if_bwn.c revision 301434
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/bwn/if_bwn.c 301434 2016-06-05 07:55:21Z adrian $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include "opt_bwn.h"
38#include "opt_wlan.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/malloc.h>
44#include <sys/module.h>
45#include <sys/endian.h>
46#include <sys/errno.h>
47#include <sys/firmware.h>
48#include <sys/lock.h>
49#include <sys/mutex.h>
50#include <machine/bus.h>
51#include <machine/resource.h>
52#include <sys/bus.h>
53#include <sys/rman.h>
54#include <sys/socket.h>
55#include <sys/sockio.h>
56
57#include <net/ethernet.h>
58#include <net/if.h>
59#include <net/if_var.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_llc.h>
63#include <net/if_media.h>
64#include <net/if_types.h>
65
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcireg.h>
68#include <dev/siba/siba_ids.h>
69#include <dev/siba/sibareg.h>
70#include <dev/siba/sibavar.h>
71
72#include <net80211/ieee80211_var.h>
73#include <net80211/ieee80211_radiotap.h>
74#include <net80211/ieee80211_regdomain.h>
75#include <net80211/ieee80211_phy.h>
76#include <net80211/ieee80211_ratectl.h>
77
78#include <dev/bwn/if_bwnreg.h>
79#include <dev/bwn/if_bwnvar.h>
80
81#include <dev/bwn/if_bwn_debug.h>
82#include <dev/bwn/if_bwn_misc.h>
83#include <dev/bwn/if_bwn_util.h>
84#include <dev/bwn/if_bwn_phy_common.h>
85#include <dev/bwn/if_bwn_phy_g.h>
86#include <dev/bwn/if_bwn_phy_lp.h>
87#include <dev/bwn/if_bwn_phy_n.h>
88
89static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90    "Broadcom driver parameters");
91
92/*
93 * Tunable & sysctl variables.
94 */
95
96#ifdef BWN_DEBUG
97static	int bwn_debug = 0;
98SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99    "Broadcom debugging printfs");
100#endif
101
102static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104    "uses Bad Frames Preemption");
105static int	bwn_bluetooth = 1;
106SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107    "turns on Bluetooth Coexistence");
108static int	bwn_hwpctl = 0;
109SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110    "uses H/W power control");
111static int	bwn_msi_disable = 0;		/* MSI disabled  */
112TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113static int	bwn_usedma = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115    "uses DMA");
116TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117static int	bwn_wme = 1;
118SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119    "uses WME support");
120
121static void	bwn_attach_pre(struct bwn_softc *);
122static int	bwn_attach_post(struct bwn_softc *);
123static void	bwn_sprom_bugfixes(device_t);
124static int	bwn_init(struct bwn_softc *);
125static void	bwn_parent(struct ieee80211com *);
126static void	bwn_start(struct bwn_softc *);
127static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128static int	bwn_attach_core(struct bwn_mac *);
129static int	bwn_phy_getinfo(struct bwn_mac *, int);
130static int	bwn_chiptest(struct bwn_mac *);
131static int	bwn_setup_channels(struct bwn_mac *, int, int);
132static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133		    uint16_t);
134static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135		    const struct bwn_channelinfo *, const uint8_t []);
136static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137		    const struct ieee80211_bpf_params *);
138static void	bwn_updateslot(struct ieee80211com *);
139static void	bwn_update_promisc(struct ieee80211com *);
140static void	bwn_wme_init(struct bwn_mac *);
141static int	bwn_wme_update(struct ieee80211com *);
142static void	bwn_wme_clear(struct bwn_softc *);
143static void	bwn_wme_load(struct bwn_mac *);
144static void	bwn_wme_loadparams(struct bwn_mac *,
145		    const struct wmeParams *, uint16_t);
146static void	bwn_scan_start(struct ieee80211com *);
147static void	bwn_scan_end(struct ieee80211com *);
148static void	bwn_set_channel(struct ieee80211com *);
149static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151		    const uint8_t [IEEE80211_ADDR_LEN],
152		    const uint8_t [IEEE80211_ADDR_LEN]);
153static void	bwn_vap_delete(struct ieee80211vap *);
154static void	bwn_stop(struct bwn_softc *);
155static int	bwn_core_init(struct bwn_mac *);
156static void	bwn_core_start(struct bwn_mac *);
157static void	bwn_core_exit(struct bwn_mac *);
158static void	bwn_bt_disable(struct bwn_mac *);
159static int	bwn_chip_init(struct bwn_mac *);
160static void	bwn_set_txretry(struct bwn_mac *, int, int);
161static void	bwn_rate_init(struct bwn_mac *);
162static void	bwn_set_phytxctl(struct bwn_mac *);
163static void	bwn_spu_setdelay(struct bwn_mac *, int);
164static void	bwn_bt_enable(struct bwn_mac *);
165static void	bwn_set_macaddr(struct bwn_mac *);
166static void	bwn_crypt_init(struct bwn_mac *);
167static void	bwn_chip_exit(struct bwn_mac *);
168static int	bwn_fw_fillinfo(struct bwn_mac *);
169static int	bwn_fw_loaducode(struct bwn_mac *);
170static int	bwn_gpio_init(struct bwn_mac *);
171static int	bwn_fw_loadinitvals(struct bwn_mac *);
172static int	bwn_phy_init(struct bwn_mac *);
173static void	bwn_set_txantenna(struct bwn_mac *, int);
174static void	bwn_set_opmode(struct bwn_mac *);
175static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176static uint8_t	bwn_plcp_getcck(const uint8_t);
177static uint8_t	bwn_plcp_getofdm(const uint8_t);
178static void	bwn_pio_init(struct bwn_mac *);
179static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181		    int);
182static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183		    struct bwn_pio_rxqueue *, int);
184static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186		    uint16_t);
187static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190static void	bwn_pio_handle_txeof(struct bwn_mac *,
191		    const struct bwn_txstatus *);
192static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195		    uint16_t);
196static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197		    uint32_t);
198static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199		    struct mbuf *);
200static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204		    uint16_t, uint32_t);
205static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210		    uint16_t, struct bwn_pio_txpkt **);
211static void	bwn_dma_init(struct bwn_mac *);
212static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213static int	bwn_dma_mask2type(uint64_t);
214static uint64_t	bwn_dma_mask(struct bwn_mac *);
215static uint16_t	bwn_dma_base(int, int);
216static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218		    int, struct bwn_dmadesc_generic **,
219		    struct bwn_dmadesc_meta **);
220static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222		    int, int);
223static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229		    int, struct bwn_dmadesc_generic **,
230		    struct bwn_dmadesc_meta **);
231static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233		    int, int);
234static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240static void	bwn_dma_setup(struct bwn_dma_ring *);
241static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245static void	bwn_dma_rx(struct bwn_dma_ring *);
246static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248		    struct bwn_dmadesc_meta *);
249static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250static int	bwn_dma_gettype(struct bwn_mac *);
251static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257		    int);
258static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259		    bus_size_t, int);
260static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261static void	bwn_dma_handle_txeof(struct bwn_mac *,
262		    const struct bwn_txstatus *);
263static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264		    struct mbuf *);
265static int	bwn_dma_getslot(struct bwn_dma_ring *);
266static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267		    uint8_t);
268static int	bwn_dma_attach(struct bwn_mac *);
269static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270		    int, int, int);
271static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272		    const struct bwn_txstatus *, uint16_t, int *);
273static void	bwn_dma_free(struct bwn_mac *);
274static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276		    const char *, struct bwn_fwfile *);
277static void	bwn_release_firmware(struct bwn_mac *);
278static void	bwn_do_release_fw(struct bwn_fwfile *);
279static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280static int	bwn_fwinitvals_write(struct bwn_mac *,
281		    const struct bwn_fwinitvals *, size_t, size_t);
282static uint16_t	bwn_ant2phy(int);
283static void	bwn_mac_write_bssid(struct bwn_mac *);
284static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285		    const uint8_t *);
286static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *, size_t, const uint8_t *);
288static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289		    const uint8_t *);
290static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291		    const uint8_t *);
292static void	bwn_phy_exit(struct bwn_mac *);
293static void	bwn_core_stop(struct bwn_mac *);
294static int	bwn_switch_band(struct bwn_softc *,
295		    struct ieee80211_channel *);
296static void	bwn_phy_reset(struct bwn_mac *);
297static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298static void	bwn_set_pretbtt(struct bwn_mac *);
299static int	bwn_intr(void *);
300static void	bwn_intrtask(void *, int);
301static void	bwn_restart(struct bwn_mac *, const char *);
302static void	bwn_intr_ucode_debug(struct bwn_mac *);
303static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304static void	bwn_intr_atim_end(struct bwn_mac *);
305static void	bwn_intr_beacon(struct bwn_mac *);
306static void	bwn_intr_pmq(struct bwn_mac *);
307static void	bwn_intr_noise(struct bwn_mac *);
308static void	bwn_intr_txeof(struct bwn_mac *);
309static void	bwn_hwreset(void *, int);
310static void	bwn_handle_fwpanic(struct bwn_mac *);
311static void	bwn_load_beacon0(struct bwn_mac *);
312static void	bwn_load_beacon1(struct bwn_mac *);
313static uint32_t	bwn_jssi_read(struct bwn_mac *);
314static void	bwn_noise_gensample(struct bwn_mac *);
315static void	bwn_handle_txeof(struct bwn_mac *,
316		    const struct bwn_txstatus *);
317static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320		    struct mbuf *);
321static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322static int	bwn_set_txhdr(struct bwn_mac *,
323		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324		    uint16_t);
325static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326		    const uint8_t);
327static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328static uint8_t	bwn_get_fbrate(uint8_t);
329static void	bwn_txpwr(void *, int);
330static void	bwn_tasks(void *);
331static void	bwn_task_15s(struct bwn_mac *);
332static void	bwn_task_30s(struct bwn_mac *);
333static void	bwn_task_60s(struct bwn_mac *);
334static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335		    uint8_t);
336static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339		    int, int);
340static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342static void	bwn_watchdog(void *);
343static void	bwn_dma_stop(struct bwn_mac *);
344static void	bwn_pio_stop(struct bwn_mac *);
345static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346static void	bwn_led_attach(struct bwn_mac *);
347static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348static void	bwn_led_event(struct bwn_mac *, int);
349static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350static void	bwn_led_blink_next(void *);
351static void	bwn_led_blink_end(void *);
352static void	bwn_rfswitch(void *);
353static void	bwn_rf_turnon(struct bwn_mac *);
354static void	bwn_rf_turnoff(struct bwn_mac *);
355static void	bwn_sysctl_node(struct bwn_softc *);
356
357static struct resource_spec bwn_res_spec_legacy[] = {
358	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359	{ -1,			0,		0 }
360};
361
362static struct resource_spec bwn_res_spec_msi[] = {
363	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364	{ -1,			0,		0 }
365};
366
367static const struct bwn_channelinfo bwn_chantable_bg = {
368	.channels = {
369		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374	.nchannels = 14
375};
376
377static const struct bwn_channelinfo bwn_chantable_a = {
378	.channels = {
379		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391		{ 6080, 216, 30 } },
392	.nchannels = 37
393};
394
395#if 0
396static const struct bwn_channelinfo bwn_chantable_n = {
397	.channels = {
398		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435	.nchannels = 110
436};
437#endif
438
439#define	VENDOR_LED_ACT(vendor)				\
440{							\
441	.vid = PCI_VENDOR_##vendor,			\
442	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443}
444
445static const struct {
446	uint16_t	vid;
447	uint8_t		led_act[BWN_LED_MAX];
448} bwn_vendor_led_act[] = {
449	VENDOR_LED_ACT(COMPAQ),
450	VENDOR_LED_ACT(ASUSTEK)
451};
452
453static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454	{ BWN_VENDOR_LED_ACT_DEFAULT };
455
456#undef VENDOR_LED_ACT
457
458static const struct {
459	int		on_dur;
460	int		off_dur;
461} bwn_led_duration[109] = {
462	[0]	= { 400, 100 },
463	[2]	= { 150, 75 },
464	[4]	= { 90, 45 },
465	[11]	= { 66, 34 },
466	[12]	= { 53, 26 },
467	[18]	= { 42, 21 },
468	[22]	= { 35, 17 },
469	[24]	= { 32, 16 },
470	[36]	= { 21, 10 },
471	[48]	= { 16, 8 },
472	[72]	= { 11, 5 },
473	[96]	= { 9, 4 },
474	[108]	= { 7, 3 }
475};
476
477static const uint16_t bwn_wme_shm_offsets[] = {
478	[0] = BWN_WME_BESTEFFORT,
479	[1] = BWN_WME_BACKGROUND,
480	[2] = BWN_WME_VOICE,
481	[3] = BWN_WME_VIDEO,
482};
483
484static const struct siba_devid bwn_devs[] = {
485	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495};
496
497static int
498bwn_probe(device_t dev)
499{
500	int i;
501
502	for (i = 0; i < nitems(bwn_devs); i++) {
503		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506			return (BUS_PROBE_DEFAULT);
507	}
508
509	return (ENXIO);
510}
511
512static int
513bwn_attach(device_t dev)
514{
515	struct bwn_mac *mac;
516	struct bwn_softc *sc = device_get_softc(dev);
517	int error, i, msic, reg;
518
519	sc->sc_dev = dev;
520#ifdef BWN_DEBUG
521	sc->sc_debug = bwn_debug;
522#endif
523
524	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525		bwn_attach_pre(sc);
526		bwn_sprom_bugfixes(dev);
527		sc->sc_flags |= BWN_FLAG_ATTACHED;
528	}
529
530	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531		if (siba_get_pci_device(dev) != 0x4313 &&
532		    siba_get_pci_device(dev) != 0x431a &&
533		    siba_get_pci_device(dev) != 0x4321) {
534			device_printf(sc->sc_dev,
535			    "skip 802.11 cores\n");
536			return (ENODEV);
537		}
538	}
539
540	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541	mac->mac_sc = sc;
542	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543	if (bwn_bfp != 0)
544		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545
546	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549
550	error = bwn_attach_core(mac);
551	if (error)
552		goto fail0;
553	bwn_led_attach(mac);
554
555	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560	    mac->mac_phy.rf_rev);
561	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563		    mac->mac_method.dma.dmatype);
564	else
565		device_printf(sc->sc_dev, "PIO\n");
566
567#ifdef	BWN_GPL_PHY
568	device_printf(sc->sc_dev,
569	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570#endif
571
572	/*
573	 * setup PCI resources and interrupt.
574	 */
575	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576		msic = pci_msi_count(dev);
577		if (bootverbose)
578			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579	} else
580		msic = 0;
581
582	mac->mac_intr_spec = bwn_res_spec_legacy;
583	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584		if (pci_alloc_msi(dev, &msic) == 0) {
585			device_printf(sc->sc_dev,
586			    "Using %d MSI messages\n", msic);
587			mac->mac_intr_spec = bwn_res_spec_msi;
588			mac->mac_msi = 1;
589		}
590	}
591
592	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593	    mac->mac_res_irq);
594	if (error) {
595		device_printf(sc->sc_dev,
596		    "couldn't allocate IRQ resources (%d)\n", error);
597		goto fail1;
598	}
599
600	if (mac->mac_msi == 0)
601		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603		    &mac->mac_intrhand[0]);
604	else {
605		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608			    &mac->mac_intrhand[i]);
609			if (error != 0) {
610				device_printf(sc->sc_dev,
611				    "couldn't setup interrupt (%d)\n", error);
612				break;
613			}
614		}
615	}
616
617	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618
619	/*
620	 * calls attach-post routine
621	 */
622	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623		bwn_attach_post(sc);
624
625	return (0);
626fail1:
627	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628		pci_release_msi(dev);
629fail0:
630	free(mac, M_DEVBUF);
631	return (error);
632}
633
634static int
635bwn_is_valid_ether_addr(uint8_t *addr)
636{
637	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638
639	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640		return (FALSE);
641
642	return (TRUE);
643}
644
645static int
646bwn_attach_post(struct bwn_softc *sc)
647{
648	struct ieee80211com *ic = &sc->sc_ic;
649
650	ic->ic_softc = sc;
651	ic->ic_name = device_get_nameunit(sc->sc_dev);
652	/* XXX not right but it's not used anywhere important */
653	ic->ic_phytype = IEEE80211_T_OFDM;
654	ic->ic_opmode = IEEE80211_M_STA;
655	ic->ic_caps =
656		  IEEE80211_C_STA		/* station mode supported */
657		| IEEE80211_C_MONITOR		/* monitor mode */
658		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660		| IEEE80211_C_SHSLOT		/* short slot time supported */
661		| IEEE80211_C_WME		/* WME/WMM supported */
662		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663#if 0
664		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665#endif
666		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667		;
668
669	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670
671	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675
676	/* call MI attach routine. */
677	ieee80211_ifattach(ic);
678
679	ic->ic_headroom = sizeof(struct bwn_txhdr);
680
681	/* override default methods */
682	ic->ic_raw_xmit = bwn_raw_xmit;
683	ic->ic_updateslot = bwn_updateslot;
684	ic->ic_update_promisc = bwn_update_promisc;
685	ic->ic_wme.wme_update = bwn_wme_update;
686	ic->ic_scan_start = bwn_scan_start;
687	ic->ic_scan_end = bwn_scan_end;
688	ic->ic_set_channel = bwn_set_channel;
689	ic->ic_vap_create = bwn_vap_create;
690	ic->ic_vap_delete = bwn_vap_delete;
691	ic->ic_transmit = bwn_transmit;
692	ic->ic_parent = bwn_parent;
693
694	ieee80211_radiotap_attach(ic,
695	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696	    BWN_TX_RADIOTAP_PRESENT,
697	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698	    BWN_RX_RADIOTAP_PRESENT);
699
700	bwn_sysctl_node(sc);
701
702	if (bootverbose)
703		ieee80211_announce(ic);
704	return (0);
705}
706
707static void
708bwn_phy_detach(struct bwn_mac *mac)
709{
710
711	if (mac->mac_phy.detach != NULL)
712		mac->mac_phy.detach(mac);
713}
714
715static int
716bwn_detach(device_t dev)
717{
718	struct bwn_softc *sc = device_get_softc(dev);
719	struct bwn_mac *mac = sc->sc_curmac;
720	struct ieee80211com *ic = &sc->sc_ic;
721	int i;
722
723	sc->sc_flags |= BWN_FLAG_INVALID;
724
725	if (device_is_attached(sc->sc_dev)) {
726		BWN_LOCK(sc);
727		bwn_stop(sc);
728		BWN_UNLOCK(sc);
729		bwn_dma_free(mac);
730		callout_drain(&sc->sc_led_blink_ch);
731		callout_drain(&sc->sc_rfswitch_ch);
732		callout_drain(&sc->sc_task_ch);
733		callout_drain(&sc->sc_watchdog_ch);
734		bwn_phy_detach(mac);
735		ieee80211_draintask(ic, &mac->mac_hwreset);
736		ieee80211_draintask(ic, &mac->mac_txpower);
737		ieee80211_ifdetach(ic);
738	}
739	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740	taskqueue_free(sc->sc_tq);
741
742	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743		if (mac->mac_intrhand[i] != NULL) {
744			bus_teardown_intr(dev, mac->mac_res_irq[i],
745			    mac->mac_intrhand[i]);
746			mac->mac_intrhand[i] = NULL;
747		}
748	}
749	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750	if (mac->mac_msi != 0)
751		pci_release_msi(dev);
752	mbufq_drain(&sc->sc_snd);
753	BWN_LOCK_DESTROY(sc);
754	return (0);
755}
756
757static void
758bwn_attach_pre(struct bwn_softc *sc)
759{
760
761	BWN_LOCK_INIT(sc);
762	TAILQ_INIT(&sc->sc_maclist);
763	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
764	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
765	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
766	mbufq_init(&sc->sc_snd, ifqmaxlen);
767	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
768		taskqueue_thread_enqueue, &sc->sc_tq);
769	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
770		"%s taskq", device_get_nameunit(sc->sc_dev));
771}
772
773static void
774bwn_sprom_bugfixes(device_t dev)
775{
776#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
777	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
778	 (siba_get_pci_device(dev) == _device) &&			\
779	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
780	 (siba_get_pci_subdevice(dev) == _subdevice))
781
782	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
783	    siba_get_pci_subdevice(dev) == 0x4e &&
784	    siba_get_pci_revid(dev) > 0x40)
785		siba_sprom_set_bf_lo(dev,
786		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
787	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
788	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
789		siba_sprom_set_bf_lo(dev,
790		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
791	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
792		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
793		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
794		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
795		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
796		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
797		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
798		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
799			siba_sprom_set_bf_lo(dev,
800			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
801	}
802#undef	BWN_ISDEV
803}
804
805static void
806bwn_parent(struct ieee80211com *ic)
807{
808	struct bwn_softc *sc = ic->ic_softc;
809	int startall = 0;
810
811	BWN_LOCK(sc);
812	if (ic->ic_nrunning > 0) {
813		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
814			bwn_init(sc);
815			startall = 1;
816		} else
817			bwn_update_promisc(ic);
818	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
819		bwn_stop(sc);
820	BWN_UNLOCK(sc);
821
822	if (startall)
823		ieee80211_start_all(ic);
824}
825
826static int
827bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
828{
829	struct bwn_softc *sc = ic->ic_softc;
830	int error;
831
832	BWN_LOCK(sc);
833	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
834		BWN_UNLOCK(sc);
835		return (ENXIO);
836	}
837	error = mbufq_enqueue(&sc->sc_snd, m);
838	if (error) {
839		BWN_UNLOCK(sc);
840		return (error);
841	}
842	bwn_start(sc);
843	BWN_UNLOCK(sc);
844	return (0);
845}
846
847static void
848bwn_start(struct bwn_softc *sc)
849{
850	struct bwn_mac *mac = sc->sc_curmac;
851	struct ieee80211_frame *wh;
852	struct ieee80211_node *ni;
853	struct ieee80211_key *k;
854	struct mbuf *m;
855
856	BWN_ASSERT_LOCKED(sc);
857
858	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
859	    mac->mac_status < BWN_MAC_STATUS_STARTED)
860		return;
861
862	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
863		if (bwn_tx_isfull(sc, m))
864			break;
865		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
866		if (ni == NULL) {
867			device_printf(sc->sc_dev, "unexpected NULL ni\n");
868			m_freem(m);
869			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
870			continue;
871		}
872		wh = mtod(m, struct ieee80211_frame *);
873		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
874			k = ieee80211_crypto_encap(ni, m);
875			if (k == NULL) {
876				if_inc_counter(ni->ni_vap->iv_ifp,
877				    IFCOUNTER_OERRORS, 1);
878				ieee80211_free_node(ni);
879				m_freem(m);
880				continue;
881			}
882		}
883		wh = NULL;	/* Catch any invalid use */
884		if (bwn_tx_start(sc, ni, m) != 0) {
885			if (ni != NULL) {
886				if_inc_counter(ni->ni_vap->iv_ifp,
887				    IFCOUNTER_OERRORS, 1);
888				ieee80211_free_node(ni);
889			}
890			continue;
891		}
892		sc->sc_watchdog_timer = 5;
893	}
894}
895
896static int
897bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
898{
899	struct bwn_dma_ring *dr;
900	struct bwn_mac *mac = sc->sc_curmac;
901	struct bwn_pio_txqueue *tq;
902	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
903
904	BWN_ASSERT_LOCKED(sc);
905
906	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
907		dr = bwn_dma_select(mac, M_WME_GETAC(m));
908		if (dr->dr_stop == 1 ||
909		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
910			dr->dr_stop = 1;
911			goto full;
912		}
913	} else {
914		tq = bwn_pio_select(mac, M_WME_GETAC(m));
915		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
916		    pktlen > (tq->tq_size - tq->tq_used))
917			goto full;
918	}
919	return (0);
920full:
921	mbufq_prepend(&sc->sc_snd, m);
922	return (1);
923}
924
925static int
926bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
927{
928	struct bwn_mac *mac = sc->sc_curmac;
929	int error;
930
931	BWN_ASSERT_LOCKED(sc);
932
933	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
934		m_freem(m);
935		return (ENXIO);
936	}
937
938	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
939	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
940	if (error) {
941		m_freem(m);
942		return (error);
943	}
944	return (0);
945}
946
947static int
948bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
949{
950	struct bwn_pio_txpkt *tp;
951	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
952	struct bwn_softc *sc = mac->mac_sc;
953	struct bwn_txhdr txhdr;
954	struct mbuf *m_new;
955	uint32_t ctl32;
956	int error;
957	uint16_t ctl16;
958
959	BWN_ASSERT_LOCKED(sc);
960
961	/* XXX TODO send packets after DTIM */
962
963	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
964	tp = TAILQ_FIRST(&tq->tq_pktlist);
965	tp->tp_ni = ni;
966	tp->tp_m = m;
967
968	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
969	if (error) {
970		device_printf(sc->sc_dev, "tx fail\n");
971		return (error);
972	}
973
974	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
975	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
976	tq->tq_free--;
977
978	if (siba_get_revid(sc->sc_dev) >= 8) {
979		/*
980		 * XXX please removes m_defrag(9)
981		 */
982		m_new = m_defrag(m, M_NOWAIT);
983		if (m_new == NULL) {
984			device_printf(sc->sc_dev,
985			    "%s: can't defrag TX buffer\n",
986			    __func__);
987			return (ENOBUFS);
988		}
989		if (m_new->m_next != NULL)
990			device_printf(sc->sc_dev,
991			    "TODO: fragmented packets for PIO\n");
992		tp->tp_m = m_new;
993
994		/* send HEADER */
995		ctl32 = bwn_pio_write_multi_4(mac, tq,
996		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
997			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
998		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
999		/* send BODY */
1000		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1002		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003		    ctl32 | BWN_PIO8_TXCTL_EOF);
1004	} else {
1005		ctl16 = bwn_pio_write_multi_2(mac, tq,
1006		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011		    ctl16 | BWN_PIO_TXCTL_EOF);
1012	}
1013
1014	return (0);
1015}
1016
1017static struct bwn_pio_txqueue *
1018bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019{
1020
1021	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024	switch (prio) {
1025	case 0:
1026		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027	case 1:
1028		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029	case 2:
1030		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031	case 3:
1032		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033	}
1034	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035	return (NULL);
1036}
1037
1038static int
1039bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040{
1041#define	BWN_GET_TXHDRCACHE(slot)					\
1042	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043	struct bwn_dma *dma = &mac->mac_method.dma;
1044	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045	struct bwn_dmadesc_generic *desc;
1046	struct bwn_dmadesc_meta *mt;
1047	struct bwn_softc *sc = mac->mac_sc;
1048	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051	BWN_ASSERT_LOCKED(sc);
1052	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054	/* XXX send after DTIM */
1055
1056	slot = bwn_dma_getslot(dr);
1057	dr->getdesc(dr, slot, &desc, &mt);
1058	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059	    ("%s:%d: fail", __func__, __LINE__));
1060
1061	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063	    BWN_DMA_COOKIE(dr, slot));
1064	if (error)
1065		goto fail;
1066	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1069	if (error) {
1070		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071		    __func__, error);
1072		goto fail;
1073	}
1074	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075	    BUS_DMASYNC_PREWRITE);
1076	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078	    BUS_DMASYNC_PREWRITE);
1079
1080	slot = bwn_dma_getslot(dr);
1081	dr->getdesc(dr, slot, &desc, &mt);
1082	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084	mt->mt_m = m;
1085	mt->mt_ni = ni;
1086
1087	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089	if (error && error != EFBIG) {
1090		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091		    __func__, error);
1092		goto fail;
1093	}
1094	if (error) {    /* error == EFBIG */
1095		struct mbuf *m_new;
1096
1097		m_new = m_defrag(m, M_NOWAIT);
1098		if (m_new == NULL) {
1099			device_printf(sc->sc_dev,
1100			    "%s: can't defrag TX buffer\n",
1101			    __func__);
1102			error = ENOBUFS;
1103			goto fail;
1104		} else {
1105			m = m_new;
1106		}
1107
1108		mt->mt_m = m;
1109		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111		if (error) {
1112			device_printf(sc->sc_dev,
1113			    "%s: can't load TX buffer (2) %d\n",
1114			    __func__, error);
1115			goto fail;
1116		}
1117	}
1118	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121	    BUS_DMASYNC_PREWRITE);
1122
1123	/* XXX send after DTIM */
1124
1125	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126	return (0);
1127fail:
1128	dr->dr_curslot = backup[0];
1129	dr->dr_usedslot = backup[1];
1130	return (error);
1131#undef BWN_GET_TXHDRCACHE
1132}
1133
1134static void
1135bwn_watchdog(void *arg)
1136{
1137	struct bwn_softc *sc = arg;
1138
1139	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140		device_printf(sc->sc_dev, "device timeout\n");
1141		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142	}
1143	callout_schedule(&sc->sc_watchdog_ch, hz);
1144}
1145
1146static int
1147bwn_attach_core(struct bwn_mac *mac)
1148{
1149	struct bwn_softc *sc = mac->mac_sc;
1150	int error, have_bg = 0, have_a = 0;
1151
1152	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1153	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1154
1155	if (bwn_is_bus_siba(mac)) {
1156		uint32_t high;
1157
1158		siba_powerup(sc->sc_dev, 0);
1159		high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1160		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1161		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1162		if (high & BWN_TGSHIGH_DUALPHY) {
1163			have_bg = 1;
1164			have_a = 1;
1165		}
1166#if 0
1167		device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1168		    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1169		    __func__,
1170		    high,
1171		    have_a,
1172		    have_bg,
1173		    siba_get_pci_device(sc->sc_dev),
1174		    siba_get_chipid(sc->sc_dev));
1175#endif
1176	} else {
1177		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1178		error = ENXIO;
1179		goto fail;
1180	}
1181
1182	/*
1183	 * Guess at whether it has A-PHY or G-PHY.
