packet
4198	 * handling.
4199	 */
4200	if (mac->mac_fw.rev >= 598)
4201		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4202	else if (mac->mac_fw.rev >= 410)
4203		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4204	else
4205		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4206
4207	/*
4208	 * We don't support rev 598 or later; that requires
4209	 * another round of changes to the TX/RX descriptor
4210	 * and status layout.
4211	 *
4212	 * So, complain this is the case and exit out, rather
4213	 * than attaching and then failing.
4214	 */
4215#if 0
4216	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4217		device_printf(sc->sc_dev,
4218		    "firmware is too new (>=598); not supported\n");
4219		error = EOPNOTSUPP;
4220		goto error;
4221	}
4222#endif
4223
4224	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4225	    BWN_SHARED_UCODE_PATCH);
4226	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4227	mac->mac_fw.opensource = (date == 0xffff);
4228	if (bwn_wme != 0)
4229		mac->mac_flags |= BWN_MAC_FLAG_WME;
4230	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4231
4232	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4233	if (mac->mac_fw.opensource == 0) {
4234		device_printf(sc->sc_dev,
4235		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4236		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4237		if (mac->mac_fw.no_pcmfile)
4238			device_printf(sc->sc_dev,
4239			    "no HW crypto acceleration due to pcm5\n");
4240	} else {
4241		mac->mac_fw.patch = time;
4242		fwcaps = bwn_fwcaps_read(mac);
4243		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4244			device_printf(sc->sc_dev,
4245			    "disabling HW crypto acceleration\n");
4246			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4247		}
4248		if (!(fwcaps & BWN_FWCAPS_WME)) {
4249			device_printf(sc->sc_dev, "disabling WME support\n");
4250			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4251		}
4252	}
4253
4254	if (BWN_ISOLDFMT(mac))
4255		device_printf(sc->sc_dev, "using old firmware image\n");
4256
4257	return (0);
4258
4259error:
4260	BWN_WRITE_4(mac, BWN_MACCTL,
4261	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4262	    BWN_MACCTL_MCODE_JMP0);
4263
4264	return (error);
4265#undef GETFWSIZE
4266#undef GETFWOFFSET
4267}
4268
4269/* OpenFirmware only */
4270static uint16_t
4271bwn_fwcaps_read(struct bwn_mac *mac)
4272{
4273
4274	KASSERT(mac->mac_fw.opensource == 1,
4275	    ("%s:%d: fail", __func__, __LINE__));
4276	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4277}
4278
4279static int
4280bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4281    size_t count, size_t array_size)
4282{
4283#define	GET_NEXTIV16(iv)						\
4284	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4285	    sizeof(uint16_t) + sizeof(uint16_t)))
4286#define	GET_NEXTIV32(iv)						\
4287	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4288	    sizeof(uint16_t) + sizeof(uint32_t)))
4289	struct bwn_softc *sc = mac->mac_sc;
4290	const struct bwn_fwinitvals *iv;
4291	uint16_t offset;
4292	size_t i;
4293	uint8_t bit32;
4294
4295	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4296	    ("%s:%d: fail", __func__, __LINE__));
4297	iv = ivals;
4298	for (i = 0; i < count; i++) {
4299		if (array_size < sizeof(iv->offset_size))
4300			goto fail;
4301		array_size -= sizeof(iv->offset_size);
4302		offset = be16toh(iv->offset_size);
4303		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4304		offset &= BWN_FWINITVALS_OFFSET_MASK;
4305		if (offset >= 0x1000)
4306			goto fail;
4307		if (bit32) {
4308			if (array_size < sizeof(iv->data.d32))
4309				goto fail;
4310			array_size -= sizeof(iv->data.d32);
4311			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4312			iv = GET_NEXTIV32(iv);
4313		} else {
4314
4315			if (array_size < sizeof(iv->data.d16))
4316				goto fail;
4317			array_size -= sizeof(iv->data.d16);
4318			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4319
4320			iv = GET_NEXTIV16(iv);
4321		}
4322	}
4323	if (array_size != 0)
4324		goto fail;
4325	return (0);
4326fail:
4327	device_printf(sc->sc_dev, "initvals: invalid format\n");
4328	return (EPROTO);
4329#undef GET_NEXTIV16
4330#undef GET_NEXTIV32
4331}
4332
4333int
4334bwn_switch_channel(struct bwn_mac *mac, int chan)
4335{
4336	struct bwn_phy *phy = &(mac->mac_phy);
4337	struct bwn_softc *sc = mac->mac_sc;
4338	struct ieee80211com *ic = &sc->sc_ic;
4339	uint16_t channelcookie, savedcookie;
4340	int error;
4341
4342	if (chan == 0xffff)
4343		chan = phy->get_default_chan(mac);
4344
4345	channelcookie = chan;
4346	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4347		channelcookie |= 0x100;
4348	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4349	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4350	error = phy->switch_channel(mac, chan);
4351	if (error)
4352		goto fail;
4353
4354	mac->mac_phy.chan = chan;
4355	DELAY(8000);
4356	return (0);
4357fail:
4358	device_printf(sc->sc_dev, "failed to switch channel\n");
4359	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4360	return (error);
4361}
4362
4363static uint16_t
4364bwn_ant2phy(int antenna)
4365{
4366
4367	switch (antenna) {
4368	case BWN_ANT0:
4369		return (BWN_TX_PHY_ANT0);
4370	case BWN_ANT1:
4371		return (BWN_TX_PHY_ANT1);
4372	case BWN_ANT2:
4373		return (BWN_TX_PHY_ANT2);
4374	case BWN_ANT3:
4375		return (BWN_TX_PHY_ANT3);
4376	case BWN_ANTAUTO:
4377		return (BWN_TX_PHY_ANT01AUTO);
4378	}
4379	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4380	return (0);
4381}
4382
4383static void
4384bwn_wme_load(struct bwn_mac *mac)
4385{
4386	struct bwn_softc *sc = mac->mac_sc;
4387	int i;
4388
4389	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4390	    ("%s:%d: fail", __func__, __LINE__));
4391
4392	bwn_mac_suspend(mac);
4393	for (i = 0; i < N(sc->sc_wmeParams); i++)
4394		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4395		    bwn_wme_shm_offsets[i]);
4396	bwn_mac_enable(mac);
4397}
4398
4399static void
4400bwn_wme_loadparams(struct bwn_mac *mac,
4401    const struct wmeParams *p, uint16_t shm_offset)
4402{
4403#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4404	struct bwn_softc *sc = mac->mac_sc;
4405	uint16_t params[BWN_NR_WMEPARAMS];
4406	int slot, tmp;
4407	unsigned int i;
4408
4409	slot = BWN_READ_2(mac, BWN_RNG) &
4410	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4411
4412	memset(&params, 0, sizeof(params));
4413
4414	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4415	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4416	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4417
4418	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4419	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4420	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4421	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4422	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4423	params[BWN_WMEPARAM_BSLOTS] = slot;
4424	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4425
4426	for (i = 0; i < N(params); i++) {
4427		if (i == BWN_WMEPARAM_STATUS) {
4428			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4429			    shm_offset + (i * 2));
4430			tmp |= 0x100;
4431			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4432			    tmp);
4433		} else {
4434			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4435			    params[i]);
4436		}
4437	}
4438}
4439
4440static void
4441bwn_mac_write_bssid(struct bwn_mac *mac)
4442{
4443	struct bwn_softc *sc = mac->mac_sc;
4444	uint32_t tmp;
4445	int i;
4446	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4447
4448	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4449	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4450	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4451	    IEEE80211_ADDR_LEN);
4452
4453	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4454		tmp = (uint32_t) (mac_bssid[i + 0]);
4455		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4456		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4457		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4458		bwn_ram_write(mac, 0x20 + i, tmp);
4459	}
4460}
4461
4462static void
4463bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4464    const uint8_t *macaddr)
4465{
4466	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4467	uint16_t data;
4468
4469	if (!mac)
4470		macaddr = zero;
4471
4472	offset |= 0x0020;
4473	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4474
4475	data = macaddr[0];
4476	data |= macaddr[1] << 8;
4477	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4478	data = macaddr[2];
4479	data |= macaddr[3] << 8;
4480	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4481	data = macaddr[4];
4482	data |= macaddr[5] << 8;
4483	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4484}
4485
4486static void
4487bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4488    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4489{
4490	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4491	uint8_t per_sta_keys_start = 8;
4492
4493	if (BWN_SEC_NEWAPI(mac))
4494		per_sta_keys_start = 4;
4495
4496	KASSERT(index < mac->mac_max_nr_keys,
4497	    ("%s:%d: fail", __func__, __LINE__));
4498	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4499	    ("%s:%d: fail", __func__, __LINE__));
4500
4501	if (index >= per_sta_keys_start)
4502		bwn_key_macwrite(mac, index, NULL);
4503	if (key)
4504		memcpy(buf, key, key_len);
4505	bwn_key_write(mac, index, algorithm, buf);
4506	if (index >= per_sta_keys_start)
4507		bwn_key_macwrite(mac, index, mac_addr);
4508
4509	mac->mac_key[index].algorithm = algorithm;
4510}
4511
4512static void
4513bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4514{
4515	struct bwn_softc *sc = mac->mac_sc;
4516	uint32_t addrtmp[2] = { 0, 0 };
4517	uint8_t start = 8;
4518
4519	if (BWN_SEC_NEWAPI(mac))
4520		start = 4;
4521
4522	KASSERT(index >= start,
4523	    ("%s:%d: fail", __func__, __LINE__));
4524	index -= start;
4525
4526	if (addr) {
4527		addrtmp[0] = addr[0];
4528		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4529		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4530		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4531		addrtmp[1] = addr[4];
4532		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4533	}
4534
4535	if (siba_get_revid(sc->sc_dev) >= 5) {
4536		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4537		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4538	} else {
4539		if (index >= 8) {
4540			bwn_shm_write_4(mac, BWN_SHARED,
4541			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4542			bwn_shm_write_2(mac, BWN_SHARED,
4543			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4544		}
4545	}
4546}
4547
4548static void
4549bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4550    const uint8_t *key)
4551{
4552	unsigned int i;
4553	uint32_t offset;
4554	uint16_t kidx, value;
4555
4556	kidx = BWN_SEC_KEY2FW(mac, index);
4557	bwn_shm_write_2(mac, BWN_SHARED,
4558	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4559
4560	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4561	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4562		value = key[i];
4563		value |= (uint16_t)(key[i + 1]) << 8;
4564		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4565	}
4566}
4567
4568static void
4569bwn_phy_exit(struct bwn_mac *mac)
4570{
4571
4572	mac->mac_phy.rf_onoff(mac, 0);
4573	if (mac->mac_phy.exit != NULL)
4574		mac->mac_phy.exit(mac);
4575}
4576
4577static void
4578bwn_dma_free(struct bwn_mac *mac)
4579{
4580	struct bwn_dma *dma;
4581
4582	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4583		return;
4584	dma = &mac->mac_method.dma;
4585
4586	bwn_dma_ringfree(&dma->rx);
4587	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4588	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4589	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4590	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4591	bwn_dma_ringfree(&dma->mcast);
4592}
4593
4594static void
4595bwn_core_stop(struct bwn_mac *mac)
4596{
4597	struct bwn_softc *sc = mac->mac_sc;
4598
4599	BWN_ASSERT_LOCKED(sc);
4600
4601	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4602		return;
4603
4604	callout_stop(&sc->sc_rfswitch_ch);
4605	callout_stop(&sc->sc_task_ch);
4606	callout_stop(&sc->sc_watchdog_ch);
4607	sc->sc_watchdog_timer = 0;
4608	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4609	BWN_READ_4(mac, BWN_INTR_MASK);
4610	bwn_mac_suspend(mac);
4611
4612	mac->mac_status = BWN_MAC_STATUS_INITED;
4613}
4614
4615static int
4616bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4617{
4618	struct bwn_mac *up_dev = NULL;
4619	struct bwn_mac *down_dev;
4620	struct bwn_mac *mac;
4621	int err, status;
4622	uint8_t gmode;
4623
4624	BWN_ASSERT_LOCKED(sc);
4625
4626	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4627		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4628		    mac->mac_phy.supports_2ghz) {
4629			up_dev = mac;
4630			gmode = 1;
4631		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4632		    mac->mac_phy.supports_5ghz) {
4633			up_dev = mac;
4634			gmode = 0;
4635		} else {
4636			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4637			return (EINVAL);
4638		}
4639		if (up_dev != NULL)
4640			break;
4641	}
4642	if (up_dev == NULL) {
4643		device_printf(sc->sc_dev, "Could not find a device\n");
4644		return (ENODEV);
4645	}
4646	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4647		return (0);
4648
4649	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4650	    "switching to %s-GHz band\n",
4651	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4652
4653	down_dev = sc->sc_curmac;
4654	status = down_dev->mac_status;
4655	if (status >= BWN_MAC_STATUS_STARTED)
4656		bwn_core_stop(down_dev);
4657	if (status >= BWN_MAC_STATUS_INITED)
4658		bwn_core_exit(down_dev);
4659
4660	if (down_dev != up_dev)
4661		bwn_phy_reset(down_dev);
4662
4663	up_dev->mac_phy.gmode = gmode;
4664	if (status >= BWN_MAC_STATUS_INITED) {
4665		err = bwn_core_init(up_dev);
4666		if (err) {
4667			device_printf(sc->sc_dev,
4668			    "fatal: failed to initialize for %s-GHz\n",
4669			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4670			goto fail;
4671		}
4672	}
4673	if (status >= BWN_MAC_STATUS_STARTED)
4674		bwn_core_start(up_dev);
4675	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4676	sc->sc_curmac = up_dev;
4677
4678	return (0);
4679fail:
4680	sc->sc_curmac = NULL;
4681	return (err);
4682}
4683
4684static void
4685bwn_rf_turnon(struct bwn_mac *mac)
4686{
4687
4688	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4689
4690	bwn_mac_suspend(mac);
4691	mac->mac_phy.rf_onoff(mac, 1);
4692	mac->mac_phy.rf_on = 1;
4693	bwn_mac_enable(mac);
4694}
4695
4696static void
4697bwn_rf_turnoff(struct bwn_mac *mac)
4698{
4699
4700	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4701
4702	bwn_mac_suspend(mac);
4703	mac->mac_phy.rf_onoff(mac, 0);
4704	mac->mac_phy.rf_on = 0;
4705	bwn_mac_enable(mac);
4706}
4707
4708/*
4709 * SSB PHY reset.
