if_bwn.c revision 331722
1/*-
2 * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13 *    redistribution must be conditioned upon including a substantially
14 *    similar Disclaimer requirement for further binary redistribution.
15 *
16 * NO WARRANTY
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGES.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: stable/11/sys/dev/bwn/if_bwn.c 331722 2018-03-29 02:50:57Z eadler $");
32
33/*
34 * The Broadcom Wireless LAN controller driver.
35 */
36
37#include "opt_bwn.h"
38#include "opt_wlan.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/malloc.h>
44#include <sys/module.h>
45#include <sys/endian.h>
46#include <sys/errno.h>
47#include <sys/firmware.h>
48#include <sys/lock.h>
49#include <sys/mutex.h>
50#include <machine/bus.h>
51#include <machine/resource.h>
52#include <sys/bus.h>
53#include <sys/rman.h>
54#include <sys/socket.h>
55#include <sys/sockio.h>
56
57#include <net/ethernet.h>
58#include <net/if.h>
59#include <net/if_var.h>
60#include <net/if_arp.h>
61#include <net/if_dl.h>
62#include <net/if_llc.h>
63#include <net/if_media.h>
64#include <net/if_types.h>
65
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcireg.h>
68#include <dev/siba/siba_ids.h>
69#include <dev/siba/sibareg.h>
70#include <dev/siba/sibavar.h>
71
72#include <net80211/ieee80211_var.h>
73#include <net80211/ieee80211_radiotap.h>
74#include <net80211/ieee80211_regdomain.h>
75#include <net80211/ieee80211_phy.h>
76#include <net80211/ieee80211_ratectl.h>
77
78#include <dev/bwn/if_bwnreg.h>
79#include <dev/bwn/if_bwnvar.h>
80
81#include <dev/bwn/if_bwn_debug.h>
82#include <dev/bwn/if_bwn_misc.h>
83#include <dev/bwn/if_bwn_util.h>
84#include <dev/bwn/if_bwn_phy_common.h>
85#include <dev/bwn/if_bwn_phy_g.h>
86#include <dev/bwn/if_bwn_phy_lp.h>
87#include <dev/bwn/if_bwn_phy_n.h>
88
89static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90    "Broadcom driver parameters");
91
92/*
93 * Tunable & sysctl variables.
94 */
95
96#ifdef BWN_DEBUG
97static	int bwn_debug = 0;
98SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99    "Broadcom debugging printfs");
100#endif
101
102static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104    "uses Bad Frames Preemption");
105static int	bwn_bluetooth = 1;
106SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107    "turns on Bluetooth Coexistence");
108static int	bwn_hwpctl = 0;
109SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110    "uses H/W power control");
111static int	bwn_msi_disable = 0;		/* MSI disabled  */
112TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113static int	bwn_usedma = 1;
114SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115    "uses DMA");
116TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117static int	bwn_wme = 1;
118SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119    "uses WME support");
120
121static void	bwn_attach_pre(struct bwn_softc *);
122static int	bwn_attach_post(struct bwn_softc *);
123static void	bwn_sprom_bugfixes(device_t);
124static int	bwn_init(struct bwn_softc *);
125static void	bwn_parent(struct ieee80211com *);
126static void	bwn_start(struct bwn_softc *);
127static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128static int	bwn_attach_core(struct bwn_mac *);
129static int	bwn_phy_getinfo(struct bwn_mac *, int);
130static int	bwn_chiptest(struct bwn_mac *);
131static int	bwn_setup_channels(struct bwn_mac *, int, int);
132static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133		    uint16_t);
134static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135		    const struct bwn_channelinfo *, const uint8_t []);
136static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137		    const struct ieee80211_bpf_params *);
138static void	bwn_updateslot(struct ieee80211com *);
139static void	bwn_update_promisc(struct ieee80211com *);
140static void	bwn_wme_init(struct bwn_mac *);
141static int	bwn_wme_update(struct ieee80211com *);
142static void	bwn_wme_clear(struct bwn_softc *);
143static void	bwn_wme_load(struct bwn_mac *);
144static void	bwn_wme_loadparams(struct bwn_mac *,
145		    const struct wmeParams *, uint16_t);
146static void	bwn_scan_start(struct ieee80211com *);
147static void	bwn_scan_end(struct ieee80211com *);
148static void	bwn_set_channel(struct ieee80211com *);
149static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151		    const uint8_t [IEEE80211_ADDR_LEN],
152		    const uint8_t [IEEE80211_ADDR_LEN]);
153static void	bwn_vap_delete(struct ieee80211vap *);
154static void	bwn_stop(struct bwn_softc *);
155static int	bwn_core_init(struct bwn_mac *);
156static void	bwn_core_start(struct bwn_mac *);
157static void	bwn_core_exit(struct bwn_mac *);
158static void	bwn_bt_disable(struct bwn_mac *);
159static int	bwn_chip_init(struct bwn_mac *);
160static void	bwn_set_txretry(struct bwn_mac *, int, int);
161static void	bwn_rate_init(struct bwn_mac *);
162static void	bwn_set_phytxctl(struct bwn_mac *);
163static void	bwn_spu_setdelay(struct bwn_mac *, int);
164static void	bwn_bt_enable(struct bwn_mac *);
165static void	bwn_set_macaddr(struct bwn_mac *);
166static void	bwn_crypt_init(struct bwn_mac *);
167static void	bwn_chip_exit(struct bwn_mac *);
168static int	bwn_fw_fillinfo(struct bwn_mac *);
169static int	bwn_fw_loaducode(struct bwn_mac *);
170static int	bwn_gpio_init(struct bwn_mac *);
171static int	bwn_fw_loadinitvals(struct bwn_mac *);
172static int	bwn_phy_init(struct bwn_mac *);
173static void	bwn_set_txantenna(struct bwn_mac *, int);
174static void	bwn_set_opmode(struct bwn_mac *);
175static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176static uint8_t	bwn_plcp_getcck(const uint8_t);
177static uint8_t	bwn_plcp_getofdm(const uint8_t);
178static void	bwn_pio_init(struct bwn_mac *);
179static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181		    int);
182static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183		    struct bwn_pio_rxqueue *, int);
184static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186		    uint16_t);
187static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190static void	bwn_pio_handle_txeof(struct bwn_mac *,
191		    const struct bwn_txstatus *);
192static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195		    uint16_t);
196static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197		    uint32_t);
198static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199		    struct mbuf *);
200static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204		    uint16_t, uint32_t);
205static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210		    uint16_t, struct bwn_pio_txpkt **);
211static void	bwn_dma_init(struct bwn_mac *);
212static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213static int	bwn_dma_mask2type(uint64_t);
214static uint64_t	bwn_dma_mask(struct bwn_mac *);
215static uint16_t	bwn_dma_base(int, int);
216static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218		    int, struct bwn_dmadesc_generic **,
219		    struct bwn_dmadesc_meta **);
220static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222		    int, int);
223static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229		    int, struct bwn_dmadesc_generic **,
230		    struct bwn_dmadesc_meta **);
231static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233		    int, int);
234static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240static void	bwn_dma_setup(struct bwn_dma_ring *);
241static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245static void	bwn_dma_rx(struct bwn_dma_ring *);
246static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248		    struct bwn_dmadesc_meta *);
249static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250static int	bwn_dma_gettype(struct bwn_mac *);
251static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257		    int);
258static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259		    bus_size_t, int);
260static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261static void	bwn_dma_handle_txeof(struct bwn_mac *,
262		    const struct bwn_txstatus *);
263static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264		    struct mbuf *);
265static int	bwn_dma_getslot(struct bwn_dma_ring *);
266static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267		    uint8_t);
268static int	bwn_dma_attach(struct bwn_mac *);
269static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270		    int, int, int);
271static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272		    const struct bwn_txstatus *, uint16_t, int *);
273static void	bwn_dma_free(struct bwn_mac *);
274static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276		    const char *, struct bwn_fwfile *);
277static void	bwn_release_firmware(struct bwn_mac *);
278static void	bwn_do_release_fw(struct bwn_fwfile *);
279static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280static int	bwn_fwinitvals_write(struct bwn_mac *,
281		    const struct bwn_fwinitvals *, size_t, size_t);
282static uint16_t	bwn_ant2phy(int);
283static void	bwn_mac_write_bssid(struct bwn_mac *);
284static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285		    const uint8_t *);
286static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287		    const uint8_t *, size_t, const uint8_t *);
288static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289		    const uint8_t *);
290static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291		    const uint8_t *);
292static void	bwn_phy_exit(struct bwn_mac *);
293static void	bwn_core_stop(struct bwn_mac *);
294static int	bwn_switch_band(struct bwn_softc *,
295		    struct ieee80211_channel *);
296static void	bwn_phy_reset(struct bwn_mac *);
297static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298static void	bwn_set_pretbtt(struct bwn_mac *);
299static int	bwn_intr(void *);
300static void	bwn_intrtask(void *, int);
301static void	bwn_restart(struct bwn_mac *, const char *);
302static void	bwn_intr_ucode_debug(struct bwn_mac *);
303static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304static void	bwn_intr_atim_end(struct bwn_mac *);
305static void	bwn_intr_beacon(struct bwn_mac *);
306static void	bwn_intr_pmq(struct bwn_mac *);
307static void	bwn_intr_noise(struct bwn_mac *);
308static void	bwn_intr_txeof(struct bwn_mac *);
309static void	bwn_hwreset(void *, int);
310static void	bwn_handle_fwpanic(struct bwn_mac *);
311static void	bwn_load_beacon0(struct bwn_mac *);
312static void	bwn_load_beacon1(struct bwn_mac *);
313static uint32_t	bwn_jssi_read(struct bwn_mac *);
314static void	bwn_noise_gensample(struct bwn_mac *);
315static void	bwn_handle_txeof(struct bwn_mac *,
316		    const struct bwn_txstatus *);
317static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320		    struct mbuf *);
321static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322static int	bwn_set_txhdr(struct bwn_mac *,
323		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324		    uint16_t);
325static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326		    const uint8_t);
327static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328static uint8_t	bwn_get_fbrate(uint8_t);
329static void	bwn_txpwr(void *, int);
330static void	bwn_tasks(void *);
331static void	bwn_task_15s(struct bwn_mac *);
332static void	bwn_task_30s(struct bwn_mac *);
333static void	bwn_task_60s(struct bwn_mac *);
334static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335		    uint8_t);
336static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339		    int, int);
340static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342static void	bwn_watchdog(void *);
343static void	bwn_dma_stop(struct bwn_mac *);
344static void	bwn_pio_stop(struct bwn_mac *);
345static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346static void	bwn_led_attach(struct bwn_mac *);
347static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348static void	bwn_led_event(struct bwn_mac *, int);
349static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350static void	bwn_led_blink_next(void *);
351static void	bwn_led_blink_end(void *);
352static void	bwn_rfswitch(void *);
353static void	bwn_rf_turnon(struct bwn_mac *);
354static void	bwn_rf_turnoff(struct bwn_mac *);
355static void	bwn_sysctl_node(struct bwn_softc *);
356
357static struct resource_spec bwn_res_spec_legacy[] = {
358	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359	{ -1,			0,		0 }
360};
361
362static struct resource_spec bwn_res_spec_msi[] = {
363	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364	{ -1,			0,		0 }
365};
366
367static const struct bwn_channelinfo bwn_chantable_bg = {
368	.channels = {
369		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374	.nchannels = 14
375};
376
377static const struct bwn_channelinfo bwn_chantable_a = {
378	.channels = {
379		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391		{ 6080, 216, 30 } },
392	.nchannels = 37
393};
394
395#if 0
396static const struct bwn_channelinfo bwn_chantable_n = {
397	.channels = {
398		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435	.nchannels = 110
436};
437#endif
438
439#define	VENDOR_LED_ACT(vendor)				\
440{							\
441	.vid = PCI_VENDOR_##vendor,			\
442	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443}
444
445static const struct {
446	uint16_t	vid;
447	uint8_t		led_act[BWN_LED_MAX];
448} bwn_vendor_led_act[] = {
449	VENDOR_LED_ACT(COMPAQ),
450	VENDOR_LED_ACT(ASUSTEK)
451};
452
453static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454	{ BWN_VENDOR_LED_ACT_DEFAULT };
455
456#undef VENDOR_LED_ACT
457
458static const struct {
459	int		on_dur;
460	int		off_dur;
461} bwn_led_duration[109] = {
462	[0]	= { 400, 100 },
463	[2]	= { 150, 75 },
464	[4]	= { 90, 45 },
465	[11]	= { 66, 34 },
466	[12]	= { 53, 26 },
467	[18]	= { 42, 21 },
468	[22]	= { 35, 17 },
469	[24]	= { 32, 16 },
470	[36]	= { 21, 10 },
471	[48]	= { 16, 8 },
472	[72]	= { 11, 5 },
473	[96]	= { 9, 4 },
474	[108]	= { 7, 3 }
475};
476
477static const uint16_t bwn_wme_shm_offsets[] = {
478	[0] = BWN_WME_BESTEFFORT,
479	[1] = BWN_WME_BACKGROUND,
480	[2] = BWN_WME_VOICE,
481	[3] = BWN_WME_VIDEO,
482};
483
484static const struct siba_devid bwn_devs[] = {
485	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495};
496
497static int
498bwn_probe(device_t dev)
499{
500	int i;
501
502	for (i = 0; i < nitems(bwn_devs); i++) {
503		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506			return (BUS_PROBE_DEFAULT);
507	}
508
509	return (ENXIO);
510}
511
512static int
513bwn_attach(device_t dev)
514{
515	struct bwn_mac *mac;
516	struct bwn_softc *sc = device_get_softc(dev);
517	int error, i, msic, reg;
518
519	sc->sc_dev = dev;
520#ifdef BWN_DEBUG
521	sc->sc_debug = bwn_debug;
522#endif
523
524	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525		bwn_attach_pre(sc);
526		bwn_sprom_bugfixes(dev);
527		sc->sc_flags |= BWN_FLAG_ATTACHED;
528	}
529
530	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531		if (siba_get_pci_device(dev) != 0x4313 &&
532		    siba_get_pci_device(dev) != 0x431a &&
533		    siba_get_pci_device(dev) != 0x4321) {
534			device_printf(sc->sc_dev,
535			    "skip 802.11 cores\n");
536			return (ENODEV);
537		}
538	}
539
540	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541	mac->mac_sc = sc;
542	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543	if (bwn_bfp != 0)
544		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545
546	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549
550	error = bwn_attach_core(mac);
551	if (error)
552		goto fail0;
553	bwn_led_attach(mac);
554
555	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560	    mac->mac_phy.rf_rev);
561	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563		    mac->mac_method.dma.dmatype);
564	else
565		device_printf(sc->sc_dev, "PIO\n");
566
567#ifdef	BWN_GPL_PHY
568	device_printf(sc->sc_dev,
569	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570#endif
571
572	/*
573	 * setup PCI resources and interrupt.