1184	 * This is just used for resetting the core to probe things;
1185	 * we will re-guess once it's all up and working.
1186	 */
1187	bwn_reset_core(mac, have_bg);
1188
1189	/*
1190	 * Get the PHY version.
1191	 */
1192	error = bwn_phy_getinfo(mac, have_bg);
1193	if (error)
1194		goto fail;
1195
1196	/*
1197	 * This is the whitelist of devices which we "believe"
1198	 * the SPROM PHY config from.  The rest are "guessed".
1199	 */
1200	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1201	    siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1202	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1203	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1204	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1205	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1206		have_a = have_bg = 0;
1207		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1208			have_a = 1;
1209		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1210		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1211		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1212			have_bg = 1;
1213		else
1214			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1215			    mac->mac_phy.type));
1216	}
1217
1218	/*
1219	 * XXX The PHY-G support doesn't do 5GHz operation.
1220	 */
1221	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1222	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1223		device_printf(sc->sc_dev,
1224		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1225		    __func__);
1226		have_a = 0;
1227		have_bg = 1;
1228	}
1229
1230	mac->mac_phy.phy_n = NULL;
1231
1232	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1233		mac->mac_phy.attach = bwn_phy_g_attach;
1234		mac->mac_phy.detach = bwn_phy_g_detach;
1235		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1236		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1237		mac->mac_phy.init = bwn_phy_g_init;
1238		mac->mac_phy.exit = bwn_phy_g_exit;
1239		mac->mac_phy.phy_read = bwn_phy_g_read;
1240		mac->mac_phy.phy_write = bwn_phy_g_write;
1241		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1242		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1243		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1244		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1245		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1246		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1247		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1248		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1249		mac->mac_phy.set_im = bwn_phy_g_im;
1250		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1251		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1252		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1253		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1254	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1255		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1256		mac->mac_phy.init = bwn_phy_lp_init;
1257		mac->mac_phy.phy_read = bwn_phy_lp_read;
1258		mac->mac_phy.phy_write = bwn_phy_lp_write;
1259		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1260		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1261		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1262		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1263		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1264		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1265		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1266		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1267		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1268	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1269		mac->mac_phy.attach = bwn_phy_n_attach;
1270		mac->mac_phy.detach = bwn_phy_n_detach;
1271		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1272		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1273		mac->mac_phy.init = bwn_phy_n_init;
1274		mac->mac_phy.exit = bwn_phy_n_exit;
1275		mac->mac_phy.phy_read = bwn_phy_n_read;
1276		mac->mac_phy.phy_write = bwn_phy_n_write;
1277		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1278		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1279		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1280		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1281		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1282		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1283		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1284		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1285		mac->mac_phy.set_im = bwn_phy_n_im;
1286		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1287		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1288		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1289		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1290	} else {
1291		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1292		    mac->mac_phy.type);
1293		error = ENXIO;
1294		goto fail;
1295	}
1296
1297	mac->mac_phy.gmode = have_bg;
1298	if (mac->mac_phy.attach != NULL) {
1299		error = mac->mac_phy.attach(mac);
1300		if (error) {
1301			device_printf(sc->sc_dev, "failed\n");
1302			goto fail;
1303		}
1304	}
1305
1306	bwn_reset_core(mac, have_bg);
1307
1308	error = bwn_chiptest(mac);
1309	if (error)
1310		goto fail;
1311	error = bwn_setup_channels(mac, have_bg, have_a);
1312	if (error) {
1313		device_printf(sc->sc_dev, "failed to setup channels\n");
1314		goto fail;
1315	}
1316
1317	if (sc->sc_curmac == NULL)
1318		sc->sc_curmac = mac;
1319
1320	error = bwn_dma_attach(mac);
1321	if (error != 0) {
1322		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1323		goto fail;
1324	}
1325
1326	mac->mac_phy.switch_analog(mac, 0);
1327
1328	siba_dev_down(sc->sc_dev, 0);
1329fail:
1330	siba_powerdown(sc->sc_dev);
1331	return (error);
1332}
1333
1334/*
1335 * Reset - SIBA.
1336 *
1337 * XXX TODO: implement BCMA version!
1338 */
1339void
1340bwn_reset_core(struct bwn_mac *mac, int g_mode)
1341{
1342	struct bwn_softc *sc = mac->mac_sc;
1343	uint32_t low, ctl;
1344	uint32_t flags = 0;
1345
1346	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1347
1348	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1349	if (g_mode)
1350		flags |= BWN_TGSLOW_SUPPORT_G;
1351
1352	/* XXX N-PHY only; and hard-code to 20MHz for now */
1353	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1354		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1355
1356	siba_dev_up(sc->sc_dev, flags);
1357	DELAY(2000);
1358
1359	/* Take PHY out of reset */
1360	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1361	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1362	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1363	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1364	DELAY(2000);
1365	low &= ~SIBA_TGSLOW_FGC;
1366	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1367	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1368	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1369	DELAY(2000);
1370
1371	if (mac->mac_phy.switch_analog != NULL)
1372		mac->mac_phy.switch_analog(mac, 1);
1373
1374	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1375	if (g_mode)
1376		ctl |= BWN_MACCTL_GMODE;
1377	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1378}
1379
1380static int
1381bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1382{
1383	struct bwn_phy *phy = &mac->mac_phy;
1384	struct bwn_softc *sc = mac->mac_sc;
1385	uint32_t tmp;
1386
1387	/* PHY */
1388	tmp = BWN_READ_2(mac, BWN_PHYVER);
1389	phy->gmode = gmode;
1390	phy->rf_on = 1;
1391	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1392	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1393	phy->rev = (tmp & BWN_PHYVER_VERSION);
1394	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1395	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1396		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1397	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1398	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1399	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1400		goto unsupphy;
1401
1402	/* RADIO */
1403	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1404		if (siba_get_chiprev(sc->sc_dev) == 0)
1405			tmp = 0x3205017f;
1406		else if (siba_get_chiprev(sc->sc_dev) == 1)
1407			tmp = 0x4205017f;
1408		else
1409			tmp = 0x5205017f;
1410	} else {
1411		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1412		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1413		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1414		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1415	}
1416	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1417	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1418	phy->rf_manuf = (tmp & 0x00000fff);
1419
1420	/*
1421	 * For now, just always do full init (ie, what bwn has traditionally
1422	 * done)
1423	 */
1424	phy->phy_do_full_init = 1;
1425
1426	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1427		goto unsupradio;
1428	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1429	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1430	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1431	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1432	    (phy->type == BWN_PHYTYPE_N &&
1433	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1434	    (phy->type == BWN_PHYTYPE_LP &&
1435	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1436		goto unsupradio;
1437
1438	return (0);
1439unsupphy:
1440	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1441	    "analog %#x)\n",
1442	    phy->type, phy->rev, phy->analog);
1443	return (ENXIO);
1444unsupradio:
1445	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1446	    "rev %#x)\n",
1447	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1448	return (ENXIO);
1449}
1450
1451static int
1452bwn_chiptest(struct bwn_mac *mac)
1453{
1454#define	TESTVAL0	0x55aaaa55
1455#define	TESTVAL1	0xaa5555aa
1456	struct bwn_softc *sc = mac->mac_sc;
1457	uint32_t v, backup;
1458
1459	BWN_LOCK(sc);
1460
1461	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1462
1463	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1464	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1465		goto error;
1466	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1467	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1468		goto error;
1469
1470	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1471
1472	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1473	    (siba_get_revid(sc->sc_dev) <= 10)) {
1474		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1475		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1476		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1477			goto error;
1478		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1479			goto error;
1480	}
1481	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1482
1483	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1484	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1485		goto error;
1486
1487	BWN_UNLOCK(sc);
1488	return (0);
1489error:
1490	BWN_UNLOCK(sc);
1491	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1492	return (ENODEV);
1493}
1494
1495static int
1496bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1497{
1498	struct bwn_softc *sc = mac->mac_sc;
1499	struct ieee80211com *ic = &sc->sc_ic;
1500	uint8_t bands[IEEE80211_MODE_BYTES];
1501
1502	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1503	ic->ic_nchans = 0;
1504
1505	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1506	    __func__,
1507	    have_bg,
1508	    have_a);
1509
1510	if (have_bg) {
1511		memset(bands, 0, sizeof(bands));
1512		setbit(bands, IEEE80211_MODE_11B);
1513		setbit(bands, IEEE80211_MODE_11G);
1514		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1515		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1516	}
1517
1518	if (have_a) {
1519		memset(bands, 0, sizeof(bands));
1520		setbit(bands, IEEE80211_MODE_11A);
1521		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1522		    &ic->ic_nchans, &bwn_chantable_a, bands);
1523	}
1524
1525	mac->mac_phy.supports_2ghz = have_bg;
1526	mac->mac_phy.supports_5ghz = have_a;
1527
1528	return (ic->ic_nchans == 0 ? ENXIO : 0);
1529}
1530
1531uint32_t
1532bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1533{
1534	uint32_t ret;
1535
1536	BWN_ASSERT_LOCKED(mac->mac_sc);
1537
1538	if (way == BWN_SHARED) {
1539		KASSERT((offset & 0x0001) == 0,
1540		    ("%s:%d warn", __func__, __LINE__));
1541		if (offset & 0x0003) {
1542			bwn_shm_ctlword(mac, way, offset >> 2);
1543			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1544			ret <<= 16;
1545			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1546			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1547			goto out;
1548		}
1549		offset >>= 2;
1550	}
1551	bwn_shm_ctlword(mac, way, offset);
1552	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1553out:
1554	return (ret);
1555}
1556
1557uint16_t
1558bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1559{
1560	uint16_t ret;
1561
1562	BWN_ASSERT_LOCKED(mac->mac_sc);
1563
1564	if (way == BWN_SHARED) {
1565		KASSERT((offset & 0x0001) == 0,
1566		    ("%s:%d warn", __func__, __LINE__));
1567		if (offset & 0x0003) {
1568			bwn_shm_ctlword(mac, way, offset >> 2);
1569			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1570			goto out;
1571		}
1572		offset >>= 2;
1573	}
1574	bwn_shm_ctlword(mac, way, offset);
1575	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1576out:
1577
1578	return (ret);
1579}
1580
1581static void
1582bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1583    uint16_t offset)
1584{
1585	uint32_t control;
1586
1587	control = way;
1588	control <<= 16;
1589	control |= offset;
1590	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1591}
1592
1593void
1594bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1595    uint32_t value)
1596{
1597	BWN_ASSERT_LOCKED(mac->mac_sc);
1598
1599	if (way == BWN_SHARED) {
1600		KASSERT((offset & 0x0001) == 0,
1601		    ("%s:%d warn", __func__, __LINE__));
1602		if (offset & 0x0003) {
1603			bwn_shm_ctlword(mac, way, offset >> 2);
1604			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1605				    (value >> 16) & 0xffff);
1606			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1607			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1608			return;
1609		}
1610		offset >>= 2;
1611	}
1612	bwn_shm_ctlword(mac, way, offset);
1613	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1614}
1615
1616void
1617bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1618    uint16_t value)
1619{
1620	BWN_ASSERT_LOCKED(mac->mac_sc);
1621
1622	if (way == BWN_SHARED) {
1623		KASSERT((offset & 0x0001) == 0,
1624		    ("%s:%d warn", __func__, __LINE__));
1625		if (offset & 0x0003) {
1626			bwn_shm_ctlword(mac, way, offset >> 2);
1627			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1628			return;
1629		}
1630		offset >>= 2;
1631	}
1632	bwn_shm_ctlword(mac, way, offset);
1633	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1634}
1635
1636static void
1637bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1638    const struct bwn_channelinfo *ci, const uint8_t bands[])
1639{
1640	int i, error;
1641
1642	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1643		const struct bwn_channel *hc = &ci->channels[i];
1644
1645		error = ieee80211_add_channel(chans, maxchans, nchans,
1646		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1647	}
1648}
1649
1650static int
1651bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1652	const struct ieee80211_bpf_params *params)
1653{
1654	struct ieee80211com *ic = ni->ni_ic;
1655	struct bwn_softc *sc = ic->ic_softc;
1656	struct bwn_mac *mac = sc->sc_curmac;
1657	int error;
1658
1659	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1660	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1661		m_freem(m);
1662		return (ENETDOWN);
1663	}
1664
1665	BWN_LOCK(sc);
1666	if (bwn_tx_isfull(sc, m)) {
1667		m_freem(m);
1668		BWN_UNLOCK(sc);
1669		return (ENOBUFS);
1670	}
1671
1672	error = bwn_tx_start(sc, ni, m);
1673	if (error == 0)
1674		sc->sc_watchdog_timer = 5;
1675	BWN_UNLOCK(sc);
1676	return (error);
1677}
1678
1679/*
1680 * Callback from the 802.11 layer to update the slot time
1681 * based on the current setting.  We use it to notify the
1682 * firmware of ERP changes and the f/w takes care of things
1683 * like slot time and preamble.
1684 */
1685static void
1686bwn_updateslot(struct ieee80211com *ic)
1687{
1688	struct bwn_softc *sc = ic->ic_softc;
1689	struct bwn_mac *mac;
1690
1691	BWN_LOCK(sc);
1692	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1693		mac = (struct bwn_mac *)sc->sc_curmac;
1694		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1695	}
1696	BWN_UNLOCK(sc);
1697}
1698
1699/*
1700 * Callback from the 802.11 layer after a promiscuous mode change.
1701 * Note this interface does not check the operating mode as this
1702 * is an internal callback and we are expected to honor the current
1703 * state (e.g. this is used for setting the interface in promiscuous
1704 * mode when operating in hostap mode to do ACS).
1705 */
1706static void
1707bwn_update_promisc(struct ieee80211com *ic)
1708{
1709	struct bwn_softc *sc = ic->ic_softc;
1710	struct bwn_mac *mac = sc->sc_curmac;
1711
1712	BWN_LOCK(sc);
1713	mac = sc->sc_curmac;
1714	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1715		if (ic->ic_promisc > 0)
1716			sc->sc_filters |= BWN_MACCTL_PROMISC;
1717		else
1718			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1719		bwn_set_opmode(mac);
1720	}
1721	BWN_UNLOCK(sc);
1722}
1723
1724/*
1725 * Callback from the 802.11 layer to update WME parameters.