4710 */
4711static void
4712bwn_phy_reset_siba(struct bwn_mac *mac)
4713{
4714	struct bwn_softc *sc = mac->mac_sc;
4715
4716	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4717	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4718	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4719	DELAY(1000);
4720	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4721	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4722	DELAY(1000);
4723}
4724
4725static void
4726bwn_phy_reset(struct bwn_mac *mac)
4727{
4728
4729	if (bwn_is_bus_siba(mac)) {
4730		bwn_phy_reset_siba(mac);
4731	} else {
4732		BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4733	}
4734}
4735
4736static int
4737bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4738{
4739	struct bwn_vap *bvp = BWN_VAP(vap);
4740	struct ieee80211com *ic= vap->iv_ic;
4741	enum ieee80211_state ostate = vap->iv_state;
4742	struct bwn_softc *sc = ic->ic_softc;
4743	struct bwn_mac *mac = sc->sc_curmac;
4744	int error;
4745
4746	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4747	    ieee80211_state_name[vap->iv_state],
4748	    ieee80211_state_name[nstate]);
4749
4750	error = bvp->bv_newstate(vap, nstate, arg);
4751	if (error != 0)
4752		return (error);
4753
4754	BWN_LOCK(sc);
4755
4756	bwn_led_newstate(mac, nstate);
4757
4758	/*
4759	 * Clear the BSSID when we stop a STA
4760	 */
4761	if (vap->iv_opmode == IEEE80211_M_STA) {
4762		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4763			/*
4764			 * Clear out the BSSID.  If we reassociate to
4765			 * the same AP, this will reinialize things
4766			 * correctly...
4767			 */
4768			if (ic->ic_opmode == IEEE80211_M_STA &&
4769			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4770				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4771				bwn_set_macaddr(mac);
4772			}
4773		}
4774	}
4775
4776	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4777	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4778		/* XXX nothing to do? */
4779	} else if (nstate == IEEE80211_S_RUN) {
4780		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4781		bwn_set_opmode(mac);
4782		bwn_set_pretbtt(mac);
4783		bwn_spu_setdelay(mac, 0);
4784		bwn_set_macaddr(mac);
4785	}
4786
4787	BWN_UNLOCK(sc);
4788
4789	return (error);
4790}
4791
4792static void
4793bwn_set_pretbtt(struct bwn_mac *mac)
4794{
4795	struct bwn_softc *sc = mac->mac_sc;
4796	struct ieee80211com *ic = &sc->sc_ic;
4797	uint16_t pretbtt;
4798
4799	if (ic->ic_opmode == IEEE80211_M_IBSS)
4800		pretbtt = 2;
4801	else
4802		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4803	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4804	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4805}
4806
4807static int
4808bwn_intr(void *arg)
4809{
4810	struct bwn_mac *mac = arg;
4811	struct bwn_softc *sc = mac->mac_sc;
4812	uint32_t reason;
4813
4814	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4815	    (sc->sc_flags & BWN_FLAG_INVALID))
4816		return (FILTER_STRAY);
4817
4818	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4819
4820	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4821	if (reason == 0xffffffff)	/* shared IRQ */
4822		return (FILTER_STRAY);
4823	reason &= mac->mac_intr_mask;
4824	if (reason == 0)
4825		return (FILTER_HANDLED);
4826	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4827
4828	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4829	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4830	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4831	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4832	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4833	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4834	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4835	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4836	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4837	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4838	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4839
4840	/* Disable interrupts. */
4841	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4842
4843	mac->mac_reason_intr = reason;
4844
4845	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4846	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4847
4848	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4849	return (FILTER_HANDLED);
4850}
4851
4852static void
4853bwn_intrtask(void *arg, int npending)
4854{
4855	struct bwn_mac *mac = arg;
4856	struct bwn_softc *sc = mac->mac_sc;
4857	uint32_t merged = 0;
4858	int i, tx = 0, rx = 0;
4859
4860	BWN_LOCK(sc);
4861	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4862	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4863		BWN_UNLOCK(sc);
4864		return;
4865	}
4866
4867	for (i = 0; i < N(mac->mac_reason); i++)
4868		merged |= mac->mac_reason[i];
4869
4870	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4871		device_printf(sc->sc_dev, "MAC trans error\n");
4872
4873	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4874		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4875		mac->mac_phy.txerrors--;
4876		if (mac->mac_phy.txerrors == 0) {
4877			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4878			bwn_restart(mac, "PHY TX errors");
4879		}
4880	}
4881
4882	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4883		if (merged & BWN_DMAINTR_FATALMASK) {
4884			device_printf(sc->sc_dev,
4885			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4886			    mac->mac_reason[0], mac->mac_reason[1],
4887			    mac->mac_reason[2], mac->mac_reason[3],
4888			    mac->mac_reason[4], mac->mac_reason[5]);
4889			bwn_restart(mac, "DMA error");
4890			BWN_UNLOCK(sc);
4891			return;
4892		}
4893		if (merged & BWN_DMAINTR_NONFATALMASK) {
4894			device_printf(sc->sc_dev,
4895			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4896			    mac->mac_reason[0], mac->mac_reason[1],
4897			    mac->mac_reason[2], mac->mac_reason[3],
4898			    mac->mac_reason[4], mac->mac_reason[5]);
4899		}
4900	}
4901
4902	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4903		bwn_intr_ucode_debug(mac);
4904	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4905		bwn_intr_tbtt_indication(mac);
4906	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4907		bwn_intr_atim_end(mac);
4908	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4909		bwn_intr_beacon(mac);
4910	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4911		bwn_intr_pmq(mac);
4912	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4913		bwn_intr_noise(mac);
4914
4915	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4916		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4917			bwn_dma_rx(mac->mac_method.dma.rx);
4918			rx = 1;
4919		}
4920	} else
4921		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4922
4923	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4924	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4925	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4926	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4927	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4928
4929	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4930		bwn_intr_txeof(mac);
4931		tx = 1;
4932	}
4933
4934	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4935
4936	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4937		int evt = BWN_LED_EVENT_NONE;
4938
4939		if (tx && rx) {
4940			if (sc->sc_rx_rate > sc->sc_tx_rate)
4941				evt = BWN_LED_EVENT_RX;
4942			else
4943				evt = BWN_LED_EVENT_TX;
4944		} else if (tx) {
4945			evt = BWN_LED_EVENT_TX;
4946		} else if (rx) {
4947			evt = BWN_LED_EVENT_RX;
4948		} else if (rx == 0) {
4949			evt = BWN_LED_EVENT_POLL;
4950		}
4951
4952		if (evt != BWN_LED_EVENT_NONE)
4953			bwn_led_event(mac, evt);
4954       }
4955
4956	if (mbufq_first(&sc->sc_snd) != NULL)
4957		bwn_start(sc);
4958
4959	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4960	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4961
4962	BWN_UNLOCK(sc);
4963}
4964
4965static void
4966bwn_restart(struct bwn_mac *mac, const char *msg)
4967{
4968	struct bwn_softc *sc = mac->mac_sc;
4969	struct ieee80211com *ic = &sc->sc_ic;
4970
4971	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4972		return;
4973
4974	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4975	ieee80211_runtask(ic, &mac->mac_hwreset);
4976}
4977
4978static void
4979bwn_intr_ucode_debug(struct bwn_mac *mac)
4980{
4981	struct bwn_softc *sc = mac->mac_sc;
4982	uint16_t reason;
4983
4984	if (mac->mac_fw.opensource == 0)
4985		return;
4986
4987	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4988	switch (reason) {
4989	case BWN_DEBUGINTR_PANIC:
4990		bwn_handle_fwpanic(mac);
4991		break;
4992	case BWN_DEBUGINTR_DUMP_SHM:
4993		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4994		break;
4995	case BWN_DEBUGINTR_DUMP_REGS:
4996		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4997		break;
4998	case BWN_DEBUGINTR_MARKER:
4999		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5000		break;
5001	default:
5002		device_printf(sc->sc_dev,
5003		    "ucode debug unknown reason: %#x\n", reason);
5004	}
5005
5006	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5007	    BWN_DEBUGINTR_ACK);
5008}
5009
5010static void
5011bwn_intr_tbtt_indication(struct bwn_mac *mac)
5012{
5013	struct bwn_softc *sc = mac->mac_sc;
5014	struct ieee80211com *ic = &sc->sc_ic;
5015
5016	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5017		bwn_psctl(mac, 0);
5018	if (ic->ic_opmode == IEEE80211_M_IBSS)
5019		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5020}
5021
5022static void
5023bwn_intr_atim_end(struct bwn_mac *mac)
5024{
5025
5026	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5027		BWN_WRITE_4(mac, BWN_MACCMD,
5028		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5029		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5030	}
5031}
5032
5033static void
5034bwn_intr_beacon(struct bwn_mac *mac)
5035{
5036	struct bwn_softc *sc = mac->mac_sc;
5037	struct ieee80211com *ic = &sc->sc_ic;
5038	uint32_t cmd, beacon0, beacon1;
5039
5040	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5041	    ic->ic_opmode == IEEE80211_M_MBSS)
5042		return;
5043
5044	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5045
5046	cmd = BWN_READ_4(mac, BWN_MACCMD);
5047	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5048	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5049
5050	if (beacon0 && beacon1) {
5051		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5052		mac->mac_intr_mask |= BWN_INTR_BEACON;
5053		return;
5054	}
5055
5056	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5057		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5058		bwn_load_beacon0(mac);
5059		bwn_load_beacon1(mac);
5060		cmd = BWN_READ_4(mac, BWN_MACCMD);
5061		cmd |= BWN_MACCMD_BEACON0_VALID;
5062		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5063	} else {
5064		if (!beacon0) {
5065			bwn_load_beacon0(mac);
5066			cmd = BWN_READ_4(mac, BWN_MACCMD);
5067			cmd |= BWN_MACCMD_BEACON0_VALID;