574	 */
575	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576		msic = pci_msi_count(dev);
577		if (bootverbose)
578			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579	} else
580		msic = 0;
581
582	mac->mac_intr_spec = bwn_res_spec_legacy;
583	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584		if (pci_alloc_msi(dev, &msic) == 0) {
585			device_printf(sc->sc_dev,
586			    "Using %d MSI messages\n", msic);
587			mac->mac_intr_spec = bwn_res_spec_msi;
588			mac->mac_msi = 1;
589		}
590	}
591
592	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593	    mac->mac_res_irq);
594	if (error) {
595		device_printf(sc->sc_dev,
596		    "couldn't allocate IRQ resources (%d)\n", error);
597		goto fail1;
598	}
599
600	if (mac->mac_msi == 0)
601		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603		    &mac->mac_intrhand[0]);
604	else {
605		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608			    &mac->mac_intrhand[i]);
609			if (error != 0) {
610				device_printf(sc->sc_dev,
611				    "couldn't setup interrupt (%d)\n", error);
612				break;
613			}
614		}
615	}
616
617	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618
619	/*
620	 * calls attach-post routine
621	 */
622	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623		bwn_attach_post(sc);
624
625	return (0);
626fail1:
627	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628		pci_release_msi(dev);
629fail0:
630	free(mac, M_DEVBUF);
631	return (error);
632}
633
634static int
635bwn_is_valid_ether_addr(uint8_t *addr)
636{
637	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638
639	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640		return (FALSE);
641
642	return (TRUE);
643}
644
645static int
646bwn_attach_post(struct bwn_softc *sc)
647{
648	struct ieee80211com *ic = &sc->sc_ic;
649
650	ic->ic_softc = sc;
651	ic->ic_name = device_get_nameunit(sc->sc_dev);
652	/* XXX not right but it's not used anywhere important */
653	ic->ic_phytype = IEEE80211_T_OFDM;
654	ic->ic_opmode = IEEE80211_M_STA;
655	ic->ic_caps =
656		  IEEE80211_C_STA		/* station mode supported */
657		| IEEE80211_C_MONITOR		/* monitor mode */
658		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660		| IEEE80211_C_SHSLOT		/* short slot time supported */
661		| IEEE80211_C_WME		/* WME/WMM supported */
662		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663#if 0
664		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665#endif
666		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667		;
668
669	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670
671	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675
676	/* call MI attach routine. */
677	ieee80211_ifattach(ic);
678
679	ic->ic_headroom = sizeof(struct bwn_txhdr);
680
681	/* override default methods */
682	ic->ic_raw_xmit = bwn_raw_xmit;
683	ic->ic_updateslot = bwn_updateslot;
684	ic->ic_update_promisc = bwn_update_promisc;
685	ic->ic_wme.wme_update = bwn_wme_update;
686	ic->ic_scan_start = bwn_scan_start;
687	ic->ic_scan_end = bwn_scan_end;
688	ic->ic_set_channel = bwn_set_channel;
689	ic->ic_vap_create = bwn_vap_create;
690	ic->ic_vap_delete = bwn_vap_delete;
691	ic->ic_transmit = bwn_transmit;
692	ic->ic_parent = bwn_parent;
693
694	ieee80211_radiotap_attach(ic,
695	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696	    BWN_TX_RADIOTAP_PRESENT,
697	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698	    BWN_RX_RADIOTAP_PRESENT);
699
700	bwn_sysctl_node(sc);
701
702	if (bootverbose)
703		ieee80211_announce(ic);
704	return (0);
705}
706
707static void
708bwn_phy_detach(struct bwn_mac *mac)
709{
710
711	if (mac->mac_phy.detach != NULL)
712		mac->mac_phy.detach(mac);
713}
714
715static int
716bwn_detach(device_t dev)
717{
718	struct bwn_softc *sc = device_get_softc(dev);
719	struct bwn_mac *mac = sc->sc_curmac;
720	struct ieee80211com *ic = &sc->sc_ic;
721	int i;
722
723	sc->sc_flags |= BWN_FLAG_INVALID;
724
725	if (device_is_attached(sc->sc_dev)) {
726		BWN_LOCK(sc);
727		bwn_stop(sc);
728		BWN_UNLOCK(sc);
729		bwn_dma_free(mac);
730		callout_drain(&sc->sc_led_blink_ch);
731		callout_drain(&sc->sc_rfswitch_ch);
732		callout_drain(&sc->sc_task_ch);
733		callout_drain(&sc->sc_watchdog_ch);
734		bwn_phy_detach(mac);
735		ieee80211_draintask(ic, &mac->mac_hwreset);
736		ieee80211_draintask(ic, &mac->mac_txpower);
737		ieee80211_ifdetach(ic);
738	}
739	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740	taskqueue_free(sc->sc_tq);
741
742	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743		if (mac->mac_intrhand[i] != NULL) {
744			bus_teardown_intr(dev, mac->mac_res_irq[i],
745			    mac->mac_intrhand[i]);
746			mac->mac_intrhand[i] = NULL;
747		}
748	}
749	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750	if (mac->mac_msi != 0)
751		pci_release_msi(dev);
752	mbufq_drain(&sc->sc_snd);
753	bwn_release_firmware(mac);
754	BWN_LOCK_DESTROY(sc);
755	return (0);
756}
757
758static void
759bwn_attach_pre(struct bwn_softc *sc)
760{
761
762	BWN_LOCK_INIT(sc);
763	TAILQ_INIT(&sc->sc_maclist);
764	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
765	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
766	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
767	mbufq_init(&sc->sc_snd, ifqmaxlen);
768	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
769		taskqueue_thread_enqueue, &sc->sc_tq);
770	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
771		"%s taskq", device_get_nameunit(sc->sc_dev));
772}
773
774static void
775bwn_sprom_bugfixes(device_t dev)
776{
777#define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
778	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
779	 (siba_get_pci_device(dev) == _device) &&			\
780	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
781	 (siba_get_pci_subdevice(dev) == _subdevice))
782
783	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
784	    siba_get_pci_subdevice(dev) == 0x4e &&
785	    siba_get_pci_revid(dev) > 0x40)
786		siba_sprom_set_bf_lo(dev,
787		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
788	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
789	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
790		siba_sprom_set_bf_lo(dev,
791		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
792	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
793		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
794		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
795		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
796		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
797		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
798		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
799		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
800			siba_sprom_set_bf_lo(dev,
801			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
802	}
803#undef	BWN_ISDEV
804}
805
806static void
807bwn_parent(struct ieee80211com *ic)
808{
809	struct bwn_softc *sc = ic->ic_softc;
810	int startall = 0;
811
812	BWN_LOCK(sc);
813	if (ic->ic_nrunning > 0) {
814		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
815			bwn_init(sc);
816			startall = 1;
817		} else
818			bwn_update_promisc(ic);
819	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
820		bwn_stop(sc);
821	BWN_UNLOCK(sc);
822
823	if (startall)
824		ieee80211_start_all(ic);
825}
826
827static int
828bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
829{
830	struct bwn_softc *sc = ic->ic_softc;
831	int error;
832
833	BWN_LOCK(sc);
834	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
835		BWN_UNLOCK(sc);
836		return (ENXIO);
837	}
838	error = mbufq_enqueue(&sc->sc_snd, m);
839	if (error) {
840		BWN_UNLOCK(sc);
841		return (error);
842	}
843	bwn_start(sc);
844	BWN_UNLOCK(sc);
845	return (0);
846}
847
848static void
849bwn_start(struct bwn_softc *sc)
850{
851	struct bwn_mac *mac = sc->sc_curmac;
852	struct ieee80211_frame *wh;
853	struct ieee80211_node *ni;
854	struct ieee80211_key *k;
855	struct mbuf *m;
856
857	BWN_ASSERT_LOCKED(sc);
858
859	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
860	    mac->mac_status < BWN_MAC_STATUS_STARTED)
861		return;
862
863	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
864		if (bwn_tx_isfull(sc, m))
865			break;
866		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
867		if (ni == NULL) {
868			device_printf(sc->sc_dev, "unexpected NULL ni\n");
869			m_freem(m);
870			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
871			continue;
872		}
873		wh = mtod(m, struct ieee80211_frame *);
874		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
875			k = ieee80211_crypto_encap(ni, m);
876			if (k == NULL) {
877				if_inc_counter(ni->ni_vap->iv_ifp,
878				    IFCOUNTER_OERRORS, 1);
879				ieee80211_free_node(ni);
880				m_freem(m);
881				continue;
882			}
883		}
884		wh = NULL;	/* Catch any invalid use */
885		if (bwn_tx_start(sc, ni, m) != 0) {
886			if (ni != NULL) {
887				if_inc_counter(ni->ni_vap->iv_ifp,
888				    IFCOUNTER_OERRORS, 1);
889				ieee80211_free_node(ni);
890			}
891			continue;
892		}
893		sc->sc_watchdog_timer = 5;
894	}
895}
896
897static int
898bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
899{
900	struct bwn_dma_ring *dr;
901	struct bwn_mac *mac = sc->sc_curmac;
902	struct bwn_pio_txqueue *tq;
903	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
904
905	BWN_ASSERT_LOCKED(sc);
906
907	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
908		dr = bwn_dma_select(mac, M_WME_GETAC(m));
909		if (dr->dr_stop == 1 ||
910		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
911			dr->dr_stop = 1;
912			goto full;
913		}
914	} else {
915		tq = bwn_pio_select(mac, M_WME_GETAC(m));
916		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
917		    pktlen > (tq->tq_size - tq->tq_used))
918			goto full;
919	}
920	return (0);
921full:
922	mbufq_prepend(&sc->sc_snd, m);
923	return (1);
924}
925
926static int
927bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
928{
929	struct bwn_mac *mac = sc->sc_curmac;
930	int error;
931
932	BWN_ASSERT_LOCKED(sc);
933
934	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
935		m_freem(m);
936		return (ENXIO);
937	}
938
939	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
940	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
941	if (error) {
942		m_freem(m);
943		return (error);
944	}
945	return (0);
946}
947
948static int
949bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
950{
951	struct bwn_pio_txpkt *tp;
952	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
953	struct bwn_softc *sc = mac->mac_sc;
954	struct bwn_txhdr txhdr;
955	struct mbuf *m_new;
956	uint32_t ctl32;
957	int error;
958	uint16_t ctl16;
959
960	BWN_ASSERT_LOCKED(sc);
961
962	/* XXX TODO send packets after DTIM */
963
964	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
965	tp = TAILQ_FIRST(&tq->tq_pktlist);
966	tp->tp_ni = ni;
967	tp->tp_m = m;
968
969	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
970	if (error) {
971		device_printf(sc->sc_dev, "tx fail\n");
972		return (error);
973	}
974
975	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
976	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
977	tq->tq_free--;
978
979	if (siba_get_revid(sc->sc_dev) >= 8) {
980		/*
981		 * XXX please removes m_defrag(9)
982		 */
983		m_new = m_defrag(m, M_NOWAIT);
984		if (m_new == NULL) {
985			device_printf(sc->sc_dev,
986			    "%s: can't defrag TX buffer\n",
987			    __func__);
988			return (ENOBUFS);
989		}
990		if (m_new->m_next != NULL)
991			device_printf(sc->sc_dev,
992			    "TODO: fragmented packets for PIO\n");
993		tp->tp_m = m_new;
994
995		/* send HEADER */
996		ctl32 = bwn_pio_write_multi_4(mac, tq,
997		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
998			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
999		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1000		/* send BODY */
1001		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1002		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1003		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1004		    ctl32 | BWN_PIO8_TXCTL_EOF);
1005	} else {
1006		ctl16 = bwn_pio_write_multi_2(mac, tq,
1007		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1008			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1009		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1010		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1011		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1012		    ctl16 | BWN_PIO_TXCTL_EOF);
1013	}
1014
1015	return (0);
1016}
1017
1018static struct bwn_pio_txqueue *
1019bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1020{
1021
1022	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1023		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1024
1025	switch (prio) {
1026	case 0:
1027		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1028	case 1:
1029		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1030	case 2:
1031		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1032	case 3:
1033		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1034	}
1035	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1036	return (NULL);
1037}
1038
1039static int
1040bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1041{
1042#define	BWN_GET_TXHDRCACHE(slot)					\
1043	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1044	struct bwn_dma *dma = &mac->mac_method.dma;
1045	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1046	struct bwn_dmadesc_generic *desc;
1047	struct bwn_dmadesc_meta *mt;
1048	struct bwn_softc *sc = mac->mac_sc;
1049	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1050	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1051
1052	BWN_ASSERT_LOCKED(sc);
1053	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1054
1055	/* XXX send after DTIM */
1056
1057	slot = bwn_dma_getslot(dr);
1058	dr->getdesc(dr, slot, &desc, &mt);
1059	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1060	    ("%s:%d: fail", __func__, __LINE__));
1061
1062	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1063	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1064	    BWN_DMA_COOKIE(dr, slot));
1065	if (error)
1066		goto fail;
1067	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1068	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1069	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1070	if (error) {
1071		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1072		    __func__, error);
1073		goto fail;
1074	}
1075	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1076	    BUS_DMASYNC_PREWRITE);
1077	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1078	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1079	    BUS_DMASYNC_PREWRITE);
1080
1081	slot = bwn_dma_getslot(dr);
1082	dr->getdesc(dr, slot, &desc, &mt);
1083	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1084	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1085	mt->mt_m = m;
1086	mt->mt_ni = ni;
1087
1088	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1089	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1090	if (error && error != EFBIG) {
1091		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1092		    __func__, error);
1093		goto fail;
1094	}
1095	if (error) {    /* error == EFBIG */
1096		struct mbuf *m_new;
1097
1098		m_new = m_defrag(m, M_NOWAIT);
1099		if (m_new == NULL) {
1100			device_printf(sc->sc_dev,
1101			    "%s: can't defrag TX buffer\n",
1102			    __func__);
1103			error = ENOBUFS;
1104			goto fail;
1105		} else {
1106			m = m_new;
1107		}
1108
1109		mt->mt_m = m;
1110		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1111		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1112		if (error) {
1113			device_printf(sc->sc_dev,
1114			    "%s: can't load TX buffer (2) %d\n",
1115			    __func__, error);
1116			goto fail;
1117		}
1118	}
1119	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1120	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1121	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1122	    BUS_DMASYNC_PREWRITE);
1123
1124	/* XXX send after DTIM */
1125
1126	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1127	return (0);
1128fail:
1129	dr->dr_curslot = backup[0];
1130	dr->dr_usedslot = backup[1];
1131	return (error);
1132#undef BWN_GET_TXHDRCACHE
1133}
1134
1135static void
1136bwn_watchdog(void *arg)
1137{
1138	struct bwn_softc *sc = arg;
1139
1140	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1141		device_printf(sc->sc_dev, "device timeout\n");
1142		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1143	}
1144	callout_schedule(&sc->sc_watchdog_ch, hz);
1145}
1146
1147static int
1148bwn_attach_core(struct bwn_mac *mac)
1149{
1150	struct bwn_softc *sc = mac->mac_sc;
1151	int error, have_bg = 0, have_a = 0;
1152
1153	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155
1156	if (bwn_is_bus_siba(mac)) {
1157		uint32_t high;
1158
1159		siba_powerup(sc->sc_dev, 0);
1160		high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1161		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1162		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1163		if (high & BWN_TGSHIGH_DUALPHY) {
1164			have_bg = 1;
1165			have_a = 1;
1166		}
1167#if 0
1168		device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1169		    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1170		    __func__,
1171		    high,
1172		    have_a,
1173		    have_bg,
1174		    siba_get_pci_device(sc->sc_dev),
1175		    siba_get_chipid(sc->sc_dev));
1176#endif
1177	} else {
1178		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1179		error = ENXIO;
1180		goto fail;
1181	}
1182
1183	/*
1184	 * Guess at whether it has A-PHY or G-PHY.