1726 */
1727static int
1728bwn_wme_update(struct ieee80211com *ic)
1729{
1730	struct bwn_softc *sc = ic->ic_softc;
1731	struct bwn_mac *mac = sc->sc_curmac;
1732	struct wmeParams *wmep;
1733	int i;
1734
1735	BWN_LOCK(sc);
1736	mac = sc->sc_curmac;
1737	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1738		bwn_mac_suspend(mac);
1739		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1740			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1741			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1742		}
1743		bwn_mac_enable(mac);
1744	}
1745	BWN_UNLOCK(sc);
1746	return (0);
1747}
1748
1749static void
1750bwn_scan_start(struct ieee80211com *ic)
1751{
1752	struct bwn_softc *sc = ic->ic_softc;
1753	struct bwn_mac *mac;
1754
1755	BWN_LOCK(sc);
1756	mac = sc->sc_curmac;
1757	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1758		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1759		bwn_set_opmode(mac);
1760		/* disable CFP update during scan */
1761		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1762	}
1763	BWN_UNLOCK(sc);
1764}
1765
1766static void
1767bwn_scan_end(struct ieee80211com *ic)
1768{
1769	struct bwn_softc *sc = ic->ic_softc;
1770	struct bwn_mac *mac;
1771
1772	BWN_LOCK(sc);
1773	mac = sc->sc_curmac;
1774	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1775		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1776		bwn_set_opmode(mac);
1777		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1778	}
1779	BWN_UNLOCK(sc);
1780}
1781
1782static void
1783bwn_set_channel(struct ieee80211com *ic)
1784{
1785	struct bwn_softc *sc = ic->ic_softc;
1786	struct bwn_mac *mac = sc->sc_curmac;
1787	struct bwn_phy *phy = &mac->mac_phy;
1788	int chan, error;
1789
1790	BWN_LOCK(sc);
1791
1792	error = bwn_switch_band(sc, ic->ic_curchan);
1793	if (error)
1794		goto fail;
1795	bwn_mac_suspend(mac);
1796	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1797	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1798	if (chan != phy->chan)
1799		bwn_switch_channel(mac, chan);
1800
1801	/* TX power level */
1802	if (ic->ic_curchan->ic_maxpower != 0 &&
1803	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1804		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1805		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1806		    BWN_TXPWR_IGNORE_TSSI);
1807	}
1808
1809	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1810	if (phy->set_antenna)
1811		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1812
1813	if (sc->sc_rf_enabled != phy->rf_on) {
1814		if (sc->sc_rf_enabled) {
1815			bwn_rf_turnon(mac);
1816			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1817				device_printf(sc->sc_dev,
1818				    "please turn on the RF switch\n");
1819		} else
1820			bwn_rf_turnoff(mac);
1821	}
1822
1823	bwn_mac_enable(mac);
1824
1825fail:
1826	/*
1827	 * Setup radio tap channel freq and flags
1828	 */
1829	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1830		htole16(ic->ic_curchan->ic_freq);
1831	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1832		htole16(ic->ic_curchan->ic_flags & 0xffff);
1833
1834	BWN_UNLOCK(sc);
1835}
1836
1837static struct ieee80211vap *
1838bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1839    enum ieee80211_opmode opmode, int flags,
1840    const uint8_t bssid[IEEE80211_ADDR_LEN],
1841    const uint8_t mac[IEEE80211_ADDR_LEN])
1842{
1843	struct ieee80211vap *vap;
1844	struct bwn_vap *bvp;
1845
1846	switch (opmode) {
1847	case IEEE80211_M_HOSTAP:
1848	case IEEE80211_M_MBSS:
1849	case IEEE80211_M_STA:
1850	case IEEE80211_M_WDS:
1851	case IEEE80211_M_MONITOR:
1852	case IEEE80211_M_IBSS:
1853	case IEEE80211_M_AHDEMO:
1854		break;
1855	default:
1856		return (NULL);
1857	}
1858
1859	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1860	vap = &bvp->bv_vap;
1861	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1862	/* override with driver methods */
1863	bvp->bv_newstate = vap->iv_newstate;
1864	vap->iv_newstate = bwn_newstate;
1865
1866	/* override max aid so sta's cannot assoc when we're out of sta id's */
1867	vap->iv_max_aid = BWN_STAID_MAX;
1868
1869	ieee80211_ratectl_init(vap);
1870
1871	/* complete setup */
1872	ieee80211_vap_attach(vap, ieee80211_media_change,
1873	    ieee80211_media_status, mac);
1874	return (vap);
1875}
1876
1877static void
1878bwn_vap_delete(struct ieee80211vap *vap)
1879{
1880	struct bwn_vap *bvp = BWN_VAP(vap);
1881
1882	ieee80211_ratectl_deinit(vap);
1883	ieee80211_vap_detach(vap);
1884	free(bvp, M_80211_VAP);
1885}
1886
1887static int
1888bwn_init(struct bwn_softc *sc)
1889{
1890	struct bwn_mac *mac;
1891	int error;
1892
1893	BWN_ASSERT_LOCKED(sc);
1894
1895	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1896
1897	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1898	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1899	sc->sc_filters = 0;
1900	bwn_wme_clear(sc);
1901	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1902	sc->sc_rf_enabled = 1;
1903
1904	mac = sc->sc_curmac;
1905	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1906		error = bwn_core_init(mac);
1907		if (error != 0)
1908			return (error);
1909	}
1910	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1911		bwn_core_start(mac);
1912
1913	bwn_set_opmode(mac);
1914	bwn_set_pretbtt(mac);
1915	bwn_spu_setdelay(mac, 0);
1916	bwn_set_macaddr(mac);
1917
1918	sc->sc_flags |= BWN_FLAG_RUNNING;
1919	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1920	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1921
1922	return (0);
1923}
1924
1925static void
1926bwn_stop(struct bwn_softc *sc)
1927{
1928	struct bwn_mac *mac = sc->sc_curmac;
1929
1930	BWN_ASSERT_LOCKED(sc);
1931
1932	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1933
1934	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1935		/* XXX FIXME opmode not based on VAP */
1936		bwn_set_opmode(mac);
1937		bwn_set_macaddr(mac);
1938	}
1939
1940	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1941		bwn_core_stop(mac);
1942
1943	callout_stop(&sc->sc_led_blink_ch);
1944	sc->sc_led_blinking = 0;
1945
1946	bwn_core_exit(mac);
1947	sc->sc_rf_enabled = 0;
1948
1949	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1950}
1951
1952static void
1953bwn_wme_clear(struct bwn_softc *sc)
1954{
1955#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1956	struct wmeParams *p;
1957	unsigned int i;
1958
1959	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1960	    ("%s:%d: fail", __func__, __LINE__));
1961
1962	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1963		p = &(sc->sc_wmeParams[i]);
1964
1965		switch (bwn_wme_shm_offsets[i]) {
1966		case BWN_WME_VOICE:
1967			p->wmep_txopLimit = 0;
1968			p->wmep_aifsn = 2;
1969			/* XXX FIXME: log2(cwmin) */
1970			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1971			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1972			break;
1973		case BWN_WME_VIDEO:
1974			p->wmep_txopLimit = 0;
1975			p->wmep_aifsn = 2;
1976			/* XXX FIXME: log2(cwmin) */
1977			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1978			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1979			break;
1980		case BWN_WME_BESTEFFORT:
1981			p->wmep_txopLimit = 0;
1982			p->wmep_aifsn = 3;
1983			/* XXX FIXME: log2(cwmin) */
1984			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1985			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1986			break;
1987		case BWN_WME_BACKGROUND:
1988			p->wmep_txopLimit = 0;
1989			p->wmep_aifsn = 7;
1990			/* XXX FIXME: log2(cwmin) */
1991			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1992			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1993			break;
1994		default:
1995			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1996		}
1997	}
1998}
1999
2000static int
2001bwn_core_init(struct bwn_mac *mac)
2002{
2003	struct bwn_softc *sc = mac->mac_sc;
2004	uint64_t hf;
2005	int error;
2006
2007	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2008	    ("%s:%d: fail", __func__, __LINE__));
2009
2010	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2011
2012	siba_powerup(sc->sc_dev, 0);
2013	if (!siba_dev_isup(sc->sc_dev))
2014		bwn_reset_core(mac, mac->mac_phy.gmode);
2015
2016	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2017	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2018	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2019	BWN_GETTIME(mac->mac_phy.nexttime);
2020	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2021	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2022	mac->mac_stats.link_noise = -95;
2023	mac->mac_reason_intr = 0;
2024	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2025	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2026#ifdef BWN_DEBUG
2027	if (sc->sc_debug & BWN_DEBUG_XMIT)
2028		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2029#endif
2030	mac->mac_suspended = 1;
2031	mac->mac_task_state = 0;
2032	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2033
2034	mac->mac_phy.init_pre(mac);
2035
2036	siba_pcicore_intr(sc->sc_dev);
2037
2038	siba_fix_imcfglobug(sc->sc_dev);
2039	bwn_bt_disable(mac);
2040	if (mac->mac_phy.prepare_hw) {
2041		error = mac->mac_phy.prepare_hw(mac);
2042		if (error)
2043			goto fail0;
2044	}
2045	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2046	error = bwn_chip_init(mac);
2047	if (error)
2048		goto fail0;
2049	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2050	    siba_get_revid(sc->sc_dev));
2051	hf = bwn_hf_read(mac);
2052	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2053		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2054		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2055			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2056		if (mac->mac_phy.rev == 1)
2057			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2058	}
2059	if (mac->mac_phy.rf_ver == 0x2050) {
2060		if (mac->mac_phy.rf_rev < 6)
2061			hf |= BWN_HF_FORCE_VCO_RECALC;
2062		if (mac->mac_phy.rf_rev == 6)
2063			hf |= BWN_HF_4318_TSSI;
2064	}
2065	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2066		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2067	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2068	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2069		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2070	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2071	bwn_hf_write(mac, hf);
2072
2073	/* Tell the firmware about the MAC capabilities */
2074	if (siba_get_revid(sc->sc_dev) >= 13) {
2075		uint32_t cap;
2076		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2077		DPRINTF(sc, BWN_DEBUG_RESET,
2078		    "%s: hw capabilities: 0x%08x\n",
2079		    __func__, cap);
2080		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2081		    cap & 0xffff);
2082		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2083		    (cap >> 16) & 0xffff);
2084	}
2085
2086	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2087	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2088	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2089	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2090
2091	bwn_rate_init(mac);
2092	bwn_set_phytxctl(mac);
2093
2094	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2095	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2096	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2097
2098	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2099		bwn_pio_init(mac);
2100	else
2101		bwn_dma_init(mac);
2102	bwn_wme_init(mac);
2103	bwn_spu_setdelay(mac, 1);
2104	bwn_bt_enable(mac);
2105
2106	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2107	siba_powerup(sc->sc_dev,
2108	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2109	bwn_set_macaddr(mac);
2110	bwn_crypt_init(mac);
2111
2112	/* XXX LED initializatin */
2113
2114	mac->mac_status = BWN_MAC_STATUS_INITED;
2115
2116	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2117	return (error);
2118
2119fail0:
2120	siba_powerdown(sc->sc_dev);
2121	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2122	    ("%s:%d: fail", __func__, __LINE__));
2123	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2124	return (error);
2125}
2126
2127static void
2128bwn_core_start(struct bwn_mac *mac)
2129{
2130	struct bwn_softc *sc = mac->mac_sc;
2131	uint32_t tmp;
2132
2133	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2134	    ("%s:%d: fail", __func__, __LINE__));
2135
2136	if (siba_get_revid(sc->sc_dev) < 5)
2137		return;
2138
2139	while (1) {
2140		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2141		if (!(tmp & 0x00000001))
2142			break;
2143		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2144	}
2145
2146	bwn_mac_enable(mac);
2147	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2148	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2149
2150	mac->mac_status = BWN_MAC_STATUS_STARTED;
2151}
2152
2153static void
2154bwn_core_exit(struct bwn_mac *mac)
2155{
2156	struct bwn_softc *sc = mac->mac_sc;
2157	uint32_t macctl;
2158
2159	BWN_ASSERT_LOCKED(mac->mac_sc);
2160
2161	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2162	    ("%s:%d: fail", __func__, __LINE__));
2163
2164	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2165		return;
2166	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2167
2168	macctl = BWN_READ_4(mac, BWN_MACCTL);
2169	macctl &= ~BWN_MACCTL_MCODE_RUN;
2170	macctl |= BWN_MACCTL_MCODE_JMP0;
2171	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2172
2173	bwn_dma_stop(mac);
2174	bwn_pio_stop(mac);
2175	bwn_chip_exit(mac);
2176	mac->mac_phy.switch_analog(mac, 0);
2177	siba_dev_down(sc->sc_dev, 0);
2178	siba_powerdown(sc->sc_dev);
2179}
2180
2181static void
2182bwn_bt_disable(struct bwn_mac *mac)
2183{
2184	struct bwn_softc *sc = mac->mac_sc;
2185
2186	(void)sc;
2187	/* XXX do nothing yet */
2188}
2189
2190static int
2191bwn_chip_init(struct bwn_mac *mac)
2192{
2193	struct bwn_softc *sc = mac->mac_sc;
2194	struct bwn_phy *phy = &mac->mac_phy;
2195	uint32_t macctl;
2196	int error;
2197
2198	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2199	if (phy->gmode)
2200		macctl |= BWN_MACCTL_GMODE;
2201	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2202
2203	error = bwn_fw_fillinfo(mac);
2204	if (error)
2205		return (error);
2206	error = bwn_fw_loaducode(mac);
2207	if (error)
2208		return (error);
2209
2210	error = bwn_gpio_init(mac);
2211	if (error)
2212		return (error);
2213
2214	error = bwn_fw_loadinitvals(mac);
2215	if (error) {
2216		siba_gpio_set(sc->sc_dev, 0);
2217		return (error);
2218	}
2219	phy->switch_analog(mac, 1);
2220	error = bwn_phy_init(mac);
2221	if (error) {
2222		siba_gpio_set(sc->sc_dev, 0);
2223		return (error);
2224	}
2225	if (phy->set_im)
2226		phy->set_im(mac, BWN_IMMODE_NONE);
2227	if (phy->set_antenna)
2228		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2229	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2230
2231	if (phy->type == BWN_PHYTYPE_B)
2232		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2233	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2234	if (siba_get_revid(sc->sc_dev) < 5)
2235		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2236
2237	BWN_WRITE_4(mac, BWN_MACCTL,
2238	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2239	BWN_WRITE_4(mac, BWN_MACCTL,
2240	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2241	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2242
2243	bwn_set_opmode(mac);
2244	if (siba_get_revid(sc->sc_dev) < 3) {
2245		BWN_WRITE_2(mac, 0x060e, 0x0000);
2246		BWN_WRITE_2(mac, 0x0610, 0x8000);
2247		BWN_WRITE_2(mac, 0x0604, 0x0000);
2248		BWN_WRITE_2(mac, 0x0606, 0x0200);
2249	} else {
2250		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2251		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2252	}
2253	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2254	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2255	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2256	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2257	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2258	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2259	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2260
2261	bwn_mac_phy_clock_set(mac, true);
2262
2263	/* SIBA powerup */
2264	/* XXX TODO: BCMA powerup */
2265	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2266	return (error);
2267}
2268
2269/* read hostflags */
2270uint64_t
2271bwn_hf_read(struct bwn_mac *mac)
2272{
2273	uint64_t ret;
2274
2275	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2276	ret <<= 16;
2277	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2278	ret <<= 16;
2279	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2280	return (ret);
2281}
2282
2283void
2284bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2285{
2286
2287	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2288	    (value & 0x00000000ffffull));
2289	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2290	    (value & 0x0000ffff0000ull) >> 16);
2291	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2292	    (value & 0xffff00000000ULL) >> 32);
2293}
2294
2295static void
2296bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2297{
2298
2299	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2300	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2301}
2302
2303static void
2304bwn_rate_init(struct bwn_mac *mac)
2305{
2306
2307	switch (mac->mac_phy.type) {
2308	case BWN_PHYTYPE_A:
2309	case BWN_PHYTYPE_G:
2310	case BWN_PHYTYPE_LP:
2311	case BWN_PHYTYPE_N:
2312		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2313		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2314		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2315		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2316		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2317		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2318		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2319		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2320			break;
2321		/* FALLTHROUGH */
2322	case BWN_PHYTYPE_B:
2323		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2324		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2325		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2326		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2327		break;
2328	default:
2329		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2330	}
2331}
2332
2333static void
2334bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2335{
2336	uint16_t offset;
2337
2338	if (ofdm) {
2339		offset = 0x480;
2340		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2341	} else {
2342		offset = 0x4c0;
2343		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2344	}
2345	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2346	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2347}
2348
2349static uint8_t
2350bwn_plcp_getcck(const uint8_t bitrate)
2351{
2352
2353	switch (bitrate) {
2354	case BWN_CCK_RATE_1MB:
2355		return (0x0a);
2356	case BWN_CCK_RATE_2MB:
2357		return (0x14);
2358	case BWN_CCK_RATE_5MB:
2359		return (0x37);
2360	case BWN_CCK_RATE_11MB:
2361		return (0x6e);
2362	}
2363	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2364	return (0);
2365}
2366
2367static uint8_t
2368bwn_plcp_getofdm(const uint8_t bitrate)
2369{
2370
2371	switch (bitrate) {
2372	case BWN_OFDM_RATE_6MB:
2373		return (0xb);
2374	case BWN_OFDM_RATE_9MB:
2375		return (0xf);
2376	case BWN_OFDM_RATE_12MB:
2377		return (0xa);
2378	case BWN_OFDM_RATE_18MB:
2379		return (0xe);
2380	case BWN_OFDM_RATE_24MB:
2381		return (0x9);
2382	case BWN_OFDM_RATE_36MB:
2383		return (0xd);
2384	case BWN_OFDM_RATE_48MB:
2385		return (0x8);
2386	case BWN_OFDM_RATE_54MB:
2387		return (0xc);
2388	}
2389	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2390	return (0);
2391}
2392
2393static void
2394bwn_set_phytxctl(struct bwn_mac *mac)
2395{
2396	uint16_t ctl;
2397
2398	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2399	    BWN_TX_PHY_TXPWR);
2400	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2401	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2402	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2403}
2404
2405static void
2406bwn_pio_init(struct bwn_mac *mac)
2407{
2408	struct bwn_pio *pio = &mac->mac_method.pio;
2409
2410	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2411	    & ~BWN_MACCTL_BIGENDIAN);
2412	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2413
2414	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2415	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2416	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2417	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2418	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2419	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2420}
2421
2422static void
2423bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2424    int index)
2425{
2426	struct bwn_pio_txpkt *tp;
2427	struct bwn_softc *sc = mac->mac_sc;
2428	unsigned int i;
2429
2430	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2431	tq->tq_index = index;
2432
2433	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2434	if (siba_get_revid(sc->sc_dev) >= 8)
2435		tq->tq_size = 1920;
2436	else {
2437		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2438		tq->tq_size -= 80;
2439	}
2440
2441	TAILQ_INIT(&tq->tq_pktlist);
2442	for (i = 0; i < N(tq->tq_pkts); i++) {
2443		tp = &(tq->tq_pkts[i]);
2444		tp->tp_index = i;
2445		tp->tp_queue = tq;
2446		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2447	}
2448}
2449
2450static uint16_t
2451bwn_pio_idx2base(struct bwn_mac *mac, int index)
2452{
2453	struct bwn_softc *sc = mac->mac_sc;
2454	static const uint16_t bases[] = {
2455		BWN_PIO_BASE0,
2456		BWN_PIO_BASE1,
2457		BWN_PIO_BASE2,
2458		BWN_PIO_BASE3,
2459		BWN_PIO_BASE4,
2460		BWN_PIO_BASE5,
2461		BWN_PIO_BASE6,
2462		BWN_PIO_BASE7,
2463	};
2464	static const uint16_t bases_rev11[] = {
2465		BWN_PIO11_BASE0,
2466		BWN_PIO11_BASE1,
2467		BWN_PIO11_BASE2,
2468		BWN_PIO11_BASE3,
2469		BWN_PIO11_BASE4,
2470		BWN_PIO11_BASE5,
2471	};
2472
2473	if (siba_get_revid(sc->sc_dev) >= 11) {
2474		if (index >= N(bases_rev11))
2475			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2476		return (bases_rev11[index]);
2477	}
2478	if (index >= N(bases))
2479		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2480	return (bases[index]);
2481}
2482
2483static void
2484bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2485    int index)
2486{
2487	struct bwn_softc *sc = mac->mac_sc;
2488
2489	prq->prq_mac = mac;
2490	prq->prq_rev = siba_get_revid(sc->sc_dev);
2491	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2492	bwn_dma_rxdirectfifo(mac, index, 1);
2493}
2494
2495static void
2496bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2497{
2498	if (tq == NULL)
2499		return;
2500	bwn_pio_cancel_tx_packets(tq);
2501}
2502
2503static void
2504bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2505{
2506
2507	bwn_destroy_pioqueue_tx(pio);
2508}
2509
2510static uint16_t
2511bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2512    uint16_t offset)
2513{
2514
2515	return (BWN_READ_2(mac, tq->tq_base + offset));
2516}
2517
2518static void
2519bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2520{
2521	uint32_t ctl;
2522	int type;
2523	uint16_t base;
2524
2525	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2526	base = bwn_dma_base(type, idx);
2527	if (type == BWN_DMA_64BIT) {
2528		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2529		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2530		if (enable)
2531			ctl |= BWN_DMA64_RXDIRECTFIFO;
2532		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2533	} else {
2534		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2535		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2536		if (enable)
2537			ctl |= BWN_DMA32_RXDIRECTFIFO;
2538		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2539	}
2540}
2541
2542static uint64_t
2543bwn_dma_mask(struct bwn_mac *mac)
2544{
2545	uint32_t tmp;
2546	uint16_t base;
2547
2548	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2549	if (tmp & SIBA_TGSHIGH_DMA64)
2550		return (BWN_DMA_BIT_MASK(64));
2551	base = bwn_dma_base(0, 0);
2552	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2553	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2554	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2555		return (BWN_DMA_BIT_MASK(32));
2556
2557	return (BWN_DMA_BIT_MASK(30));
2558}
2559
2560static int
2561bwn_dma_mask2type(uint64_t dmamask)
2562{
2563
2564	if (dmamask == BWN_DMA_BIT_MASK(30))
2565		return (BWN_DMA_30BIT);
2566	if (dmamask == BWN_DMA_BIT_MASK(32))
2567		return (BWN_DMA_32BIT);
2568	if (dmamask == BWN_DMA_BIT_MASK(64))
2569		return (BWN_DMA_64BIT);
2570	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2571	return (BWN_DMA_30BIT);
2572}
2573
2574static void
2575bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2576{
2577	struct bwn_pio_txpkt *tp;
2578	unsigned int i;
2579
2580	for (i = 0; i < N(tq->tq_pkts); i++) {
2581		tp = &(tq->tq_pkts[i]);
2582		if (tp->tp_m) {
2583			m_freem(tp->tp_m);
2584			tp->tp_m = NULL;
2585		}
2586	}
2587}
2588
2589static uint16_t
2590bwn_dma_base(int type, int controller_idx)
2591{
2592	static const uint16_t map64[] = {
2593		BWN_DMA64_BASE0,
2594		BWN_DMA64_BASE1,
2595		BWN_DMA64_BASE2,
2596		BWN_DMA64_BASE3,
2597		BWN_DMA64_BASE4,
2598		BWN_DMA64_BASE5,
2599	};
2600	static const uint16_t map32[] = {
2601		BWN_DMA32_BASE0,
2602		BWN_DMA32_BASE1,
2603		BWN_DMA32_BASE2,
2604		BWN_DMA32_BASE3,
2605		BWN_DMA32_BASE4,
2606		BWN_DMA32_BASE5,
2607	};
2608
2609	if (type == BWN_DMA_64BIT) {
2610		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2611		    ("%s:%d: fail", __func__, __LINE__));
2612		return (map64[controller_idx]);
2613	}
2614	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2615	    ("%s:%d: fail", __func__, __LINE__));
2616	return (map32[controller_idx]);
2617}
2618
2619static void
2620bwn_dma_init(struct bwn_mac *mac)
2621{
2622	struct bwn_dma *dma = &mac->mac_method.dma;
2623
2624	/* setup TX DMA channels. */
2625	bwn_dma_setup(dma->wme[WME_AC_BK]);
2626	bwn_dma_setup(dma->wme[WME_AC_BE]);
2627	bwn_dma_setup(dma->wme[WME_AC_VI]);
2628	bwn_dma_setup(dma->wme[WME_AC_VO]);
2629	bwn_dma_setup(dma->mcast);
2630	/* setup RX DMA channel. */
2631	bwn_dma_setup(dma->rx);
2632}
2633
2634static struct bwn_dma_ring *
2635bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2636    int for_tx, int type)
2637{
2638	struct bwn_dma *dma = &mac->mac_method.dma;
2639	struct bwn_dma_ring *dr;
2640	struct bwn_dmadesc_generic *desc;
2641	struct bwn_dmadesc_meta *mt;
2642	struct bwn_softc *sc = mac->mac_sc;
2643	int error, i;
2644
2645	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2646	if (dr == NULL)
2647		goto out;
2648	dr->dr_numslots = BWN_RXRING_SLOTS;
2649	if (for_tx)
2650		dr->dr_numslots = BWN_TXRING_SLOTS;
2651
2652	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2653	    M_DEVBUF, M_NOWAIT | M_ZERO);
2654	if (dr->dr_meta == NULL)
2655		goto fail0;
2656
2657	dr->dr_type = type;
2658	dr->dr_mac = mac;
2659	dr->dr_base = bwn_dma_base(type, controller_index);
2660	dr->dr_index = controller_index;
2661	if (type == BWN_DMA_64BIT) {
2662		dr->getdesc = bwn_dma_64_getdesc;
2663		dr->setdesc = bwn_dma_64_setdesc;
2664		dr->start_transfer = bwn_dma_64_start_transfer;
2665		dr->suspend = bwn_dma_64_suspend;
2666		dr->resume = bwn_dma_64_resume;
2667		dr->get_curslot = bwn_dma_64_get_curslot;
2668		dr->set_curslot = bwn_dma_64_set_curslot;
2669	} else {
2670		dr->getdesc = bwn_dma_32_getdesc;
2671		dr->setdesc = bwn_dma_32_setdesc;
2672		dr->start_transfer = bwn_dma_32_start_transfer;
2673		dr->suspend = bwn_dma_32_suspend;
2674		dr->resume = bwn_dma_32_resume;
2675		dr->get_curslot = bwn_dma_32_get_curslot;
2676		dr->set_curslot = bwn_dma_32_set_curslot;
2677	}
2678	if (for_tx) {
2679		dr->dr_tx = 1;
2680		dr->dr_curslot = -1;
2681	} else {
2682		if (dr->dr_index == 0) {
2683			switch (mac->mac_fw.fw_hdr_format) {
2684			case BWN_FW_HDR_351:
2685			case BWN_FW_HDR_410:
2686				dr->dr_rx_bufsize =
2687				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2688				dr->dr_frameoffset =
2689				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2690				break;
2691			case BWN_FW_HDR_598:
2692				dr->dr_rx_bufsize =
2693				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2694				dr->dr_frameoffset =
2695				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2696				break;
2697			}
2698		} else
2699			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2700	}
2701
2702	error = bwn_dma_allocringmemory(dr);
2703	if (error)
2704		goto fail2;
2705
2706	if (for_tx) {
2707		/*
2708		 * Assumption: BWN_TXRING_SLOTS can be divided by
2709		 * BWN_TX_SLOTS_PER_FRAME
2710		 */
2711		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2712		    ("%s:%d: fail", __func__, __LINE__));
2713
2714		dr->dr_txhdr_cache = contigmalloc(
2715		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2716		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2717		    0, BUS_SPACE_MAXADDR, 8, 0);
2718		if (dr->dr_txhdr_cache == NULL) {
2719			device_printf(sc->sc_dev,
2720			    "can't allocate TX header DMA memory\n");
2721			goto fail1;
2722		}
2723
2724		/*
2725		 * Create TX ring DMA stuffs
2726		 */
2727		error = bus_dma_tag_create(dma->parent_dtag,
2728				    BWN_ALIGN, 0,
2729				    BUS_SPACE_MAXADDR,
2730				    BUS_SPACE_MAXADDR,
2731				    NULL, NULL,
2732				    BWN_HDRSIZE(mac),
2733				    1,
2734				    BUS_SPACE_MAXSIZE_32BIT,