5068			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5069		} else if (!beacon1) {
5070			bwn_load_beacon1(mac);
5071			cmd = BWN_READ_4(mac, BWN_MACCMD);
5072			cmd |= BWN_MACCMD_BEACON1_VALID;
5073			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5074		}
5075	}
5076}
5077
5078static void
5079bwn_intr_pmq(struct bwn_mac *mac)
5080{
5081	uint32_t tmp;
5082
5083	while (1) {
5084		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5085		if (!(tmp & 0x00000008))
5086			break;
5087	}
5088	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5089}
5090
5091static void
5092bwn_intr_noise(struct bwn_mac *mac)
5093{
5094	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5095	uint16_t tmp;
5096	uint8_t noise[4];
5097	uint8_t i, j;
5098	int32_t average;
5099
5100	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5101		return;
5102
5103	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5104	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5105	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5106	    noise[3] == 0x7f)
5107		goto new;
5108
5109	KASSERT(mac->mac_noise.noi_nsamples < 8,
5110	    ("%s:%d: fail", __func__, __LINE__));
5111	i = mac->mac_noise.noi_nsamples;
5112	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5113	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5114	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5115	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5116	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5117	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5118	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5119	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5120	mac->mac_noise.noi_nsamples++;
5121	if (mac->mac_noise.noi_nsamples == 8) {
5122		average = 0;
5123		for (i = 0; i < 8; i++) {
5124			for (j = 0; j < 4; j++)
5125				average += mac->mac_noise.noi_samples[i][j];
5126		}
5127		average = (((average / 32) * 125) + 64) / 128;
5128		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5129		if (tmp >= 8)
5130			average += 2;
5131		else
5132			average -= 25;
5133		average -= (tmp == 8) ? 72 : 48;
5134
5135		mac->mac_stats.link_noise = average;
5136		mac->mac_noise.noi_running = 0;
5137		return;
5138	}
5139new:
5140	bwn_noise_gensample(mac);
5141}
5142
5143static int
5144bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5145{
5146	struct bwn_mac *mac = prq->prq_mac;
5147	struct bwn_softc *sc = mac->mac_sc;
5148	unsigned int i;
5149
5150	BWN_ASSERT_LOCKED(sc);
5151
5152	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5153		return (0);
5154
5155	for (i = 0; i < 5000; i++) {
5156		if (bwn_pio_rxeof(prq) == 0)
5157			break;
5158	}
5159	if (i >= 5000)
5160		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5161	return ((i > 0) ? 1 : 0);
5162}
5163
5164static void
5165bwn_dma_rx(struct bwn_dma_ring *dr)
5166{
5167	int slot, curslot;
5168
5169	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5170	curslot = dr->get_curslot(dr);
5171	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5172	    ("%s:%d: fail", __func__, __LINE__));
5173
5174	slot = dr->dr_curslot;
5175	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5176		bwn_dma_rxeof(dr, &slot);
5177
5178	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5179	    BUS_DMASYNC_PREWRITE);
5180
5181	dr->set_curslot(dr, slot);
5182	dr->dr_curslot = slot;
5183}
5184
5185static void
5186bwn_intr_txeof(struct bwn_mac *mac)
5187{
5188	struct bwn_txstatus stat;
5189	uint32_t stat0, stat1;
5190	uint16_t tmp;
5191
5192	BWN_ASSERT_LOCKED(mac->mac_sc);
5193
5194	while (1) {
5195		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5196		if (!(stat0 & 0x00000001))
5197			break;
5198		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5199
5200		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5201		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5202		    __func__,
5203		    stat0,
5204		    stat1);
5205
5206		stat.cookie = (stat0 >> 16);
5207		stat.seq = (stat1 & 0x0000ffff);
5208		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5209		tmp = (stat0 & 0x0000ffff);
5210		stat.framecnt = ((tmp & 0xf000) >> 12);
5211		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5212		stat.sreason = ((tmp & 0x001c) >> 2);
5213		stat.pm = (tmp & 0x0080) ? 1 : 0;
5214		stat.im = (tmp & 0x0040) ? 1 : 0;
5215		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5216		stat.ack = (tmp & 0x0002) ? 1 : 0;
5217
5218		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5219		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5220		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5221		    __func__,
5222		    stat.cookie,
5223		    stat.seq,
5224		    stat.phy_stat,
5225		    stat.framecnt,
5226		    stat.rtscnt,
5227		    stat.sreason,
5228		    stat.pm,
5229		    stat.im,
5230		    stat.ampdu,
5231		    stat.ack);
5232
5233		bwn_handle_txeof(mac, &stat);
5234	}
5235}
5236
5237static void
5238bwn_hwreset(void *arg, int npending)
5239{
5240	struct bwn_mac *mac = arg;
5241	struct bwn_softc *sc = mac->mac_sc;
5242	int error = 0;
5243	int prev_status;
5244
5245	BWN_LOCK(sc);
5246
5247	prev_status = mac->mac_status;
5248	if (prev_status >= BWN_MAC_STATUS_STARTED)
5249		bwn_core_stop(mac);
5250	if (prev_status >= BWN_MAC_STATUS_INITED)
5251		bwn_core_exit(mac);
5252
5253	if (prev_status >= BWN_MAC_STATUS_INITED) {
5254		error = bwn_core_init(mac);
5255		if (error)
5256			goto out;
5257	}
5258	if (prev_status >= BWN_MAC_STATUS_STARTED)
5259		bwn_core_start(mac);
5260out:
5261	if (error) {
5262		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5263		sc->sc_curmac = NULL;
5264	}
5265	BWN_UNLOCK(sc);
5266}
5267
5268static void
5269bwn_handle_fwpanic(struct bwn_mac *mac)
5270{
5271	struct bwn_softc *sc = mac->mac_sc;
5272	uint16_t reason;
5273
5274	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5275	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5276
5277	if (reason == BWN_FWPANIC_RESTART)
5278		bwn_restart(mac, "ucode panic");
5279}
5280
5281static void
5282bwn_load_beacon0(struct bwn_mac *mac)
5283{
5284
5285	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5286}
5287
5288static void
5289bwn_load_beacon1(struct bwn_mac *mac)
5290{
5291
5292	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5293}
5294
5295static uint32_t
5296bwn_jssi_read(struct bwn_mac *mac)
5297{
5298	uint32_t val = 0;
5299
5300	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5301	val <<= 16;
5302	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5303
5304	return (val);
5305}
5306
5307static void
5308bwn_noise_gensample(struct bwn_mac *mac)
5309{
5310	uint32_t jssi = 0x7f7f7f7f;
5311
5312	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5313	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5314	BWN_WRITE_4(mac, BWN_MACCMD,
5315	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5316}
5317
5318static int
5319bwn_dma_freeslot(struct bwn_dma_ring *dr)
5320{
5321	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5322
5323	return (dr->dr_numslots - dr->dr_usedslot);
5324}
5325
5326static int
5327bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5328{
5329	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5330
5331	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5332	    ("%s:%d: fail", __func__, __LINE__));
5333	if (slot == dr->dr_numslots - 1)
5334		return (0);
5335	return (slot + 1);
5336}
5337
5338static void
5339bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5340{
5341	struct bwn_mac *mac = dr->dr_mac;
5342	struct bwn_softc *sc = mac->mac_sc;
5343	struct bwn_dma *dma = &mac->mac_method.dma;
5344	struct bwn_dmadesc_generic *desc;
5345	struct bwn_dmadesc_meta *meta;
5346	struct bwn_rxhdr4 *rxhdr;
5347	struct mbuf *m;
5348	uint32_t macstat;
5349	int32_t tmp;
5350	int cnt = 0;
5351	uint16_t len;
5352
5353	dr->getdesc(dr, *slot, &desc, &meta);
5354
5355	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5356	m = meta->mt_m;
5357
5358	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5359		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5360		return;
5361	}
5362
5363	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5364	len = le16toh(rxhdr->frame_len);
5365	if (len <= 0) {
5366		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5367		return;
5368	}
5369	if (bwn_dma_check_redzone(dr, m)) {
5370		device_printf(sc->sc_dev, "redzone error.\n");
5371		bwn_dma_set_redzone(dr, m);
5372		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5373		    BUS_DMASYNC_PREWRITE);
5374		return;
5375	}
5376	if (len > dr->dr_rx_bufsize) {
5377		tmp = len;
5378		while (1) {
5379			dr->getdesc(dr, *slot, &desc, &meta);
5380			bwn_dma_set_redzone(dr, meta->mt_m);
5381			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5382			    BUS_DMASYNC_PREWRITE);
5383			*slot = bwn_dma_nextslot(dr, *slot);
5384			cnt++;
5385			tmp -= dr->dr_rx_bufsize;
5386			if (tmp <= 0)
5387				break;
5388		}
5389		device_printf(sc->sc_dev, "too small buffer "
5390		       "(len %u buffer %u dropped %d)\n",
5391		       len, dr->dr_rx_bufsize, cnt);
5392		return;
5393	}
5394
5395	switch (mac->mac_fw.fw_hdr_format) {
5396	case BWN_FW_HDR_351:
5397	case BWN_FW_HDR_410:
5398		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5399		break;
5400	case BWN_FW_HDR_598:
5401		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5402		break;
5403	}
5404
5405	if (macstat & BWN_RX_MAC_FCSERR) {
5406		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5407			device_printf(sc->sc_dev, "RX drop\n");
5408			return;
5409		}
5410	}
5411
5412	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5413	m_adj(m, dr->dr_frameoffset);
5414
5415	bwn_rxeof(dr->dr_mac, m, rxhdr);
5416}
5417
5418static void
5419bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5420{
5421	struct bwn_softc *sc = mac->mac_sc;
5422	struct bwn_stats *stats = &mac->mac_stats;
5423
5424	BWN_ASSERT_LOCKED(mac->mac_sc);
5425
5426	if (status->im)
5427		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5428	if (status->ampdu)
5429		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5430	if (status->rtscnt) {
5431		if (status->rtscnt == 0xf)
5432			stats->rtsfail++;
5433		else
5434			stats->rts++;
5435	}
5436
5437	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5438		bwn_dma_handle_txeof(mac, status);
5439	} else {
5440		bwn_pio_handle_txeof(mac, status);
5441	}
5442
5443	bwn_phy_txpower_check(mac, 0);
5444}
5445
5446static uint8_t
5447bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5448{
5449	struct bwn_mac *mac = prq->prq_mac;
5450	struct bwn_softc *sc = mac->mac_sc;
5451	struct bwn_rxhdr4 rxhdr;
5452	struct mbuf *m;
5453	uint32_t ctl32, macstat, v32;
5454	unsigned int i, padding;
5455	uint16_t ctl16, len, totlen, v16;
5456	unsigned char *mp;
5457	char *data;
5458
5459	memset(&rxhdr, 0, sizeof(rxhdr));
5460
5461	if (prq->prq_rev >= 8) {
5462		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5463		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5464			return (0);
5465		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5466		    BWN_PIO8_RXCTL_FRAMEREADY);