1185	 * This is just used for resetting the core to probe things;
1186	 * we will re-guess once it's all up and working.
1187	 */
1188	bwn_reset_core(mac, have_bg);
1189
1190	/*
1191	 * Get the PHY version.
1192	 */
1193	error = bwn_phy_getinfo(mac, have_bg);
1194	if (error)
1195		goto fail;
1196
1197	/*
1198	 * This is the whitelist of devices which we "believe"
1199	 * the SPROM PHY config from.  The rest are "guessed".
1200	 */
1201	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1202	    siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1203	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207		have_a = have_bg = 0;
1208		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209			have_a = 1;
1210		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1212		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1213			have_bg = 1;
1214		else
1215			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216			    mac->mac_phy.type));
1217	}
1218
1219	/*
1220	 * XXX The PHY-G support doesn't do 5GHz operation.
1221	 */
1222	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1224		device_printf(sc->sc_dev,
1225		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226		    __func__);
1227		have_a = 0;
1228		have_bg = 1;
1229	}
1230
1231	mac->mac_phy.phy_n = NULL;
1232
1233	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234		mac->mac_phy.attach = bwn_phy_g_attach;
1235		mac->mac_phy.detach = bwn_phy_g_detach;
1236		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238		mac->mac_phy.init = bwn_phy_g_init;
1239		mac->mac_phy.exit = bwn_phy_g_exit;
1240		mac->mac_phy.phy_read = bwn_phy_g_read;
1241		mac->mac_phy.phy_write = bwn_phy_g_write;
1242		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250		mac->mac_phy.set_im = bwn_phy_g_im;
1251		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257		mac->mac_phy.init = bwn_phy_lp_init;
1258		mac->mac_phy.phy_read = bwn_phy_lp_read;
1259		mac->mac_phy.phy_write = bwn_phy_lp_write;
1260		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270		mac->mac_phy.attach = bwn_phy_n_attach;
1271		mac->mac_phy.detach = bwn_phy_n_detach;
1272		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274		mac->mac_phy.init = bwn_phy_n_init;
1275		mac->mac_phy.exit = bwn_phy_n_exit;
1276		mac->mac_phy.phy_read = bwn_phy_n_read;
1277		mac->mac_phy.phy_write = bwn_phy_n_write;
1278		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286		mac->mac_phy.set_im = bwn_phy_n_im;
1287		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291	} else {
1292		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293		    mac->mac_phy.type);
1294		error = ENXIO;
1295		goto fail;
1296	}
1297
1298	mac->mac_phy.gmode = have_bg;
1299	if (mac->mac_phy.attach != NULL) {
1300		error = mac->mac_phy.attach(mac);
1301		if (error) {
1302			device_printf(sc->sc_dev, "failed\n");
1303			goto fail;
1304		}
1305	}
1306
1307	bwn_reset_core(mac, have_bg);
1308
1309	error = bwn_chiptest(mac);
1310	if (error)
1311		goto fail;
1312	error = bwn_setup_channels(mac, have_bg, have_a);
1313	if (error) {
1314		device_printf(sc->sc_dev, "failed to setup channels\n");
1315		goto fail;
1316	}
1317
1318	if (sc->sc_curmac == NULL)
1319		sc->sc_curmac = mac;
1320
1321	error = bwn_dma_attach(mac);
1322	if (error != 0) {
1323		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324		goto fail;
1325	}
1326
1327	mac->mac_phy.switch_analog(mac, 0);
1328
1329	siba_dev_down(sc->sc_dev, 0);
1330fail:
1331	siba_powerdown(sc->sc_dev);
1332	bwn_release_firmware(mac);
1333	return (error);
1334}
1335
1336/*
1337 * Reset - SIBA.
1338 *
1339 * XXX TODO: implement BCMA version!
1340 */
1341void
1342bwn_reset_core(struct bwn_mac *mac, int g_mode)
1343{
1344	struct bwn_softc *sc = mac->mac_sc;
1345	uint32_t low, ctl;
1346	uint32_t flags = 0;
1347
1348	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1349
1350	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1351	if (g_mode)
1352		flags |= BWN_TGSLOW_SUPPORT_G;
1353
1354	/* XXX N-PHY only; and hard-code to 20MHz for now */
1355	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1356		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1357
1358	siba_dev_up(sc->sc_dev, flags);
1359	DELAY(2000);
1360
1361	/* Take PHY out of reset */
1362	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1363	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1364	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1365	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1366	DELAY(2000);
1367	low &= ~SIBA_TGSLOW_FGC;
1368	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1369	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1370	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1371	DELAY(2000);
1372
1373	if (mac->mac_phy.switch_analog != NULL)
1374		mac->mac_phy.switch_analog(mac, 1);
1375
1376	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1377	if (g_mode)
1378		ctl |= BWN_MACCTL_GMODE;
1379	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1380}
1381
1382static int
1383bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1384{
1385	struct bwn_phy *phy = &mac->mac_phy;
1386	struct bwn_softc *sc = mac->mac_sc;
1387	uint32_t tmp;
1388
1389	/* PHY */
1390	tmp = BWN_READ_2(mac, BWN_PHYVER);
1391	phy->gmode = gmode;
1392	phy->rf_on = 1;
1393	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1394	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1395	phy->rev = (tmp & BWN_PHYVER_VERSION);
1396	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1397	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1398		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1399	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1400	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1401	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1402		goto unsupphy;
1403
1404	/* RADIO */
1405	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1406		if (siba_get_chiprev(sc->sc_dev) == 0)
1407			tmp = 0x3205017f;
1408		else if (siba_get_chiprev(sc->sc_dev) == 1)
1409			tmp = 0x4205017f;
1410		else
1411			tmp = 0x5205017f;
1412	} else {
1413		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1414		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1415		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1416		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1417	}
1418	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1419	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1420	phy->rf_manuf = (tmp & 0x00000fff);
1421
1422	/*
1423	 * For now, just always do full init (ie, what bwn has traditionally
1424	 * done)
1425	 */
1426	phy->phy_do_full_init = 1;
1427
1428	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1429		goto unsupradio;
1430	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1431	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1432	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1433	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1434	    (phy->type == BWN_PHYTYPE_N &&
1435	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1436	    (phy->type == BWN_PHYTYPE_LP &&
1437	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1438		goto unsupradio;
1439
1440	return (0);
1441unsupphy:
1442	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1443	    "analog %#x)\n",
1444	    phy->type, phy->rev, phy->analog);
1445	return (ENXIO);
1446unsupradio:
1447	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1448	    "rev %#x)\n",
1449	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1450	return (ENXIO);
1451}
1452
1453static int
1454bwn_chiptest(struct bwn_mac *mac)
1455{
1456#define	TESTVAL0	0x55aaaa55
1457#define	TESTVAL1	0xaa5555aa
1458	struct bwn_softc *sc = mac->mac_sc;
1459	uint32_t v, backup;
1460
1461	BWN_LOCK(sc);
1462
1463	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1464
1465	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1466	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1467		goto error;
1468	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1469	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1470		goto error;
1471
1472	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1473
1474	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1475	    (siba_get_revid(sc->sc_dev) <= 10)) {
1476		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1477		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1478		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1479			goto error;
1480		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1481			goto error;
1482	}
1483	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1484
1485	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1486	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1487		goto error;
1488
1489	BWN_UNLOCK(sc);
1490	return (0);
1491error:
1492	BWN_UNLOCK(sc);
1493	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1494	return (ENODEV);
1495}
1496
1497static int
1498bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1499{
1500	struct bwn_softc *sc = mac->mac_sc;
1501	struct ieee80211com *ic = &sc->sc_ic;
1502	uint8_t bands[IEEE80211_MODE_BYTES];
1503
1504	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1505	ic->ic_nchans = 0;
1506
1507	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1508	    __func__,
1509	    have_bg,
1510	    have_a);
1511
1512	if (have_bg) {
1513		memset(bands, 0, sizeof(bands));
1514		setbit(bands, IEEE80211_MODE_11B);
1515		setbit(bands, IEEE80211_MODE_11G);
1516		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1517		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1518	}
1519
1520	if (have_a) {
1521		memset(bands, 0, sizeof(bands));
1522		setbit(bands, IEEE80211_MODE_11A);
1523		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1524		    &ic->ic_nchans, &bwn_chantable_a, bands);
1525	}
1526
1527	mac->mac_phy.supports_2ghz = have_bg;
1528	mac->mac_phy.supports_5ghz = have_a;
1529
1530	return (ic->ic_nchans == 0 ? ENXIO : 0);
1531}
1532
1533uint32_t
1534bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1535{
1536	uint32_t ret;
1537
1538	BWN_ASSERT_LOCKED(mac->mac_sc);
1539
1540	if (way == BWN_SHARED) {
1541		KASSERT((offset & 0x0001) == 0,
1542		    ("%s:%d warn", __func__, __LINE__));
1543		if (offset & 0x0003) {
1544			bwn_shm_ctlword(mac, way, offset >> 2);
1545			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1546			ret <<= 16;
1547			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1548			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1549			goto out;
1550		}
1551		offset >>= 2;
1552	}
1553	bwn_shm_ctlword(mac, way, offset);
1554	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1555out:
1556	return (ret);
1557}
1558
1559uint16_t
1560bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1561{
1562	uint16_t ret;
1563
1564	BWN_ASSERT_LOCKED(mac->mac_sc);
1565
1566	if (way == BWN_SHARED) {
1567		KASSERT((offset & 0x0001) == 0,
1568		    ("%s:%d warn", __func__, __LINE__));
1569		if (offset & 0x0003) {
1570			bwn_shm_ctlword(mac, way, offset >> 2);
1571			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1572			goto out;
1573		}
1574		offset >>= 2;
1575	}
1576	bwn_shm_ctlword(mac, way, offset);
1577	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1578out:
1579
1580	return (ret);
1581}
1582
1583static void
1584bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1585    uint16_t offset)
1586{
1587	uint32_t control;
1588
1589	control = way;
1590	control <<= 16;
1591	control |= offset;
1592	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1593}
1594
1595void
1596bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1597    uint32_t value)
1598{
1599	BWN_ASSERT_LOCKED(mac->mac_sc);
1600
1601	if (way == BWN_SHARED) {
1602		KASSERT((offset & 0x0001) == 0,
1603		    ("%s:%d warn", __func__, __LINE__));
1604		if (offset & 0x0003) {
1605			bwn_shm_ctlword(mac, way, offset >> 2);
1606			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1607				    (value >> 16) & 0xffff);
1608			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1609			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1610			return;
1611		}
1612		offset >>= 2;
1613	}
1614	bwn_shm_ctlword(mac, way, offset);
1615	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1616}
1617
1618void
1619bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1620    uint16_t value)
1621{
1622	BWN_ASSERT_LOCKED(mac->mac_sc);
1623
1624	if (way == BWN_SHARED) {
1625		KASSERT((offset & 0x0001) == 0,
1626		    ("%s:%d warn", __func__, __LINE__));
1627		if (offset & 0x0003) {
1628			bwn_shm_ctlword(mac, way, offset >> 2);
1629			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1630			return;
1631		}
1632		offset >>= 2;
1633	}
1634	bwn_shm_ctlword(mac, way, offset);
1635	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1636}
1637
1638static void
1639bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1640    const struct bwn_channelinfo *ci, const uint8_t bands[])
1641{
1642	int i, error;
1643
1644	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1645		const struct bwn_channel *hc = &ci->channels[i];
1646
1647		error = ieee80211_add_channel(chans, maxchans, nchans,
1648		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1649	}
1650}
1651
1652static int
1653bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1654	const struct ieee80211_bpf_params *params)
1655{
1656	struct ieee80211com *ic = ni->ni_ic;
1657	struct bwn_softc *sc = ic->ic_softc;
1658	struct bwn_mac *mac = sc->sc_curmac;
1659	int error;
1660
1661	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1662	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1663		m_freem(m);
1664		return (ENETDOWN);
1665	}
1666
1667	BWN_LOCK(sc);
1668	if (bwn_tx_isfull(sc, m)) {
1669		m_freem(m);
1670		BWN_UNLOCK(sc);
1671		return (ENOBUFS);
1672	}
1673
1674	error = bwn_tx_start(sc, ni, m);
1675	if (error == 0)
1676		sc->sc_watchdog_timer = 5;
1677	BWN_UNLOCK(sc);
1678	return (error);
1679}
1680
1681/*
1682 * Callback from the 802.11 layer to update the slot time
1683 * based on the current setting.  We use it to notify the
1684 * firmware of ERP changes and the f/w takes care of things
1685 * like slot time and preamble.