2735				    0,
2736				    NULL, NULL,
2737				    &dr->dr_txring_dtag);
2738		if (error) {
2739			device_printf(sc->sc_dev,
2740			    "can't create TX ring DMA tag: TODO frees\n");
2741			goto fail2;
2742		}
2743
2744		for (i = 0; i < dr->dr_numslots; i += 2) {
2745			dr->getdesc(dr, i, &desc, &mt);
2746
2747			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2748			mt->mt_m = NULL;
2749			mt->mt_ni = NULL;
2750			mt->mt_islast = 0;
2751			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2752			    &mt->mt_dmap);
2753			if (error) {
2754				device_printf(sc->sc_dev,
2755				     "can't create RX buf DMA map\n");
2756				goto fail2;
2757			}
2758
2759			dr->getdesc(dr, i + 1, &desc, &mt);
2760
2761			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2762			mt->mt_m = NULL;
2763			mt->mt_ni = NULL;
2764			mt->mt_islast = 1;
2765			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2766			    &mt->mt_dmap);
2767			if (error) {
2768				device_printf(sc->sc_dev,
2769				     "can't create RX buf DMA map\n");
2770				goto fail2;
2771			}
2772		}
2773	} else {
2774		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2775		    &dr->dr_spare_dmap);
2776		if (error) {
2777			device_printf(sc->sc_dev,
2778			    "can't create RX buf DMA map\n");
2779			goto out;		/* XXX wrong! */
2780		}
2781
2782		for (i = 0; i < dr->dr_numslots; i++) {
2783			dr->getdesc(dr, i, &desc, &mt);
2784
2785			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2786			    &mt->mt_dmap);
2787			if (error) {
2788				device_printf(sc->sc_dev,
2789				    "can't create RX buf DMA map\n");
2790				goto out;	/* XXX wrong! */
2791			}
2792			error = bwn_dma_newbuf(dr, desc, mt, 1);
2793			if (error) {
2794				device_printf(sc->sc_dev,
2795				    "failed to allocate RX buf\n");
2796				goto out;	/* XXX wrong! */
2797			}
2798		}
2799
2800		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2801		    BUS_DMASYNC_PREWRITE);
2802
2803		dr->dr_usedslot = dr->dr_numslots;
2804	}
2805
2806      out:
2807	return (dr);
2808
2809fail2:
2810	if (dr->dr_txhdr_cache != NULL) {
2811		contigfree(dr->dr_txhdr_cache,
2812		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2813		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2814	}
2815fail1:
2816	free(dr->dr_meta, M_DEVBUF);
2817fail0:
2818	free(dr, M_DEVBUF);
2819	return (NULL);
2820}
2821
2822static void
2823bwn_dma_ringfree(struct bwn_dma_ring **dr)
2824{
2825
2826	if (dr == NULL)
2827		return;
2828
2829	bwn_dma_free_descbufs(*dr);
2830	bwn_dma_free_ringmemory(*dr);
2831
2832	if ((*dr)->dr_txhdr_cache != NULL) {
2833		contigfree((*dr)->dr_txhdr_cache,
2834		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2835		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2836	}
2837	free((*dr)->dr_meta, M_DEVBUF);
2838	free(*dr, M_DEVBUF);
2839
2840	*dr = NULL;
2841}
2842
2843static void
2844bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2845    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2846{
2847	struct bwn_dmadesc32 *desc;
2848
2849	*meta = &(dr->dr_meta[slot]);
2850	desc = dr->dr_ring_descbase;
2851	desc = &(desc[slot]);
2852
2853	*gdesc = (struct bwn_dmadesc_generic *)desc;
2854}
2855
2856static void
2857bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2858    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2859    int start, int end, int irq)
2860{
2861	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2862	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2863	uint32_t addr, addrext, ctl;
2864	int slot;
2865
2866	slot = (int)(&(desc->dma.dma32) - descbase);
2867	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2868	    ("%s:%d: fail", __func__, __LINE__));
2869
2870	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2871	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2872	addr |= siba_dma_translation(sc->sc_dev);
2873	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2874	if (slot == dr->dr_numslots - 1)
2875		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2876	if (start)
2877		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2878	if (end)
2879		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2880	if (irq)
2881		ctl |= BWN_DMA32_DCTL_IRQ;
2882	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2883	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2884
2885	desc->dma.dma32.control = htole32(ctl);
2886	desc->dma.dma32.address = htole32(addr);
2887}
2888
2889static void
2890bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2891{
2892
2893	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2894	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2895}
2896
2897static void
2898bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2899{
2900
2901	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2902	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2903}
2904
2905static void
2906bwn_dma_32_resume(struct bwn_dma_ring *dr)
2907{
2908
2909	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2910	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2911}
2912
2913static int
2914bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2915{
2916	uint32_t val;
2917
2918	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2919	val &= BWN_DMA32_RXDPTR;
2920
2921	return (val / sizeof(struct bwn_dmadesc32));
2922}
2923
2924static void
2925bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2926{
2927
2928	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2929	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2930}
2931
2932static void
2933bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2934    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2935{
2936	struct bwn_dmadesc64 *desc;
2937
2938	*meta = &(dr->dr_meta[slot]);
2939	desc = dr->dr_ring_descbase;
2940	desc = &(desc[slot]);
2941
2942	*gdesc = (struct bwn_dmadesc_generic *)desc;
2943}
2944
2945static void
2946bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2947    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2948    int start, int end, int irq)
2949{
2950	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2951	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2952	int slot;
2953	uint32_t ctl0 = 0, ctl1 = 0;
2954	uint32_t addrlo, addrhi;
2955	uint32_t addrext;
2956
2957	slot = (int)(&(desc->dma.dma64) - descbase);
2958	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2959	    ("%s:%d: fail", __func__, __LINE__));
2960
2961	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2962	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2963	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2964	    30;
2965	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2966	if (slot == dr->dr_numslots - 1)
2967		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2968	if (start)
2969		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2970	if (end)
2971		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2972	if (irq)
2973		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2974	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2975	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2976	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2977
2978	desc->dma.dma64.control0 = htole32(ctl0);
2979	desc->dma.dma64.control1 = htole32(ctl1);
2980	desc->dma.dma64.address_low = htole32(addrlo);
2981	desc->dma.dma64.address_high = htole32(addrhi);
2982}
2983
2984static void
2985bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2986{
2987
2988	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2989	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2990}
2991
2992static void
2993bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2994{
2995
2996	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2997	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2998}
2999
3000static void
3001bwn_dma_64_resume(struct bwn_dma_ring *dr)
3002{
3003
3004	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3005	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3006}
3007
3008static int
3009bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3010{
3011	uint32_t val;
3012
3013	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3014	val &= BWN_DMA64_RXSTATDPTR;
3015
3016	return (val / sizeof(struct bwn_dmadesc64));
3017}
3018
3019static void
3020bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3021{
3022
3023	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3024	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3025}
3026
3027static int
3028bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3029{
3030	struct bwn_mac *mac = dr->dr_mac;
3031	struct bwn_dma *dma = &mac->mac_method.dma;
3032	struct bwn_softc *sc = mac->mac_sc;
3033	int error;
3034
3035	error = bus_dma_tag_create(dma->parent_dtag,
3036			    BWN_ALIGN, 0,
3037			    BUS_SPACE_MAXADDR,
3038			    BUS_SPACE_MAXADDR,
3039			    NULL, NULL,
3040			    BWN_DMA_RINGMEMSIZE,
3041			    1,
3042			    BUS_SPACE_MAXSIZE_32BIT,
3043			    0,
3044			    NULL, NULL,
3045			    &dr->dr_ring_dtag);
3046	if (error) {
3047		device_printf(sc->sc_dev,
3048		    "can't create TX ring DMA tag: TODO frees\n");
3049		return (-1);
3050	}
3051
3052	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3053	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3054	    &dr->dr_ring_dmap);
3055	if (error) {
3056		device_printf(sc->sc_dev,
3057		    "can't allocate DMA mem: TODO frees\n");
3058		return (-1);
3059	}
3060	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3061	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3062	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3063	if (error) {
3064		device_printf(sc->sc_dev,
3065		    "can't load DMA mem: TODO free\n");
3066		return (-1);
3067	}
3068
3069	return (0);
3070}
3071
3072static void
3073bwn_dma_setup(struct bwn_dma_ring *dr)
3074{
3075	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3076	uint64_t ring64;
3077	uint32_t addrext, ring32, value;
3078	uint32_t trans = siba_dma_translation(sc->sc_dev);
3079
3080	if (dr->dr_tx) {
3081		dr->dr_curslot = -1;
3082
3083		if (dr->dr_type == BWN_DMA_64BIT) {
3084			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3085			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3086			    >> 30;
3087			value = BWN_DMA64_TXENABLE;
3088			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3089			    & BWN_DMA64_TXADDREXT_MASK;
3090			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3091			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3092			    (ring64 & 0xffffffff));
3093			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3094			    ((ring64 >> 32) &
3095			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3096		} else {
3097			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3098			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3099			value = BWN_DMA32_TXENABLE;
3100			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3101			    & BWN_DMA32_TXADDREXT_MASK;
3102			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3103			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3104			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3105		}
3106		return;
3107	}
3108
3109	/*
3110	 * set for RX
3111	 */
3112	dr->dr_usedslot = dr->dr_numslots;
3113
3114	if (dr->dr_type == BWN_DMA_64BIT) {
3115		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3116		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3117		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3118		value |= BWN_DMA64_RXENABLE;
3119		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3120		    & BWN_DMA64_RXADDREXT_MASK;
3121		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3122		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3123		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3124		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3125		    | (trans << 1));
3126		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3127		    sizeof(struct bwn_dmadesc64));
3128	} else {
3129		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3130		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3131		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3132		value |= BWN_DMA32_RXENABLE;
3133		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3134		    & BWN_DMA32_RXADDREXT_MASK;
3135		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3136		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3137		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3138		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3139		    sizeof(struct bwn_dmadesc32));
3140	}
3141}
3142
3143static void
3144bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3145{
3146
3147	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3148	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3149	    dr->dr_ring_dmap);
3150}
3151
3152static void
3153bwn_dma_cleanup(struct bwn_dma_ring *dr)
3154{
3155
3156	if (dr->dr_tx) {
3157		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3158		if (dr->dr_type == BWN_DMA_64BIT) {
3159			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3160			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3161		} else
3162			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3163	} else {
3164		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3165		if (dr->dr_type == BWN_DMA_64BIT) {
3166			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3167			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3168		} else
3169			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3170	}
3171}
3172
3173static void
3174bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3175{
3176	struct bwn_dmadesc_generic *desc;
3177	struct bwn_dmadesc_meta *meta;
3178	struct bwn_mac *mac = dr->dr_mac;
3179	struct bwn_dma *dma = &mac->mac_method.dma;
3180	struct bwn_softc *sc = mac->mac_sc;
3181	int i;
3182
3183	if (!dr->dr_usedslot)
3184		return;
3185	for (i = 0; i < dr->dr_numslots; i++) {
3186		dr->getdesc(dr, i, &desc, &meta);
3187
3188		if (meta->mt_m == NULL) {
3189			if (!dr->dr_tx)
3190				device_printf(sc->sc_dev, "%s: not TX?\n",
3191				    __func__);
3192			continue;
3193		}
3194		if (dr->dr_tx) {
3195			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3196				bus_dmamap_unload(dr->dr_txring_dtag,
3197				    meta->mt_dmap);
3198			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3199				bus_dmamap_unload(dma->txbuf_dtag,
3200				    meta->mt_dmap);
3201		} else
3202			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3203		bwn_dma_free_descbuf(dr, meta);
3204	}
3205}
3206
3207static int
3208bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3209    int type)
3210{
3211	struct bwn_softc *sc = mac->mac_sc;
3212	uint32_t value;
3213	int i;
3214	uint16_t offset;
3215
3216	for (i = 0; i < 10; i++) {
3217		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3218		    BWN_DMA32_TXSTATUS;
3219		value = BWN_READ_4(mac, base + offset);
3220		if (type == BWN_DMA_64BIT) {
3221			value &= BWN_DMA64_TXSTAT;
3222			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3223			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3224			    value == BWN_DMA64_TXSTAT_STOPPED)
3225				break;
3226		} else {
3227			value &= BWN_DMA32_TXSTATE;
3228			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3229			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3230			    value == BWN_DMA32_TXSTAT_STOPPED)
3231				break;
3232		}
3233		DELAY(1000);
3234	}
3235	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3236	BWN_WRITE_4(mac, base + offset, 0);
3237	for (i = 0; i < 10; i++) {
3238		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3239						   BWN_DMA32_TXSTATUS;
3240		value = BWN_READ_4(mac, base + offset);
3241		if (type == BWN_DMA_64BIT) {
3242			value &= BWN_DMA64_TXSTAT;
3243			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3244				i = -1;
3245				break;
3246			}
3247		} else {
3248			value &= BWN_DMA32_TXSTATE;
3249			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3250				i = -1;
3251				break;
3252			}
3253		}
3254		DELAY(1000);
3255	}
3256	if (i != -1) {
3257		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3258		return (ENODEV);
3259	}
3260	DELAY(1000);
3261
3262	return (0);
3263}
3264
3265static int
3266bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3267    int type)
3268{
3269	struct bwn_softc *sc = mac->mac_sc;
3270	uint32_t value;
3271	int i;
3272	uint16_t offset;
3273
3274	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3275	BWN_WRITE_4(mac, base + offset, 0);
3276	for (i = 0; i < 10; i++) {
3277		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3278		    BWN_DMA32_RXSTATUS;
3279		value = BWN_READ_4(mac, base + offset);
3280		if (type == BWN_DMA_64BIT) {
3281			value &= BWN_DMA64_RXSTAT;
3282			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3283				i = -1;
3284				break;
3285			}
3286		} else {
3287			value &= BWN_DMA32_RXSTATE;
3288			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3289				i = -1;
3290				break;
3291			}
3292		}
3293		DELAY(1000);
3294	}
3295	if (i != -1) {
3296		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3297		return (ENODEV);
3298	}
3299
3300	return (0);
3301}
3302
3303static void
3304bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3305    struct bwn_dmadesc_meta *meta)
3306{
3307
3308	if (meta->mt_m != NULL) {
3309		m_freem(meta->mt_m);
3310		meta->mt_m = NULL;
3311	}
3312	if (meta->mt_ni != NULL) {
3313		ieee80211_free_node(meta->mt_ni);
3314		meta->mt_ni = NULL;
3315	}
3316}
3317
3318static void
3319bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3320{
3321	struct bwn_rxhdr4 *rxhdr;
3322	unsigned char *frame;
3323
3324	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3325	rxhdr->frame_len = 0;
3326
3327	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3328	    sizeof(struct bwn_plcp6) + 2,
3329	    ("%s:%d: fail", __func__, __LINE__));
3330	frame = mtod(m, char *) + dr->dr_frameoffset;
3331	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3332}
3333
3334static uint8_t
3335bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3336{
3337	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3338
3339	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3340	    == 0xff);
3341}
3342
3343static void
3344bwn_wme_init(struct bwn_mac *mac)
3345{
3346
3347	bwn_wme_load(mac);
3348
3349	/* enable WME support. */
3350	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3351	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3352	    BWN_IFSCTL_USE_EDCF);
3353}
3354
3355static void
3356bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3357{
3358	struct bwn_softc *sc = mac->mac_sc;
3359	struct ieee80211com *ic = &sc->sc_ic;
3360	uint16_t delay;	/* microsec */
3361
3362	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3363	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3364		delay = 500;
3365	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3366		delay = max(delay, (uint16_t)2400);
3367
3368	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3369}
3370
3371static void
3372bwn_bt_enable(struct bwn_mac *mac)
3373{
3374	struct bwn_softc *sc = mac->mac_sc;
3375	uint64_t hf;
3376
3377	if (bwn_bluetooth == 0)
3378		return;
3379	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3380		return;
3381	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3382		return;
3383
3384	hf = bwn_hf_read(mac);
3385	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3386		hf |= BWN_HF_BT_COEXISTALT;
3387	else
3388		hf |= BWN_HF_BT_COEXIST;
3389	bwn_hf_write(mac, hf);
3390}
3391
3392static void
3393bwn_set_macaddr(struct bwn_mac *mac)
3394{
3395
3396	bwn_mac_write_bssid(mac);
3397	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3398	    mac->mac_sc->sc_ic.ic_macaddr);
3399}
3400
3401static void
3402bwn_clear_keys(struct bwn_mac *mac)
3403{
3404	int i;
3405
3406	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3407		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3408		    ("%s:%d: fail", __func__, __LINE__));
3409
3410		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3411		    NULL, BWN_SEC_KEYSIZE, NULL);
3412		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3413			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3414			    NULL, BWN_SEC_KEYSIZE, NULL);
3415		}
3416		mac->mac_key[i].keyconf = NULL;
3417	}
3418}
3419
3420static void
3421bwn_crypt_init(struct bwn_mac *mac)
3422{
3423	struct bwn_softc *sc = mac->mac_sc;
3424
3425	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3426	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3427	    ("%s:%d: fail", __func__, __LINE__));
3428	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3429	mac->mac_ktp *= 2;
3430	if (siba_get_revid(sc->sc_dev) >= 5)
3431		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3432	bwn_clear_keys(mac);
3433}
3434
3435static void
3436bwn_chip_exit(struct bwn_mac *mac)
3437{
3438	struct bwn_softc *sc = mac->mac_sc;
3439
3440	bwn_phy_exit(mac);
3441	siba_gpio_set(sc->sc_dev, 0);
3442}
3443
3444static int
3445bwn_fw_fillinfo(struct bwn_mac *mac)
3446{
3447	int error;
3448
3449	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3450	if (error == 0)
3451		return (0);
3452	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3453	if (error == 0)
3454		return (0);
3455	return (error);
3456}
3457
3458static int
3459bwn_gpio_init(struct bwn_mac *mac)
3460{
3461	struct bwn_softc *sc = mac->mac_sc;
3462	uint32_t mask = 0x1f, set = 0xf, value;
3463
3464	BWN_WRITE_4(mac, BWN_MACCTL,
3465	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3466	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3467	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3468
3469	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3470		mask |= 0x0060;
3471		set |= 0x0060;
3472	}
3473	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3474		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3475		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3476		mask |= 0x0200;
3477		set |= 0x0200;
3478	}
3479	if (siba_get_revid(sc->sc_dev) >= 2)
3480		mask |= 0x0010;
3481
3482	value = siba_gpio_get(sc->sc_dev);
3483	if (value == -1)
3484		return (0);
3485	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3486
3487	return (0);
3488}
3489
3490static int
3491bwn_fw_loadinitvals(struct bwn_mac *mac)
3492{
3493#define	GETFWOFFSET(fwp, offset)				\
3494	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3495	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3496	const struct bwn_fwhdr *hdr;
3497	struct bwn_fw *fw = &mac->mac_fw;
3498	int error;
3499
3500	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3501	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3502	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3503	if (error)
3504		return (error);
3505	if (fw->initvals_band.fw) {
3506		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3507		error = bwn_fwinitvals_write(mac,
3508		    GETFWOFFSET(fw->initvals_band, hdr_len),
3509		    be32toh(hdr->size),
3510		    fw->initvals_band.fw->datasize - hdr_len);
3511	}
3512	return (error);
3513#undef GETFWOFFSET
3514}
3515
3516static int
3517bwn_phy_init(struct bwn_mac *mac)
3518{
3519	struct bwn_softc *sc = mac->mac_sc;
3520	int error;
3521
3522	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3523	mac->mac_phy.rf_onoff(mac, 1);
3524	error = mac->mac_phy.init(mac);
3525	if (error) {
3526		device_printf(sc->sc_dev, "PHY init failed\n");
3527		goto fail0;
3528	}
3529	error = bwn_switch_channel(mac,
3530	    mac->mac_phy.get_default_chan(mac));
3531	if (error) {
3532		device_printf(sc->sc_dev,
3533		    "failed to switch default channel\n");
3534		goto fail1;
3535	}
3536	return (0);
3537fail1:
3538	if (mac->mac_phy.exit)
3539		mac->mac_phy.exit(mac);
3540fail0:
3541	mac->mac_phy.rf_onoff(mac, 0);
3542
3543	return (error);
3544}
3545
3546static void
3547bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3548{
3549	uint16_t ant;
3550	uint16_t tmp;
3551
3552	ant = bwn_ant2phy(antenna);
3553
3554	/* For ACK/CTS */
3555	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3556	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3557	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3558	/* For Probe Resposes */
3559	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3560	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3561	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3562}
3563
3564static void
3565bwn_set_opmode(struct bwn_mac *mac)
3566{
3567	struct bwn_softc *sc = mac->mac_sc;
3568	struct ieee80211com *ic = &sc->sc_ic;
3569	uint32_t ctl;
3570	uint16_t cfp_pretbtt;
3571
3572	ctl = BWN_READ_4(mac, BWN_MACCTL);
3573	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3574	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3575	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3576	ctl |= BWN_MACCTL_STA;
3577
3578	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3579	    ic->ic_opmode == IEEE80211_M_MBSS)
3580		ctl |= BWN_MACCTL_HOSTAP;
3581	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3582		ctl &= ~BWN_MACCTL_STA;
3583	ctl |= sc->sc_filters;
3584
3585	if (siba_get_revid(sc->sc_dev) <= 4)
3586		ctl |= BWN_MACCTL_PROMISC;
3587
3588	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3589
3590	cfp_pretbtt = 2;
3591	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3592		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3593		    siba_get_chiprev(sc->sc_dev) == 3)
3594			cfp_pretbtt = 100;
3595		else
3596			cfp_pretbtt = 50;
3597	}
3598	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3599}
3600
3601static int
3602bwn_dma_gettype(struct bwn_mac *mac)
3603{
3604	uint32_t tmp;
3605	uint16_t base;
3606
3607	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3608	if (tmp & SIBA_TGSHIGH_DMA64)
3609		return (BWN_DMA_64BIT);
3610	base = bwn_dma_base(0, 0);
3611	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3612	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3613	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3614		return (BWN_DMA_32BIT);
3615
3616	return (BWN_DMA_30BIT);
3617}
3618
3619static void
3620bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3621{
3622	if (!error) {
3623		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3624		*((bus_addr_t *)arg) = seg->ds_addr;
3625	}
3626}
3627
3628void
3629bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3630{
3631	struct bwn_phy *phy = &mac->mac_phy;
3632	struct bwn_softc *sc = mac->mac_sc;
3633	unsigned int i, max_loop;
3634	uint16_t value;
3635	uint32_t buffer[5] = {
3636		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3637	};
3638
3639	if (ofdm) {
3640		max_loop = 0x1e;
3641		buffer[0] = 0x000201cc;
3642	} else {
3643		max_loop = 0xfa;
3644		buffer[0] = 0x000b846e;
3645	}
3646
3647	BWN_ASSERT_LOCKED(mac->mac_sc);
3648
3649	for (i = 0; i < 5; i++)
3650		bwn_ram_write(mac, i * 4, buffer[i]);
3651
3652	BWN_WRITE_2(mac, 0x0568, 0x0000);
3653	BWN_WRITE_2(mac, 0x07c0,
3654	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3655
3656	value = (ofdm ? 0x41 : 0x40);
3657	BWN_WRITE_2(mac, 0x050c, value);
3658
3659	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3660	    phy->type == BWN_PHYTYPE_LCN)
3661		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3662	BWN_WRITE_2(mac, 0x0508, 0x0000);
3663	BWN_WRITE_2(mac, 0x050a, 0x0000);
3664	BWN_WRITE_2(mac, 0x054c, 0x0000);
3665	BWN_WRITE_2(mac, 0x056a, 0x0014);
3666	BWN_WRITE_2(mac, 0x0568, 0x0826);
3667	BWN_WRITE_2(mac, 0x0500, 0x0000);
3668
3669	/* XXX TODO: n phy pa override? */
3670
3671	switch (phy->type) {
3672	case BWN_PHYTYPE_N:
3673	case BWN_PHYTYPE_LCN:
3674		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3675		break;
3676	case BWN_PHYTYPE_LP:
3677		BWN_WRITE_2(mac, 0x0502, 0x0050);
3678		break;
3679	default:
3680		BWN_WRITE_2(mac, 0x0502, 0x0030);
3681		break;
3682	}
3683
3684	/* flush */
3685	BWN_READ_2(mac, 0x0502);
3686
3687	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3688		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3689	for (i = 0x00; i < max_loop; i++) {
3690		value = BWN_READ_2(mac, 0x050e);
3691		if (value & 0x0080)
3692			break;
3693		DELAY(10);
3694	}
3695	for (i = 0x00; i < 0x0a; i++) {
3696		value = BWN_READ_2(mac, 0x050e);
3697		if (value & 0x0400)
3698			break;
3699		DELAY(10);
3700	}
3701	for (i = 0x00; i < 0x19; i++) {
3702		value = BWN_READ_2(mac, 0x0690);
3703		if (!(value & 0x0100))
3704			break;
3705		DELAY(10);
3706	}
3707	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3708		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3709}
3710
3711void
3712bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3713{
3714	uint32_t macctl;
3715
3716	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3717
3718	macctl = BWN_READ_4(mac, BWN_MACCTL);
3719	if (macctl & BWN_MACCTL_BIGENDIAN)
3720		printf("TODO: need swap\n");
3721
3722	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3723	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3724	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3725}
3726
3727void
3728bwn_mac_suspend(struct bwn_mac *mac)
3729{
3730	struct bwn_softc *sc = mac->mac_sc;
3731	int i;
3732	uint32_t tmp;
3733
3734	KASSERT(mac->mac_suspended >= 0,
3735	    ("%s:%d: fail", __func__, __LINE__));
3736
3737	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3738	    __func__, mac->mac_suspended);
3739
3740	if (mac->mac_suspended == 0) {
3741		bwn_psctl(mac, BWN_PS_AWAKE);
3742		BWN_WRITE_4(mac, BWN_MACCTL,
3743			    BWN_READ_4(mac, BWN_MACCTL)
3744			    & ~BWN_MACCTL_ON);
3745		BWN_READ_4(mac, BWN_MACCTL);