5467		for (i = 0; i < 10; i++) {
5468			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5469			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5470				goto ready;
5471			DELAY(10);
5472		}
5473	} else {
5474		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5475		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5476			return (0);
5477		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5478		    BWN_PIO_RXCTL_FRAMEREADY);
5479		for (i = 0; i < 10; i++) {
5480			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5481			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5482				goto ready;
5483			DELAY(10);
5484		}
5485	}
5486	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5487	return (1);
5488ready:
5489	if (prq->prq_rev >= 8)
5490		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5491		    prq->prq_base + BWN_PIO8_RXDATA);
5492	else
5493		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5494		    prq->prq_base + BWN_PIO_RXDATA);
5495	len = le16toh(rxhdr.frame_len);
5496	if (len > 0x700) {
5497		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5498		goto error;
5499	}
5500	if (len == 0) {
5501		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5502		goto error;
5503	}
5504
5505	switch (mac->mac_fw.fw_hdr_format) {
5506	case BWN_FW_HDR_351:
5507	case BWN_FW_HDR_410:
5508		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5509		break;
5510	case BWN_FW_HDR_598:
5511		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5512		break;
5513	}
5514
5515	if (macstat & BWN_RX_MAC_FCSERR) {
5516		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5517			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5518			goto error;
5519		}
5520	}
5521
5522	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5523	totlen = len + padding;
5524	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5525	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5526	if (m == NULL) {
5527		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5528		goto error;
5529	}
5530	mp = mtod(m, unsigned char *);
5531	if (prq->prq_rev >= 8) {
5532		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5533		    prq->prq_base + BWN_PIO8_RXDATA);
5534		if (totlen & 3) {
5535			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5536			data = &(mp[totlen - 1]);
5537			switch (totlen & 3) {
5538			case 3:
5539				*data = (v32 >> 16);
5540				data--;
5541			case 2:
5542				*data = (v32 >> 8);
5543				data--;
5544			case 1:
5545				*data = v32;
5546			}
5547		}
5548	} else {
5549		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5550		    prq->prq_base + BWN_PIO_RXDATA);
5551		if (totlen & 1) {
5552			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5553			mp[totlen - 1] = v16;
5554		}
5555	}
5556
5557	m->m_len = m->m_pkthdr.len = totlen;
5558
5559	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5560
5561	return (1);
5562error:
5563	if (prq->prq_rev >= 8)
5564		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5565		    BWN_PIO8_RXCTL_DATAREADY);
5566	else
5567		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5568	return (1);
5569}
5570
5571static int
5572bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5573    struct bwn_dmadesc_meta *meta, int init)
5574{
5575	struct bwn_mac *mac = dr->dr_mac;
5576	struct bwn_dma *dma = &mac->mac_method.dma;
5577	struct bwn_rxhdr4 *hdr;
5578	bus_dmamap_t map;
5579	bus_addr_t paddr;
5580	struct mbuf *m;
5581	int error;
5582
5583	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5584	if (m == NULL) {
5585		error = ENOBUFS;
5586
5587		/*
5588		 * If the NIC is up and running, we need to:
5589		 * - Clear RX buffer's header.
5590		 * - Restore RX descriptor settings.
5591		 */
5592		if (init)
5593			return (error);
5594		else
5595			goto back;
5596	}
5597	m->m_len = m->m_pkthdr.len = MCLBYTES;
5598
5599	bwn_dma_set_redzone(dr, m);
5600
5601	/*
5602	 * Try to load RX buf into temporary DMA map
5603	 */
5604	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5605	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5606	if (error) {
5607		m_freem(m);
5608
5609		/*
5610		 * See the comment above
5611		 */
5612		if (init)
5613			return (error);
5614		else
5615			goto back;
5616	}
5617
5618	if (!init)
5619		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5620	meta->mt_m = m;
5621	meta->mt_paddr = paddr;
5622
5623	/*
5624	 * Swap RX buf's DMA map with the loaded temporary one
5625	 */
5626	map = meta->mt_dmap;
5627	meta->mt_dmap = dr->dr_spare_dmap;
5628	dr->dr_spare_dmap = map;
5629
5630back:
5631	/*
5632	 * Clear RX buf header
5633	 */
5634	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5635	bzero(hdr, sizeof(*hdr));
5636	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5637	    BUS_DMASYNC_PREWRITE);
5638
5639	/*
5640	 * Setup RX buf descriptor
5641	 */
5642	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5643	    sizeof(*hdr), 0, 0, 0);
5644	return (error);
5645}
5646
5647static void
5648bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5649		 bus_size_t mapsz __unused, int error)
5650{
5651
5652	if (!error) {
5653		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5654		*((bus_addr_t *)arg) = seg->ds_addr;
5655	}
5656}
5657
5658static int
5659bwn_hwrate2ieeerate(int rate)
5660{
5661
5662	switch (rate) {
5663	case BWN_CCK_RATE_1MB:
5664		return (2);
5665	case BWN_CCK_RATE_2MB:
5666		return (4);
5667	case BWN_CCK_RATE_5MB:
5668		return (11);
5669	case BWN_CCK_RATE_11MB:
5670		return (22);
5671	case BWN_OFDM_RATE_6MB:
5672		return (12);
5673	case BWN_OFDM_RATE_9MB:
5674		return (18);
5675	case BWN_OFDM_RATE_12MB:
5676		return (24);
5677	case BWN_OFDM_RATE_18MB:
5678		return (36);
5679	case BWN_OFDM_RATE_24MB:
5680		return (48);
5681	case BWN_OFDM_RATE_36MB:
5682		return (72);
5683	case BWN_OFDM_RATE_48MB:
5684		return (96);
5685	case BWN_OFDM_RATE_54MB:
5686		return (108);
5687	default:
5688		printf("Ooops\n");
5689		return (0);
5690	}
5691}
5692
5693/*
5694 * Post process the RX provided RSSI.
5695 *
5696 * Valid for A, B, G, LP PHYs.
5697 */
5698static int8_t
5699bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5700    int ofdm, int adjust_2053, int adjust_2050)
5701{
5702	struct bwn_phy *phy = &mac->mac_phy;
5703	struct bwn_phy_g *gphy = &phy->phy_g;
5704	int tmp;
5705
5706	switch (phy->rf_ver) {
5707	case 0x2050:
5708		if (ofdm) {
5709			tmp = in_rssi;
5710			if (tmp > 127)
5711				tmp -= 256;
5712			tmp = tmp * 73 / 64;
5713			if (adjust_2050)
5714				tmp += 25;
5715			else
5716				tmp -= 3;
5717		} else {
5718			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5719			    & BWN_BFL_RSSI) {
5720				if (in_rssi > 63)
5721					in_rssi = 63;
5722				tmp = gphy->pg_nrssi_lt[in_rssi];
5723				tmp = (31 - tmp) * -131 / 128 - 57;
5724			} else {
5725				tmp = in_rssi;
5726				tmp = (31 - tmp) * -149 / 128 - 68;
5727			}
5728			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5729				tmp += 25;
5730		}
5731		break;
5732	case 0x2060:
5733		if (in_rssi > 127)
5734			tmp = in_rssi - 256;
5735		else
5736			tmp = in_rssi;
5737		break;
5738	default:
5739		tmp = in_rssi;
5740		tmp = (tmp - 11) * 103 / 64;
5741		if (adjust_2053)
5742			tmp -= 109;
5743		else
5744			tmp -= 83;
5745	}
5746
5747	return (tmp);
5748}
5749
5750static void
5751bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5752{
5753	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5754	struct bwn_plcp6 *plcp;
5755	struct bwn_softc *sc = mac->mac_sc;
5756	struct ieee80211_frame_min *wh;
5757	struct ieee80211_node *ni;
5758	struct ieee80211com *ic = &sc->sc_ic;
5759	uint32_t macstat;
5760	int padding, rate, rssi = 0, noise = 0, type;
5761	uint16_t phytype, phystat0, phystat3, chanstat;
5762	unsigned char *mp = mtod(m, unsigned char *);
5763	static int rx_mac_dec_rpt = 0;
5764
5765	BWN_ASSERT_LOCKED(sc);
5766
5767	phystat0 = le16toh(rxhdr->phy_status0);
5768
5769	/*
5770	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5771	 * used for LP-PHY.
5772	 */
5773	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5774
5775	switch (mac->mac_fw.fw_hdr_format) {
5776	case BWN_FW_HDR_351:
5777	case BWN_FW_HDR_410:
5778		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5779		chanstat = le16toh(rxhdr->ps4.r351.channel);
5780		break;
5781	case BWN_FW_HDR_598:
5782		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5783		chanstat = le16toh(rxhdr->ps4.r598.channel);
5784		break;
5785	}
5786
5787
5788	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5789
5790	if (macstat & BWN_RX_MAC_FCSERR)
5791		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5792	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5793		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5794	if (macstat & BWN_RX_MAC_DECERR)
5795		goto drop;
5796
5797	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5798	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5799		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5800		    m->m_pkthdr.len);
5801		goto drop;
5802	}
5803	plcp = (struct bwn_plcp6 *)(mp + padding);
5804	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5805	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5806		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5807		    m->m_pkthdr.len);
5808		goto drop;
5809	}
5810	wh = mtod(m, struct ieee80211_frame_min *);
5811
5812	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5813		device_printf(sc->sc_dev,
5814		    "RX decryption attempted (old %d keyidx %#x)\n",
5815		    BWN_ISOLDFMT(mac),
5816		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5817
5818	if (phystat0 & BWN_RX_PHYST0_OFDM)
5819		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5820		    phytype == BWN_PHYTYPE_A);
5821	else
5822		rate = bwn_plcp_get_cckrate(mac, plcp);
5823	if (rate == -1) {
5824		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5825			goto drop;
5826	}
5827	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5828
5829	/* rssi/noise */
5830	switch (phytype) {
5831	case BWN_PHYTYPE_A:
5832	case BWN_PHYTYPE_B:
5833	case BWN_PHYTYPE_G:
5834	case BWN_PHYTYPE_LP:
5835		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5836		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5837		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5838		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5839		break;
5840	case BWN_PHYTYPE_N:
5841		/* Broadcom has code for min/avg, but always used max */
5842		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5843			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5844		else
5845			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5846#if 0
5847		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5848		    "%s: power0=%d, power1=%d, power2=%d\n",
5849		    __func__,
5850		    rxhdr->phy.n.power0,
5851		    rxhdr->phy.n.power1,
5852		    rxhdr->ps2.n.power2);
5853#endif
5854		break;
5855	default:
5856		/* XXX TODO: implement rssi for other PHYs */
5857		break;
5858	}
5859
5860	/*
5861	 * RSSI here is absolute, not relative to the noise floor.