1686 */
1687static void
1688bwn_updateslot(struct ieee80211com *ic)
1689{
1690	struct bwn_softc *sc = ic->ic_softc;
1691	struct bwn_mac *mac;
1692
1693	BWN_LOCK(sc);
1694	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1695		mac = (struct bwn_mac *)sc->sc_curmac;
1696		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1697	}
1698	BWN_UNLOCK(sc);
1699}
1700
1701/*
1702 * Callback from the 802.11 layer after a promiscuous mode change.
1703 * Note this interface does not check the operating mode as this
1704 * is an internal callback and we are expected to honor the current
1705 * state (e.g. this is used for setting the interface in promiscuous
1706 * mode when operating in hostap mode to do ACS).
1707 */
1708static void
1709bwn_update_promisc(struct ieee80211com *ic)
1710{
1711	struct bwn_softc *sc = ic->ic_softc;
1712	struct bwn_mac *mac = sc->sc_curmac;
1713
1714	BWN_LOCK(sc);
1715	mac = sc->sc_curmac;
1716	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1717		if (ic->ic_promisc > 0)
1718			sc->sc_filters |= BWN_MACCTL_PROMISC;
1719		else
1720			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1721		bwn_set_opmode(mac);
1722	}
1723	BWN_UNLOCK(sc);
1724}
1725
1726/*
1727 * Callback from the 802.11 layer to update WME parameters.
1728 */
1729static int
1730bwn_wme_update(struct ieee80211com *ic)
1731{
1732	struct bwn_softc *sc = ic->ic_softc;
1733	struct bwn_mac *mac = sc->sc_curmac;
1734	struct wmeParams *wmep;
1735	int i;
1736
1737	BWN_LOCK(sc);
1738	mac = sc->sc_curmac;
1739	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1740		bwn_mac_suspend(mac);
1741		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1742			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1743			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1744		}
1745		bwn_mac_enable(mac);
1746	}
1747	BWN_UNLOCK(sc);
1748	return (0);
1749}
1750
1751static void
1752bwn_scan_start(struct ieee80211com *ic)
1753{
1754	struct bwn_softc *sc = ic->ic_softc;
1755	struct bwn_mac *mac;
1756
1757	BWN_LOCK(sc);
1758	mac = sc->sc_curmac;
1759	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1760		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1761		bwn_set_opmode(mac);
1762		/* disable CFP update during scan */
1763		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1764	}
1765	BWN_UNLOCK(sc);
1766}
1767
1768static void
1769bwn_scan_end(struct ieee80211com *ic)
1770{
1771	struct bwn_softc *sc = ic->ic_softc;
1772	struct bwn_mac *mac;
1773
1774	BWN_LOCK(sc);
1775	mac = sc->sc_curmac;
1776	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1777		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1778		bwn_set_opmode(mac);
1779		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1780	}
1781	BWN_UNLOCK(sc);
1782}
1783
1784static void
1785bwn_set_channel(struct ieee80211com *ic)
1786{
1787	struct bwn_softc *sc = ic->ic_softc;
1788	struct bwn_mac *mac = sc->sc_curmac;
1789	struct bwn_phy *phy = &mac->mac_phy;
1790	int chan, error;
1791
1792	BWN_LOCK(sc);
1793
1794	error = bwn_switch_band(sc, ic->ic_curchan);
1795	if (error)
1796		goto fail;
1797	bwn_mac_suspend(mac);
1798	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1799	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1800	if (chan != phy->chan)
1801		bwn_switch_channel(mac, chan);
1802
1803	/* TX power level */
1804	if (ic->ic_curchan->ic_maxpower != 0 &&
1805	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1806		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1807		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1808		    BWN_TXPWR_IGNORE_TSSI);
1809	}
1810
1811	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1812	if (phy->set_antenna)
1813		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1814
1815	if (sc->sc_rf_enabled != phy->rf_on) {
1816		if (sc->sc_rf_enabled) {
1817			bwn_rf_turnon(mac);
1818			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1819				device_printf(sc->sc_dev,
1820				    "please turn on the RF switch\n");
1821		} else
1822			bwn_rf_turnoff(mac);
1823	}
1824
1825	bwn_mac_enable(mac);
1826
1827fail:
1828	/*
1829	 * Setup radio tap channel freq and flags
1830	 */
1831	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1832		htole16(ic->ic_curchan->ic_freq);
1833	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1834		htole16(ic->ic_curchan->ic_flags & 0xffff);
1835
1836	BWN_UNLOCK(sc);
1837}
1838
1839static struct ieee80211vap *
1840bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1841    enum ieee80211_opmode opmode, int flags,
1842    const uint8_t bssid[IEEE80211_ADDR_LEN],
1843    const uint8_t mac[IEEE80211_ADDR_LEN])
1844{
1845	struct ieee80211vap *vap;
1846	struct bwn_vap *bvp;
1847
1848	switch (opmode) {
1849	case IEEE80211_M_HOSTAP:
1850	case IEEE80211_M_MBSS:
1851	case IEEE80211_M_STA:
1852	case IEEE80211_M_WDS:
1853	case IEEE80211_M_MONITOR:
1854	case IEEE80211_M_IBSS:
1855	case IEEE80211_M_AHDEMO:
1856		break;
1857	default:
1858		return (NULL);
1859	}
1860
1861	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1862	vap = &bvp->bv_vap;
1863	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1864	/* override with driver methods */
1865	bvp->bv_newstate = vap->iv_newstate;
1866	vap->iv_newstate = bwn_newstate;
1867
1868	/* override max aid so sta's cannot assoc when we're out of sta id's */
1869	vap->iv_max_aid = BWN_STAID_MAX;
1870
1871	ieee80211_ratectl_init(vap);
1872
1873	/* complete setup */
1874	ieee80211_vap_attach(vap, ieee80211_media_change,
1875	    ieee80211_media_status, mac);
1876	return (vap);
1877}
1878
1879static void
1880bwn_vap_delete(struct ieee80211vap *vap)
1881{
1882	struct bwn_vap *bvp = BWN_VAP(vap);
1883
1884	ieee80211_ratectl_deinit(vap);
1885	ieee80211_vap_detach(vap);
1886	free(bvp, M_80211_VAP);
1887}
1888
1889static int
1890bwn_init(struct bwn_softc *sc)
1891{
1892	struct bwn_mac *mac;
1893	int error;
1894
1895	BWN_ASSERT_LOCKED(sc);
1896
1897	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1898
1899	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1900	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1901	sc->sc_filters = 0;
1902	bwn_wme_clear(sc);
1903	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1904	sc->sc_rf_enabled = 1;
1905
1906	mac = sc->sc_curmac;
1907	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1908		error = bwn_core_init(mac);
1909		if (error != 0)
1910			return (error);
1911	}
1912	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1913		bwn_core_start(mac);
1914
1915	bwn_set_opmode(mac);
1916	bwn_set_pretbtt(mac);
1917	bwn_spu_setdelay(mac, 0);
1918	bwn_set_macaddr(mac);
1919
1920	sc->sc_flags |= BWN_FLAG_RUNNING;
1921	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1922	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1923
1924	return (0);
1925}
1926
1927static void
1928bwn_stop(struct bwn_softc *sc)
1929{
1930	struct bwn_mac *mac = sc->sc_curmac;
1931
1932	BWN_ASSERT_LOCKED(sc);
1933
1934	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1935
1936	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1937		/* XXX FIXME opmode not based on VAP */
1938		bwn_set_opmode(mac);
1939		bwn_set_macaddr(mac);
1940	}
1941
1942	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1943		bwn_core_stop(mac);
1944
1945	callout_stop(&sc->sc_led_blink_ch);
1946	sc->sc_led_blinking = 0;
1947
1948	bwn_core_exit(mac);
1949	sc->sc_rf_enabled = 0;
1950
1951	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1952}
1953
1954static void
1955bwn_wme_clear(struct bwn_softc *sc)
1956{
1957#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1958	struct wmeParams *p;
1959	unsigned int i;
1960
1961	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1962	    ("%s:%d: fail", __func__, __LINE__));
1963
1964	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1965		p = &(sc->sc_wmeParams[i]);
1966
1967		switch (bwn_wme_shm_offsets[i]) {
1968		case BWN_WME_VOICE:
1969			p->wmep_txopLimit = 0;
1970			p->wmep_aifsn = 2;
1971			/* XXX FIXME: log2(cwmin) */
1972			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1973			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1974			break;
1975		case BWN_WME_VIDEO:
1976			p->wmep_txopLimit = 0;
1977			p->wmep_aifsn = 2;
1978			/* XXX FIXME: log2(cwmin) */
1979			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1980			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1981			break;
1982		case BWN_WME_BESTEFFORT:
1983			p->wmep_txopLimit = 0;
1984			p->wmep_aifsn = 3;
1985			/* XXX FIXME: log2(cwmin) */
1986			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1987			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1988			break;
1989		case BWN_WME_BACKGROUND:
1990			p->wmep_txopLimit = 0;
1991			p->wmep_aifsn = 7;
1992			/* XXX FIXME: log2(cwmin) */
1993			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1994			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1995			break;
1996		default:
1997			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1998		}
1999	}
2000}
2001
2002static int
2003bwn_core_init(struct bwn_mac *mac)
2004{
2005	struct bwn_softc *sc = mac->mac_sc;
2006	uint64_t hf;
2007	int error;
2008
2009	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2010	    ("%s:%d: fail", __func__, __LINE__));
2011
2012	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2013
2014	siba_powerup(sc->sc_dev, 0);
2015	if (!siba_dev_isup(sc->sc_dev))
2016		bwn_reset_core(mac, mac->mac_phy.gmode);
2017
2018	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2019	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2020	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2021	BWN_GETTIME(mac->mac_phy.nexttime);
2022	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2023	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2024	mac->mac_stats.link_noise = -95;
2025	mac->mac_reason_intr = 0;
2026	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2027	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2028#ifdef BWN_DEBUG
2029	if (sc->sc_debug & BWN_DEBUG_XMIT)
2030		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2031#endif
2032	mac->mac_suspended = 1;
2033	mac->mac_task_state = 0;
2034	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2035
2036	mac->mac_phy.init_pre(mac);
2037
2038	siba_pcicore_intr(sc->sc_dev);
2039
2040	siba_fix_imcfglobug(sc->sc_dev);
2041	bwn_bt_disable(mac);
2042	if (mac->mac_phy.prepare_hw) {
2043		error = mac->mac_phy.prepare_hw(mac);
2044		if (error)
2045			goto fail0;
2046	}
2047	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2048	error = bwn_chip_init(mac);
2049	if (error)
2050		goto fail0;
2051	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2052	    siba_get_revid(sc->sc_dev));
2053	hf = bwn_hf_read(mac);
2054	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2055		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2056		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2057			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2058		if (mac->mac_phy.rev == 1)
2059			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2060	}
2061	if (mac->mac_phy.rf_ver == 0x2050) {
2062		if (mac->mac_phy.rf_rev < 6)
2063			hf |= BWN_HF_FORCE_VCO_RECALC;
2064		if (mac->mac_phy.rf_rev == 6)
2065			hf |= BWN_HF_4318_TSSI;
2066	}
2067	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2068		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2069	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2070	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2071		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2072	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2073	bwn_hf_write(mac, hf);
2074
2075	/* Tell the firmware about the MAC capabilities */
2076	if (siba_get_revid(sc->sc_dev) >= 13) {
2077		uint32_t cap;
2078		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2079		DPRINTF(sc, BWN_DEBUG_RESET,
2080		    "%s: hw capabilities: 0x%08x\n",
2081		    __func__, cap);
2082		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2083		    cap & 0xffff);
2084		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2085		    (cap >> 16) & 0xffff);
2086	}
2087
2088	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2089	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2090	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2091	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2092
2093	bwn_rate_init(mac);
2094	bwn_set_phytxctl(mac);
2095
2096	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2097	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2098	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2099
2100	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2101		bwn_pio_init(mac);
2102	else
2103		bwn_dma_init(mac);
2104	bwn_wme_init(mac);
2105	bwn_spu_setdelay(mac, 1);
2106	bwn_bt_enable(mac);
2107
2108	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2109	siba_powerup(sc->sc_dev,
2110	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2111	bwn_set_macaddr(mac);
2112	bwn_crypt_init(mac);
2113
2114	/* XXX LED initializatin */
2115
2116	mac->mac_status = BWN_MAC_STATUS_INITED;
2117
2118	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2119	return (error);
2120
2121fail0:
2122	siba_powerdown(sc->sc_dev);
2123	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2124	    ("%s:%d: fail", __func__, __LINE__));
2125	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2126	return (error);
2127}
2128
2129static void
2130bwn_core_start(struct bwn_mac *mac)
2131{
2132	struct bwn_softc *sc = mac->mac_sc;
2133	uint32_t tmp;
2134
2135	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2136	    ("%s:%d: fail", __func__, __LINE__));
2137
2138	if (siba_get_revid(sc->sc_dev) < 5)
2139		return;
2140
2141	while (1) {
2142		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2143		if (!(tmp & 0x00000001))
2144			break;
2145		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2146	}
2147
2148	bwn_mac_enable(mac);
2149	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2150	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2151
2152	mac->mac_status = BWN_MAC_STATUS_STARTED;
2153}
2154
2155static void
2156bwn_core_exit(struct bwn_mac *mac)
2157{
2158	struct bwn_softc *sc = mac->mac_sc;
2159	uint32_t macctl;
2160
2161	BWN_ASSERT_LOCKED(mac->mac_sc);
2162
2163	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2164	    ("%s:%d: fail", __func__, __LINE__));
2165
2166	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2167		return;
2168	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2169
2170	macctl = BWN_READ_4(mac, BWN_MACCTL);
2171	macctl &= ~BWN_MACCTL_MCODE_RUN;
2172	macctl |= BWN_MACCTL_MCODE_JMP0;
2173	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2174
2175	bwn_dma_stop(mac);
2176	bwn_pio_stop(mac);
2177	bwn_chip_exit(mac);
2178	mac->mac_phy.switch_analog(mac, 0);
2179	siba_dev_down(sc->sc_dev, 0);
2180	siba_powerdown(sc->sc_dev);
2181}
2182
2183static void
2184bwn_bt_disable(struct bwn_mac *mac)
2185{
2186	struct bwn_softc *sc = mac->mac_sc;
2187
2188	(void)sc;
2189	/* XXX do nothing yet */
2190}
2191
2192static int
2193bwn_chip_init(struct bwn_mac *mac)
2194{
2195	struct bwn_softc *sc = mac->mac_sc;
2196	struct bwn_phy *phy = &mac->mac_phy;
2197	uint32_t macctl;
2198	int error;
2199
2200	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2201	if (phy->gmode)