3746		for (i = 35; i; i--) {
3747			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3748			if (tmp & BWN_INTR_MAC_SUSPENDED)
3749				goto out;
3750			DELAY(10);
3751		}
3752		for (i = 40; i; i--) {
3753			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3754			if (tmp & BWN_INTR_MAC_SUSPENDED)
3755				goto out;
3756			DELAY(1000);
3757		}
3758		device_printf(sc->sc_dev, "MAC suspend failed\n");
3759	}
3760out:
3761	mac->mac_suspended++;
3762}
3763
3764void
3765bwn_mac_enable(struct bwn_mac *mac)
3766{
3767	struct bwn_softc *sc = mac->mac_sc;
3768	uint16_t state;
3769
3770	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3771	    __func__, mac->mac_suspended);
3772
3773	state = bwn_shm_read_2(mac, BWN_SHARED,
3774	    BWN_SHARED_UCODESTAT);
3775	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3776	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3777		DPRINTF(sc, BWN_DEBUG_FW,
3778		    "%s: warn: firmware state (%d)\n",
3779		    __func__, state);
3780	}
3781
3782	mac->mac_suspended--;
3783	KASSERT(mac->mac_suspended >= 0,
3784	    ("%s:%d: fail", __func__, __LINE__));
3785	if (mac->mac_suspended == 0) {
3786		BWN_WRITE_4(mac, BWN_MACCTL,
3787		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3788		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3789		BWN_READ_4(mac, BWN_MACCTL);
3790		BWN_READ_4(mac, BWN_INTR_REASON);
3791		bwn_psctl(mac, 0);
3792	}
3793}
3794
3795void
3796bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3797{
3798	struct bwn_softc *sc = mac->mac_sc;
3799	int i;
3800	uint16_t ucstat;
3801
3802	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3803	    ("%s:%d: fail", __func__, __LINE__));
3804	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3805	    ("%s:%d: fail", __func__, __LINE__));
3806
3807	/* XXX forcibly awake and hwps-off */
3808
3809	BWN_WRITE_4(mac, BWN_MACCTL,
3810	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3811	    ~BWN_MACCTL_HWPS);
3812	BWN_READ_4(mac, BWN_MACCTL);
3813	if (siba_get_revid(sc->sc_dev) >= 5) {
3814		for (i = 0; i < 100; i++) {
3815			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3816			    BWN_SHARED_UCODESTAT);
3817			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3818				break;
3819			DELAY(10);
3820		}
3821	}
3822	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3823	    ucstat);
3824}
3825
3826static int
3827bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3828{
3829	struct bwn_softc *sc = mac->mac_sc;
3830	struct bwn_fw *fw = &mac->mac_fw;
3831	const uint8_t rev = siba_get_revid(sc->sc_dev);
3832	const char *filename;
3833	uint32_t high;
3834	int error;
3835
3836	/* microcode */
3837	filename = NULL;
3838	switch (rev) {
3839	case 42:
3840		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3841			filename = "ucode42";
3842		break;
3843	case 40:
3844		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3845			filename = "ucode40";
3846		break;
3847	case 33:
3848		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3849			filename = "ucode33_lcn40";
3850		break;
3851	case 30:
3852		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3853			filename = "ucode30_mimo";
3854		break;
3855	case 29:
3856		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3857			filename = "ucode29_mimo";
3858		break;
3859	case 26:
3860		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3861			filename = "ucode26_mimo";
3862		break;
3863	case 28:
3864	case 25:
3865		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3866			filename = "ucode25_mimo";
3867		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3868			filename = "ucode25_lcn";
3869		break;
3870	case 24:
3871		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3872			filename = "ucode24_lcn";
3873		break;
3874	case 23:
3875		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3876			filename = "ucode16_mimo";
3877		break;
3878	case 16:
3879	case 17:
3880	case 18:
3881	case 19:
3882		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3883			filename = "ucode16_mimo";
3884		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3885			filename = "ucode16_lp";
3886		break;
3887	case 15:
3888		filename = "ucode15";
3889		break;
3890	case 14:
3891		filename = "ucode14";
3892		break;
3893	case 13:
3894		filename = "ucode13";
3895		break;
3896	case 12:
3897	case 11:
3898		filename = "ucode11";
3899		break;
3900	case 10:
3901	case 9:
3902	case 8:
3903	case 7:
3904	case 6:
3905	case 5:
3906		filename = "ucode5";
3907		break;
3908	default:
3909		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3910		bwn_release_firmware(mac);
3911		return (EOPNOTSUPP);
3912	}
3913
3914	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3915	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3916	if (error) {
3917		bwn_release_firmware(mac);
3918		return (error);
3919	}
3920
3921	/* PCM */
3922	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3923	if (rev >= 5 && rev <= 10) {
3924		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3925		if (error == ENOENT)
3926			fw->no_pcmfile = 1;
3927		else if (error) {
3928			bwn_release_firmware(mac);
3929			return (error);
3930		}
3931	} else if (rev < 11) {
3932		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3933		return (EOPNOTSUPP);
3934	}
3935
3936	/* initvals */
3937	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3938	switch (mac->mac_phy.type) {
3939	case BWN_PHYTYPE_A:
3940		if (rev < 5 || rev > 10)
3941			goto fail1;
3942		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3943			filename = "a0g1initvals5";
3944		else
3945			filename = "a0g0initvals5";
3946		break;
3947	case BWN_PHYTYPE_G:
3948		if (rev >= 5 && rev <= 10)
3949			filename = "b0g0initvals5";
3950		else if (rev >= 13)
3951			filename = "b0g0initvals13";
3952		else
3953			goto fail1;
3954		break;
3955	case BWN_PHYTYPE_LP:
3956		if (rev == 13)
3957			filename = "lp0initvals13";
3958		else if (rev == 14)
3959			filename = "lp0initvals14";
3960		else if (rev >= 15)
3961			filename = "lp0initvals15";
3962		else
3963			goto fail1;
3964		break;
3965	case BWN_PHYTYPE_N:
3966		if (rev == 30)
3967			filename = "n16initvals30";
3968		else if (rev == 28 || rev == 25)
3969			filename = "n0initvals25";
3970		else if (rev == 24)
3971			filename = "n0initvals24";
3972		else if (rev == 23)
3973			filename = "n0initvals16";
3974		else if (rev >= 16 && rev <= 18)
3975			filename = "n0initvals16";
3976		else if (rev >= 11 && rev <= 12)
3977			filename = "n0initvals11";
3978		else
3979			goto fail1;
3980		break;
3981	default:
3982		goto fail1;
3983	}
3984	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3985	if (error) {
3986		bwn_release_firmware(mac);
3987		return (error);
3988	}
3989
3990	/* bandswitch initvals */
3991	switch (mac->mac_phy.type) {
3992	case BWN_PHYTYPE_A:
3993		if (rev >= 5 && rev <= 10) {
3994			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3995				filename = "a0g1bsinitvals5";
3996			else
3997				filename = "a0g0bsinitvals5";
3998		} else if (rev >= 11)
3999			filename = NULL;
4000		else
4001			goto fail1;
4002		break;
4003	case BWN_PHYTYPE_G:
4004		if (rev >= 5 && rev <= 10)
4005			filename = "b0g0bsinitvals5";
4006		else if (rev >= 11)
4007			filename = NULL;
4008		else
4009			goto fail1;
4010		break;
4011	case BWN_PHYTYPE_LP:
4012		if (rev == 13)
4013			filename = "lp0bsinitvals13";
4014		else if (rev == 14)
4015			filename = "lp0bsinitvals14";
4016		else if (rev >= 15)
4017			filename = "lp0bsinitvals15";
4018		else
4019			goto fail1;
4020		break;
4021	case BWN_PHYTYPE_N:
4022		if (rev == 30)
4023			filename = "n16bsinitvals30";
4024		else if (rev == 28 || rev == 25)
4025			filename = "n0bsinitvals25";
4026		else if (rev == 24)
4027			filename = "n0bsinitvals24";
4028		else if (rev == 23)
4029			filename = "n0bsinitvals16";
4030		else if (rev >= 16 && rev <= 18)
4031			filename = "n0bsinitvals16";
4032		else if (rev >= 11 && rev <= 12)
4033			filename = "n0bsinitvals11";
4034		else
4035			goto fail1;
4036		break;
4037	default:
4038		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4039		    mac->mac_phy.type);
4040		goto fail1;
4041	}
4042	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4043	if (error) {
4044		bwn_release_firmware(mac);
4045		return (error);
4046	}
4047	return (0);
4048fail1:
4049	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4050	    rev, mac->mac_phy.type);
4051	bwn_release_firmware(mac);
4052	return (EOPNOTSUPP);
4053}
4054
4055static int
4056bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4057    const char *name, struct bwn_fwfile *bfw)
4058{
4059	const struct bwn_fwhdr *hdr;
4060	struct bwn_softc *sc = mac->mac_sc;
4061	const struct firmware *fw;
4062	char namebuf[64];
4063
4064	if (name == NULL) {
4065		bwn_do_release_fw(bfw);
4066		return (0);
4067	}
4068	if (bfw->filename != NULL) {
4069		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4070			return (0);
4071		bwn_do_release_fw(bfw);
4072	}
4073
4074	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4075	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4076	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4077	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4078	fw = firmware_get(namebuf);
4079	if (fw == NULL) {
4080		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4081		    namebuf);
4082		return (ENOENT);
4083	}
4084	if (fw->datasize < sizeof(struct bwn_fwhdr))
4085		goto fail;
4086	hdr = (const struct bwn_fwhdr *)(fw->data);
4087	switch (hdr->type) {
4088	case BWN_FWTYPE_UCODE:
4089	case BWN_FWTYPE_PCM:
4090		if (be32toh(hdr->size) !=
4091		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4092			goto fail;
4093		/* FALLTHROUGH */
4094	case BWN_FWTYPE_IV:
4095		if (hdr->ver != 1)
4096			goto fail;
4097		break;
4098	default:
4099		goto fail;
4100	}
4101	bfw->filename = name;
4102	bfw->fw = fw;
4103	bfw->type = type;
4104	return (0);
4105fail:
4106	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4107	if (fw != NULL)
4108		firmware_put(fw, FIRMWARE_UNLOAD);
4109	return (EPROTO);
4110}
4111
4112static void
4113bwn_release_firmware(struct bwn_mac *mac)
4114{
4115
4116	bwn_do_release_fw(&mac->mac_fw.ucode);
4117	bwn_do_release_fw(&mac->mac_fw.pcm);
4118	bwn_do_release_fw(&mac->mac_fw.initvals);
4119	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4120}
4121
4122static void
4123bwn_do_release_fw(struct bwn_fwfile *bfw)
4124{
4125
4126	if (bfw->fw != NULL)
4127		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4128	bfw->fw = NULL;
4129	bfw->filename = NULL;
4130}
4131
4132static int
4133bwn_fw_loaducode(struct bwn_mac *mac)
4134{
4135#define	GETFWOFFSET(fwp, offset)	\
4136	((const uint32_t *)((const char *)fwp.fw->data + offset))
4137#define	GETFWSIZE(fwp, offset)	\
4138	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4139	struct bwn_softc *sc = mac->mac_sc;
4140	const uint32_t *data;
4141	unsigned int i;
4142	uint32_t ctl;
4143	uint16_t date, fwcaps, time;
4144	int error = 0;
4145
4146	ctl = BWN_READ_4(mac, BWN_MACCTL);
4147	ctl |= BWN_MACCTL_MCODE_JMP0;
4148	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4149	    __LINE__));
4150	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4151	for (i = 0; i < 64; i++)
4152		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4153	for (i = 0; i < 4096; i += 2)
4154		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4155
4156	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4157	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4158	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4159	     i++) {
4160		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4161		DELAY(10);
4162	}
4163
4164	if (mac->mac_fw.pcm.fw) {
4165		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4166		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4167		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4168		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4169		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4170		    sizeof(struct bwn_fwhdr)); i++) {
4171			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4172			DELAY(10);
4173		}
4174	}
4175
4176	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4177	BWN_WRITE_4(mac, BWN_MACCTL,
4178	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4179	    BWN_MACCTL_MCODE_RUN);
4180
4181	for (i = 0; i < 21; i++) {
4182		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4183			break;
4184		if (i >= 20) {
4185			device_printf(sc->sc_dev, "ucode timeout\n");
4186			error = ENXIO;
4187			goto error;
4188		}
4189		DELAY(50000);
4190	}
4191	BWN_READ_4(mac, BWN_INTR_REASON);
4192
4193	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4194	if (mac->mac_fw.rev <= 0x128) {
4195		device_printf(sc->sc_dev, "the firmware is too old\n");
4196		error = EOPNOTSUPP;
4197		goto error;
4198	}
4199
4200	/*
4201	 * Determine firmware header version; needed for TX/RX packet
4202	 * handling.
4203	 */
4204	if (mac->mac_fw.rev >= 598)
4205		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4206	else if (mac->mac_fw.rev >= 410)
4207		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4208	else
4209		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4210
4211	/*
4212	 * We don't support rev 598 or later; that requires
4213	 * another round of changes to the TX/RX descriptor
4214	 * and status layout.
4215	 *
4216	 * So, complain this is the case and exit out, rather
4217	 * than attaching and then failing.
4218	 */
4219#if 0
4220	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4221		device_printf(sc->sc_dev,
4222		    "firmware is too new (>=598); not supported\n");
4223		error = EOPNOTSUPP;
4224		goto error;
4225	}
4226#endif
4227
4228	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4229	    BWN_SHARED_UCODE_PATCH);
4230	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4231	mac->mac_fw.opensource = (date == 0xffff);
4232	if (bwn_wme != 0)
4233		mac->mac_flags |= BWN_MAC_FLAG_WME;
4234	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4235
4236	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4237	if (mac->mac_fw.opensource == 0) {
4238		device_printf(sc->sc_dev,
4239		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4240		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4241		if (mac->mac_fw.no_pcmfile)
4242			device_printf(sc->sc_dev,
4243			    "no HW crypto acceleration due to pcm5\n");
4244	} else {
4245		mac->mac_fw.patch = time;
4246		fwcaps = bwn_fwcaps_read(mac);
4247		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4248			device_printf(sc->sc_dev,
4249			    "disabling HW crypto acceleration\n");
4250			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4251		}
4252		if (!(fwcaps & BWN_FWCAPS_WME)) {
4253			device_printf(sc->sc_dev, "disabling WME support\n");
4254			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4255		}
4256	}
4257
4258	if (BWN_ISOLDFMT(mac))
4259		device_printf(sc->sc_dev, "using old firmware image\n");
4260
4261	return (0);
4262
4263error:
4264	BWN_WRITE_4(mac, BWN_MACCTL,
4265	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4266	    BWN_MACCTL_MCODE_JMP0);
4267
4268	return (error);
4269#undef GETFWSIZE
4270#undef GETFWOFFSET
4271}
4272
4273/* OpenFirmware only */
4274static uint16_t
4275bwn_fwcaps_read(struct bwn_mac *mac)
4276{
4277
4278	KASSERT(mac->mac_fw.opensource == 1,
4279	    ("%s:%d: fail", __func__, __LINE__));
4280	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4281}
4282
4283static int
4284bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4285    size_t count, size_t array_size)
4286{
4287#define	GET_NEXTIV16(iv)						\
4288	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4289	    sizeof(uint16_t) + sizeof(uint16_t)))
4290#define	GET_NEXTIV32(iv)						\
4291	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4292	    sizeof(uint16_t) + sizeof(uint32_t)))
4293	struct bwn_softc *sc = mac->mac_sc;
4294	const struct bwn_fwinitvals *iv;
4295	uint16_t offset;
4296	size_t i;
4297	uint8_t bit32;
4298
4299	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4300	    ("%s:%d: fail", __func__, __LINE__));
4301	iv = ivals;
4302	for (i = 0; i < count; i++) {
4303		if (array_size < sizeof(iv->offset_size))
4304			goto fail;
4305		array_size -= sizeof(iv->offset_size);
4306		offset = be16toh(iv->offset_size);
4307		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4308		offset &= BWN_FWINITVALS_OFFSET_MASK;
4309		if (offset >= 0x1000)
4310			goto fail;
4311		if (bit32) {
4312			if (array_size < sizeof(iv->data.d32))
4313				goto fail;
4314			array_size -= sizeof(iv->data.d32);
4315			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4316			iv = GET_NEXTIV32(iv);
4317		} else {
4318
4319			if (array_size < sizeof(iv->data.d16))
4320				goto fail;
4321			array_size -= sizeof(iv->data.d16);
4322			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4323
4324			iv = GET_NEXTIV16(iv);
4325		}
4326	}
4327	if (array_size != 0)
4328		goto fail;
4329	return (0);
4330fail:
4331	device_printf(sc->sc_dev, "initvals: invalid format\n");
4332	return (EPROTO);
4333#undef GET_NEXTIV16
4334#undef GET_NEXTIV32
4335}
4336
4337int
4338bwn_switch_channel(struct bwn_mac *mac, int chan)
4339{
4340	struct bwn_phy *phy = &(mac->mac_phy);
4341	struct bwn_softc *sc = mac->mac_sc;
4342	struct ieee80211com *ic = &sc->sc_ic;
4343	uint16_t channelcookie, savedcookie;
4344	int error;
4345
4346	if (chan == 0xffff)
4347		chan = phy->get_default_chan(mac);
4348
4349	channelcookie = chan;
4350	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4351		channelcookie |= 0x100;
4352	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4353	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4354	error = phy->switch_channel(mac, chan);
4355	if (error)
4356		goto fail;
4357
4358	mac->mac_phy.chan = chan;
4359	DELAY(8000);
4360	return (0);
4361fail:
4362	device_printf(sc->sc_dev, "failed to switch channel\n");
4363	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4364	return (error);
4365}
4366
4367static uint16_t
4368bwn_ant2phy(int antenna)
4369{
4370
4371	switch (antenna) {
4372	case BWN_ANT0:
4373		return (BWN_TX_PHY_ANT0);
4374	case BWN_ANT1:
4375		return (BWN_TX_PHY_ANT1);
4376	case BWN_ANT2:
4377		return (BWN_TX_PHY_ANT2);
4378	case BWN_ANT3:
4379		return (BWN_TX_PHY_ANT3);
4380	case BWN_ANTAUTO:
4381		return (BWN_TX_PHY_ANT01AUTO);
4382	}
4383	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4384	return (0);
4385}
4386
4387static void
4388bwn_wme_load(struct bwn_mac *mac)
4389{
4390	struct bwn_softc *sc = mac->mac_sc;
4391	int i;
4392
4393	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4394	    ("%s:%d: fail", __func__, __LINE__));
4395
4396	bwn_mac_suspend(mac);
4397	for (i = 0; i < N(sc->sc_wmeParams); i++)
4398		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4399		    bwn_wme_shm_offsets[i]);
4400	bwn_mac_enable(mac);
4401}
4402
4403static void
4404bwn_wme_loadparams(struct bwn_mac *mac,
4405    const struct wmeParams *p, uint16_t shm_offset)
4406{
4407#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4408	struct bwn_softc *sc = mac->mac_sc;
4409	uint16_t params[BWN_NR_WMEPARAMS];
4410	int slot, tmp;
4411	unsigned int i;
4412
4413	slot = BWN_READ_2(mac, BWN_RNG) &
4414	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4415
4416	memset(&params, 0, sizeof(params));
4417
4418	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4419	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4420	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4421
4422	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4423	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4424	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4425	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4426	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4427	params[BWN_WMEPARAM_BSLOTS] = slot;
4428	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4429
4430	for (i = 0; i < N(params); i++) {
4431		if (i == BWN_WMEPARAM_STATUS) {
4432			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4433			    shm_offset + (i * 2));
4434			tmp |= 0x100;
4435			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4436			    tmp);
4437		} else {
4438			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4439			    params[i]);
4440		}
4441	}
4442}
4443
4444static void
4445bwn_mac_write_bssid(struct bwn_mac *mac)
4446{
4447	struct bwn_softc *sc = mac->mac_sc;
4448	uint32_t tmp;
4449	int i;
4450	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4451
4452	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4453	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4454	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4455	    IEEE80211_ADDR_LEN);
4456
4457	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4458		tmp = (uint32_t) (mac_bssid[i + 0]);
4459		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4460		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4461		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4462		bwn_ram_write(mac, 0x20 + i, tmp);
4463	}
4464}
4465
4466static void
4467bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4468    const uint8_t *macaddr)
4469{
4470	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4471	uint16_t data;
4472
4473	if (!mac)
4474		macaddr = zero;
4475
4476	offset |= 0x0020;
4477	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4478
4479	data = macaddr[0];
4480	data |= macaddr[1] << 8;
4481	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4482	data = macaddr[2];
4483	data |= macaddr[3] << 8;
4484	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4485	data = macaddr[4];
4486	data |= macaddr[5] << 8;
4487	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4488}
4489
4490static void
4491bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4492    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4493{
4494	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4495	uint8_t per_sta_keys_start = 8;
4496
4497	if (BWN_SEC_NEWAPI(mac))
4498		per_sta_keys_start = 4;
4499
4500	KASSERT(index < mac->mac_max_nr_keys,
4501	    ("%s:%d: fail", __func__, __LINE__));
4502	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4503	    ("%s:%d: fail", __func__, __LINE__));
4504
4505	if (index >= per_sta_keys_start)
4506		bwn_key_macwrite(mac, index, NULL);
4507	if (key)
4508		memcpy(buf, key, key_len);
4509	bwn_key_write(mac, index, algorithm, buf);
4510	if (index >= per_sta_keys_start)
4511		bwn_key_macwrite(mac, index, mac_addr);
4512
4513	mac->mac_key[index].algorithm = algorithm;
4514}
4515
4516static void
4517bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4518{
4519	struct bwn_softc *sc = mac->mac_sc;
4520	uint32_t addrtmp[2] = { 0, 0 };
4521	uint8_t start = 8;
4522
4523	if (BWN_SEC_NEWAPI(mac))
4524		start = 4;
4525
4526	KASSERT(index >= start,
4527	    ("%s:%d: fail", __func__, __LINE__));
4528	index -= start;
4529
4530	if (addr) {
4531		addrtmp[0] = addr[0];
4532		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4533		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4534		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4535		addrtmp[1] = addr[4];
4536		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4537	}
4538
4539	if (siba_get_revid(sc->sc_dev) >= 5) {
4540		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4541		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4542	} else {
4543		if (index >= 8) {
4544			bwn_shm_write_4(mac, BWN_SHARED,
4545			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4546			bwn_shm_write_2(mac, BWN_SHARED,
4547			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4548		}
4549	}
4550}
4551
4552static void
4553bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4554    const uint8_t *key)
4555{
4556	unsigned int i;
4557	uint32_t offset;
4558	uint16_t kidx, value;
4559
4560	kidx = BWN_SEC_KEY2FW(mac, index);
4561	bwn_shm_write_2(mac, BWN_SHARED,
4562	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4563
4564	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4565	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4566		value = key[i];
4567		value |= (uint16_t)(key[i + 1]) << 8;
4568		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4569	}
4570}
4571
4572static void
4573bwn_phy_exit(struct bwn_mac *mac)
4574{
4575
4576	mac->mac_phy.rf_onoff(mac, 0);
4577	if (mac->mac_phy.exit != NULL)
4578		mac->mac_phy.exit(mac);
4579}
4580
4581static void
4582bwn_dma_free(struct bwn_mac *mac)
4583{
4584	struct bwn_dma *dma;
4585
4586	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4587		return;
4588	dma = &mac->mac_method.dma;
4589
4590	bwn_dma_ringfree(&dma->rx);
4591	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4592	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4593	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4594	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4595	bwn_dma_ringfree(&dma->mcast);
4596}
4597
4598static void
4599bwn_core_stop(struct bwn_mac *mac)
4600{
4601	struct bwn_softc *sc = mac->mac_sc;
4602
4603	BWN_ASSERT_LOCKED(sc);
4604
4605	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4606		return;
4607
4608	callout_stop(&sc->sc_rfswitch_ch);
4609	callout_stop(&sc->sc_task_ch);
4610	callout_stop(&sc->sc_watchdog_ch);
4611	sc->sc_watchdog_timer = 0;
4612	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4613	BWN_READ_4(mac, BWN_INTR_MASK);
4614	bwn_mac_suspend(mac);
4615
4616	mac->mac_status = BWN_MAC_STATUS_INITED;
4617}
4618
4619static int
4620bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4621{
4622	struct bwn_mac *up_dev = NULL;
4623	struct bwn_mac *down_dev;
4624	struct bwn_mac *mac;
4625	int err, status;
4626	uint8_t gmode;
4627
4628	BWN_ASSERT_LOCKED(sc);
4629
4630	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4631		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4632		    mac->mac_phy.supports_2ghz) {
4633			up_dev = mac;
4634			gmode = 1;
4635		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4636		    mac->mac_phy.supports_5ghz) {
4637			up_dev = mac;
4638			gmode = 0;
4639		} else {
4640			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4641			return (EINVAL);
4642		}
4643		if (up_dev != NULL)
4644			break;
4645	}
4646	if (up_dev == NULL) {
4647		device_printf(sc->sc_dev, "Could not find a device\n");
4648		return (ENODEV);
4649	}
4650	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4651		return (0);
4652
4653	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4654	    "switching to %s-GHz band\n",
4655	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4656
4657	down_dev = sc->sc_curmac;
4658	status = down_dev->mac_status;
4659	if (status >= BWN_MAC_STATUS_STARTED)
4660		bwn_core_stop(down_dev);
4661	if (status >= BWN_MAC_STATUS_INITED)
4662		bwn_core_exit(down_dev);
4663
4664	if (down_dev != up_dev)
4665		bwn_phy_reset(down_dev);
4666
4667	up_dev->mac_phy.gmode = gmode;
4668	if (status >= BWN_MAC_STATUS_INITED) {
4669		err = bwn_core_init(up_dev);
4670		if (err) {
4671			device_printf(sc->sc_dev,
4672			    "fatal: failed to initialize for %s-GHz\n",
4673			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4674			goto fail;
4675		}
4676	}
4677	if (status >= BWN_MAC_STATUS_STARTED)
4678		bwn_core_start(up_dev);
4679	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4680	sc->sc_curmac = up_dev;
4681
4682	return (0);
4683fail:
4684	sc->sc_curmac = NULL;
4685	return (err);
4686}
4687
4688static void
4689bwn_rf_turnon(struct bwn_mac *mac)
4690{
4691
4692	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4693
4694	bwn_mac_suspend(mac);
4695	mac->mac_phy.rf_onoff(mac, 1);
4696	mac->mac_phy.rf_on = 1;
4697	bwn_mac_enable(mac);
4698}
4699
4700static void
4701bwn_rf_turnoff(struct bwn_mac *mac)
4702{
4703
4704	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4705
4706	bwn_mac_suspend(mac);
4707	mac->mac_phy.rf_onoff(mac, 0);
4708	mac->mac_phy.rf_on = 0;
4709	bwn_mac_enable(mac);
4710}
4711
4712/*
4713 * SSB PHY reset.
4714 */
4715static void
4716bwn_phy_reset_siba(struct bwn_mac *mac)
4717{
4718	struct bwn_softc *sc = mac->mac_sc;
4719
4720	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4721	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4722	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4723	DELAY(1000);
4724	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4725	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4726	DELAY(1000);
4727}
4728
4729static void
4730bwn_phy_reset(struct bwn_mac *mac)
4731{
4732
4733	if (bwn_is_bus_siba(mac)) {
4734		bwn_phy_reset_siba(mac);
4735	} else {
4736		BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4737	}
4738}
4739
4740static int
4741bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4742{
4743	struct bwn_vap *bvp = BWN_VAP(vap);
4744	struct ieee80211com *ic= vap->iv_ic;
4745	enum ieee80211_state ostate = vap->iv_state;
4746	struct bwn_softc *sc = ic->ic_softc;
4747	struct bwn_mac *mac = sc->sc_curmac;
4748	int error;
4749
4750	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4751	    ieee80211_state_name[vap->iv_state],
4752	    ieee80211_state_name[nstate]);
4753
4754	error = bvp->bv_newstate(vap, nstate, arg);
4755	if (error != 0)
4756		return (error);
4757
4758	BWN_LOCK(sc);
4759
4760	bwn_led_newstate(mac, nstate);
4761
4762	/*
4763	 * Clear the BSSID when we stop a STA
4764	 */
4765	if (vap->iv_opmode == IEEE80211_M_STA) {
4766		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4767			/*
4768			 * Clear out the BSSID.  If we reassociate to
4769			 * the same AP, this will reinialize things
4770			 * correctly...