5862	 */
5863	noise = mac->mac_stats.link_noise;
5864	rssi = rssi - noise;
5865
5866	/* RX radio tap */
5867	if (ieee80211_radiotap_active(ic))
5868		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5869	m_adj(m, -IEEE80211_CRC_LEN);
5870
5871	BWN_UNLOCK(sc);
5872
5873	ni = ieee80211_find_rxnode(ic, wh);
5874	if (ni != NULL) {
5875		type = ieee80211_input(ni, m, rssi, noise);
5876		ieee80211_free_node(ni);
5877	} else
5878		type = ieee80211_input_all(ic, m, rssi, noise);
5879
5880	BWN_LOCK(sc);
5881	return;
5882drop:
5883	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5884}
5885
5886static void
5887bwn_dma_handle_txeof(struct bwn_mac *mac,
5888    const struct bwn_txstatus *status)
5889{
5890	struct bwn_dma *dma = &mac->mac_method.dma;
5891	struct bwn_dma_ring *dr;
5892	struct bwn_dmadesc_generic *desc;
5893	struct bwn_dmadesc_meta *meta;
5894	struct bwn_softc *sc = mac->mac_sc;
5895	int slot;
5896	int retrycnt = 0;
5897
5898	BWN_ASSERT_LOCKED(sc);
5899
5900	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5901	if (dr == NULL) {
5902		device_printf(sc->sc_dev, "failed to parse cookie\n");
5903		return;
5904	}
5905	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5906
5907	while (1) {
5908		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5909		    ("%s:%d: fail", __func__, __LINE__));
5910		dr->getdesc(dr, slot, &desc, &meta);
5911
5912		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5913			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5914		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5915			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5916
5917		if (meta->mt_islast) {
5918			KASSERT(meta->mt_m != NULL,
5919			    ("%s:%d: fail", __func__, __LINE__));
5920
5921			/*
5922			 * If we don't get an ACK, then we should log the
5923			 * full framecnt.  That may be 0 if it's a PHY
5924			 * failure, so ensure that gets logged as some
5925			 * retry attempt.
5926			 */
5927			if (status->ack) {
5928				retrycnt = status->framecnt - 1;
5929			} else {
5930				retrycnt = status->framecnt;
5931				if (retrycnt == 0)
5932					retrycnt = 1;
5933			}
5934			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5935			    status->ack ?
5936			      IEEE80211_RATECTL_TX_SUCCESS :
5937			      IEEE80211_RATECTL_TX_FAILURE,
5938			    &retrycnt, 0);
5939			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5940			meta->mt_ni = NULL;
5941			meta->mt_m = NULL;
5942		} else
5943			KASSERT(meta->mt_m == NULL,
5944			    ("%s:%d: fail", __func__, __LINE__));
5945
5946		dr->dr_usedslot--;
5947		if (meta->mt_islast)
5948			break;
5949		slot = bwn_dma_nextslot(dr, slot);
5950	}
5951	sc->sc_watchdog_timer = 0;
5952	if (dr->dr_stop) {
5953		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5954		    ("%s:%d: fail", __func__, __LINE__));
5955		dr->dr_stop = 0;
5956	}
5957}
5958
5959static void
5960bwn_pio_handle_txeof(struct bwn_mac *mac,
5961    const struct bwn_txstatus *status)
5962{
5963	struct bwn_pio_txqueue *tq;
5964	struct bwn_pio_txpkt *tp = NULL;
5965	struct bwn_softc *sc = mac->mac_sc;
5966	int retrycnt = 0;
5967
5968	BWN_ASSERT_LOCKED(sc);
5969
5970	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5971	if (tq == NULL)
5972		return;
5973
5974	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5975	tq->tq_free++;
5976
5977	if (tp->tp_ni != NULL) {
5978		/*
5979		 * Do any tx complete callback.  Note this must
5980		 * be done before releasing the node reference.
5981		 */
5982
5983		/*
5984		 * If we don't get an ACK, then we should log the
5985		 * full framecnt.  That may be 0 if it's a PHY
5986		 * failure, so ensure that gets logged as some
5987		 * retry attempt.
5988		 */
5989		if (status->ack) {
5990			retrycnt = status->framecnt - 1;
5991		} else {
5992			retrycnt = status->framecnt;
5993			if (retrycnt == 0)
5994				retrycnt = 1;
5995		}
5996		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5997		    status->ack ?
5998		      IEEE80211_RATECTL_TX_SUCCESS :
5999		      IEEE80211_RATECTL_TX_FAILURE,
6000		    &retrycnt, 0);
6001
6002		if (tp->tp_m->m_flags & M_TXCB)
6003			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6004		ieee80211_free_node(tp->tp_ni);
6005		tp->tp_ni = NULL;
6006	}
6007	m_freem(tp->tp_m);
6008	tp->tp_m = NULL;
6009	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6010
6011	sc->sc_watchdog_timer = 0;
6012}
6013
6014static void
6015bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6016{
6017	struct bwn_softc *sc = mac->mac_sc;
6018	struct bwn_phy *phy = &mac->mac_phy;
6019	struct ieee80211com *ic = &sc->sc_ic;
6020	unsigned long now;
6021	bwn_txpwr_result_t result;
6022
6023	BWN_GETTIME(now);
6024
6025	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6026		return;
6027	phy->nexttime = now + 2 * 1000;
6028
6029	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6030	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6031		return;
6032
6033	if (phy->recalc_txpwr != NULL) {
6034		result = phy->recalc_txpwr(mac,
6035		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6036		if (result == BWN_TXPWR_RES_DONE)
6037			return;
6038		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6039		    ("%s: fail", __func__));
6040		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6041
6042		ieee80211_runtask(ic, &mac->mac_txpower);
6043	}
6044}
6045
6046static uint16_t
6047bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6048{
6049
6050	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6051}
6052
6053static uint32_t
6054bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6055{
6056
6057	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6058}
6059
6060static void
6061bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6062{
6063
6064	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6065}
6066
6067static void
6068bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6069{
6070
6071	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6072}
6073
6074static int
6075bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6076{
6077
6078	switch (rate) {
6079	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6080	case 12:
6081		return (BWN_OFDM_RATE_6MB);
6082	case 18:
6083		return (BWN_OFDM_RATE_9MB);
6084	case 24:
6085		return (BWN_OFDM_RATE_12MB);
6086	case 36:
6087		return (BWN_OFDM_RATE_18MB);
6088	case 48:
6089		return (BWN_OFDM_RATE_24MB);
6090	case 72:
6091		return (BWN_OFDM_RATE_36MB);
6092	case 96:
6093		return (BWN_OFDM_RATE_48MB);
6094	case 108:
6095		return (BWN_OFDM_RATE_54MB);
6096	/* CCK rates (NB: not IEEE std, device-specific) */
6097	case 2:
6098		return (BWN_CCK_RATE_1MB);
6099	case 4:
6100		return (BWN_CCK_RATE_2MB);
6101	case 11:
6102		return (BWN_CCK_RATE_5MB);
6103	case 22:
6104		return (BWN_CCK_RATE_11MB);
6105	}
6106
6107	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6108	return (BWN_CCK_RATE_1MB);
6109}
6110
6111static uint16_t
6112bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6113{
6114	struct bwn_phy *phy = &mac->mac_phy;
6115	uint16_t control = 0;
6116	uint16_t bw;
6117
6118	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6119	bw = BWN_TXH_PHY1_BW_20;
6120
6121	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6122		control = bw;
6123	} else {
6124		control = bw;
6125		/* Figure out coding rate and modulation */
6126		/* XXX TODO: table-ize, for MCS transmit */
6127		/* Note: this is BWN_*_RATE values */
6128		switch (bitrate) {
6129		case BWN_CCK_RATE_1MB:
6130			control |= 0;
6131			break;
6132		case BWN_CCK_RATE_2MB:
6133			control |= 1;
6134			break;
6135		case BWN_CCK_RATE_5MB:
6136			control |= 2;
6137			break;
6138		case BWN_CCK_RATE_11MB:
6139			control |= 3;
6140			break;
6141		case BWN_OFDM_RATE_6MB:
6142			control |= BWN_TXH_PHY1_CRATE_1_2;
6143			control |= BWN_TXH_PHY1_MODUL_BPSK;
6144			break;
6145		case BWN_OFDM_RATE_9MB:
6146			control |= BWN_TXH_PHY1_CRATE_3_4;
6147			control |= BWN_TXH_PHY1_MODUL_BPSK;
6148			break;
6149		case BWN_OFDM_RATE_12MB:
6150			control |= BWN_TXH_PHY1_CRATE_1_2;
6151			control |= BWN_TXH_PHY1_MODUL_QPSK;
6152			break;
6153		case BWN_OFDM_RATE_18MB:
6154			control |= BWN_TXH_PHY1_CRATE_3_4;
6155			control |= BWN_TXH_PHY1_MODUL_QPSK;
6156			break;
6157		case BWN_OFDM_RATE_24MB:
6158			control |= BWN_TXH_PHY1_CRATE_1_2;
6159			control |= BWN_TXH_PHY1_MODUL_QAM16;
6160			break;
6161		case BWN_OFDM_RATE_36MB:
6162			control |= BWN_TXH_PHY1_CRATE_3_4;
6163			control |= BWN_TXH_PHY1_MODUL_QAM16;
6164			break;
6165		case BWN_OFDM_RATE_48MB:
6166			control |= BWN_TXH_PHY1_CRATE_1_2;
6167			control |= BWN_TXH_PHY1_MODUL_QAM64;
6168			break;
6169		case BWN_OFDM_RATE_54MB:
6170			control |= BWN_TXH_PHY1_CRATE_3_4;
6171			control |= BWN_TXH_PHY1_MODUL_QAM64;
6172			break;
6173		default:
6174			break;
6175		}
6176		control |= BWN_TXH_PHY1_MODE_SISO;
6177	}
6178
6179	return control;
6180}
6181
6182static int
6183bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6184    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6185{
6186	const struct bwn_phy *phy = &mac->mac_phy;
6187	struct bwn_softc *sc = mac->mac_sc;
6188	struct ieee80211_frame *wh;
6189	struct ieee80211_frame *protwh;
6190	struct ieee80211_frame_cts *cts;
6191	struct ieee80211_frame_rts *rts;
6192	const struct ieee80211_txparam *tp;
6193	struct ieee80211vap *vap = ni->ni_vap;
6194	struct ieee80211com *ic = &sc->sc_ic;
6195	struct mbuf *mprot;
6196	unsigned int len;
6197	uint32_t macctl = 0;
6198	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6199	uint16_t phyctl = 0;
6200	uint8_t rate, rate_fb;
6201	int fill_phy_ctl1 = 0;
6202
6203	wh = mtod(m, struct ieee80211_frame *);
6204	memset(txhdr, 0, sizeof(*txhdr));
6205
6206	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6207	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6208	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6209