2202		macctl |= BWN_MACCTL_GMODE;
2203	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2204
2205	error = bwn_fw_fillinfo(mac);
2206	if (error)
2207		return (error);
2208	error = bwn_fw_loaducode(mac);
2209	if (error)
2210		return (error);
2211
2212	error = bwn_gpio_init(mac);
2213	if (error)
2214		return (error);
2215
2216	error = bwn_fw_loadinitvals(mac);
2217	if (error) {
2218		siba_gpio_set(sc->sc_dev, 0);
2219		return (error);
2220	}
2221	phy->switch_analog(mac, 1);
2222	error = bwn_phy_init(mac);
2223	if (error) {
2224		siba_gpio_set(sc->sc_dev, 0);
2225		return (error);
2226	}
2227	if (phy->set_im)
2228		phy->set_im(mac, BWN_IMMODE_NONE);
2229	if (phy->set_antenna)
2230		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2231	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2232
2233	if (phy->type == BWN_PHYTYPE_B)
2234		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2235	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2236	if (siba_get_revid(sc->sc_dev) < 5)
2237		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2238
2239	BWN_WRITE_4(mac, BWN_MACCTL,
2240	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2241	BWN_WRITE_4(mac, BWN_MACCTL,
2242	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2243	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2244
2245	bwn_set_opmode(mac);
2246	if (siba_get_revid(sc->sc_dev) < 3) {
2247		BWN_WRITE_2(mac, 0x060e, 0x0000);
2248		BWN_WRITE_2(mac, 0x0610, 0x8000);
2249		BWN_WRITE_2(mac, 0x0604, 0x0000);
2250		BWN_WRITE_2(mac, 0x0606, 0x0200);
2251	} else {
2252		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2253		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2254	}
2255	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2256	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2257	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2258	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2259	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2260	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2261	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2262
2263	bwn_mac_phy_clock_set(mac, true);
2264
2265	/* SIBA powerup */
2266	/* XXX TODO: BCMA powerup */
2267	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2268	return (error);
2269}
2270
2271/* read hostflags */
2272uint64_t
2273bwn_hf_read(struct bwn_mac *mac)
2274{
2275	uint64_t ret;
2276
2277	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2278	ret <<= 16;
2279	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2280	ret <<= 16;
2281	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2282	return (ret);
2283}
2284
2285void
2286bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2287{
2288
2289	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2290	    (value & 0x00000000ffffull));
2291	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2292	    (value & 0x0000ffff0000ull) >> 16);
2293	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2294	    (value & 0xffff00000000ULL) >> 32);
2295}
2296
2297static void
2298bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2299{
2300
2301	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2302	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2303}
2304
2305static void
2306bwn_rate_init(struct bwn_mac *mac)
2307{
2308
2309	switch (mac->mac_phy.type) {
2310	case BWN_PHYTYPE_A:
2311	case BWN_PHYTYPE_G:
2312	case BWN_PHYTYPE_LP:
2313	case BWN_PHYTYPE_N:
2314		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2315		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2316		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2317		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2318		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2319		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2320		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2321		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2322			break;
2323		/* FALLTHROUGH */
2324	case BWN_PHYTYPE_B:
2325		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2326		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2327		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2328		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2329		break;
2330	default:
2331		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2332	}
2333}
2334
2335static void
2336bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2337{
2338	uint16_t offset;
2339
2340	if (ofdm) {
2341		offset = 0x480;
2342		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2343	} else {
2344		offset = 0x4c0;
2345		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2346	}
2347	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2348	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2349}
2350
2351static uint8_t
2352bwn_plcp_getcck(const uint8_t bitrate)
2353{
2354
2355	switch (bitrate) {
2356	case BWN_CCK_RATE_1MB:
2357		return (0x0a);
2358	case BWN_CCK_RATE_2MB:
2359		return (0x14);
2360	case BWN_CCK_RATE_5MB:
2361		return (0x37);
2362	case BWN_CCK_RATE_11MB:
2363		return (0x6e);
2364	}
2365	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2366	return (0);
2367}
2368
2369static uint8_t
2370bwn_plcp_getofdm(const uint8_t bitrate)
2371{
2372
2373	switch (bitrate) {
2374	case BWN_OFDM_RATE_6MB:
2375		return (0xb);
2376	case BWN_OFDM_RATE_9MB:
2377		return (0xf);
2378	case BWN_OFDM_RATE_12MB:
2379		return (0xa);
2380	case BWN_OFDM_RATE_18MB:
2381		return (0xe);
2382	case BWN_OFDM_RATE_24MB:
2383		return (0x9);
2384	case BWN_OFDM_RATE_36MB:
2385		return (0xd);
2386	case BWN_OFDM_RATE_48MB:
2387		return (0x8);
2388	case BWN_OFDM_RATE_54MB:
2389		return (0xc);
2390	}
2391	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2392	return (0);
2393}
2394
2395static void
2396bwn_set_phytxctl(struct bwn_mac *mac)
2397{
2398	uint16_t ctl;
2399
2400	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2401	    BWN_TX_PHY_TXPWR);
2402	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2403	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2404	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2405}
2406
2407static void
2408bwn_pio_init(struct bwn_mac *mac)
2409{
2410	struct bwn_pio *pio = &mac->mac_method.pio;
2411
2412	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2413	    & ~BWN_MACCTL_BIGENDIAN);
2414	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2415
2416	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2417	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2418	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2419	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2420	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2421	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2422}
2423
2424static void
2425bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2426    int index)
2427{
2428	struct bwn_pio_txpkt *tp;
2429	struct bwn_softc *sc = mac->mac_sc;
2430	unsigned int i;
2431
2432	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2433	tq->tq_index = index;
2434
2435	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2436	if (siba_get_revid(sc->sc_dev) >= 8)
2437		tq->tq_size = 1920;
2438	else {
2439		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2440		tq->tq_size -= 80;
2441	}
2442
2443	TAILQ_INIT(&tq->tq_pktlist);
2444	for (i = 0; i < N(tq->tq_pkts); i++) {
2445		tp = &(tq->tq_pkts[i]);
2446		tp->tp_index = i;
2447		tp->tp_queue = tq;
2448		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2449	}
2450}
2451
2452static uint16_t
2453bwn_pio_idx2base(struct bwn_mac *mac, int index)
2454{
2455	struct bwn_softc *sc = mac->mac_sc;
2456	static const uint16_t bases[] = {
2457		BWN_PIO_BASE0,
2458		BWN_PIO_BASE1,
2459		BWN_PIO_BASE2,
2460		BWN_PIO_BASE3,
2461		BWN_PIO_BASE4,
2462		BWN_PIO_BASE5,
2463		BWN_PIO_BASE6,
2464		BWN_PIO_BASE7,
2465	};
2466	static const uint16_t bases_rev11[] = {
2467		BWN_PIO11_BASE0,
2468		BWN_PIO11_BASE1,
2469		BWN_PIO11_BASE2,
2470		BWN_PIO11_BASE3,
2471		BWN_PIO11_BASE4,
2472		BWN_PIO11_BASE5,
2473	};
2474
2475	if (siba_get_revid(sc->sc_dev) >= 11) {
2476		if (index >= N(bases_rev11))
2477			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2478		return (bases_rev11[index]);
2479	}
2480	if (index >= N(bases))
2481		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2482	return (bases[index]);
2483}
2484
2485static void
2486bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2487    int index)
2488{
2489	struct bwn_softc *sc = mac->mac_sc;
2490
2491	prq->prq_mac = mac;
2492	prq->prq_rev = siba_get_revid(sc->sc_dev);
2493	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2494	bwn_dma_rxdirectfifo(mac, index, 1);
2495}
2496
2497static void
2498bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2499{
2500	if (tq == NULL)
2501		return;
2502	bwn_pio_cancel_tx_packets(tq);
2503}
2504
2505static void
2506bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2507{
2508
2509	bwn_destroy_pioqueue_tx(pio);
2510}
2511
2512static uint16_t
2513bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2514    uint16_t offset)
2515{
2516
2517	return (BWN_READ_2(mac, tq->tq_base + offset));
2518}
2519
2520static void
2521bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2522{
2523	uint32_t ctl;
2524	int type;
2525	uint16_t base;
2526
2527	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2528	base = bwn_dma_base(type, idx);
2529	if (type == BWN_DMA_64BIT) {
2530		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2531		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2532		if (enable)
2533			ctl |= BWN_DMA64_RXDIRECTFIFO;
2534		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2535	} else {
2536		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2537		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2538		if (enable)
2539			ctl |= BWN_DMA32_RXDIRECTFIFO;
2540		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2541	}
2542}
2543
2544static uint64_t
2545bwn_dma_mask(struct bwn_mac *mac)
2546{
2547	uint32_t tmp;
2548	uint16_t base;
2549
2550	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2551	if (tmp & SIBA_TGSHIGH_DMA64)
2552		return (BWN_DMA_BIT_MASK(64));
2553	base = bwn_dma_base(0, 0);
2554	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2555	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2556	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2557		return (BWN_DMA_BIT_MASK(32));
2558
2559	return (BWN_DMA_BIT_MASK(30));
2560}
2561
2562static int
2563bwn_dma_mask2type(uint64_t dmamask)
2564{
2565
2566	if (dmamask == BWN_DMA_BIT_MASK(30))
2567		return (BWN_DMA_30BIT);
2568	if (dmamask == BWN_DMA_BIT_MASK(32))
2569		return (BWN_DMA_32BIT);
2570	if (dmamask == BWN_DMA_BIT_MASK(64))
2571		return (BWN_DMA_64BIT);
2572	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2573	return (BWN_DMA_30BIT);
2574}
2575
2576static void
2577bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2578{
2579	struct bwn_pio_txpkt *tp;
2580	unsigned int i;
2581
2582	for (i = 0; i < N(tq->tq_pkts); i++) {
2583		tp = &(tq->tq_pkts[i]);
2584		if (tp->tp_m) {
2585			m_freem(tp->tp_m);
2586			tp->tp_m = NULL;
2587		}
2588	}
2589}
2590
2591static uint16_t
2592bwn_dma_base(int type, int controller_idx)
2593{
2594	static const uint16_t map64[] = {
2595		BWN_DMA64_BASE0,
2596		BWN_DMA64_BASE1,
2597		BWN_DMA64_BASE2,
2598		BWN_DMA64_BASE3,
2599		BWN_DMA64_BASE4,
2600		BWN_DMA64_BASE5,
2601	};
2602	static const uint16_t map32[] = {
2603		BWN_DMA32_BASE0,
2604		BWN_DMA32_BASE1,
2605		BWN_DMA32_BASE2,
2606		BWN_DMA32_BASE3,
2607		BWN_DMA32_BASE4,
2608		BWN_DMA32_BASE5,
2609	};
2610
2611	if (type == BWN_DMA_64BIT) {
2612		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2613		    ("%s:%d: fail", __func__, __LINE__));
2614		return (map64[controller_idx]);
2615	}
2616	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2617	    ("%s:%d: fail", __func__, __LINE__));
2618	return (map32[controller_idx]);
2619}
2620
2621static void
2622bwn_dma_init(struct bwn_mac *mac)
2623{
2624	struct bwn_dma *dma = &mac->mac_method.dma;
2625
2626	/* setup TX DMA channels. */
2627	bwn_dma_setup(dma->wme[WME_AC_BK]);
2628	bwn_dma_setup(dma->wme[WME_AC_BE]);
2629	bwn_dma_setup(dma->wme[WME_AC_VI]);
2630	bwn_dma_setup(dma->wme[WME_AC_VO]);
2631	bwn_dma_setup(dma->mcast);
2632	/* setup RX DMA channel. */
2633	bwn_dma_setup(dma->rx);
2634}
2635
2636static struct bwn_dma_ring *
2637bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2638    int for_tx, int type)
2639{
2640	struct bwn_dma *dma = &mac->mac_method.dma;
2641	struct bwn_dma_ring *dr;
2642	struct bwn_dmadesc_generic *desc;
2643	struct bwn_dmadesc_meta *mt;
2644	struct bwn_softc *sc = mac->mac_sc;
2645	int error, i;
2646
2647	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2648	if (dr == NULL)
2649		goto out;
2650	dr->dr_numslots = BWN_RXRING_SLOTS;
2651	if (for_tx)
2652		dr->dr_numslots = BWN_TXRING_SLOTS;
2653
2654	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2655	    M_DEVBUF, M_NOWAIT | M_ZERO);
2656	if (dr->dr_meta == NULL)
2657		goto fail0;
2658
2659	dr->dr_type = type;
2660	dr->dr_mac = mac;
2661	dr->dr_base = bwn_dma_base(type, controller_index);
2662	dr->dr_index = controller_index;
2663	if (type == BWN_DMA_64BIT) {
2664		dr->getdesc = bwn_dma_64_getdesc;
2665		dr->setdesc = bwn_dma_64_setdesc;
2666		dr->start_transfer = bwn_dma_64_start_transfer;
2667		dr->suspend = bwn_dma_64_suspend;
2668		dr->resume = bwn_dma_64_resume;
2669		dr->get_curslot = bwn_dma_64_get_curslot;
2670		dr->set_curslot = bwn_dma_64_set_curslot;
2671	} else {
2672		dr->getdesc = bwn_dma_32_getdesc;
2673		dr->setdesc = bwn_dma_32_setdesc;
2674		dr->start_transfer = bwn_dma_32_start_transfer;
2675		dr->suspend = bwn_dma_32_suspend;
2676		dr->resume = bwn_dma_32_resume;
2677		dr->get_curslot = bwn_dma_32_get_curslot;
2678		dr->set_curslot = bwn_dma_32_set_curslot;
2679	}
2680	if (for_tx) {
2681		dr->dr_tx = 1;
2682		dr->dr_curslot = -1;
2683	} else {
2684		if (dr->dr_index == 0) {
2685			switch (mac->mac_fw.fw_hdr_format) {
2686			case BWN_FW_HDR_351:
2687			case BWN_FW_HDR_410:
2688				dr->dr_rx_bufsize =
2689				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2690				dr->dr_frameoffset =
2691				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2692				break;
2693			case BWN_FW_HDR_598:
2694				dr->dr_rx_bufsize =
2695				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2696				dr->dr_frameoffset =
2697				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2698				break;
2699			}
2700		} else
2701			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2702	}
2703
2704	error = bwn_dma_allocringmemory(dr);
2705	if (error)
2706		goto fail2;
2707
2708	if (for_tx) {
2709		/*
2710		 * Assumption: BWN_TXRING_SLOTS can be divided by
2711		 * BWN_TX_SLOTS_PER_FRAME
2712		 */
2713		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2714		    ("%s:%d: fail", __func__, __LINE__));
2715
2716		dr->dr_txhdr_cache = contigmalloc(
2717		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2718		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2719		    0, BUS_SPACE_MAXADDR, 8, 0);
2720		if (dr->dr_txhdr_cache == NULL) {
2721			device_printf(sc->sc_dev,
2722			    "can't allocate TX header DMA memory\n");
2723			goto fail1;
2724		}
2725
2726		/*
2727		 * Create TX ring DMA stuffs
2728		 */
2729		error = bus_dma_tag_create(dma->parent_dtag,
2730				    BWN_ALIGN, 0,