4771			 */
4772			if (ic->ic_opmode == IEEE80211_M_STA &&
4773			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4774				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4775				bwn_set_macaddr(mac);
4776			}
4777		}
4778	}
4779
4780	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4781	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4782		/* XXX nothing to do? */
4783	} else if (nstate == IEEE80211_S_RUN) {
4784		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4785		bwn_set_opmode(mac);
4786		bwn_set_pretbtt(mac);
4787		bwn_spu_setdelay(mac, 0);
4788		bwn_set_macaddr(mac);
4789	}
4790
4791	BWN_UNLOCK(sc);
4792
4793	return (error);
4794}
4795
4796static void
4797bwn_set_pretbtt(struct bwn_mac *mac)
4798{
4799	struct bwn_softc *sc = mac->mac_sc;
4800	struct ieee80211com *ic = &sc->sc_ic;
4801	uint16_t pretbtt;
4802
4803	if (ic->ic_opmode == IEEE80211_M_IBSS)
4804		pretbtt = 2;
4805	else
4806		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4807	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4808	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4809}
4810
4811static int
4812bwn_intr(void *arg)
4813{
4814	struct bwn_mac *mac = arg;
4815	struct bwn_softc *sc = mac->mac_sc;
4816	uint32_t reason;
4817
4818	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4819	    (sc->sc_flags & BWN_FLAG_INVALID))
4820		return (FILTER_STRAY);
4821
4822	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4823
4824	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4825	if (reason == 0xffffffff)	/* shared IRQ */
4826		return (FILTER_STRAY);
4827	reason &= mac->mac_intr_mask;
4828	if (reason == 0)
4829		return (FILTER_HANDLED);
4830	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4831
4832	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4833	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4834	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4835	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4836	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4837	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4838	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4839	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4840	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4841	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4842	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4843
4844	/* Disable interrupts. */
4845	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4846
4847	mac->mac_reason_intr = reason;
4848
4849	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4850	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4851
4852	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4853	return (FILTER_HANDLED);
4854}
4855
4856static void
4857bwn_intrtask(void *arg, int npending)
4858{
4859	struct bwn_mac *mac = arg;
4860	struct bwn_softc *sc = mac->mac_sc;
4861	uint32_t merged = 0;
4862	int i, tx = 0, rx = 0;
4863
4864	BWN_LOCK(sc);
4865	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4866	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4867		BWN_UNLOCK(sc);
4868		return;
4869	}
4870
4871	for (i = 0; i < N(mac->mac_reason); i++)
4872		merged |= mac->mac_reason[i];
4873
4874	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4875		device_printf(sc->sc_dev, "MAC trans error\n");
4876
4877	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4878		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4879		mac->mac_phy.txerrors--;
4880		if (mac->mac_phy.txerrors == 0) {
4881			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4882			bwn_restart(mac, "PHY TX errors");
4883		}
4884	}
4885
4886	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4887		if (merged & BWN_DMAINTR_FATALMASK) {
4888			device_printf(sc->sc_dev,
4889			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4890			    mac->mac_reason[0], mac->mac_reason[1],
4891			    mac->mac_reason[2], mac->mac_reason[3],
4892			    mac->mac_reason[4], mac->mac_reason[5]);
4893			bwn_restart(mac, "DMA error");
4894			BWN_UNLOCK(sc);
4895			return;
4896		}
4897		if (merged & BWN_DMAINTR_NONFATALMASK) {
4898			device_printf(sc->sc_dev,
4899			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4900			    mac->mac_reason[0], mac->mac_reason[1],
4901			    mac->mac_reason[2], mac->mac_reason[3],
4902			    mac->mac_reason[4], mac->mac_reason[5]);
4903		}
4904	}
4905
4906	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4907		bwn_intr_ucode_debug(mac);
4908	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4909		bwn_intr_tbtt_indication(mac);
4910	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4911		bwn_intr_atim_end(mac);
4912	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4913		bwn_intr_beacon(mac);
4914	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4915		bwn_intr_pmq(mac);
4916	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4917		bwn_intr_noise(mac);
4918
4919	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4920		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4921			bwn_dma_rx(mac->mac_method.dma.rx);
4922			rx = 1;
4923		}
4924	} else
4925		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4926
4927	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4928	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4929	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4930	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4931	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4932
4933	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4934		bwn_intr_txeof(mac);
4935		tx = 1;
4936	}
4937
4938	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4939
4940	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4941		int evt = BWN_LED_EVENT_NONE;
4942
4943		if (tx && rx) {
4944			if (sc->sc_rx_rate > sc->sc_tx_rate)
4945				evt = BWN_LED_EVENT_RX;
4946			else
4947				evt = BWN_LED_EVENT_TX;
4948		} else if (tx) {
4949			evt = BWN_LED_EVENT_TX;
4950		} else if (rx) {
4951			evt = BWN_LED_EVENT_RX;
4952		} else if (rx == 0) {
4953			evt = BWN_LED_EVENT_POLL;
4954		}
4955
4956		if (evt != BWN_LED_EVENT_NONE)
4957			bwn_led_event(mac, evt);
4958       }
4959
4960	if (mbufq_first(&sc->sc_snd) != NULL)
4961		bwn_start(sc);
4962
4963	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4964	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4965
4966	BWN_UNLOCK(sc);
4967}
4968
4969static void
4970bwn_restart(struct bwn_mac *mac, const char *msg)
4971{
4972	struct bwn_softc *sc = mac->mac_sc;
4973	struct ieee80211com *ic = &sc->sc_ic;
4974
4975	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4976		return;
4977
4978	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4979	ieee80211_runtask(ic, &mac->mac_hwreset);
4980}
4981
4982static void
4983bwn_intr_ucode_debug(struct bwn_mac *mac)
4984{
4985	struct bwn_softc *sc = mac->mac_sc;
4986	uint16_t reason;
4987
4988	if (mac->mac_fw.opensource == 0)
4989		return;
4990
4991	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4992	switch (reason) {
4993	case BWN_DEBUGINTR_PANIC:
4994		bwn_handle_fwpanic(mac);
4995		break;
4996	case BWN_DEBUGINTR_DUMP_SHM:
4997		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4998		break;
4999	case BWN_DEBUGINTR_DUMP_REGS:
5000		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5001		break;
5002	case BWN_DEBUGINTR_MARKER:
5003		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5004		break;
5005	default:
5006		device_printf(sc->sc_dev,
5007		    "ucode debug unknown reason: %#x\n", reason);
5008	}
5009
5010	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5011	    BWN_DEBUGINTR_ACK);
5012}
5013
5014static void
5015bwn_intr_tbtt_indication(struct bwn_mac *mac)
5016{
5017	struct bwn_softc *sc = mac->mac_sc;
5018	struct ieee80211com *ic = &sc->sc_ic;
5019
5020	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5021		bwn_psctl(mac, 0);
5022	if (ic->ic_opmode == IEEE80211_M_IBSS)
5023		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5024}
5025
5026static void
5027bwn_intr_atim_end(struct bwn_mac *mac)
5028{
5029
5030	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5031		BWN_WRITE_4(mac, BWN_MACCMD,
5032		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5033		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5034	}
5035}
5036
5037static void
5038bwn_intr_beacon(struct bwn_mac *mac)
5039{
5040	struct bwn_softc *sc = mac->mac_sc;
5041	struct ieee80211com *ic = &sc->sc_ic;
5042	uint32_t cmd, beacon0, beacon1;
5043
5044	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5045	    ic->ic_opmode == IEEE80211_M_MBSS)
5046		return;
5047
5048	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5049
5050	cmd = BWN_READ_4(mac, BWN_MACCMD);
5051	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5052	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5053
5054	if (beacon0 && beacon1) {
5055		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5056		mac->mac_intr_mask |= BWN_INTR_BEACON;
5057		return;
5058	}
5059
5060	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5061		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5062		bwn_load_beacon0(mac);
5063		bwn_load_beacon1(mac);
5064		cmd = BWN_READ_4(mac, BWN_MACCMD);
5065		cmd |= BWN_MACCMD_BEACON0_VALID;
5066		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5067	} else {
5068		if (!beacon0) {
5069			bwn_load_beacon0(mac);
5070			cmd = BWN_READ_4(mac, BWN_MACCMD);
5071			cmd |= BWN_MACCMD_BEACON0_VALID;
5072			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5073		} else if (!beacon1) {
5074			bwn_load_beacon1(mac);
5075			cmd = BWN_READ_4(mac, BWN_MACCMD);
5076			cmd |= BWN_MACCMD_BEACON1_VALID;
5077			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5078		}
5079	}
5080}
5081
5082static void
5083bwn_intr_pmq(struct bwn_mac *mac)
5084{
5085	uint32_t tmp;
5086
5087	while (1) {
5088		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5089		if (!(tmp & 0x00000008))
5090			break;
5091	}
5092	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5093}
5094
5095static void
5096bwn_intr_noise(struct bwn_mac *mac)
5097{
5098	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5099	uint16_t tmp;
5100	uint8_t noise[4];
5101	uint8_t i, j;
5102	int32_t average;
5103
5104	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5105		return;
5106
5107	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5108	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5109	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5110	    noise[3] == 0x7f)
5111		goto new;
5112
5113	KASSERT(mac->mac_noise.noi_nsamples < 8,
5114	    ("%s:%d: fail", __func__, __LINE__));
5115	i = mac->mac_noise.noi_nsamples;
5116	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5117	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5118	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5119	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5120	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5121	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5122	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5123	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5124	mac->mac_noise.noi_nsamples++;
5125	if (mac->mac_noise.noi_nsamples == 8) {
5126		average = 0;
5127		for (i = 0; i < 8; i++) {
5128			for (j = 0; j < 4; j++)
5129				average += mac->mac_noise.noi_samples[i][j];
5130		}
5131		average = (((average / 32) * 125) + 64) / 128;
5132		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5133		if (tmp >= 8)
5134			average += 2;
5135		else
5136			average -= 25;
5137		average -= (tmp == 8) ? 72 : 48;
5138
5139		mac->mac_stats.link_noise = average;
5140		mac->mac_noise.noi_running = 0;
5141		return;
5142	}
5143new:
5144	bwn_noise_gensample(mac);
5145}
5146
5147static int
5148bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5149{
5150	struct bwn_mac *mac = prq->prq_mac;
5151	struct bwn_softc *sc = mac->mac_sc;
5152	unsigned int i;
5153
5154	BWN_ASSERT_LOCKED(sc);
5155
5156	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5157		return (0);
5158
5159	for (i = 0; i < 5000; i++) {
5160		if (bwn_pio_rxeof(prq) == 0)
5161			break;
5162	}
5163	if (i >= 5000)
5164		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5165	return ((i > 0) ? 1 : 0);
5166}
5167
5168static void
5169bwn_dma_rx(struct bwn_dma_ring *dr)
5170{
5171	int slot, curslot;
5172
5173	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5174	curslot = dr->get_curslot(dr);
5175	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5176	    ("%s:%d: fail", __func__, __LINE__));
5177
5178	slot = dr->dr_curslot;
5179	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5180		bwn_dma_rxeof(dr, &slot);
5181
5182	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5183	    BUS_DMASYNC_PREWRITE);
5184
5185	dr->set_curslot(dr, slot);
5186	dr->dr_curslot = slot;
5187}
5188
5189static void
5190bwn_intr_txeof(struct bwn_mac *mac)
5191{
5192	struct bwn_txstatus stat;
5193	uint32_t stat0, stat1;
5194	uint16_t tmp;
5195
5196	BWN_ASSERT_LOCKED(mac->mac_sc);
5197
5198	while (1) {
5199		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5200		if (!(stat0 & 0x00000001))
5201			break;
5202		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5203
5204		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5205		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5206		    __func__,
5207		    stat0,
5208		    stat1);
5209
5210		stat.cookie = (stat0 >> 16);
5211		stat.seq = (stat1 & 0x0000ffff);
5212		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5213		tmp = (stat0 & 0x0000ffff);
5214		stat.framecnt = ((tmp & 0xf000) >> 12);
5215		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5216		stat.sreason = ((tmp & 0x001c) >> 2);
5217		stat.pm = (tmp & 0x0080) ? 1 : 0;
5218		stat.im = (tmp & 0x0040) ? 1 : 0;
5219		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5220		stat.ack = (tmp & 0x0002) ? 1 : 0;
5221
5222		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5223		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5224		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5225		    __func__,
5226		    stat.cookie,
5227		    stat.seq,
5228		    stat.phy_stat,
5229		    stat.framecnt,
5230		    stat.rtscnt,
5231		    stat.sreason,
5232		    stat.pm,
5233		    stat.im,
5234		    stat.ampdu,
5235		    stat.ack);
5236
5237		bwn_handle_txeof(mac, &stat);
5238	}
5239}
5240
5241static void
5242bwn_hwreset(void *arg, int npending)
5243{
5244	struct bwn_mac *mac = arg;
5245	struct bwn_softc *sc = mac->mac_sc;
5246	int error = 0;
5247	int prev_status;
5248
5249	BWN_LOCK(sc);
5250
5251	prev_status = mac->mac_status;
5252	if (prev_status >= BWN_MAC_STATUS_STARTED)
5253		bwn_core_stop(mac);
5254	if (prev_status >= BWN_MAC_STATUS_INITED)
5255		bwn_core_exit(mac);
5256
5257	if (prev_status >= BWN_MAC_STATUS_INITED) {
5258		error = bwn_core_init(mac);
5259		if (error)
5260			goto out;
5261	}
5262	if (prev_status >= BWN_MAC_STATUS_STARTED)
5263		bwn_core_start(mac);
5264out:
5265	if (error) {
5266		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5267		sc->sc_curmac = NULL;
5268	}
5269	BWN_UNLOCK(sc);
5270}
5271
5272static void
5273bwn_handle_fwpanic(struct bwn_mac *mac)
5274{
5275	struct bwn_softc *sc = mac->mac_sc;
5276	uint16_t reason;
5277
5278	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5279	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5280
5281	if (reason == BWN_FWPANIC_RESTART)
5282		bwn_restart(mac, "ucode panic");
5283}
5284
5285static void
5286bwn_load_beacon0(struct bwn_mac *mac)
5287{
5288
5289	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5290}
5291
5292static void
5293bwn_load_beacon1(struct bwn_mac *mac)
5294{
5295
5296	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5297}
5298
5299static uint32_t
5300bwn_jssi_read(struct bwn_mac *mac)
5301{
5302	uint32_t val = 0;
5303
5304	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5305	val <<= 16;
5306	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5307
5308	return (val);
5309}
5310
5311static void
5312bwn_noise_gensample(struct bwn_mac *mac)
5313{
5314	uint32_t jssi = 0x7f7f7f7f;
5315
5316	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5317	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5318	BWN_WRITE_4(mac, BWN_MACCMD,
5319	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5320}
5321
5322static int
5323bwn_dma_freeslot(struct bwn_dma_ring *dr)
5324{
5325	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5326
5327	return (dr->dr_numslots - dr->dr_usedslot);
5328}
5329
5330static int
5331bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5332{
5333	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5334
5335	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5336	    ("%s:%d: fail", __func__, __LINE__));
5337	if (slot == dr->dr_numslots - 1)
5338		return (0);
5339	return (slot + 1);
5340}
5341
5342static void
5343bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5344{
5345	struct bwn_mac *mac = dr->dr_mac;
5346	struct bwn_softc *sc = mac->mac_sc;
5347	struct bwn_dma *dma = &mac->mac_method.dma;
5348	struct bwn_dmadesc_generic *desc;
5349	struct bwn_dmadesc_meta *meta;
5350	struct bwn_rxhdr4 *rxhdr;
5351	struct mbuf *m;
5352	uint32_t macstat;
5353	int32_t tmp;
5354	int cnt = 0;
5355	uint16_t len;
5356
5357	dr->getdesc(dr, *slot, &desc, &meta);
5358
5359	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5360	m = meta->mt_m;
5361
5362	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5363		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5364		return;
5365	}
5366
5367	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5368	len = le16toh(rxhdr->frame_len);
5369	if (len <= 0) {
5370		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5371		return;
5372	}
5373	if (bwn_dma_check_redzone(dr, m)) {
5374		device_printf(sc->sc_dev, "redzone error.\n");
5375		bwn_dma_set_redzone(dr, m);
5376		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5377		    BUS_DMASYNC_PREWRITE);
5378		return;
5379	}
5380	if (len > dr->dr_rx_bufsize) {
5381		tmp = len;
5382		while (1) {
5383			dr->getdesc(dr, *slot, &desc, &meta);
5384			bwn_dma_set_redzone(dr, meta->mt_m);
5385			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5386			    BUS_DMASYNC_PREWRITE);
5387			*slot = bwn_dma_nextslot(dr, *slot);
5388			cnt++;
5389			tmp -= dr->dr_rx_bufsize;
5390			if (tmp <= 0)
5391				break;
5392		}
5393		device_printf(sc->sc_dev, "too small buffer "
5394		       "(len %u buffer %u dropped %d)\n",
5395		       len, dr->dr_rx_bufsize, cnt);
5396		return;
5397	}
5398
5399	switch (mac->mac_fw.fw_hdr_format) {
5400	case BWN_FW_HDR_351:
5401	case BWN_FW_HDR_410:
5402		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5403		break;
5404	case BWN_FW_HDR_598:
5405		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5406		break;
5407	}
5408
5409	if (macstat & BWN_RX_MAC_FCSERR) {
5410		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5411			device_printf(sc->sc_dev, "RX drop\n");
5412			return;
5413		}
5414	}
5415
5416	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5417	m_adj(m, dr->dr_frameoffset);
5418
5419	bwn_rxeof(dr->dr_mac, m, rxhdr);
5420}
5421
5422static void
5423bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5424{
5425	struct bwn_softc *sc = mac->mac_sc;
5426	struct bwn_stats *stats = &mac->mac_stats;
5427
5428	BWN_ASSERT_LOCKED(mac->mac_sc);
5429
5430	if (status->im)
5431		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5432	if (status->ampdu)
5433		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5434	if (status->rtscnt) {
5435		if (status->rtscnt == 0xf)
5436			stats->rtsfail++;
5437		else
5438			stats->rts++;
5439	}
5440
5441	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5442		bwn_dma_handle_txeof(mac, status);
5443	} else {
5444		bwn_pio_handle_txeof(mac, status);
5445	}
5446
5447	bwn_phy_txpower_check(mac, 0);
5448}
5449
5450static uint8_t
5451bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5452{
5453	struct bwn_mac *mac = prq->prq_mac;
5454	struct bwn_softc *sc = mac->mac_sc;
5455	struct bwn_rxhdr4 rxhdr;
5456	struct mbuf *m;
5457	uint32_t ctl32, macstat, v32;
5458	unsigned int i, padding;
5459	uint16_t ctl16, len, totlen, v16;
5460	unsigned char *mp;
5461	char *data;
5462
5463	memset(&rxhdr, 0, sizeof(rxhdr));
5464
5465	if (prq->prq_rev >= 8) {
5466		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5467		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5468			return (0);
5469		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5470		    BWN_PIO8_RXCTL_FRAMEREADY);
5471		for (i = 0; i < 10; i++) {
5472			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5473			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5474				goto ready;
5475			DELAY(10);
5476		}
5477	} else {
5478		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5479		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5480			return (0);
5481		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5482		    BWN_PIO_RXCTL_FRAMEREADY);
5483		for (i = 0; i < 10; i++) {
5484			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5485			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5486				goto ready;
5487			DELAY(10);
5488		}
5489	}
5490	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5491	return (1);
5492ready:
5493	if (prq->prq_rev >= 8)
5494		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5495		    prq->prq_base + BWN_PIO8_RXDATA);
5496	else
5497		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5498		    prq->prq_base + BWN_PIO_RXDATA);
5499	len = le16toh(rxhdr.frame_len);
5500	if (len > 0x700) {
5501		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5502		goto error;
5503	}
5504	if (len == 0) {
5505		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5506		goto error;
5507	}
5508
5509	switch (mac->mac_fw.fw_hdr_format) {
5510	case BWN_FW_HDR_351:
5511	case BWN_FW_HDR_410:
5512		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5513		break;
5514	case BWN_FW_HDR_598:
5515		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5516		break;
5517	}
5518
5519	if (macstat & BWN_RX_MAC_FCSERR) {
5520		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5521			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5522			goto error;
5523		}
5524	}
5525
5526	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5527	totlen = len + padding;
5528	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5529	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5530	if (m == NULL) {
5531		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5532		goto error;
5533	}
5534	mp = mtod(m, unsigned char *);
5535	if (prq->prq_rev >= 8) {
5536		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5537		    prq->prq_base + BWN_PIO8_RXDATA);
5538		if (totlen & 3) {
5539			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5540			data = &(mp[totlen - 1]);
5541			switch (totlen & 3) {
5542			case 3:
5543				*data = (v32 >> 16);
5544				data--;
5545			case 2:
5546				*data = (v32 >> 8);
5547				data--;
5548			case 1:
5549				*data = v32;
5550			}
5551		}
5552	} else {
5553		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5554		    prq->prq_base + BWN_PIO_RXDATA);
5555		if (totlen & 1) {
5556			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5557			mp[totlen - 1] = v16;
5558		}
5559	}
5560
5561	m->m_len = m->m_pkthdr.len = totlen;
5562
5563	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5564
5565	return (1);
5566error:
5567	if (prq->prq_rev >= 8)
5568		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5569		    BWN_PIO8_RXCTL_DATAREADY);
5570	else
5571		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5572	return (1);
5573}
5574
5575static int
5576bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5577    struct bwn_dmadesc_meta *meta, int init)
5578{
5579	struct bwn_mac *mac = dr->dr_mac;
5580	struct bwn_dma *dma = &mac->mac_method.dma;
5581	struct bwn_rxhdr4 *hdr;
5582	bus_dmamap_t map;
5583	bus_addr_t paddr;
5584	struct mbuf *m;
5585	int error;
5586
5587	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5588	if (m == NULL) {
5589		error = ENOBUFS;
5590
5591		/*
5592		 * If the NIC is up and running, we need to:
5593		 * - Clear RX buffer's header.
5594		 * - Restore RX descriptor settings.
5595		 */
5596		if (init)
5597			return (error);
5598		else
5599			goto back;
5600	}
5601	m->m_len = m->m_pkthdr.len = MCLBYTES;
5602
5603	bwn_dma_set_redzone(dr, m);
5604
5605	/*
5606	 * Try to load RX buf into temporary DMA map
5607	 */
5608	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5609	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5610	if (error) {
5611		m_freem(m);
5612
5613		/*
5614		 * See the comment above
5615		 */
5616		if (init)
5617			return (error);
5618		else
5619			goto back;
5620	}
5621
5622	if (!init)
5623		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5624	meta->mt_m = m;
5625	meta->mt_paddr = paddr;
5626
5627	/*
5628	 * Swap RX buf's DMA map with the loaded temporary one
5629	 */
5630	map = meta->mt_dmap;
5631	meta->mt_dmap = dr->dr_spare_dmap;
5632	dr->dr_spare_dmap = map;
5633
5634back:
5635	/*
5636	 * Clear RX buf header
5637	 */
5638	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5639	bzero(hdr, sizeof(*hdr));
5640	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5641	    BUS_DMASYNC_PREWRITE);
5642
5643	/*
5644	 * Setup RX buf descriptor
5645	 */
5646	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5647	    sizeof(*hdr), 0, 0, 0);
5648	return (error);
5649}
5650
5651static void
5652bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5653		 bus_size_t mapsz __unused, int error)
5654{
5655
5656	if (!error) {
5657		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5658		*((bus_addr_t *)arg) = seg->ds_addr;
5659	}
5660}
5661
5662static int
5663bwn_hwrate2ieeerate(int rate)
5664{
5665
5666	switch (rate) {
5667	case BWN_CCK_RATE_1MB:
5668		return (2);
5669	case BWN_CCK_RATE_2MB:
5670		return (4);
5671	case BWN_CCK_RATE_5MB:
5672		return (11);
5673	case BWN_CCK_RATE_11MB:
5674		return (22);
5675	case BWN_OFDM_RATE_6MB:
5676		return (12);
5677	case BWN_OFDM_RATE_9MB:
5678		return (18);
5679	case BWN_OFDM_RATE_12MB:
5680		return (24);
5681	case BWN_OFDM_RATE_18MB:
5682		return (36);
5683	case BWN_OFDM_RATE_24MB:
5684		return (48);
5685	case BWN_OFDM_RATE_36MB:
5686		return (72);
5687	case BWN_OFDM_RATE_48MB:
5688		return (96);
5689	case BWN_OFDM_RATE_54MB:
5690		return (108);
5691	default:
5692		printf("Ooops\n");
5693		return (0);
5694	}
5695}
5696
5697/*
5698 * Post process the RX provided RSSI.
5699 *
5700 * Valid for A, B, G, LP PHYs.