6210	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6211	    || (phy->type == BWN_PHYTYPE_HT))
6212		fill_phy_ctl1 = 1;
6213
6214	/*
6215	 * Find TX rate
6216	 */
6217	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6218	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6219		rate = rate_fb = tp->mgmtrate;
6220	else if (ismcast)
6221		rate = rate_fb = tp->mcastrate;
6222	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6223		rate = rate_fb = tp->ucastrate;
6224	else {
6225		/* XXX TODO: don't fall back to CCK rates for OFDM */
6226		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6227		rate = ni->ni_txrate;
6228
6229		if (rix > 0)
6230			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6231			    IEEE80211_RATE_VAL;
6232		else
6233			rate_fb = rate;
6234	}
6235
6236	sc->sc_tx_rate = rate;
6237
6238	/* Note: this maps the select ieee80211 rate to hardware rate */
6239	rate = bwn_ieeerate2hwrate(sc, rate);
6240	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6241
6242	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6243	    bwn_plcp_getcck(rate);
6244	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6245	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6246
6247	/* XXX rate/rate_fb is the hardware rate */
6248	if ((rate_fb == rate) ||
6249	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6250	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6251		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6252	else
6253		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6254		    m->m_pkthdr.len, rate, isshort);
6255
6256	/* XXX TX encryption */
6257
6258	switch (mac->mac_fw.fw_hdr_format) {
6259	case BWN_FW_HDR_351:
6260		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6261		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6262		break;
6263	case BWN_FW_HDR_410:
6264		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6265		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6266		break;
6267	case BWN_FW_HDR_598:
6268		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6269		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6270		break;
6271	}
6272
6273	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6274	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6275
6276	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6277	    BWN_TX_EFT_FB_CCK;
6278	txhdr->chan = phy->chan;
6279	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6280	    BWN_TX_PHY_ENC_CCK;
6281	/* XXX preamble? obey net80211 */
6282	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6283	     rate == BWN_CCK_RATE_11MB))
6284		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6285
6286	if (! phy->gmode)
6287		macctl |= BWN_TX_MAC_5GHZ;
6288
6289	/* XXX TX antenna selection */
6290
6291	switch (bwn_antenna_sanitize(mac, 0)) {
6292	case 0:
6293		phyctl |= BWN_TX_PHY_ANT01AUTO;
6294		break;
6295	case 1:
6296		phyctl |= BWN_TX_PHY_ANT0;
6297		break;
6298	case 2:
6299		phyctl |= BWN_TX_PHY_ANT1;
6300		break;
6301	case 3:
6302		phyctl |= BWN_TX_PHY_ANT2;
6303		break;
6304	case 4:
6305		phyctl |= BWN_TX_PHY_ANT3;
6306		break;
6307	default:
6308		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6309	}
6310
6311	if (!ismcast)
6312		macctl |= BWN_TX_MAC_ACK;
6313
6314	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6315	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6316	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6317		macctl |= BWN_TX_MAC_LONGFRAME;
6318
6319	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6320		/* XXX RTS rate is always 1MB??? */
6321		/* XXX TODO: don't fall back to CCK rates for OFDM */
6322		rts_rate = BWN_CCK_RATE_1MB;
6323		rts_rate_fb = bwn_get_fbrate(rts_rate);
6324
6325		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6326		protdur = ieee80211_compute_duration(ic->ic_rt,
6327		    m->m_pkthdr.len, rate, isshort) +
6328		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6329
6330		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6331
6332			switch (mac->mac_fw.fw_hdr_format) {
6333			case BWN_FW_HDR_351:
6334				cts = (struct ieee80211_frame_cts *)
6335				    txhdr->body.r351.rts_frame;
6336				break;
6337			case BWN_FW_HDR_410:
6338				cts = (struct ieee80211_frame_cts *)
6339				    txhdr->body.r410.rts_frame;
6340				break;
6341			case BWN_FW_HDR_598:
6342				cts = (struct ieee80211_frame_cts *)
6343				    txhdr->body.r598.rts_frame;
6344				break;
6345			}
6346
6347			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6348			    protdur);
6349			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6350			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6351			    mprot->m_pkthdr.len);
6352			m_freem(mprot);
6353			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6354			len = sizeof(struct ieee80211_frame_cts);
6355		} else {
6356			switch (mac->mac_fw.fw_hdr_format) {
6357			case BWN_FW_HDR_351:
6358				rts = (struct ieee80211_frame_rts *)
6359				    txhdr->body.r351.rts_frame;
6360				break;
6361			case BWN_FW_HDR_410:
6362				rts = (struct ieee80211_frame_rts *)
6363				    txhdr->body.r410.rts_frame;
6364				break;
6365			case BWN_FW_HDR_598:
6366				rts = (struct ieee80211_frame_rts *)
6367				    txhdr->body.r598.rts_frame;
6368				break;
6369			}
6370
6371			/* XXX rate/rate_fb is the hardware rate */
6372			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6373			    isshort);
6374			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6375			    wh->i_addr2, protdur);
6376			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6377			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6378			    mprot->m_pkthdr.len);
6379			m_freem(mprot);
6380			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6381			len = sizeof(struct ieee80211_frame_rts);
6382		}
6383		len += IEEE80211_CRC_LEN;
6384
6385		switch (mac->mac_fw.fw_hdr_format) {
6386		case BWN_FW_HDR_351:
6387			bwn_plcp_genhdr((struct bwn_plcp4 *)
6388			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6389			break;
6390		case BWN_FW_HDR_410:
6391			bwn_plcp_genhdr((struct bwn_plcp4 *)
6392			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6393			break;
6394		case BWN_FW_HDR_598:
6395			bwn_plcp_genhdr((struct bwn_plcp4 *)
6396			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6397			break;
6398		}
6399
6400		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6401		    rts_rate_fb);
6402
6403		switch (mac->mac_fw.fw_hdr_format) {
6404		case BWN_FW_HDR_351:
6405			protwh = (struct ieee80211_frame *)
6406			    &txhdr->body.r351.rts_frame;
6407			break;
6408		case BWN_FW_HDR_410:
6409			protwh = (struct ieee80211_frame *)
6410			    &txhdr->body.r410.rts_frame;
6411			break;
6412		case BWN_FW_HDR_598:
6413			protwh = (struct ieee80211_frame *)
6414			    &txhdr->body.r598.rts_frame;
6415			break;
6416		}
6417
6418		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6419
6420		if (BWN_ISOFDMRATE(rts_rate)) {
6421			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6422			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6423		} else {
6424			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6425			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6426		}
6427		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6428		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6429
6430		if (fill_phy_ctl1) {
6431			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6432			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6433		}
6434	}
6435
6436	if (fill_phy_ctl1) {
6437		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6438		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6439	}
6440
6441	switch (mac->mac_fw.fw_hdr_format) {
6442	case BWN_FW_HDR_351:
6443		txhdr->body.r351.cookie = htole16(cookie);
6444		break;
6445	case BWN_FW_HDR_410:
6446		txhdr->body.r410.cookie = htole16(cookie);
6447		break;
6448	case BWN_FW_HDR_598:
6449		txhdr->body.r598.cookie = htole16(cookie);
6450		break;
6451	}
6452
6453	txhdr->macctl = htole32(macctl);
6454	txhdr->phyctl = htole16(phyctl);
6455
6456	/*
6457	 * TX radio tap
6458	 */
6459	if (ieee80211_radiotap_active_vap(vap)) {
6460		sc->sc_tx_th.wt_flags = 0;
6461		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6462			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6463		if (isshort &&
6464		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6465		     rate == BWN_CCK_RATE_11MB))
6466			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6467		sc->sc_tx_th.wt_rate = rate;
6468
6469		ieee80211_radiotap_tx(vap, m);
6470	}
6471
6472	return (0);
6473}
6474
6475static void
6476bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6477    const uint8_t rate)
6478{
6479	uint32_t d, plen;
6480	uint8_t *raw = plcp->o.raw;
6481
6482	if (BWN_ISOFDMRATE(rate)) {
6483		d = bwn_plcp_getofdm(rate);
6484		KASSERT(!(octets & 0xf000),
6485		    ("%s:%d: fail", __func__, __LINE__));
6486		d |= (octets << 5);
6487		plcp->o.data = htole32(d);
6488	} else {
6489		plen = octets * 16 / rate;
6490		if ((octets * 16 % rate) > 0) {
6491			plen++;
6492			if ((rate == BWN_CCK_RATE_11MB)
6493			    && ((octets * 8 % 11) < 4)) {
6494				raw[1] = 0x84;
6495			} else
6496				raw[1] = 0x04;
6497		} else
6498			raw[1] = 0x04;
6499		plcp->o.data |= htole32(plen << 16);
6500		raw[0] = bwn_plcp_getcck(rate);
6501	}
6502}
6503
6504static uint8_t
6505bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6506{
6507	struct bwn_softc *sc = mac->mac_sc;
6508	uint8_t mask;
6509
6510	if (n == 0)
6511		return (0);
6512	if (mac->mac_phy.gmode)
6513		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6514	else
6515		mask = siba_sprom_get_ant_a(sc->sc_dev);
6516	if (!(mask & (1 << (n - 1))))
6517		return (0);
6518	return (n);
6519}
6520
6521/*
6522 * Return a fallback rate for the given rate.
6523 *
6524 * Note: Don't fall back from OFDM to CCK.