2731				    BUS_SPACE_MAXADDR,
2732				    BUS_SPACE_MAXADDR,
2733				    NULL, NULL,
2734				    BWN_HDRSIZE(mac),
2735				    1,
2736				    BUS_SPACE_MAXSIZE_32BIT,
2737				    0,
2738				    NULL, NULL,
2739				    &dr->dr_txring_dtag);
2740		if (error) {
2741			device_printf(sc->sc_dev,
2742			    "can't create TX ring DMA tag: TODO frees\n");
2743			goto fail2;
2744		}
2745
2746		for (i = 0; i < dr->dr_numslots; i += 2) {
2747			dr->getdesc(dr, i, &desc, &mt);
2748
2749			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2750			mt->mt_m = NULL;
2751			mt->mt_ni = NULL;
2752			mt->mt_islast = 0;
2753			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2754			    &mt->mt_dmap);
2755			if (error) {
2756				device_printf(sc->sc_dev,
2757				     "can't create RX buf DMA map\n");
2758				goto fail2;
2759			}
2760
2761			dr->getdesc(dr, i + 1, &desc, &mt);
2762
2763			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2764			mt->mt_m = NULL;
2765			mt->mt_ni = NULL;
2766			mt->mt_islast = 1;
2767			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2768			    &mt->mt_dmap);
2769			if (error) {
2770				device_printf(sc->sc_dev,
2771				     "can't create RX buf DMA map\n");
2772				goto fail2;
2773			}
2774		}
2775	} else {
2776		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2777		    &dr->dr_spare_dmap);
2778		if (error) {
2779			device_printf(sc->sc_dev,
2780			    "can't create RX buf DMA map\n");
2781			goto out;		/* XXX wrong! */
2782		}
2783
2784		for (i = 0; i < dr->dr_numslots; i++) {
2785			dr->getdesc(dr, i, &desc, &mt);
2786
2787			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2788			    &mt->mt_dmap);
2789			if (error) {
2790				device_printf(sc->sc_dev,
2791				    "can't create RX buf DMA map\n");
2792				goto out;	/* XXX wrong! */
2793			}
2794			error = bwn_dma_newbuf(dr, desc, mt, 1);
2795			if (error) {
2796				device_printf(sc->sc_dev,
2797				    "failed to allocate RX buf\n");
2798				goto out;	/* XXX wrong! */
2799			}
2800		}
2801
2802		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2803		    BUS_DMASYNC_PREWRITE);
2804
2805		dr->dr_usedslot = dr->dr_numslots;
2806	}
2807
2808      out:
2809	return (dr);
2810
2811fail2:
2812	if (dr->dr_txhdr_cache != NULL) {
2813		contigfree(dr->dr_txhdr_cache,
2814		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2815		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2816	}
2817fail1:
2818	free(dr->dr_meta, M_DEVBUF);
2819fail0:
2820	free(dr, M_DEVBUF);
2821	return (NULL);
2822}
2823
2824static void
2825bwn_dma_ringfree(struct bwn_dma_ring **dr)
2826{
2827
2828	if (dr == NULL)
2829		return;
2830
2831	bwn_dma_free_descbufs(*dr);
2832	bwn_dma_free_ringmemory(*dr);
2833
2834	if ((*dr)->dr_txhdr_cache != NULL) {
2835		contigfree((*dr)->dr_txhdr_cache,
2836		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2837		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2838	}
2839	free((*dr)->dr_meta, M_DEVBUF);
2840	free(*dr, M_DEVBUF);
2841
2842	*dr = NULL;
2843}
2844
2845static void
2846bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2847    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2848{
2849	struct bwn_dmadesc32 *desc;
2850
2851	*meta = &(dr->dr_meta[slot]);
2852	desc = dr->dr_ring_descbase;
2853	desc = &(desc[slot]);
2854
2855	*gdesc = (struct bwn_dmadesc_generic *)desc;
2856}
2857
2858static void
2859bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2860    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2861    int start, int end, int irq)
2862{
2863	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2864	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2865	uint32_t addr, addrext, ctl;
2866	int slot;
2867
2868	slot = (int)(&(desc->dma.dma32) - descbase);
2869	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2870	    ("%s:%d: fail", __func__, __LINE__));
2871
2872	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2873	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2874	addr |= siba_dma_translation(sc->sc_dev);
2875	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2876	if (slot == dr->dr_numslots - 1)
2877		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2878	if (start)
2879		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2880	if (end)
2881		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2882	if (irq)
2883		ctl |= BWN_DMA32_DCTL_IRQ;
2884	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2885	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2886
2887	desc->dma.dma32.control = htole32(ctl);
2888	desc->dma.dma32.address = htole32(addr);
2889}
2890
2891static void
2892bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2893{
2894
2895	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2896	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2897}
2898
2899static void
2900bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2901{
2902
2903	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2904	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2905}
2906
2907static void
2908bwn_dma_32_resume(struct bwn_dma_ring *dr)
2909{
2910
2911	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2912	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2913}
2914
2915static int
2916bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2917{
2918	uint32_t val;
2919
2920	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2921	val &= BWN_DMA32_RXDPTR;
2922
2923	return (val / sizeof(struct bwn_dmadesc32));
2924}
2925
2926static void
2927bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2928{
2929
2930	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2931	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2932}
2933
2934static void
2935bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2936    struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2937{
2938	struct bwn_dmadesc64 *desc;
2939
2940	*meta = &(dr->dr_meta[slot]);
2941	desc = dr->dr_ring_descbase;
2942	desc = &(desc[slot]);
2943
2944	*gdesc = (struct bwn_dmadesc_generic *)desc;
2945}
2946
2947static void
2948bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2949    struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2950    int start, int end, int irq)
2951{
2952	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2953	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2954	int slot;
2955	uint32_t ctl0 = 0, ctl1 = 0;
2956	uint32_t addrlo, addrhi;
2957	uint32_t addrext;
2958
2959	slot = (int)(&(desc->dma.dma64) - descbase);
2960	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2961	    ("%s:%d: fail", __func__, __LINE__));
2962
2963	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2964	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2965	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2966	    30;
2967	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2968	if (slot == dr->dr_numslots - 1)
2969		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2970	if (start)
2971		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2972	if (end)
2973		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2974	if (irq)
2975		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2976	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2977	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2978	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2979
2980	desc->dma.dma64.control0 = htole32(ctl0);
2981	desc->dma.dma64.control1 = htole32(ctl1);
2982	desc->dma.dma64.address_low = htole32(addrlo);
2983	desc->dma.dma64.address_high = htole32(addrhi);
2984}
2985
2986static void
2987bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2988{
2989
2990	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2991	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2992}
2993
2994static void
2995bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2996{
2997
2998	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2999	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3000}
3001
3002static void
3003bwn_dma_64_resume(struct bwn_dma_ring *dr)
3004{
3005
3006	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3007	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3008}
3009
3010static int
3011bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3012{
3013	uint32_t val;
3014
3015	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3016	val &= BWN_DMA64_RXSTATDPTR;
3017
3018	return (val / sizeof(struct bwn_dmadesc64));
3019}
3020
3021static void
3022bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3023{
3024
3025	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3026	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3027}
3028
3029static int
3030bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3031{
3032	struct bwn_mac *mac = dr->dr_mac;
3033	struct bwn_dma *dma = &mac->mac_method.dma;
3034	struct bwn_softc *sc = mac->mac_sc;
3035	int error;
3036
3037	error = bus_dma_tag_create(dma->parent_dtag,
3038			    BWN_ALIGN, 0,
3039			    BUS_SPACE_MAXADDR,
3040			    BUS_SPACE_MAXADDR,
3041			    NULL, NULL,
3042			    BWN_DMA_RINGMEMSIZE,
3043			    1,
3044			    BUS_SPACE_MAXSIZE_32BIT,
3045			    0,
3046			    NULL, NULL,
3047			    &dr->dr_ring_dtag);
3048	if (error) {
3049		device_printf(sc->sc_dev,
3050		    "can't create TX ring DMA tag: TODO frees\n");
3051		return (-1);
3052	}
3053
3054	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3055	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3056	    &dr->dr_ring_dmap);
3057	if (error) {
3058		device_printf(sc->sc_dev,
3059		    "can't allocate DMA mem: TODO frees\n");
3060		return (-1);
3061	}
3062	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3063	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3064	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3065	if (error) {
3066		device_printf(sc->sc_dev,
3067		    "can't load DMA mem: TODO free\n");
3068		return (-1);
3069	}
3070
3071	return (0);
3072}
3073
3074static void
3075bwn_dma_setup(struct bwn_dma_ring *dr)
3076{
3077	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3078	uint64_t ring64;
3079	uint32_t addrext, ring32, value;
3080	uint32_t trans = siba_dma_translation(sc->sc_dev);
3081
3082	if (dr->dr_tx) {
3083		dr->dr_curslot = -1;
3084
3085		if (dr->dr_type == BWN_DMA_64BIT) {
3086			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3087			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3088			    >> 30;
3089			value = BWN_DMA64_TXENABLE;
3090			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3091			    & BWN_DMA64_TXADDREXT_MASK;
3092			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3093			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3094			    (ring64 & 0xffffffff));
3095			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3096			    ((ring64 >> 32) &
3097			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3098		} else {
3099			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3100			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3101			value = BWN_DMA32_TXENABLE;
3102			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3103			    & BWN_DMA32_TXADDREXT_MASK;
3104			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3105			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3106			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3107		}
3108		return;
3109	}
3110
3111	/*
3112	 * set for RX
3113	 */
3114	dr->dr_usedslot = dr->dr_numslots;
3115
3116	if (dr->dr_type == BWN_DMA_64BIT) {
3117		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3118		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3119		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3120		value |= BWN_DMA64_RXENABLE;
3121		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3122		    & BWN_DMA64_RXADDREXT_MASK;
3123		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3124		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3125		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3126		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3127		    | (trans << 1));
3128		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3129		    sizeof(struct bwn_dmadesc64));
3130	} else {
3131		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3132		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3133		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3134		value |= BWN_DMA32_RXENABLE;
3135		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3136		    & BWN_DMA32_RXADDREXT_MASK;
3137		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3138		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3139		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3140		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3141		    sizeof(struct bwn_dmadesc32));
3142	}
3143}
3144
3145static void
3146bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3147{
3148
3149	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3150	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3151	    dr->dr_ring_dmap);
3152}
3153
3154static void
3155bwn_dma_cleanup(struct bwn_dma_ring *dr)
3156{
3157
3158	if (dr->dr_tx) {
3159		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3160		if (dr->dr_type == BWN_DMA_64BIT) {
3161			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3162			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3163		} else
3164			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3165	} else {
3166		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3167		if (dr->dr_type == BWN_DMA_64BIT) {
3168			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3169			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3170		} else
3171			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3172	}
3173}
3174
3175static void
3176bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3177{
3178	struct bwn_dmadesc_generic *desc;
3179	struct bwn_dmadesc_meta *meta;
3180	struct bwn_mac *mac = dr->dr_mac;
3181	struct bwn_dma *dma = &mac->mac_method.dma;
3182	struct bwn_softc *sc = mac->mac_sc;
3183	int i;
3184
3185	if (!dr->dr_usedslot)
3186		return;
3187	for (i = 0; i < dr->dr_numslots; i++) {
3188		dr->getdesc(dr, i, &desc, &meta);
3189
3190		if (meta->mt_m == NULL) {
3191			if (!dr->dr_tx)
3192				device_printf(sc->sc_dev, "%s: not TX?\n",
3193				    __func__);
3194			continue;
3195		}
3196		if (dr->dr_tx) {
3197			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3198				bus_dmamap_unload(dr->dr_txring_dtag,
3199				    meta->mt_dmap);
3200			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3201				bus_dmamap_unload(dma->txbuf_dtag,
3202				    meta->mt_dmap);
3203		} else
3204			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3205		bwn_dma_free_descbuf(dr, meta);
3206	}
3207}
3208
3209static int
3210bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3211    int type)
3212{
3213	struct bwn_softc *sc = mac->mac_sc;
3214	uint32_t value;
3215	int i;
3216	uint16_t offset;
3217
3218	for (i = 0; i < 10; i++) {
3219		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3220		    BWN_DMA32_TXSTATUS;
3221		value = BWN_READ_4(mac, base + offset);
3222		if (type == BWN_DMA_64BIT) {
3223			value &= BWN_DMA64_TXSTAT;
3224			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3225			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3226			    value == BWN_DMA64_TXSTAT_STOPPED)
3227				break;