5701 */
5702static int8_t
5703bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5704    int ofdm, int adjust_2053, int adjust_2050)
5705{
5706	struct bwn_phy *phy = &mac->mac_phy;
5707	struct bwn_phy_g *gphy = &phy->phy_g;
5708	int tmp;
5709
5710	switch (phy->rf_ver) {
5711	case 0x2050:
5712		if (ofdm) {
5713			tmp = in_rssi;
5714			if (tmp > 127)
5715				tmp -= 256;
5716			tmp = tmp * 73 / 64;
5717			if (adjust_2050)
5718				tmp += 25;
5719			else
5720				tmp -= 3;
5721		} else {
5722			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5723			    & BWN_BFL_RSSI) {
5724				if (in_rssi > 63)
5725					in_rssi = 63;
5726				tmp = gphy->pg_nrssi_lt[in_rssi];
5727				tmp = (31 - tmp) * -131 / 128 - 57;
5728			} else {
5729				tmp = in_rssi;
5730				tmp = (31 - tmp) * -149 / 128 - 68;
5731			}
5732			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5733				tmp += 25;
5734		}
5735		break;
5736	case 0x2060:
5737		if (in_rssi > 127)
5738			tmp = in_rssi - 256;
5739		else
5740			tmp = in_rssi;
5741		break;
5742	default:
5743		tmp = in_rssi;
5744		tmp = (tmp - 11) * 103 / 64;
5745		if (adjust_2053)
5746			tmp -= 109;
5747		else
5748			tmp -= 83;
5749	}
5750
5751	return (tmp);
5752}
5753
5754static void
5755bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5756{
5757	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5758	struct bwn_plcp6 *plcp;
5759	struct bwn_softc *sc = mac->mac_sc;
5760	struct ieee80211_frame_min *wh;
5761	struct ieee80211_node *ni;
5762	struct ieee80211com *ic = &sc->sc_ic;
5763	uint32_t macstat;
5764	int padding, rate, rssi = 0, noise = 0, type;
5765	uint16_t phytype, phystat0, phystat3, chanstat;
5766	unsigned char *mp = mtod(m, unsigned char *);
5767	static int rx_mac_dec_rpt = 0;
5768
5769	BWN_ASSERT_LOCKED(sc);
5770
5771	phystat0 = le16toh(rxhdr->phy_status0);
5772
5773	/*
5774	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5775	 * used for LP-PHY.
5776	 */
5777	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5778
5779	switch (mac->mac_fw.fw_hdr_format) {
5780	case BWN_FW_HDR_351:
5781	case BWN_FW_HDR_410:
5782		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5783		chanstat = le16toh(rxhdr->ps4.r351.channel);
5784		break;
5785	case BWN_FW_HDR_598:
5786		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5787		chanstat = le16toh(rxhdr->ps4.r598.channel);
5788		break;
5789	}
5790
5791
5792	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5793
5794	if (macstat & BWN_RX_MAC_FCSERR)
5795		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5796	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5797		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5798	if (macstat & BWN_RX_MAC_DECERR)
5799		goto drop;
5800
5801	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5802	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5803		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5804		    m->m_pkthdr.len);
5805		goto drop;
5806	}
5807	plcp = (struct bwn_plcp6 *)(mp + padding);
5808	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5809	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5810		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5811		    m->m_pkthdr.len);
5812		goto drop;
5813	}
5814	wh = mtod(m, struct ieee80211_frame_min *);
5815
5816	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5817		device_printf(sc->sc_dev,
5818		    "RX decryption attempted (old %d keyidx %#x)\n",
5819		    BWN_ISOLDFMT(mac),
5820		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5821
5822	if (phystat0 & BWN_RX_PHYST0_OFDM)
5823		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5824		    phytype == BWN_PHYTYPE_A);
5825	else
5826		rate = bwn_plcp_get_cckrate(mac, plcp);
5827	if (rate == -1) {
5828		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5829			goto drop;
5830	}
5831	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5832
5833	/* rssi/noise */
5834	switch (phytype) {
5835	case BWN_PHYTYPE_A:
5836	case BWN_PHYTYPE_B:
5837	case BWN_PHYTYPE_G:
5838	case BWN_PHYTYPE_LP:
5839		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5840		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5841		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5842		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5843		break;
5844	case BWN_PHYTYPE_N:
5845		/* Broadcom has code for min/avg, but always used max */
5846		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5847			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5848		else
5849			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5850#if 0
5851		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5852		    "%s: power0=%d, power1=%d, power2=%d\n",
5853		    __func__,
5854		    rxhdr->phy.n.power0,
5855		    rxhdr->phy.n.power1,
5856		    rxhdr->ps2.n.power2);
5857#endif
5858		break;
5859	default:
5860		/* XXX TODO: implement rssi for other PHYs */
5861		break;
5862	}
5863
5864	/*
5865	 * RSSI here is absolute, not relative to the noise floor.
5866	 */
5867	noise = mac->mac_stats.link_noise;
5868	rssi = rssi - noise;
5869
5870	/* RX radio tap */
5871	if (ieee80211_radiotap_active(ic))
5872		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5873	m_adj(m, -IEEE80211_CRC_LEN);
5874
5875	BWN_UNLOCK(sc);
5876
5877	ni = ieee80211_find_rxnode(ic, wh);
5878	if (ni != NULL) {
5879		type = ieee80211_input(ni, m, rssi, noise);
5880		ieee80211_free_node(ni);
5881	} else
5882		type = ieee80211_input_all(ic, m, rssi, noise);
5883
5884	BWN_LOCK(sc);
5885	return;
5886drop:
5887	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5888}
5889
5890static void
5891bwn_dma_handle_txeof(struct bwn_mac *mac,
5892    const struct bwn_txstatus *status)
5893{
5894	struct bwn_dma *dma = &mac->mac_method.dma;
5895	struct bwn_dma_ring *dr;
5896	struct bwn_dmadesc_generic *desc;
5897	struct bwn_dmadesc_meta *meta;
5898	struct bwn_softc *sc = mac->mac_sc;
5899	int slot;
5900	int retrycnt = 0;
5901
5902	BWN_ASSERT_LOCKED(sc);
5903
5904	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5905	if (dr == NULL) {
5906		device_printf(sc->sc_dev, "failed to parse cookie\n");
5907		return;
5908	}
5909	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5910
5911	while (1) {
5912		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5913		    ("%s:%d: fail", __func__, __LINE__));
5914		dr->getdesc(dr, slot, &desc, &meta);
5915
5916		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5917			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5918		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5919			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5920
5921		if (meta->mt_islast) {
5922			KASSERT(meta->mt_m != NULL,
5923			    ("%s:%d: fail", __func__, __LINE__));
5924
5925			/*
5926			 * If we don't get an ACK, then we should log the
5927			 * full framecnt.  That may be 0 if it's a PHY
5928			 * failure, so ensure that gets logged as some
5929			 * retry attempt.
5930			 */
5931			if (status->ack) {
5932				retrycnt = status->framecnt - 1;
5933			} else {
5934				retrycnt = status->framecnt;
5935				if (retrycnt == 0)
5936					retrycnt = 1;
5937			}
5938			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5939			    status->ack ?
5940			      IEEE80211_RATECTL_TX_SUCCESS :
5941			      IEEE80211_RATECTL_TX_FAILURE,
5942			    &retrycnt, 0);
5943			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5944			meta->mt_ni = NULL;
5945			meta->mt_m = NULL;
5946		} else
5947			KASSERT(meta->mt_m == NULL,
5948			    ("%s:%d: fail", __func__, __LINE__));
5949
5950		dr->dr_usedslot--;
5951		if (meta->mt_islast)
5952			break;
5953		slot = bwn_dma_nextslot(dr, slot);
5954	}
5955	sc->sc_watchdog_timer = 0;
5956	if (dr->dr_stop) {
5957		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5958		    ("%s:%d: fail", __func__, __LINE__));
5959		dr->dr_stop = 0;
5960	}
5961}
5962
5963static void
5964bwn_pio_handle_txeof(struct bwn_mac *mac,
5965    const struct bwn_txstatus *status)
5966{
5967	struct bwn_pio_txqueue *tq;
5968	struct bwn_pio_txpkt *tp = NULL;
5969	struct bwn_softc *sc = mac->mac_sc;
5970	int retrycnt = 0;
5971
5972	BWN_ASSERT_LOCKED(sc);
5973
5974	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5975	if (tq == NULL)
5976		return;
5977
5978	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5979	tq->tq_free++;
5980
5981	if (tp->tp_ni != NULL) {
5982		/*
5983		 * Do any tx complete callback.  Note this must
5984		 * be done before releasing the node reference.
5985		 */
5986
5987		/*
5988		 * If we don't get an ACK, then we should log the
5989		 * full framecnt.  That may be 0 if it's a PHY
5990		 * failure, so ensure that gets logged as some
5991		 * retry attempt.
5992		 */
5993		if (status->ack) {
5994			retrycnt = status->framecnt - 1;
5995		} else {
5996			retrycnt = status->framecnt;
5997			if (retrycnt == 0)
5998				retrycnt = 1;
5999		}
6000		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6001		    status->ack ?
6002		      IEEE80211_RATECTL_TX_SUCCESS :
6003		      IEEE80211_RATECTL_TX_FAILURE,
6004		    &retrycnt, 0);
6005
6006		if (tp->tp_m->m_flags & M_TXCB)
6007			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6008		ieee80211_free_node(tp->tp_ni);
6009		tp->tp_ni = NULL;
6010	}
6011	m_freem(tp->tp_m);
6012	tp->tp_m = NULL;
6013	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6014
6015	sc->sc_watchdog_timer = 0;
6016}
6017
6018static void
6019bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6020{
6021	struct bwn_softc *sc = mac->mac_sc;
6022	struct bwn_phy *phy = &mac->mac_phy;
6023	struct ieee80211com *ic = &sc->sc_ic;
6024	unsigned long now;
6025	bwn_txpwr_result_t result;
6026
6027	BWN_GETTIME(now);
6028
6029	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6030		return;
6031	phy->nexttime = now + 2 * 1000;
6032
6033	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6034	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6035		return;
6036
6037	if (phy->recalc_txpwr != NULL) {
6038		result = phy->recalc_txpwr(mac,
6039		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6040		if (result == BWN_TXPWR_RES_DONE)
6041			return;
6042		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6043		    ("%s: fail", __func__));
6044		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6045
6046		ieee80211_runtask(ic, &mac->mac_txpower);
6047	}
6048}
6049
6050static uint16_t
6051bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6052{
6053
6054	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6055}
6056
6057static uint32_t
6058bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6059{
6060
6061	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6062}
6063
6064static void
6065bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6066{
6067
6068	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6069}
6070
6071static void
6072bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6073{
6074
6075	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6076}
6077
6078static int
6079bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6080{
6081
6082	switch (rate) {
6083	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6084	case 12:
6085		return (BWN_OFDM_RATE_6MB);
6086	case 18:
6087		return (BWN_OFDM_RATE_9MB);
6088	case 24:
6089		return (BWN_OFDM_RATE_12MB);
6090	case 36:
6091		return (BWN_OFDM_RATE_18MB);
6092	case 48:
6093		return (BWN_OFDM_RATE_24MB);
6094	case 72:
6095		return (BWN_OFDM_RATE_36MB);
6096	case 96:
6097		return (BWN_OFDM_RATE_48MB);
6098	case 108:
6099		return (BWN_OFDM_RATE_54MB);
6100	/* CCK rates (NB: not IEEE std, device-specific) */
6101	case 2:
6102		return (BWN_CCK_RATE_1MB);
6103	case 4:
6104		return (BWN_CCK_RATE_2MB);
6105	case 11:
6106		return (BWN_CCK_RATE_5MB);
6107	case 22:
6108		return (BWN_CCK_RATE_11MB);
6109	}
6110
6111	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6112	return (BWN_CCK_RATE_1MB);
6113}
6114
6115static uint16_t
6116bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6117{
6118	struct bwn_phy *phy = &mac->mac_phy;
6119	uint16_t control = 0;
6120	uint16_t bw;
6121
6122	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6123	bw = BWN_TXH_PHY1_BW_20;
6124
6125	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6126		control = bw;
6127	} else {
6128		control = bw;
6129		/* Figure out coding rate and modulation */
6130		/* XXX TODO: table-ize, for MCS transmit */
6131		/* Note: this is BWN_*_RATE values */
6132		switch (bitrate) {
6133		case BWN_CCK_RATE_1MB:
6134			control |= 0;
6135			break;
6136		case BWN_CCK_RATE_2MB:
6137			control |= 1;
6138			break;
6139		case BWN_CCK_RATE_5MB:
6140			control |= 2;
6141			break;
6142		case BWN_CCK_RATE_11MB:
6143			control |= 3;
6144			break;
6145		case BWN_OFDM_RATE_6MB:
6146			control |= BWN_TXH_PHY1_CRATE_1_2;
6147			control |= BWN_TXH_PHY1_MODUL_BPSK;
6148			break;
6149		case BWN_OFDM_RATE_9MB:
6150			control |= BWN_TXH_PHY1_CRATE_3_4;
6151			control |= BWN_TXH_PHY1_MODUL_BPSK;
6152			break;
6153		case BWN_OFDM_RATE_12MB:
6154			control |= BWN_TXH_PHY1_CRATE_1_2;
6155			control |= BWN_TXH_PHY1_MODUL_QPSK;
6156			break;
6157		case BWN_OFDM_RATE_18MB:
6158			control |= BWN_TXH_PHY1_CRATE_3_4;
6159			control |= BWN_TXH_PHY1_MODUL_QPSK;
6160			break;
6161		case BWN_OFDM_RATE_24MB:
6162			control |= BWN_TXH_PHY1_CRATE_1_2;
6163			control |= BWN_TXH_PHY1_MODUL_QAM16;
6164			break;
6165		case BWN_OFDM_RATE_36MB:
6166			control |= BWN_TXH_PHY1_CRATE_3_4;
6167			control |= BWN_TXH_PHY1_MODUL_QAM16;
6168			break;
6169		case BWN_OFDM_RATE_48MB:
6170			control |= BWN_TXH_PHY1_CRATE_1_2;
6171			control |= BWN_TXH_PHY1_MODUL_QAM64;
6172			break;
6173		case BWN_OFDM_RATE_54MB:
6174			control |= BWN_TXH_PHY1_CRATE_3_4;
6175			control |= BWN_TXH_PHY1_MODUL_QAM64;
6176			break;
6177		default:
6178			break;
6179		}
6180		control |= BWN_TXH_PHY1_MODE_SISO;
6181	}
6182
6183	return control;
6184}
6185
6186static int
6187bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6188    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6189{
6190	const struct bwn_phy *phy = &mac->mac_phy;
6191	struct bwn_softc *sc = mac->mac_sc;
6192	struct ieee80211_frame *wh;
6193	struct ieee80211_frame *protwh;
6194	struct ieee80211_frame_cts *cts;
6195	struct ieee80211_frame_rts *rts;
6196	const struct ieee80211_txparam *tp;
6197	struct ieee80211vap *vap = ni->ni_vap;
6198	struct ieee80211com *ic = &sc->sc_ic;
6199	struct mbuf *mprot;
6200	unsigned int len;
6201	uint32_t macctl = 0;
6202	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6203	uint16_t phyctl = 0;
6204	uint8_t rate, rate_fb;
6205	int fill_phy_ctl1 = 0;
6206
6207	wh = mtod(m, struct ieee80211_frame *);
6208	memset(txhdr, 0, sizeof(*txhdr));
6209
6210	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6211	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6212	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6213
6214	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6215	    || (phy->type == BWN_PHYTYPE_HT))
6216		fill_phy_ctl1 = 1;
6217
6218	/*
6219	 * Find TX rate
6220	 */
6221	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6222	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6223		rate = rate_fb = tp->mgmtrate;
6224	else if (ismcast)
6225		rate = rate_fb = tp->mcastrate;
6226	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6227		rate = rate_fb = tp->ucastrate;
6228	else {
6229		/* XXX TODO: don't fall back to CCK rates for OFDM */
6230		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6231		rate = ni->ni_txrate;
6232
6233		if (rix > 0)
6234			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6235			    IEEE80211_RATE_VAL;
6236		else
6237			rate_fb = rate;
6238	}
6239
6240	sc->sc_tx_rate = rate;
6241
6242	/* Note: this maps the select ieee80211 rate to hardware rate */
6243	rate = bwn_ieeerate2hwrate(sc, rate);
6244	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6245
6246	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6247	    bwn_plcp_getcck(rate);
6248	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6249	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6250
6251	/* XXX rate/rate_fb is the hardware rate */
6252	if ((rate_fb == rate) ||
6253	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6254	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6255		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6256	else
6257		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6258		    m->m_pkthdr.len, rate, isshort);
6259
6260	/* XXX TX encryption */
6261
6262	switch (mac->mac_fw.fw_hdr_format) {
6263	case BWN_FW_HDR_351:
6264		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6265		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6266		break;
6267	case BWN_FW_HDR_410:
6268		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6269		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6270		break;
6271	case BWN_FW_HDR_598:
6272		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6273		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6274		break;
6275	}
6276
6277	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6278	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6279
6280	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6281	    BWN_TX_EFT_FB_CCK;
6282	txhdr->chan = phy->chan;
6283	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6284	    BWN_TX_PHY_ENC_CCK;
6285	/* XXX preamble? obey net80211 */
6286	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6287	     rate == BWN_CCK_RATE_11MB))
6288		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6289
6290	if (! phy->gmode)
6291		macctl |= BWN_TX_MAC_5GHZ;
6292
6293	/* XXX TX antenna selection */
6294
6295	switch (bwn_antenna_sanitize(mac, 0)) {
6296	case 0:
6297		phyctl |= BWN_TX_PHY_ANT01AUTO;
6298		break;
6299	case 1:
6300		phyctl |= BWN_TX_PHY_ANT0;
6301		break;
6302	case 2:
6303		phyctl |= BWN_TX_PHY_ANT1;
6304		break;
6305	case 3:
6306		phyctl |= BWN_TX_PHY_ANT2;
6307		break;
6308	case 4:
6309		phyctl |= BWN_TX_PHY_ANT3;
6310		break;
6311	default:
6312		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6313	}
6314
6315	if (!ismcast)
6316		macctl |= BWN_TX_MAC_ACK;
6317
6318	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6319	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6320	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6321		macctl |= BWN_TX_MAC_LONGFRAME;
6322
6323	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6324		/* XXX RTS rate is always 1MB??? */
6325		/* XXX TODO: don't fall back to CCK rates for OFDM */
6326		rts_rate = BWN_CCK_RATE_1MB;
6327		rts_rate_fb = bwn_get_fbrate(rts_rate);
6328
6329		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6330		protdur = ieee80211_compute_duration(ic->ic_rt,
6331		    m->m_pkthdr.len, rate, isshort) +
6332		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6333
6334		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6335
6336			switch (mac->mac_fw.fw_hdr_format) {
6337			case BWN_FW_HDR_351:
6338				cts = (struct ieee80211_frame_cts *)
6339				    txhdr->body.r351.rts_frame;
6340				break;
6341			case BWN_FW_HDR_410:
6342				cts = (struct ieee80211_frame_cts *)
6343				    txhdr->body.r410.rts_frame;
6344				break;
6345			case BWN_FW_HDR_598:
6346				cts = (struct ieee80211_frame_cts *)
6347				    txhdr->body.r598.rts_frame;
6348				break;
6349			}
6350
6351			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6352			    protdur);
6353			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6354			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6355			    mprot->m_pkthdr.len);
6356			m_freem(mprot);
6357			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6358			len = sizeof(struct ieee80211_frame_cts);
6359		} else {
6360			switch (mac->mac_fw.fw_hdr_format) {
6361			case BWN_FW_HDR_351:
6362				rts = (struct ieee80211_frame_rts *)
6363				    txhdr->body.r351.rts_frame;
6364				break;
6365			case BWN_FW_HDR_410:
6366				rts = (struct ieee80211_frame_rts *)
6367				    txhdr->body.r410.rts_frame;
6368				break;
6369			case BWN_FW_HDR_598:
6370				rts = (struct ieee80211_frame_rts *)
6371				    txhdr->body.r598.rts_frame;
6372				break;
6373			}
6374
6375			/* XXX rate/rate_fb is the hardware rate */
6376			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6377			    isshort);
6378			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6379			    wh->i_addr2, protdur);
6380			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6381			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6382			    mprot->m_pkthdr.len);
6383			m_freem(mprot);
6384			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6385			len = sizeof(struct ieee80211_frame_rts);
6386		}
6387		len += IEEE80211_CRC_LEN;
6388
6389		switch (mac->mac_fw.fw_hdr_format) {
6390		case BWN_FW_HDR_351:
6391			bwn_plcp_genhdr((struct bwn_plcp4 *)
6392			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6393			break;
6394		case BWN_FW_HDR_410:
6395			bwn_plcp_genhdr((struct bwn_plcp4 *)
6396			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6397			break;
6398		case BWN_FW_HDR_598:
6399			bwn_plcp_genhdr((struct bwn_plcp4 *)
6400			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6401			break;
6402		}
6403
6404		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6405		    rts_rate_fb);
6406
6407		switch (mac->mac_fw.fw_hdr_format) {
6408		case BWN_FW_HDR_351:
6409			protwh = (struct ieee80211_frame *)
6410			    &txhdr->body.r351.rts_frame;
6411			break;
6412		case BWN_FW_HDR_410:
6413			protwh = (struct ieee80211_frame *)
6414			    &txhdr->body.r410.rts_frame;
6415			break;
6416		case BWN_FW_HDR_598:
6417			protwh = (struct ieee80211_frame *)
6418			    &txhdr->body.r598.rts_frame;
6419			break;
6420		}
6421
6422		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6423
6424		if (BWN_ISOFDMRATE(rts_rate)) {
6425			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6426			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6427		} else {
6428			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6429			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6430		}
6431		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6432		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6433
6434		if (fill_phy_ctl1) {
6435			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6436			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6437		}
6438	}
6439
6440	if (fill_phy_ctl1) {
6441		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6442		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6443	}
6444
6445	switch (mac->mac_fw.fw_hdr_format) {
6446	case BWN_FW_HDR_351:
6447		txhdr->body.r351.cookie = htole16(cookie);
6448		break;
6449	case BWN_FW_HDR_410:
6450		txhdr->body.r410.cookie = htole16(cookie);
6451		break;
6452	case BWN_FW_HDR_598:
6453		txhdr->body.r598.cookie = htole16(cookie);
6454		break;
6455	}
6456
6457	txhdr->macctl = htole32(macctl);
6458	txhdr->phyctl = htole16(phyctl);
6459
6460	/*
6461	 * TX radio tap
6462	 */
6463	if (ieee80211_radiotap_active_vap(vap)) {
6464		sc->sc_tx_th.wt_flags = 0;
6465		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6466			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6467		if (isshort &&
6468		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6469		     rate == BWN_CCK_RATE_11MB))
6470			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6471		sc->sc_tx_th.wt_rate = rate;
6472
6473		ieee80211_radiotap_tx(vap, m);
6474	}
6475
6476	return (0);
6477}
6478
6479static void
6480bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6481    const uint8_t rate)
6482{
6483	uint32_t d, plen;
6484	uint8_t *raw = plcp->o.raw;
6485
6486	if (BWN_ISOFDMRATE(rate)) {
6487		d = bwn_plcp_getofdm(rate);
6488		KASSERT(!(octets & 0xf000),
6489		    ("%s:%d: fail", __func__, __LINE__));
6490		d |= (octets << 5);
6491		plcp->o.data = htole32(d);
6492	} else {
6493		plen = octets * 16 / rate;
6494		if ((octets * 16 % rate) > 0) {
6495			plen++;
6496			if ((rate == BWN_CCK_RATE_11MB)
6497			    && ((octets * 8 % 11) < 4)) {
6498				raw[1] = 0x84;
6499			} else
6500				raw[1] = 0x04;
6501		} else
6502			raw[1] = 0x04;
6503		plcp->o.data |= htole32(plen << 16);
6504		raw[0] = bwn_plcp_getcck(rate);
6505	}
6506}
6507
6508static uint8_t
6509bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6510{
6511	struct bwn_softc *sc = mac->mac_sc;
6512	uint8_t mask;
6513
6514	if (n == 0)
6515		return (0);
6516	if (mac->mac_phy.gmode)
6517		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6518	else
6519		mask = siba_sprom_get_ant_a(sc->sc_dev);
6520	if (!(mask & (1 << (n - 1))))
6521		return (0);
6522	return (n);
6523}
6524
6525/*
6526 * Return a fallback rate for the given rate.
6527 *
6528 * Note: Don't fall back from OFDM to CCK.