6525 */
6526static uint8_t
6527bwn_get_fbrate(uint8_t bitrate)
6528{
6529	switch (bitrate) {
6530	/* CCK */
6531	case BWN_CCK_RATE_1MB:
6532		return (BWN_CCK_RATE_1MB);
6533	case BWN_CCK_RATE_2MB:
6534		return (BWN_CCK_RATE_1MB);
6535	case BWN_CCK_RATE_5MB:
6536		return (BWN_CCK_RATE_2MB);
6537	case BWN_CCK_RATE_11MB:
6538		return (BWN_CCK_RATE_5MB);
6539
6540	/* OFDM */
6541	case BWN_OFDM_RATE_6MB:
6542		return (BWN_OFDM_RATE_6MB);
6543	case BWN_OFDM_RATE_9MB:
6544		return (BWN_OFDM_RATE_6MB);
6545	case BWN_OFDM_RATE_12MB:
6546		return (BWN_OFDM_RATE_9MB);
6547	case BWN_OFDM_RATE_18MB:
6548		return (BWN_OFDM_RATE_12MB);
6549	case BWN_OFDM_RATE_24MB:
6550		return (BWN_OFDM_RATE_18MB);
6551	case BWN_OFDM_RATE_36MB:
6552		return (BWN_OFDM_RATE_24MB);
6553	case BWN_OFDM_RATE_48MB:
6554		return (BWN_OFDM_RATE_36MB);
6555	case BWN_OFDM_RATE_54MB:
6556		return (BWN_OFDM_RATE_48MB);
6557	}
6558	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6559	return (0);
6560}
6561
6562static uint32_t
6563bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6564    uint32_t ctl, const void *_data, int len)
6565{
6566	struct bwn_softc *sc = mac->mac_sc;
6567	uint32_t value = 0;
6568	const uint8_t *data = _data;
6569
6570	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6571	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6572	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6573
6574	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6575	    tq->tq_base + BWN_PIO8_TXDATA);
6576	if (len & 3) {
6577		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6578		    BWN_PIO8_TXCTL_24_31);
6579		data = &(data[len - 1]);
6580		switch (len & 3) {
6581		case 3:
6582			ctl |= BWN_PIO8_TXCTL_16_23;
6583			value |= (uint32_t)(*data) << 16;
6584			data--;
6585		case 2:
6586			ctl |= BWN_PIO8_TXCTL_8_15;
6587			value |= (uint32_t)(*data) << 8;
6588			data--;
6589		case 1:
6590			value |= (uint32_t)(*data);
6591		}
6592		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6593		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6594	}
6595
6596	return (ctl);
6597}
6598
6599static void
6600bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6601    uint16_t offset, uint32_t value)
6602{
6603
6604	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6605}
6606
6607static uint16_t
6608bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6609    uint16_t ctl, const void *_data, int len)
6610{
6611	struct bwn_softc *sc = mac->mac_sc;
6612	const uint8_t *data = _data;
6613
6614	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6615	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6616
6617	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6618	    tq->tq_base + BWN_PIO_TXDATA);
6619	if (len & 1) {
6620		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6621		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6622		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6623	}
6624
6625	return (ctl);
6626}
6627
6628static uint16_t
6629bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6630    uint16_t ctl, struct mbuf *m0)
6631{
6632	int i, j = 0;
6633	uint16_t data = 0;
6634	const uint8_t *buf;
6635	struct mbuf *m = m0;
6636
6637	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6638	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6639
6640	for (; m != NULL; m = m->m_next) {
6641		buf = mtod(m, const uint8_t *);
6642		for (i = 0; i < m->m_len; i++) {
6643			if (!((j++) % 2))
6644				data |= buf[i];
6645			else {
6646				data |= (buf[i] << 8);
6647				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6648				data = 0;
6649			}
6650		}
6651	}
6652	if (m0->m_pkthdr.len % 2) {
6653		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6654		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6655		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6656	}
6657
6658	return (ctl);
6659}
6660
6661static void
6662bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6663{
6664
6665	/* XXX should exit if 5GHz band .. */
6666	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6667		return;
6668
6669	BWN_WRITE_2(mac, 0x684, 510 + time);
6670	/* Disabled in Linux b43, can adversely effect performance */
6671#if 0
6672	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6673#endif
6674}
6675
6676static struct bwn_dma_ring *
6677bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6678{
6679
6680	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6681		return (mac->mac_method.dma.wme[WME_AC_BE]);
6682
6683	switch (prio) {
6684	case 3:
6685		return (mac->mac_method.dma.wme[WME_AC_VO]);
6686	case 2:
6687		return (mac->mac_method.dma.wme[WME_AC_VI]);
6688	case 0:
6689		return (mac->mac_method.dma.wme[WME_AC_BE]);
6690	case 1:
6691		return (mac->mac_method.dma.wme[WME_AC_BK]);
6692	}
6693	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6694	return (NULL);
6695}
6696
6697static int
6698bwn_dma_getslot(struct bwn_dma_ring *dr)
6699{
6700	int slot;
6701
6702	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6703
6704	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6705	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6706	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6707
6708	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6709	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6710	dr->dr_curslot = slot;
6711	dr->dr_usedslot++;
6712
6713	return (slot);
6714}
6715
6716static struct bwn_pio_txqueue *
6717bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6718    struct bwn_pio_txpkt **pack)
6719{
6720	struct bwn_pio *pio = &mac->mac_method.pio;
6721	struct bwn_pio_txqueue *tq = NULL;
6722	unsigned int index;
6723
6724	switch (cookie & 0xf000) {
6725	case 0x1000:
6726		tq = &pio->wme[WME_AC_BK];
6727		break;
6728	case 0x2000:
6729		tq = &pio->wme[WME_AC_BE];
6730		break;
6731	case 0x3000:
6732		tq = &pio->wme[WME_AC_VI];
6733		break;
6734	case 0x4000:
6735		tq = &pio->wme[WME_AC_VO];
6736		break;
6737	case 0x5000:
6738		tq = &pio->mcast;
6739		break;
6740	}
6741	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6742	if (tq == NULL)
6743		return (NULL);
6744	index = (cookie & 0x0fff);
6745	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6746	if (index >= N(tq->tq_pkts))
6747		return (NULL);
6748	*pack = &tq->tq_pkts[index];
6749	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6750	return (tq);
6751}
6752
6753static void
6754bwn_txpwr(void *arg, int npending)
6755{
6756	struct bwn_mac *mac = arg;
6757	struct bwn_softc *sc = mac->mac_sc;
6758
6759	BWN_LOCK(sc);
6760	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6761	    mac->mac_phy.set_txpwr != NULL)
6762		mac->mac_phy.set_txpwr(mac);
6763	BWN_UNLOCK(sc);
6764}
6765
6766static void
6767bwn_task_15s(struct bwn_mac *mac)
6768{
6769	uint16_t reg;
6770
6771	if (mac->mac_fw.opensource) {
6772		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6773		if (reg) {
6774			bwn_restart(mac, "fw watchdog");
6775			return;
6776		}
6777		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6778	}
6779	if (mac->mac_phy.task_15s)
6780		mac->mac_phy.task_15s(mac);
6781
6782	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6783}
6784
6785static void
6786bwn_task_30s(struct bwn_mac *mac)
6787{
6788
6789	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6790		return;
6791	mac->mac_noise.noi_running = 1;
6792	mac->mac_noise.noi_nsamples = 0;
6793
6794	bwn_noise_gensample(mac);
6795}
6796
6797static void
6798bwn_task_60s(struct bwn_mac *mac)
6799{
6800
6801	if (mac->mac_phy.task_60s)
6802		mac->mac_phy.task_60s(mac);
6803	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6804}
6805
6806static void
6807bwn_tasks(void *arg)
6808{
6809	struct bwn_mac *mac = arg;
6810	struct bwn_softc *sc = mac->mac_sc;
6811
6812	BWN_ASSERT_LOCKED(sc);
6813	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6814		return;
6815
6816	if (mac->mac_task_state % 4 == 0)
6817		bwn_task_60s(mac);
6818	if (mac->mac_task_state % 2 == 0)
6819		bwn_task_30s(mac);
6820	bwn_task_15s(mac);
6821
6822	mac->mac_task_state++;
6823	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6824}
6825
6826static int
6827bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6828{
6829	struct bwn_softc *sc = mac->mac_sc;
6830
6831	KASSERT(a == 0, ("not support APHY\n"));
6832
6833	switch (plcp->o.raw[0] & 0xf) {
6834	case 0xb:
6835		return (BWN_OFDM_RATE_6MB);
6836	case 0xf:
6837		return (BWN_OFDM_RATE_9MB);
6838	case 0xa:
6839		return (BWN_OFDM_RATE_12MB);
6840	case 0xe:
6841		return (BWN_OFDM_RATE_18MB);
6842	case 0x9:
6843		return (BWN_OFDM_RATE_24MB);
6844	case 0xd:
6845		return (BWN_OFDM_RATE_36MB);
6846	case 0x8:
6847		return (BWN_OFDM_RATE_48MB);
6848	case 0xc:
6849		return (BWN_OFDM_RATE_54MB);
6850	}
6851	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6852	    plcp->o.raw[0] & 0xf);
6853	return (-1);
6854}
6855
6856static int
6857bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6858{
6859	struct bwn_softc *sc = mac->mac_sc;
6860
6861	switch (plcp->o.raw[0]) {
6862	case 0x0a:
6863		return (BWN_CCK_RATE_1MB);
6864	case 0x14:
6865		return (BWN_CCK_RATE_2MB);
6866	case 0x37:
6867		return (BWN_CCK_RATE_5MB);
6868	case 0x6e:
6869		return (BWN_CCK_RATE_11MB);
6870	}
6871	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6872	return (-1);
6873}
6874
6875static void
6876bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6877    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6878    int rssi, int noise)
6879{
6880	struct bwn_softc *sc = mac->mac_sc;
6881	const struct ieee80211_frame_min *wh;
6882	uint64_t tsf;
6883	uint16_t low_mactime_now;
6884	uint16_t mt;
6885
6886	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6887		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6888
6889	wh = mtod(m, const struct ieee80211_frame_min *);
6890	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6891		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6892
6893	bwn_tsf_read(mac, &tsf);
6894	low_mactime_now = tsf;
6895	tsf = tsf & ~0xffffULL;
6896
6897	switch (mac->mac_fw.fw_hdr_format) {
6898	case BWN_FW_HDR_351:
6899	case BWN_FW_HDR_410:
6900		mt = le16toh(rxhdr->ps4.r351.mac_time);
6901		break;
6902	case BWN_FW_HDR_598:
6903		mt = le16toh(rxhdr->ps4.r598.mac_time);
6904		break;
6905	}
6906
6907	tsf += mt;
6908	if (low_mactime_now < mt)
6909		tsf -= 0x10000;
6910
6911	sc->sc_rx_th.wr_tsf = tsf;
6912	sc->sc_rx_th.wr_rate = rate;
6913	sc->sc_rx_th.wr_antsignal = rssi;
6914	sc->sc_rx_th.wr_antnoise = noise;
6915}
6916
6917static void
6918bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6919{
6920	uint32_t low, high;
6921
6922	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6923	    ("%s:%d: fail", __func__, __LINE__));
6924
6925	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6926	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6927	*tsf = high;
6928	*tsf <<= 32;
6929	*tsf |= low;
6930}
6931
6932static int
6933bwn_dma_attach(struct bwn_mac *mac)
6934{
6935	struct bwn_dma *dma = &mac->mac_method.dma;
6936	struct bwn_softc *sc = mac->mac_sc;
6937	bus_addr_t lowaddr = 0;
6938	int error;
6939
6940	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6941		return (0);
6942
6943	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6944
6945	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6946
6947	dma->dmatype = bwn_dma_gettype(mac);
6948	if (dma->dmatype == BWN_DMA_30BIT)
6949		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6950	else if (dma->dmatype == BWN_DMA_32BIT)
6951		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6952	else
6953		lowaddr = BUS_SPACE_MAXADDR;
6954
6955	/*
6956	 * Create top level DMA tag
6957	 */
6958	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6959			       BWN_ALIGN, 0,		/* alignment, bounds */
6960			       lowaddr,			/* lowaddr */
6961			       BUS_SPACE_MAXADDR,	/* highaddr */
6962			       NULL, NULL,		/* filter, filterarg */
6963			       BUS_SPACE_MAXSIZE,	/* maxsize */
6964			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6965			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6966			       0,			/* flags */
6967			       NULL, NULL,		/* lockfunc, lockarg */
6968			       &dma->parent_dtag);
6969	if (error) {
6970		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6971		return (error);
6972	}
6973
6974	/*
6975	 * Create TX/RX mbuf DMA tag
6976	 */
6977	error = bus_dma_tag_create(dma->parent_dtag,
6978				1,
6979				0,
6980				BUS_SPACE_MAXADDR,
6981				BUS_SPACE_MAXADDR,
6982				NULL, NULL,
6983				MCLBYTES,
6984				1,
6985				BUS_SPACE_MAXSIZE_32BIT,
6986				0,
6987				NULL, NULL,
6988				&dma->rxbuf_dtag);
6989	if (error) {
6990		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6991		goto fail0;
6992	}
6993	error = bus_dma_tag_create(dma->parent_dtag,
6994				1,
6995				0,
6996				BUS_SPACE_MAXADDR,
6997				BUS_SPACE_MAXADDR,
6998				NULL, NULL,
6999				MCLBYTES,
7000				1,
7001				BUS_SPACE_MAXSIZE_32BIT,
7002				0,
7003				NULL, NULL,
7004				&dma->txbuf_dtag);
7005	if (error) {
7006		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7007		goto fail1;
7008	}
7009
7010	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7011	if (!dma->wme[WME_AC_BK])
7012		goto fail2;
7013
7014	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7015	if (!dma->wme[WME_AC_BE])
7016		goto fail3;
7017
7018	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7019	if (!dma->wme[WME_AC_VI])
7020		goto fail4;
7021
7022	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7023	if (!dma->wme[WME_AC_VO])
7024		goto fail5;
7025
7026	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7027	if (!dma->mcast)
7028		goto fail6;
7029	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7030	if (!dma->rx)
7031		goto fail7;
7032
7033	return (error);
7034
7035fail7:	bwn_dma_ringfree(&dma->mcast);
7036fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7037fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7038fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7039fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7040fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7041fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7042fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7043	return (error);
7044}
7045
7046static struct bwn_dma_ring *
7047bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7048    uint16_t cookie, int *slot)
7049{
7050	struct bwn_dma *dma = &mac->mac_method.dma;
7051	struct bwn_dma_ring *dr;
7052	struct bwn_softc *sc = mac->mac_sc;
7053
7054	BWN_ASSERT_LOCKED(mac->mac_sc);
7055
7056	switch (cookie & 0xf000) {
7057	case 0x1000:
7058		dr = dma->wme[WME_AC_BK];
7059		break;
7060	case 0x2000:
7061		dr = dma->wme[WME_AC_BE];
7062		break;
7063	case 0x3000:
7064		dr = dma->wme[WME_AC_VI];
7065		break;
7066	case 0x4000:
7067		dr = dma->wme[WME_AC_VO];
7068		break;
7069	case 0x5000:
7070		dr = dma->mcast;
7071		break;
7072	default:
7073		dr = NULL;
7074		KASSERT(0 == 1,
7075		    ("invalid cookie value %d", cookie & 0xf000));
7076	}
7077	*slot = (cookie & 0x0fff);
7078	if (*slot < 0 || *slot >= dr->dr_numslots) {
7079		/*
7080		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7081		 * that it occurs events which have same H/W sequence numbers.