3228		} else {
3229			value &= BWN_DMA32_TXSTATE;
3230			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3231			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3232			    value == BWN_DMA32_TXSTAT_STOPPED)
3233				break;
3234		}
3235		DELAY(1000);
3236	}
3237	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3238	BWN_WRITE_4(mac, base + offset, 0);
3239	for (i = 0; i < 10; i++) {
3240		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3241						   BWN_DMA32_TXSTATUS;
3242		value = BWN_READ_4(mac, base + offset);
3243		if (type == BWN_DMA_64BIT) {
3244			value &= BWN_DMA64_TXSTAT;
3245			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3246				i = -1;
3247				break;
3248			}
3249		} else {
3250			value &= BWN_DMA32_TXSTATE;
3251			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3252				i = -1;
3253				break;
3254			}
3255		}
3256		DELAY(1000);
3257	}
3258	if (i != -1) {
3259		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3260		return (ENODEV);
3261	}
3262	DELAY(1000);
3263
3264	return (0);
3265}
3266
3267static int
3268bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3269    int type)
3270{
3271	struct bwn_softc *sc = mac->mac_sc;
3272	uint32_t value;
3273	int i;
3274	uint16_t offset;
3275
3276	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3277	BWN_WRITE_4(mac, base + offset, 0);
3278	for (i = 0; i < 10; i++) {
3279		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3280		    BWN_DMA32_RXSTATUS;
3281		value = BWN_READ_4(mac, base + offset);
3282		if (type == BWN_DMA_64BIT) {
3283			value &= BWN_DMA64_RXSTAT;
3284			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3285				i = -1;
3286				break;
3287			}
3288		} else {
3289			value &= BWN_DMA32_RXSTATE;
3290			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3291				i = -1;
3292				break;
3293			}
3294		}
3295		DELAY(1000);
3296	}
3297	if (i != -1) {
3298		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3299		return (ENODEV);
3300	}
3301
3302	return (0);
3303}
3304
3305static void
3306bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3307    struct bwn_dmadesc_meta *meta)
3308{
3309
3310	if (meta->mt_m != NULL) {
3311		m_freem(meta->mt_m);
3312		meta->mt_m = NULL;
3313	}
3314	if (meta->mt_ni != NULL) {
3315		ieee80211_free_node(meta->mt_ni);
3316		meta->mt_ni = NULL;
3317	}
3318}
3319
3320static void
3321bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3322{
3323	struct bwn_rxhdr4 *rxhdr;
3324	unsigned char *frame;
3325
3326	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3327	rxhdr->frame_len = 0;
3328
3329	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3330	    sizeof(struct bwn_plcp6) + 2,
3331	    ("%s:%d: fail", __func__, __LINE__));
3332	frame = mtod(m, char *) + dr->dr_frameoffset;
3333	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3334}
3335
3336static uint8_t
3337bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3338{
3339	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3340
3341	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3342	    == 0xff);
3343}
3344
3345static void
3346bwn_wme_init(struct bwn_mac *mac)
3347{
3348
3349	bwn_wme_load(mac);
3350
3351	/* enable WME support. */
3352	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3353	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3354	    BWN_IFSCTL_USE_EDCF);
3355}
3356
3357static void
3358bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3359{
3360	struct bwn_softc *sc = mac->mac_sc;
3361	struct ieee80211com *ic = &sc->sc_ic;
3362	uint16_t delay;	/* microsec */
3363
3364	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3365	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3366		delay = 500;
3367	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3368		delay = max(delay, (uint16_t)2400);
3369
3370	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3371}
3372
3373static void
3374bwn_bt_enable(struct bwn_mac *mac)
3375{
3376	struct bwn_softc *sc = mac->mac_sc;
3377	uint64_t hf;
3378
3379	if (bwn_bluetooth == 0)
3380		return;
3381	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3382		return;
3383	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3384		return;
3385
3386	hf = bwn_hf_read(mac);
3387	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3388		hf |= BWN_HF_BT_COEXISTALT;
3389	else
3390		hf |= BWN_HF_BT_COEXIST;
3391	bwn_hf_write(mac, hf);
3392}
3393
3394static void
3395bwn_set_macaddr(struct bwn_mac *mac)
3396{
3397
3398	bwn_mac_write_bssid(mac);
3399	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3400	    mac->mac_sc->sc_ic.ic_macaddr);
3401}
3402
3403static void
3404bwn_clear_keys(struct bwn_mac *mac)
3405{
3406	int i;
3407
3408	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3409		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3410		    ("%s:%d: fail", __func__, __LINE__));
3411
3412		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3413		    NULL, BWN_SEC_KEYSIZE, NULL);
3414		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3415			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3416			    NULL, BWN_SEC_KEYSIZE, NULL);
3417		}
3418		mac->mac_key[i].keyconf = NULL;
3419	}
3420}
3421
3422static void
3423bwn_crypt_init(struct bwn_mac *mac)
3424{
3425	struct bwn_softc *sc = mac->mac_sc;
3426
3427	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3428	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3429	    ("%s:%d: fail", __func__, __LINE__));
3430	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3431	mac->mac_ktp *= 2;
3432	if (siba_get_revid(sc->sc_dev) >= 5)
3433		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3434	bwn_clear_keys(mac);
3435}
3436
3437static void
3438bwn_chip_exit(struct bwn_mac *mac)
3439{
3440	struct bwn_softc *sc = mac->mac_sc;
3441
3442	bwn_phy_exit(mac);
3443	siba_gpio_set(sc->sc_dev, 0);
3444}
3445
3446static int
3447bwn_fw_fillinfo(struct bwn_mac *mac)
3448{
3449	int error;
3450
3451	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3452	if (error == 0)
3453		return (0);
3454	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3455	if (error == 0)
3456		return (0);
3457	return (error);
3458}
3459
3460static int
3461bwn_gpio_init(struct bwn_mac *mac)
3462{
3463	struct bwn_softc *sc = mac->mac_sc;
3464	uint32_t mask = 0x1f, set = 0xf, value;
3465
3466	BWN_WRITE_4(mac, BWN_MACCTL,
3467	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3468	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3469	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3470
3471	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3472		mask |= 0x0060;
3473		set |= 0x0060;
3474	}
3475	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3476		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3477		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3478		mask |= 0x0200;
3479		set |= 0x0200;
3480	}
3481	if (siba_get_revid(sc->sc_dev) >= 2)
3482		mask |= 0x0010;
3483
3484	value = siba_gpio_get(sc->sc_dev);
3485	if (value == -1)
3486		return (0);
3487	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3488
3489	return (0);
3490}
3491
3492static int
3493bwn_fw_loadinitvals(struct bwn_mac *mac)
3494{
3495#define	GETFWOFFSET(fwp, offset)				\
3496	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3497	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3498	const struct bwn_fwhdr *hdr;
3499	struct bwn_fw *fw = &mac->mac_fw;
3500	int error;
3501
3502	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3503	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3504	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3505	if (error)
3506		return (error);
3507	if (fw->initvals_band.fw) {
3508		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3509		error = bwn_fwinitvals_write(mac,
3510		    GETFWOFFSET(fw->initvals_band, hdr_len),
3511		    be32toh(hdr->size),
3512		    fw->initvals_band.fw->datasize - hdr_len);
3513	}
3514	return (error);
3515#undef GETFWOFFSET
3516}
3517
3518static int
3519bwn_phy_init(struct bwn_mac *mac)
3520{
3521	struct bwn_softc *sc = mac->mac_sc;
3522	int error;
3523
3524	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3525	mac->mac_phy.rf_onoff(mac, 1);
3526	error = mac->mac_phy.init(mac);
3527	if (error) {
3528		device_printf(sc->sc_dev, "PHY init failed\n");
3529		goto fail0;
3530	}
3531	error = bwn_switch_channel(mac,
3532	    mac->mac_phy.get_default_chan(mac));
3533	if (error) {
3534		device_printf(sc->sc_dev,
3535		    "failed to switch default channel\n");
3536		goto fail1;
3537	}
3538	return (0);
3539fail1:
3540	if (mac->mac_phy.exit)
3541		mac->mac_phy.exit(mac);
3542fail0:
3543	mac->mac_phy.rf_onoff(mac, 0);
3544
3545	return (error);
3546}
3547
3548static void
3549bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3550{
3551	uint16_t ant;
3552	uint16_t tmp;
3553
3554	ant = bwn_ant2phy(antenna);
3555
3556	/* For ACK/CTS */
3557	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3558	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3559	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3560	/* For Probe Resposes */
3561	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3562	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3563	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3564}
3565
3566static void
3567bwn_set_opmode(struct bwn_mac *mac)
3568{
3569	struct bwn_softc *sc = mac->mac_sc;
3570	struct ieee80211com *ic = &sc->sc_ic;
3571	uint32_t ctl;
3572	uint16_t cfp_pretbtt;
3573
3574	ctl = BWN_READ_4(mac, BWN_MACCTL);
3575	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3576	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3577	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3578	ctl |= BWN_MACCTL_STA;
3579
3580	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3581	    ic->ic_opmode == IEEE80211_M_MBSS)
3582		ctl |= BWN_MACCTL_HOSTAP;
3583	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3584		ctl &= ~BWN_MACCTL_STA;
3585	ctl |= sc->sc_filters;
3586
3587	if (siba_get_revid(sc->sc_dev) <= 4)
3588		ctl |= BWN_MACCTL_PROMISC;
3589
3590	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3591
3592	cfp_pretbtt = 2;
3593	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3594		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3595		    siba_get_chiprev(sc->sc_dev) == 3)
3596			cfp_pretbtt = 100;
3597		else
3598			cfp_pretbtt = 50;
3599	}
3600	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3601}
3602
3603static int
3604bwn_dma_gettype(struct bwn_mac *mac)
3605{
3606	uint32_t tmp;
3607	uint16_t base;
3608
3609	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3610	if (tmp & SIBA_TGSHIGH_DMA64)
3611		return (BWN_DMA_64BIT);
3612	base = bwn_dma_base(0, 0);
3613	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3614	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3615	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3616		return (BWN_DMA_32BIT);
3617
3618	return (BWN_DMA_30BIT);
3619}
3620
3621static void
3622bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3623{
3624	if (!error) {
3625		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3626		*((bus_addr_t *)arg) = seg->ds_addr;
3627	}
3628}
3629
3630void
3631bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3632{
3633	struct bwn_phy *phy = &mac->mac_phy;
3634	struct bwn_softc *sc = mac->mac_sc;
3635	unsigned int i, max_loop;
3636	uint16_t value;
3637	uint32_t buffer[5] = {
3638		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3639	};
3640
3641	if (ofdm) {
3642		max_loop = 0x1e;
3643		buffer[0] = 0x000201cc;
3644	} else {
3645		max_loop = 0xfa;
3646		buffer[0] = 0x000b846e;
3647	}
3648
3649	BWN_ASSERT_LOCKED(mac->mac_sc);
3650
3651	for (i = 0; i < 5; i++)
3652		bwn_ram_write(mac, i * 4, buffer[i]);
3653
3654	BWN_WRITE_2(mac, 0x0568, 0x0000);
3655	BWN_WRITE_2(mac, 0x07c0,
3656	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3657
3658	value = (ofdm ? 0x41 : 0x40);
3659	BWN_WRITE_2(mac, 0x050c, value);
3660
3661	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3662	    phy->type == BWN_PHYTYPE_LCN)
3663		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3664	BWN_WRITE_2(mac, 0x0508, 0x0000);
3665	BWN_WRITE_2(mac, 0x050a, 0x0000);
3666	BWN_WRITE_2(mac, 0x054c, 0x0000);
3667	BWN_WRITE_2(mac, 0x056a, 0x0014);
3668	BWN_WRITE_2(mac, 0x0568, 0x0826);
3669	BWN_WRITE_2(mac, 0x0500, 0x0000);
3670
3671	/* XXX TODO: n phy pa override? */
3672
3673	switch (phy->type) {
3674	case BWN_PHYTYPE_N:
3675	case BWN_PHYTYPE_LCN:
3676		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3677		break;
3678	case BWN_PHYTYPE_LP:
3679		BWN_WRITE_2(mac, 0x0502, 0x0050);
3680		break;
3681	default:
3682		BWN_WRITE_2(mac, 0x0502, 0x0030);
3683		break;
3684	}
3685
3686	/* flush */
3687	BWN_READ_2(mac, 0x0502);
3688
3689	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3690		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3691	for (i = 0x00; i < max_loop; i++) {
3692		value = BWN_READ_2(mac, 0x050e);
3693		if (value & 0x0080)
3694			break;
3695		DELAY(10);
3696	}
3697	for (i = 0x00; i < 0x0a; i++) {
3698		value = BWN_READ_2(mac, 0x050e);
3699		if (value & 0x0400)
3700			break;
3701		DELAY(10);
3702	}
3703	for (i = 0x00; i < 0x19; i++) {
3704		value = BWN_READ_2(mac, 0x0690);
3705		if (!(value & 0x0100))
3706			break;
3707		DELAY(10);
3708	}
3709	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3710		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3711}
3712
3713void
3714bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3715{
3716	uint32_t macctl;
3717
3718	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3719
3720	macctl = BWN_READ_4(mac, BWN_MACCTL);
3721	if (macctl & BWN_MACCTL_BIGENDIAN)
3722		printf("TODO: need swap\n");
3723
3724	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3725	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3726	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3727}
3728
3729void
3730bwn_mac_suspend(struct bwn_mac *mac)
3731{
3732	struct bwn_softc *sc = mac->mac_sc;
3733	int i;
3734	uint32_t tmp;
3735
3736	KASSERT(mac->mac_suspended >= 0,
3737	    ("%s:%d: fail", __func__, __LINE__));
3738
3739	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3740	    __func__, mac->mac_suspended);
3741
3742	if (mac->mac_suspended == 0) {
3743		bwn_psctl(mac, BWN_PS_AWAKE);
3744		BWN_WRITE_4(mac, BWN_MACCTL,
3745			    BWN_READ_4(mac, BWN_MACCTL)
3746			    & ~BWN_MACCTL_ON);
3747		BWN_READ_4(mac, BWN_MACCTL);
3748		for (i = 35; i; i--) {
3749			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3750			if (tmp & BWN_INTR_MAC_SUSPENDED)
3751				goto out;
3752			DELAY(10);
3753		}
3754		for (i = 40; i; i--) {
3755			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3756			if (tmp & BWN_INTR_MAC_SUSPENDED)
3757				goto out;
3758			DELAY(1000);
3759		}
3760		device_printf(sc->sc_dev, "MAC suspend failed\n");
3761	}
3762out:
3763	mac->mac_suspended++;
3764}
3765
3766void
3767bwn_mac_enable(struct bwn_mac *mac)
3768{
3769	struct bwn_softc *sc = mac->mac_sc;
3770	uint16_t state;
3771
3772	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3773	    __func__, mac->mac_suspended);
3774
3775	state = bwn_shm_read_2(mac, BWN_SHARED,
3776	    BWN_SHARED_UCODESTAT);
3777	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3778	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3779		DPRINTF(sc, BWN_DEBUG_FW,