6529 */
6530static uint8_t
6531bwn_get_fbrate(uint8_t bitrate)
6532{
6533	switch (bitrate) {
6534	/* CCK */
6535	case BWN_CCK_RATE_1MB:
6536		return (BWN_CCK_RATE_1MB);
6537	case BWN_CCK_RATE_2MB:
6538		return (BWN_CCK_RATE_1MB);
6539	case BWN_CCK_RATE_5MB:
6540		return (BWN_CCK_RATE_2MB);
6541	case BWN_CCK_RATE_11MB:
6542		return (BWN_CCK_RATE_5MB);
6543
6544	/* OFDM */
6545	case BWN_OFDM_RATE_6MB:
6546		return (BWN_OFDM_RATE_6MB);
6547	case BWN_OFDM_RATE_9MB:
6548		return (BWN_OFDM_RATE_6MB);
6549	case BWN_OFDM_RATE_12MB:
6550		return (BWN_OFDM_RATE_9MB);
6551	case BWN_OFDM_RATE_18MB:
6552		return (BWN_OFDM_RATE_12MB);
6553	case BWN_OFDM_RATE_24MB:
6554		return (BWN_OFDM_RATE_18MB);
6555	case BWN_OFDM_RATE_36MB:
6556		return (BWN_OFDM_RATE_24MB);
6557	case BWN_OFDM_RATE_48MB:
6558		return (BWN_OFDM_RATE_36MB);
6559	case BWN_OFDM_RATE_54MB:
6560		return (BWN_OFDM_RATE_48MB);
6561	}
6562	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6563	return (0);
6564}
6565
6566static uint32_t
6567bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6568    uint32_t ctl, const void *_data, int len)
6569{
6570	struct bwn_softc *sc = mac->mac_sc;
6571	uint32_t value = 0;
6572	const uint8_t *data = _data;
6573
6574	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6575	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6576	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6577
6578	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6579	    tq->tq_base + BWN_PIO8_TXDATA);
6580	if (len & 3) {
6581		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6582		    BWN_PIO8_TXCTL_24_31);
6583		data = &(data[len - 1]);
6584		switch (len & 3) {
6585		case 3:
6586			ctl |= BWN_PIO8_TXCTL_16_23;
6587			value |= (uint32_t)(*data) << 16;
6588			data--;
6589		case 2:
6590			ctl |= BWN_PIO8_TXCTL_8_15;
6591			value |= (uint32_t)(*data) << 8;
6592			data--;
6593		case 1:
6594			value |= (uint32_t)(*data);
6595		}
6596		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6597		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6598	}
6599
6600	return (ctl);
6601}
6602
6603static void
6604bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6605    uint16_t offset, uint32_t value)
6606{
6607
6608	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6609}
6610
6611static uint16_t
6612bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6613    uint16_t ctl, const void *_data, int len)
6614{
6615	struct bwn_softc *sc = mac->mac_sc;
6616	const uint8_t *data = _data;
6617
6618	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6619	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6620
6621	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6622	    tq->tq_base + BWN_PIO_TXDATA);
6623	if (len & 1) {
6624		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6625		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6626		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6627	}
6628
6629	return (ctl);
6630}
6631
6632static uint16_t
6633bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6634    uint16_t ctl, struct mbuf *m0)
6635{
6636	int i, j = 0;
6637	uint16_t data = 0;
6638	const uint8_t *buf;
6639	struct mbuf *m = m0;
6640
6641	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6642	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6643
6644	for (; m != NULL; m = m->m_next) {
6645		buf = mtod(m, const uint8_t *);
6646		for (i = 0; i < m->m_len; i++) {
6647			if (!((j++) % 2))
6648				data |= buf[i];
6649			else {
6650				data |= (buf[i] << 8);
6651				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6652				data = 0;
6653			}
6654		}
6655	}
6656	if (m0->m_pkthdr.len % 2) {
6657		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6658		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6659		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6660	}
6661
6662	return (ctl);
6663}
6664
6665static void
6666bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6667{
6668
6669	/* XXX should exit if 5GHz band .. */
6670	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6671		return;
6672
6673	BWN_WRITE_2(mac, 0x684, 510 + time);
6674	/* Disabled in Linux b43, can adversely effect performance */
6675#if 0
6676	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6677#endif
6678}
6679
6680static struct bwn_dma_ring *
6681bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6682{
6683
6684	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6685		return (mac->mac_method.dma.wme[WME_AC_BE]);
6686
6687	switch (prio) {
6688	case 3:
6689		return (mac->mac_method.dma.wme[WME_AC_VO]);
6690	case 2:
6691		return (mac->mac_method.dma.wme[WME_AC_VI]);
6692	case 0:
6693		return (mac->mac_method.dma.wme[WME_AC_BE]);
6694	case 1:
6695		return (mac->mac_method.dma.wme[WME_AC_BK]);
6696	}
6697	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6698	return (NULL);
6699}
6700
6701static int
6702bwn_dma_getslot(struct bwn_dma_ring *dr)
6703{
6704	int slot;
6705
6706	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6707
6708	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6709	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6710	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6711
6712	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6713	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6714	dr->dr_curslot = slot;
6715	dr->dr_usedslot++;
6716
6717	return (slot);
6718}
6719
6720static struct bwn_pio_txqueue *
6721bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6722    struct bwn_pio_txpkt **pack)
6723{
6724	struct bwn_pio *pio = &mac->mac_method.pio;
6725	struct bwn_pio_txqueue *tq = NULL;
6726	unsigned int index;
6727
6728	switch (cookie & 0xf000) {
6729	case 0x1000:
6730		tq = &pio->wme[WME_AC_BK];
6731		break;
6732	case 0x2000:
6733		tq = &pio->wme[WME_AC_BE];
6734		break;
6735	case 0x3000:
6736		tq = &pio->wme[WME_AC_VI];
6737		break;
6738	case 0x4000:
6739		tq = &pio->wme[WME_AC_VO];
6740		break;
6741	case 0x5000:
6742		tq = &pio->mcast;
6743		break;
6744	}
6745	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6746	if (tq == NULL)
6747		return (NULL);
6748	index = (cookie & 0x0fff);
6749	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6750	if (index >= N(tq->tq_pkts))
6751		return (NULL);
6752	*pack = &tq->tq_pkts[index];
6753	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6754	return (tq);
6755}
6756
6757static void
6758bwn_txpwr(void *arg, int npending)
6759{
6760	struct bwn_mac *mac = arg;
6761	struct bwn_softc *sc = mac->mac_sc;
6762
6763	BWN_LOCK(sc);
6764	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6765	    mac->mac_phy.set_txpwr != NULL)
6766		mac->mac_phy.set_txpwr(mac);
6767	BWN_UNLOCK(sc);
6768}
6769
6770static void
6771bwn_task_15s(struct bwn_mac *mac)
6772{
6773	uint16_t reg;
6774
6775	if (mac->mac_fw.opensource) {
6776		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6777		if (reg) {
6778			bwn_restart(mac, "fw watchdog");
6779			return;
6780		}
6781		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6782	}
6783	if (mac->mac_phy.task_15s)
6784		mac->mac_phy.task_15s(mac);
6785
6786	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6787}
6788
6789static void
6790bwn_task_30s(struct bwn_mac *mac)
6791{
6792
6793	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6794		return;
6795	mac->mac_noise.noi_running = 1;
6796	mac->mac_noise.noi_nsamples = 0;
6797
6798	bwn_noise_gensample(mac);
6799}
6800
6801static void
6802bwn_task_60s(struct bwn_mac *mac)
6803{
6804
6805	if (mac->mac_phy.task_60s)
6806		mac->mac_phy.task_60s(mac);
6807	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6808}
6809
6810static void
6811bwn_tasks(void *arg)
6812{
6813	struct bwn_mac *mac = arg;
6814	struct bwn_softc *sc = mac->mac_sc;
6815
6816	BWN_ASSERT_LOCKED(sc);
6817	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6818		return;
6819
6820	if (mac->mac_task_state % 4 == 0)
6821		bwn_task_60s(mac);
6822	if (mac->mac_task_state % 2 == 0)
6823		bwn_task_30s(mac);
6824	bwn_task_15s(mac);
6825
6826	mac->mac_task_state++;
6827	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6828}
6829
6830static int
6831bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6832{
6833	struct bwn_softc *sc = mac->mac_sc;
6834
6835	KASSERT(a == 0, ("not support APHY\n"));
6836
6837	switch (plcp->o.raw[0] & 0xf) {
6838	case 0xb:
6839		return (BWN_OFDM_RATE_6MB);
6840	case 0xf:
6841		return (BWN_OFDM_RATE_9MB);
6842	case 0xa:
6843		return (BWN_OFDM_RATE_12MB);
6844	case 0xe:
6845		return (BWN_OFDM_RATE_18MB);
6846	case 0x9:
6847		return (BWN_OFDM_RATE_24MB);
6848	case 0xd:
6849		return (BWN_OFDM_RATE_36MB);
6850	case 0x8:
6851		return (BWN_OFDM_RATE_48MB);
6852	case 0xc:
6853		return (BWN_OFDM_RATE_54MB);
6854	}
6855	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6856	    plcp->o.raw[0] & 0xf);
6857	return (-1);
6858}
6859
6860static int
6861bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6862{
6863	struct bwn_softc *sc = mac->mac_sc;
6864
6865	switch (plcp->o.raw[0]) {
6866	case 0x0a:
6867		return (BWN_CCK_RATE_1MB);
6868	case 0x14:
6869		return (BWN_CCK_RATE_2MB);
6870	case 0x37:
6871		return (BWN_CCK_RATE_5MB);
6872	case 0x6e:
6873		return (BWN_CCK_RATE_11MB);
6874	}
6875	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6876	return (-1);
6877}
6878
6879static void
6880bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6881    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6882    int rssi, int noise)
6883{
6884	struct bwn_softc *sc = mac->mac_sc;
6885	const struct ieee80211_frame_min *wh;
6886	uint64_t tsf;
6887	uint16_t low_mactime_now;
6888	uint16_t mt;
6889
6890	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6891		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6892
6893	wh = mtod(m, const struct ieee80211_frame_min *);
6894	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6895		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6896
6897	bwn_tsf_read(mac, &tsf);
6898	low_mactime_now = tsf;
6899	tsf = tsf & ~0xffffULL;
6900
6901	switch (mac->mac_fw.fw_hdr_format) {
6902	case BWN_FW_HDR_351:
6903	case BWN_FW_HDR_410:
6904		mt = le16toh(rxhdr->ps4.r351.mac_time);
6905		break;
6906	case BWN_FW_HDR_598:
6907		mt = le16toh(rxhdr->ps4.r598.mac_time);
6908		break;
6909	}
6910
6911	tsf += mt;
6912	if (low_mactime_now < mt)
6913		tsf -= 0x10000;
6914
6915	sc->sc_rx_th.wr_tsf = tsf;
6916	sc->sc_rx_th.wr_rate = rate;
6917	sc->sc_rx_th.wr_antsignal = rssi;
6918	sc->sc_rx_th.wr_antnoise = noise;
6919}
6920
6921static void
6922bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6923{
6924	uint32_t low, high;
6925
6926	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6927	    ("%s:%d: fail", __func__, __LINE__));
6928
6929	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6930	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6931	*tsf = high;
6932	*tsf <<= 32;
6933	*tsf |= low;
6934}
6935
6936static int
6937bwn_dma_attach(struct bwn_mac *mac)
6938{
6939	struct bwn_dma *dma = &mac->mac_method.dma;
6940	struct bwn_softc *sc = mac->mac_sc;
6941	bus_addr_t lowaddr = 0;
6942	int error;
6943
6944	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6945		return (0);
6946
6947	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6948
6949	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6950
6951	dma->dmatype = bwn_dma_gettype(mac);
6952	if (dma->dmatype == BWN_DMA_30BIT)
6953		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6954	else if (dma->dmatype == BWN_DMA_32BIT)
6955		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6956	else
6957		lowaddr = BUS_SPACE_MAXADDR;
6958
6959	/*
6960	 * Create top level DMA tag
6961	 */
6962	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6963			       BWN_ALIGN, 0,		/* alignment, bounds */
6964			       lowaddr,			/* lowaddr */
6965			       BUS_SPACE_MAXADDR,	/* highaddr */
6966			       NULL, NULL,		/* filter, filterarg */
6967			       BUS_SPACE_MAXSIZE,	/* maxsize */
6968			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6969			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6970			       0,			/* flags */
6971			       NULL, NULL,		/* lockfunc, lockarg */
6972			       &dma->parent_dtag);
6973	if (error) {
6974		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6975		return (error);
6976	}
6977
6978	/*
6979	 * Create TX/RX mbuf DMA tag
6980	 */
6981	error = bus_dma_tag_create(dma->parent_dtag,
6982				1,
6983				0,
6984				BUS_SPACE_MAXADDR,
6985				BUS_SPACE_MAXADDR,
6986				NULL, NULL,
6987				MCLBYTES,
6988				1,
6989				BUS_SPACE_MAXSIZE_32BIT,
6990				0,
6991				NULL, NULL,
6992				&dma->rxbuf_dtag);
6993	if (error) {
6994		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6995		goto fail0;
6996	}
6997	error = bus_dma_tag_create(dma->parent_dtag,
6998				1,
6999				0,
7000				BUS_SPACE_MAXADDR,
7001				BUS_SPACE_MAXADDR,
7002				NULL, NULL,
7003				MCLBYTES,
7004				1,
7005				BUS_SPACE_MAXSIZE_32BIT,
7006				0,
7007				NULL, NULL,
7008				&dma->txbuf_dtag);
7009	if (error) {
7010		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7011		goto fail1;
7012	}
7013
7014	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7015	if (!dma->wme[WME_AC_BK])
7016		goto fail2;
7017
7018	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7019	if (!dma->wme[WME_AC_BE])
7020		goto fail3;
7021
7022	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7023	if (!dma->wme[WME_AC_VI])
7024		goto fail4;
7025
7026	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7027	if (!dma->wme[WME_AC_VO])
7028		goto fail5;
7029
7030	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7031	if (!dma->mcast)
7032		goto fail6;
7033	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7034	if (!dma->rx)
7035		goto fail7;
7036
7037	return (error);
7038
7039fail7:	bwn_dma_ringfree(&dma->mcast);
7040fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7041fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7042fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7043fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7044fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7045fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7046fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7047	return (error);
7048}
7049
7050static struct bwn_dma_ring *
7051bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7052    uint16_t cookie, int *slot)
7053{
7054	struct bwn_dma *dma = &mac->mac_method.dma;
7055	struct bwn_dma_ring *dr;
7056	struct bwn_softc *sc = mac->mac_sc;
7057
7058	BWN_ASSERT_LOCKED(mac->mac_sc);
7059
7060	switch (cookie & 0xf000) {
7061	case 0x1000:
7062		dr = dma->wme[WME_AC_BK];
7063		break;
7064	case 0x2000:
7065		dr = dma->wme[WME_AC_BE];
7066		break;
7067	case 0x3000:
7068		dr = dma->wme[WME_AC_VI];
7069		break;
7070	case 0x4000:
7071		dr = dma->wme[WME_AC_VO];
7072		break;
7073	case 0x5000:
7074		dr = dma->mcast;
7075		break;
7076	default:
7077		dr = NULL;
7078		KASSERT(0 == 1,
7079		    ("invalid cookie value %d", cookie & 0xf000));
7080	}
7081	*slot = (cookie & 0x0fff);
7082	if (*slot < 0 || *slot >= dr->dr_numslots) {
7083		/*
7084		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7085		 * that it occurs events which have same H/W sequence numbers.
7086		 * When it's occurred just prints a WARNING msgs and ignores.
7087		 */
7088		KASSERT(status->seq == dma->lastseq,
7089		    ("%s:%d: fail", __func__, __LINE__));
7090		device_printf(sc->sc_dev,
7091		    "out of slot ranges (0 < %d < %d)\n", *slot,
7092		    dr->dr_numslots);
7093		return (NULL);
7094	}
7095	dma->lastseq = status->seq;
7096	return (dr);
7097}
7098
7099static void
7100bwn_dma_stop(struct bwn_mac *mac)
7101{
7102	struct bwn_dma *dma;
7103
7104	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7105		return;
7106	dma = &mac->mac_method.dma;
7107
7108	bwn_dma_ringstop(&dma->rx);
7109	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7110	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7111	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7112	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7113	bwn_dma_ringstop(&dma->mcast);
7114}
7115
7116static void
7117bwn_dma_ringstop(struct bwn_dma_ring **dr)
7118{
7119
7120	if (dr == NULL)
7121		return;
7122
7123	bwn_dma_cleanup(*dr);
7124}
7125
7126static void
7127bwn_pio_stop(struct bwn_mac *mac)
7128{
7129	struct bwn_pio *pio;
7130
7131	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7132		return;
7133	pio = &mac->mac_method.pio;
7134
7135	bwn_destroy_queue_tx(&pio->mcast);
7136	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7137	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7138	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7139	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7140}
7141
7142static void
7143bwn_led_attach(struct bwn_mac *mac)
7144{
7145	struct bwn_softc *sc = mac->mac_sc;
7146	const uint8_t *led_act = NULL;
7147	uint16_t val[BWN_LED_MAX];
7148	int i;
7149
7150	sc->sc_led_idle = (2350 * hz) / 1000;
7151	sc->sc_led_blink = 1;
7152
7153	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7154		if (siba_get_pci_subvendor(sc->sc_dev) ==
7155		    bwn_vendor_led_act[i].vid) {
7156			led_act = bwn_vendor_led_act[i].led_act;
7157			break;
7158		}
7159	}
7160	if (led_act == NULL)
7161		led_act = bwn_default_led_act;
7162
7163	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7164	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7165	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7166	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7167
7168	for (i = 0; i < BWN_LED_MAX; ++i) {
7169		struct bwn_led *led = &sc->sc_leds[i];
7170
7171		if (val[i] == 0xff) {
7172			led->led_act = led_act[i];
7173		} else {
7174			if (val[i] & BWN_LED_ACT_LOW)
7175				led->led_flags |= BWN_LED_F_ACTLOW;
7176			led->led_act = val[i] & BWN_LED_ACT_MASK;
7177		}
7178		led->led_mask = (1 << i);
7179
7180		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7181		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7182		    led->led_act == BWN_LED_ACT_BLINK) {
7183			led->led_flags |= BWN_LED_F_BLINK;
7184			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7185				led->led_flags |= BWN_LED_F_POLLABLE;
7186			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7187				led->led_flags |= BWN_LED_F_SLOW;
7188
7189			if (sc->sc_blink_led == NULL) {
7190				sc->sc_blink_led = led;
7191				if (led->led_flags & BWN_LED_F_SLOW)
7192					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7193			}
7194		}
7195
7196		DPRINTF(sc, BWN_DEBUG_LED,
7197		    "%dth led, act %d, lowact %d\n", i,
7198		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7199	}
7200	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7201}
7202
7203static __inline uint16_t
7204bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7205{
7206
7207	if (led->led_flags & BWN_LED_F_ACTLOW)
7208		on = !on;
7209	if (on)
7210		val |= led->led_mask;
7211	else
7212		val &= ~led->led_mask;
7213	return val;
7214}
7215
7216static void
7217bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7218{
7219	struct bwn_softc *sc = mac->mac_sc;
7220	struct ieee80211com *ic = &sc->sc_ic;
7221	uint16_t val;
7222	int i;
7223
7224	if (nstate == IEEE80211_S_INIT) {
7225		callout_stop(&sc->sc_led_blink_ch);
7226		sc->sc_led_blinking = 0;
7227	}
7228
7229	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7230		return;
7231
7232	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7233	for (i = 0; i < BWN_LED_MAX; ++i) {
7234		struct bwn_led *led = &sc->sc_leds[i];
7235		int on;
7236
7237		if (led->led_act == BWN_LED_ACT_UNKN ||
7238		    led->led_act == BWN_LED_ACT_NULL)
7239			continue;
7240
7241		if ((led->led_flags & BWN_LED_F_BLINK) &&
7242		    nstate != IEEE80211_S_INIT)
7243			continue;
7244
7245		switch (led->led_act) {
7246		case BWN_LED_ACT_ON:    /* Always on */
7247			on = 1;
7248			break;
7249		case BWN_LED_ACT_OFF:   /* Always off */
7250		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7251			on = 0;
7252			break;
7253		default:
7254			on = 1;
7255			switch (nstate) {
7256			case IEEE80211_S_INIT:
7257				on = 0;
7258				break;
7259			case IEEE80211_S_RUN:
7260				if (led->led_act == BWN_LED_ACT_11G &&
7261				    ic->ic_curmode != IEEE80211_MODE_11G)
7262					on = 0;
7263				break;
7264			default:
7265				if (led->led_act == BWN_LED_ACT_ASSOC)
7266					on = 0;
7267				break;
7268			}
7269			break;
7270		}
7271
7272		val = bwn_led_onoff(led, val, on);
7273	}
7274	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7275}
7276
7277static void
7278bwn_led_event(struct bwn_mac *mac, int event)
7279{
7280	struct bwn_softc *sc = mac->mac_sc;
7281	struct bwn_led *led = sc->sc_blink_led;
7282	int rate;
7283
7284	if (event == BWN_LED_EVENT_POLL) {
7285		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7286			return;
7287		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7288			return;
7289	}
7290
7291	sc->sc_led_ticks = ticks;
7292	if (sc->sc_led_blinking)
7293		return;
7294
7295	switch (event) {
7296	case BWN_LED_EVENT_RX:
7297		rate = sc->sc_rx_rate;
7298		break;
7299	case BWN_LED_EVENT_TX:
7300		rate = sc->sc_tx_rate;
7301		break;
7302	case BWN_LED_EVENT_POLL:
7303		rate = 0;
7304		break;
7305	default:
7306		panic("unknown LED event %d\n", event);
7307		break;
7308	}
7309	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7310	    bwn_led_duration[rate].off_dur);
7311}
7312
7313static void
7314bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7315{
7316	struct bwn_softc *sc = mac->mac_sc;
7317	struct bwn_led *led = sc->sc_blink_led;
7318	uint16_t val;
7319
7320	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7321	val = bwn_led_onoff(led, val, 1);
7322	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7323
7324	if (led->led_flags & BWN_LED_F_SLOW) {
7325		BWN_LED_SLOWDOWN(on_dur);
7326		BWN_LED_SLOWDOWN(off_dur);
7327	}
7328
7329	sc->sc_led_blinking = 1;
7330	sc->sc_led_blink_offdur = off_dur;
7331
7332	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7333}
7334
7335static void
7336bwn_led_blink_next(void *arg)
7337{
7338	struct bwn_mac *mac = arg;
7339	struct bwn_softc *sc = mac->mac_sc;
7340	uint16_t val;
7341
7342	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7343	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7344	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7345
7346	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7347	    bwn_led_blink_end, mac);
7348}
7349
7350static void
7351bwn_led_blink_end(void *arg)
7352{
7353	struct bwn_mac *mac = arg;
7354	struct bwn_softc *sc = mac->mac_sc;
7355
7356	sc->sc_led_blinking = 0;
7357}
7358
7359static int
7360bwn_suspend(device_t dev)
7361{
7362	struct bwn_softc *sc = device_get_softc(dev);
7363
7364	BWN_LOCK(sc);
7365	bwn_stop(sc);
7366	BWN_UNLOCK(sc);
7367	return (0);
7368}
7369
7370static int
7371bwn_resume(device_t dev)
7372{
7373	struct bwn_softc *sc = device_get_softc(dev);
7374	int error = EDOOFUS;
7375
7376	BWN_LOCK(sc);
7377	if (sc->sc_ic.ic_nrunning > 0)
7378		error = bwn_init(sc);
7379	BWN_UNLOCK(sc);
7380	if (error == 0)
7381		ieee80211_start_all(&sc->sc_ic);
7382	return (0);
7383}
7384
7385static void
7386bwn_rfswitch(void *arg)
7387{
7388	struct bwn_softc *sc = arg;
7389	struct bwn_mac *mac = sc->sc_curmac;
7390	int cur = 0, prev = 0;
7391
7392	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7393	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7394
7395	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7396	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7397		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7398			& BWN_RF_HWENABLED_HI_MASK))
7399			cur = 1;
7400	} else {
7401		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7402		    & BWN_RF_HWENABLED_LO_MASK)
7403			cur = 1;
7404	}
7405
7406	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7407		prev = 1;
7408
7409	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7410	    __func__, cur, prev);
7411
7412	if (cur != prev) {
7413		if (cur)
7414			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7415		else
7416			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7417
7418		device_printf(sc->sc_dev,
7419		    "status of RF switch is changed to %s\n",
7420		    cur ? "ON" : "OFF");
7421		if (cur != mac->mac_phy.rf_on) {
7422			if (cur)
7423				bwn_rf_turnon(mac);
7424			else
7425				bwn_rf_turnoff(mac);
7426		}
7427	}
7428
7429	callout_schedule(&sc->sc_rfswitch_ch, hz);
7430}
7431
7432static void
7433bwn_sysctl_node(struct bwn_softc *sc)
7434{
7435	device_t dev = sc->sc_dev;
7436	struct bwn_mac *mac;
7437	struct bwn_stats *stats;
7438
7439	/* XXX assume that count of MAC is only 1. */
7440
7441	if ((mac = sc->sc_curmac) == NULL)
7442		return;
7443	stats = &mac->mac_stats;
7444
7445	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7446	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7447	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7448	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7449	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7450	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7451	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7452	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7453	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7454
7455#ifdef BWN_DEBUG
7456	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7457	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7458	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7459#endif
7460}
7461
7462static device_method_t bwn_methods[] = {
7463	/* Device interface */
7464	DEVMETHOD(device_probe,		bwn_probe),
7465	DEVMETHOD(device_attach,	bwn_attach),
7466	DEVMETHOD(device_detach,	bwn_detach),
7467	DEVMETHOD(device_suspend,	bwn_suspend),
7468	DEVMETHOD(device_resume,	bwn_resume),
7469	DEVMETHOD_END
7470};
7471static driver_t bwn_driver = {
7472	"bwn",
7473	bwn_methods,
7474	sizeof(struct bwn_softc)
7475};
7476static devclass_t bwn_devclass;
7477DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7478MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7479MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7480MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7481MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7482MODULE_VERSION(bwn, 1);
7483