7082		 * When it's occurred just prints a WARNING msgs and ignores.
7083		 */
7084		KASSERT(status->seq == dma->lastseq,
7085		    ("%s:%d: fail", __func__, __LINE__));
7086		device_printf(sc->sc_dev,
7087		    "out of slot ranges (0 < %d < %d)\n", *slot,
7088		    dr->dr_numslots);
7089		return (NULL);
7090	}
7091	dma->lastseq = status->seq;
7092	return (dr);
7093}
7094
7095static void
7096bwn_dma_stop(struct bwn_mac *mac)
7097{
7098	struct bwn_dma *dma;
7099
7100	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7101		return;
7102	dma = &mac->mac_method.dma;
7103
7104	bwn_dma_ringstop(&dma->rx);
7105	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7106	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7107	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7108	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7109	bwn_dma_ringstop(&dma->mcast);
7110}
7111
7112static void
7113bwn_dma_ringstop(struct bwn_dma_ring **dr)
7114{
7115
7116	if (dr == NULL)
7117		return;
7118
7119	bwn_dma_cleanup(*dr);
7120}
7121
7122static void
7123bwn_pio_stop(struct bwn_mac *mac)
7124{
7125	struct bwn_pio *pio;
7126
7127	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7128		return;
7129	pio = &mac->mac_method.pio;
7130
7131	bwn_destroy_queue_tx(&pio->mcast);
7132	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7133	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7134	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7135	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7136}
7137
7138static void
7139bwn_led_attach(struct bwn_mac *mac)
7140{
7141	struct bwn_softc *sc = mac->mac_sc;
7142	const uint8_t *led_act = NULL;
7143	uint16_t val[BWN_LED_MAX];
7144	int i;
7145
7146	sc->sc_led_idle = (2350 * hz) / 1000;
7147	sc->sc_led_blink = 1;
7148
7149	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7150		if (siba_get_pci_subvendor(sc->sc_dev) ==
7151		    bwn_vendor_led_act[i].vid) {
7152			led_act = bwn_vendor_led_act[i].led_act;
7153			break;
7154		}
7155	}
7156	if (led_act == NULL)
7157		led_act = bwn_default_led_act;
7158
7159	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7160	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7161	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7162	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7163
7164	for (i = 0; i < BWN_LED_MAX; ++i) {
7165		struct bwn_led *led = &sc->sc_leds[i];
7166
7167		if (val[i] == 0xff) {
7168			led->led_act = led_act[i];
7169		} else {
7170			if (val[i] & BWN_LED_ACT_LOW)
7171				led->led_flags |= BWN_LED_F_ACTLOW;
7172			led->led_act = val[i] & BWN_LED_ACT_MASK;
7173		}
7174		led->led_mask = (1 << i);
7175
7176		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7177		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7178		    led->led_act == BWN_LED_ACT_BLINK) {
7179			led->led_flags |= BWN_LED_F_BLINK;
7180			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7181				led->led_flags |= BWN_LED_F_POLLABLE;
7182			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7183				led->led_flags |= BWN_LED_F_SLOW;
7184
7185			if (sc->sc_blink_led == NULL) {
7186				sc->sc_blink_led = led;
7187				if (led->led_flags & BWN_LED_F_SLOW)
7188					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7189			}
7190		}
7191
7192		DPRINTF(sc, BWN_DEBUG_LED,
7193		    "%dth led, act %d, lowact %d\n", i,
7194		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7195	}
7196	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7197}
7198
7199static __inline uint16_t
7200bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7201{
7202
7203	if (led->led_flags & BWN_LED_F_ACTLOW)
7204		on = !on;
7205	if (on)
7206		val |= led->led_mask;
7207	else
7208		val &= ~led->led_mask;
7209	return val;
7210}
7211
7212static void
7213bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7214{
7215	struct bwn_softc *sc = mac->mac_sc;
7216	struct ieee80211com *ic = &sc->sc_ic;
7217	uint16_t val;
7218	int i;
7219
7220	if (nstate == IEEE80211_S_INIT) {
7221		callout_stop(&sc->sc_led_blink_ch);
7222		sc->sc_led_blinking = 0;
7223	}
7224
7225	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7226		return;
7227
7228	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7229	for (i = 0; i < BWN_LED_MAX; ++i) {
7230		struct bwn_led *led = &sc->sc_leds[i];
7231		int on;
7232
7233		if (led->led_act == BWN_LED_ACT_UNKN ||
7234		    led->led_act == BWN_LED_ACT_NULL)
7235			continue;
7236
7237		if ((led->led_flags & BWN_LED_F_BLINK) &&
7238		    nstate != IEEE80211_S_INIT)
7239			continue;
7240
7241		switch (led->led_act) {
7242		case BWN_LED_ACT_ON:    /* Always on */
7243			on = 1;
7244			break;
7245		case BWN_LED_ACT_OFF:   /* Always off */
7246		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7247			on = 0;
7248			break;
7249		default:
7250			on = 1;
7251			switch (nstate) {
7252			case IEEE80211_S_INIT:
7253				on = 0;
7254				break;
7255			case IEEE80211_S_RUN:
7256				if (led->led_act == BWN_LED_ACT_11G &&
7257				    ic->ic_curmode != IEEE80211_MODE_11G)
7258					on = 0;
7259				break;
7260			default:
7261				if (led->led_act == BWN_LED_ACT_ASSOC)
7262					on = 0;
7263				break;
7264			}
7265			break;
7266		}
7267
7268		val = bwn_led_onoff(led, val, on);
7269	}
7270	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7271}
7272
7273static void
7274bwn_led_event(struct bwn_mac *mac, int event)
7275{
7276	struct bwn_softc *sc = mac->mac_sc;
7277	struct bwn_led *led = sc->sc_blink_led;
7278	int rate;
7279
7280	if (event == BWN_LED_EVENT_POLL) {
7281		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7282			return;
7283		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7284			return;
7285	}
7286
7287	sc->sc_led_ticks = ticks;
7288	if (sc->sc_led_blinking)
7289		return;
7290
7291	switch (event) {
7292	case BWN_LED_EVENT_RX:
7293		rate = sc->sc_rx_rate;
7294		break;
7295	case BWN_LED_EVENT_TX:
7296		rate = sc->sc_tx_rate;
7297		break;
7298	case BWN_LED_EVENT_POLL:
7299		rate = 0;
7300		break;
7301	default:
7302		panic("unknown LED event %d\n", event);
7303		break;
7304	}
7305	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7306	    bwn_led_duration[rate].off_dur);
7307}
7308
7309static void
7310bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7311{
7312	struct bwn_softc *sc = mac->mac_sc;
7313	struct bwn_led *led = sc->sc_blink_led;
7314	uint16_t val;
7315
7316	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7317	val = bwn_led_onoff(led, val, 1);
7318	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7319
7320	if (led->led_flags & BWN_LED_F_SLOW) {
7321		BWN_LED_SLOWDOWN(on_dur);
7322		BWN_LED_SLOWDOWN(off_dur);
7323	}
7324
7325	sc->sc_led_blinking = 1;
7326	sc->sc_led_blink_offdur = off_dur;
7327
7328	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7329}
7330
7331static void
7332bwn_led_blink_next(void *arg)
7333{
7334	struct bwn_mac *mac = arg;
7335	struct bwn_softc *sc = mac->mac_sc;
7336	uint16_t val;
7337
7338	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7339	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7340	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7341
7342	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7343	    bwn_led_blink_end, mac);
7344}
7345
7346static void
7347bwn_led_blink_end(void *arg)
7348{
7349	struct bwn_mac *mac = arg;
7350	struct bwn_softc *sc = mac->mac_sc;
7351
7352	sc->sc_led_blinking = 0;
7353}
7354
7355static int
7356bwn_suspend(device_t dev)
7357{
7358	struct bwn_softc *sc = device_get_softc(dev);
7359
7360	BWN_LOCK(sc);
7361	bwn_stop(sc);
7362	BWN_UNLOCK(sc);
7363	return (0);
7364}
7365
7366static int
7367bwn_resume(device_t dev)
7368{
7369	struct bwn_softc *sc = device_get_softc(dev);
7370	int error = EDOOFUS;
7371
7372	BWN_LOCK(sc);
7373	if (sc->sc_ic.ic_nrunning > 0)
7374		error = bwn_init(sc);
7375	BWN_UNLOCK(sc);
7376	if (error == 0)
7377		ieee80211_start_all(&sc->sc_ic);
7378	return (0);
7379}
7380
7381static void
7382bwn_rfswitch(void *arg)
7383{
7384	struct bwn_softc *sc = arg;
7385	struct bwn_mac *mac = sc->sc_curmac;
7386	int cur = 0, prev = 0;
7387
7388	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7389	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7390
7391	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7392	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7393		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7394			& BWN_RF_HWENABLED_HI_MASK))
7395			cur = 1;
7396	} else {
7397		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7398		    & BWN_RF_HWENABLED_LO_MASK)
7399			cur = 1;
7400	}
7401
7402	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7403		prev = 1;
7404
7405	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7406	    __func__, cur, prev);
7407
7408	if (cur != prev) {
7409		if (cur)
7410			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7411		else
7412			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7413
7414		device_printf(sc->sc_dev,
7415		    "status of RF switch is changed to %s\n",
7416		    cur ? "ON" : "OFF");
7417		if (cur != mac->mac_phy.rf_on) {
7418			if (cur)
7419				bwn_rf_turnon(mac);
7420			else
7421				bwn_rf_turnoff(mac);
7422		}
7423	}
7424
7425	callout_schedule(&sc->sc_rfswitch_ch, hz);
7426}
7427
7428static void
7429bwn_sysctl_node(struct bwn_softc *sc)
7430{
7431	device_t dev = sc->sc_dev;
7432	struct bwn_mac *mac;
7433	struct bwn_stats *stats;
7434
7435	/* XXX assume that count of MAC is only 1. */
7436
7437	if ((mac = sc->sc_curmac) == NULL)
7438		return;
7439	stats = &mac->mac_stats;
7440
7441	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7442	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7443	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7444	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7445	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7446	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7447	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7448	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7449	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7450
7451#ifdef BWN_DEBUG
7452	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7453	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7455#endif
7456}
7457
7458static device_method_t bwn_methods[] = {
7459	/* Device interface */
7460	DEVMETHOD(device_probe,		bwn_probe),
7461	DEVMETHOD(device_attach,	bwn_attach),
7462	DEVMETHOD(device_detach,	bwn_detach),
7463	DEVMETHOD(device_suspend,	bwn_suspend),
7464	DEVMETHOD(device_resume,	bwn_resume),
7465	DEVMETHOD_END
7466};
7467static driver_t bwn_driver = {
7468	"bwn",
7469	bwn_methods,
7470	sizeof(struct bwn_softc)
7471};
7472static devclass_t bwn_devclass;
7473DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7474MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7475MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7476MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7477MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7478MODULE_VERSION(bwn, 1);
7479