3780		    "%s: warn: firmware state (%d)\n",
3781		    __func__, state);
3782	}
3783
3784	mac->mac_suspended--;
3785	KASSERT(mac->mac_suspended >= 0,
3786	    ("%s:%d: fail", __func__, __LINE__));
3787	if (mac->mac_suspended == 0) {
3788		BWN_WRITE_4(mac, BWN_MACCTL,
3789		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3790		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3791		BWN_READ_4(mac, BWN_MACCTL);
3792		BWN_READ_4(mac, BWN_INTR_REASON);
3793		bwn_psctl(mac, 0);
3794	}
3795}
3796
3797void
3798bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3799{
3800	struct bwn_softc *sc = mac->mac_sc;
3801	int i;
3802	uint16_t ucstat;
3803
3804	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3805	    ("%s:%d: fail", __func__, __LINE__));
3806	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3807	    ("%s:%d: fail", __func__, __LINE__));
3808
3809	/* XXX forcibly awake and hwps-off */
3810
3811	BWN_WRITE_4(mac, BWN_MACCTL,
3812	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3813	    ~BWN_MACCTL_HWPS);
3814	BWN_READ_4(mac, BWN_MACCTL);
3815	if (siba_get_revid(sc->sc_dev) >= 5) {
3816		for (i = 0; i < 100; i++) {
3817			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3818			    BWN_SHARED_UCODESTAT);
3819			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3820				break;
3821			DELAY(10);
3822		}
3823	}
3824	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3825	    ucstat);
3826}
3827
3828static int
3829bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3830{
3831	struct bwn_softc *sc = mac->mac_sc;
3832	struct bwn_fw *fw = &mac->mac_fw;
3833	const uint8_t rev = siba_get_revid(sc->sc_dev);
3834	const char *filename;
3835	uint32_t high;
3836	int error;
3837
3838	/* microcode */
3839	filename = NULL;
3840	switch (rev) {
3841	case 42:
3842		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3843			filename = "ucode42";
3844		break;
3845	case 40:
3846		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3847			filename = "ucode40";
3848		break;
3849	case 33:
3850		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3851			filename = "ucode33_lcn40";
3852		break;
3853	case 30:
3854		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3855			filename = "ucode30_mimo";
3856		break;
3857	case 29:
3858		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3859			filename = "ucode29_mimo";
3860		break;
3861	case 26:
3862		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3863			filename = "ucode26_mimo";
3864		break;
3865	case 28:
3866	case 25:
3867		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3868			filename = "ucode25_mimo";
3869		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3870			filename = "ucode25_lcn";
3871		break;
3872	case 24:
3873		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3874			filename = "ucode24_lcn";
3875		break;
3876	case 23:
3877		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3878			filename = "ucode16_mimo";
3879		break;
3880	case 16:
3881	case 17:
3882	case 18:
3883	case 19:
3884		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3885			filename = "ucode16_mimo";
3886		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3887			filename = "ucode16_lp";
3888		break;
3889	case 15:
3890		filename = "ucode15";
3891		break;
3892	case 14:
3893		filename = "ucode14";
3894		break;
3895	case 13:
3896		filename = "ucode13";
3897		break;
3898	case 12:
3899	case 11:
3900		filename = "ucode11";
3901		break;
3902	case 10:
3903	case 9:
3904	case 8:
3905	case 7:
3906	case 6:
3907	case 5:
3908		filename = "ucode5";
3909		break;
3910	default:
3911		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3912		bwn_release_firmware(mac);
3913		return (EOPNOTSUPP);
3914	}
3915
3916	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3917	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3918	if (error) {
3919		bwn_release_firmware(mac);
3920		return (error);
3921	}
3922
3923	/* PCM */
3924	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3925	if (rev >= 5 && rev <= 10) {
3926		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3927		if (error == ENOENT)
3928			fw->no_pcmfile = 1;
3929		else if (error) {
3930			bwn_release_firmware(mac);
3931			return (error);
3932		}
3933	} else if (rev < 11) {
3934		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3935		bwn_release_firmware(mac);
3936		return (EOPNOTSUPP);
3937	}
3938
3939	/* initvals */
3940	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3941	switch (mac->mac_phy.type) {
3942	case BWN_PHYTYPE_A:
3943		if (rev < 5 || rev > 10)
3944			goto fail1;
3945		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3946			filename = "a0g1initvals5";
3947		else
3948			filename = "a0g0initvals5";
3949		break;
3950	case BWN_PHYTYPE_G:
3951		if (rev >= 5 && rev <= 10)
3952			filename = "b0g0initvals5";
3953		else if (rev >= 13)
3954			filename = "b0g0initvals13";
3955		else
3956			goto fail1;
3957		break;
3958	case BWN_PHYTYPE_LP:
3959		if (rev == 13)
3960			filename = "lp0initvals13";
3961		else if (rev == 14)
3962			filename = "lp0initvals14";
3963		else if (rev >= 15)
3964			filename = "lp0initvals15";
3965		else
3966			goto fail1;
3967		break;
3968	case BWN_PHYTYPE_N:
3969		if (rev == 30)
3970			filename = "n16initvals30";
3971		else if (rev == 28 || rev == 25)
3972			filename = "n0initvals25";
3973		else if (rev == 24)
3974			filename = "n0initvals24";
3975		else if (rev == 23)
3976			filename = "n0initvals16";
3977		else if (rev >= 16 && rev <= 18)
3978			filename = "n0initvals16";
3979		else if (rev >= 11 && rev <= 12)
3980			filename = "n0initvals11";
3981		else
3982			goto fail1;
3983		break;
3984	default:
3985		goto fail1;
3986	}
3987	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3988	if (error) {
3989		bwn_release_firmware(mac);
3990		return (error);
3991	}
3992
3993	/* bandswitch initvals */
3994	switch (mac->mac_phy.type) {
3995	case BWN_PHYTYPE_A:
3996		if (rev >= 5 && rev <= 10) {
3997			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3998				filename = "a0g1bsinitvals5";
3999			else
4000				filename = "a0g0bsinitvals5";
4001		} else if (rev >= 11)
4002			filename = NULL;
4003		else
4004			goto fail1;
4005		break;
4006	case BWN_PHYTYPE_G:
4007		if (rev >= 5 && rev <= 10)
4008			filename = "b0g0bsinitvals5";
4009		else if (rev >= 11)
4010			filename = NULL;
4011		else
4012			goto fail1;
4013		break;
4014	case BWN_PHYTYPE_LP:
4015		if (rev == 13)
4016			filename = "lp0bsinitvals13";
4017		else if (rev == 14)
4018			filename = "lp0bsinitvals14";
4019		else if (rev >= 15)
4020			filename = "lp0bsinitvals15";
4021		else
4022			goto fail1;
4023		break;
4024	case BWN_PHYTYPE_N:
4025		if (rev == 30)
4026			filename = "n16bsinitvals30";
4027		else if (rev == 28 || rev == 25)
4028			filename = "n0bsinitvals25";
4029		else if (rev == 24)
4030			filename = "n0bsinitvals24";
4031		else if (rev == 23)
4032			filename = "n0bsinitvals16";
4033		else if (rev >= 16 && rev <= 18)
4034			filename = "n0bsinitvals16";
4035		else if (rev >= 11 && rev <= 12)
4036			filename = "n0bsinitvals11";
4037		else
4038			goto fail1;
4039		break;
4040	default:
4041		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4042		    mac->mac_phy.type);
4043		goto fail1;
4044	}
4045	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4046	if (error) {
4047		bwn_release_firmware(mac);
4048		return (error);
4049	}
4050	return (0);
4051fail1:
4052	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4053	    rev, mac->mac_phy.type);
4054	bwn_release_firmware(mac);
4055	return (EOPNOTSUPP);
4056}
4057
4058static int
4059bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4060    const char *name, struct bwn_fwfile *bfw)
4061{
4062	const struct bwn_fwhdr *hdr;
4063	struct bwn_softc *sc = mac->mac_sc;
4064	const struct firmware *fw;
4065	char namebuf[64];
4066
4067	if (name == NULL) {
4068		bwn_do_release_fw(bfw);
4069		return (0);
4070	}
4071	if (bfw->filename != NULL) {
4072		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4073			return (0);
4074		bwn_do_release_fw(bfw);
4075	}
4076
4077	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4078	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4079	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4080	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4081	fw = firmware_get(namebuf);
4082	if (fw == NULL) {
4083		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4084		    namebuf);
4085		return (ENOENT);
4086	}
4087	if (fw->datasize < sizeof(struct bwn_fwhdr))
4088		goto fail;
4089	hdr = (const struct bwn_fwhdr *)(fw->data);
4090	switch (hdr->type) {
4091	case BWN_FWTYPE_UCODE:
4092	case BWN_FWTYPE_PCM:
4093		if (be32toh(hdr->size) !=
4094		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4095			goto fail;
4096		/* FALLTHROUGH */
4097	case BWN_FWTYPE_IV:
4098		if (hdr->ver != 1)
4099			goto fail;
4100		break;
4101	default:
4102		goto fail;
4103	}
4104	bfw->filename = name;
4105	bfw->fw = fw;
4106	bfw->type = type;
4107	return (0);
4108fail:
4109	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4110	if (fw != NULL)
4111		firmware_put(fw, FIRMWARE_UNLOAD);
4112	return (EPROTO);
4113}
4114
4115static void
4116bwn_release_firmware(struct bwn_mac *mac)
4117{
4118
4119	bwn_do_release_fw(&mac->mac_fw.ucode);
4120	bwn_do_release_fw(&mac->mac_fw.pcm);
4121	bwn_do_release_fw(&mac->mac_fw.initvals);
4122	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4123}
4124
4125static void
4126bwn_do_release_fw(struct bwn_fwfile *bfw)
4127{
4128
4129	if (bfw->fw != NULL)
4130		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4131	bfw->fw = NULL;
4132	bfw->filename = NULL;
4133}
4134
4135static int
4136bwn_fw_loaducode(struct bwn_mac *mac)
4137{
4138#define	GETFWOFFSET(fwp, offset)	\
4139	((const uint32_t *)((const char *)fwp.fw->data + offset))
4140#define	GETFWSIZE(fwp, offset)	\
4141	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4142	struct bwn_softc *sc = mac->mac_sc;
4143	const uint32_t *data;
4144	unsigned int i;
4145	uint32_t ctl;
4146	uint16_t date, fwcaps, time;
4147	int error = 0;
4148
4149	ctl = BWN_READ_4(mac, BWN_MACCTL);
4150	ctl |= BWN_MACCTL_MCODE_JMP0;
4151	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4152	    __LINE__));
4153	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4154	for (i = 0; i < 64; i++)
4155		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4156	for (i = 0; i < 4096; i += 2)
4157		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4158
4159	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4160	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4161	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4162	     i++) {
4163		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4164		DELAY(10);
4165	}
4166
4167	if (mac->mac_fw.pcm.fw) {
4168		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4169		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4170		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4171		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4172		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4173		    sizeof(struct bwn_fwhdr)); i++) {
4174			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4175			DELAY(10);
4176		}
4177	}
4178
4179	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4180	BWN_WRITE_4(mac, BWN_MACCTL,
4181	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4182	    BWN_MACCTL_MCODE_RUN);
4183
4184	for (i = 0; i < 21; i++) {
4185		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4186			break;
4187		if (i >= 20) {
4188			device_printf(sc->sc_dev, "ucode timeout\n");
4189			error = ENXIO;
4190			goto error;
4191		}
4192		DELAY(50000);
4193	}
4194	BWN_READ_4(mac, BWN_INTR_REASON);
4195
4196	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4197	if (mac->mac_fw.rev <= 0x128) {
4198		device_printf(sc->sc_dev, "the firmware is too old\n");
4199		error = EOPNOTSUPP;
4200		goto error;
4201	}
4202
4203	/*
4204	 * Determine firmware header version; needed for TX/RX packet
4205	 * handling.
4206	 */
4207	if (mac->mac_fw.rev >= 598)
4208		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4209	else if (mac->mac_fw.rev >= 410)
4210		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4211	else
4212		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4213
4214	/*
4215	 * We don't support rev 598 or later; that requires
4216	 * another round of changes to the TX/RX descriptor
4217	 * and status layout.
4218	 *
4219	 * So, complain this is the case and exit out, rather
4220	 * than attaching and then failing.
4221	 */
4222#if 0
4223	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4224		device_printf(sc->sc_dev,
4225		    "firmware is too new (>=598); not supported\n");
4226		error = EOPNOTSUPP;
4227		goto error;
4228	}
4229#endif
4230
4231	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4232	    BWN_SHARED_UCODE_PATCH);
4233	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4234	mac->mac_fw.opensource = (date == 0xffff);
4235	if (bwn_wme != 0)
4236		mac->mac_flags |= BWN_MAC_FLAG_WME;
4237	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4238
4239	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4240	if (mac->mac_fw.opensource == 0) {
4241		device_printf(sc->sc_dev,
4242		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4243		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4244		if (mac->mac_fw.no_pcmfile)
4245			device_printf(sc->sc_dev,
4246			    "no HW crypto acceleration due to pcm5\n");
4247	} else {
4248		mac->mac_fw.patch = time;
4249		fwcaps = bwn_fwcaps_read(mac);
4250		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4251			device_printf(sc->sc_dev,
4252			    "disabling HW crypto acceleration\n");
4253			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4254		}
4255		if (!(fwcaps & BWN_FWCAPS_WME)) {
4256			device_printf(sc->sc_dev, "disabling WME support\n");
4257			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4258		}
4259	}
4260
4261	if (BWN_ISOLDFMT(mac))
4262		device_printf(sc->sc_dev, "using old firmware image\n");
4263
4264	return (0);
4265
4266error:
4267	BWN_WRITE_4(mac, BWN_MACCTL,
4268	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4269	    BWN_MACCTL_MCODE_JMP0);
4270
4271	return (error);
4272#undef GETFWSIZE
4273#undef GETFWOFFSET
4274}
4275
4276/* OpenFirmware only */
4277static uint16_t
4278bwn_fwcaps_read(struct bwn_mac *mac)
4279{
4280
4281	KASSERT(mac->mac_fw.opensource == 1,
4282	    ("%s:%d: fail", __func__, __LINE__));
4283	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4284}
4285
4286static int
4287bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4288    size_t count, size_t array_size)
4289{
4290#define	GET_NEXTIV16(iv)						\
4291	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4292	    sizeof(uint16_t) + sizeof(uint16_t)))
4293#define	GET_NEXTIV32(iv)						\
4294	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4295	    sizeof(uint16_t) + sizeof(uint32_t)))
4296	struct bwn_softc *sc = mac->mac_sc;
4297	const struct bwn_fwinitvals *iv;
4298	uint16_t offset;
4299	size_t i;
4300	uint8_t bit32;
4301
4302	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4303	    ("%s:%d: fail", __func__, __LINE__));
4304	iv = ivals;
4305	for (i = 0; i < count; i++) {
4306		if (array_size < sizeof(iv->offset_size))
4307			goto fail;
4308		array_size -= sizeof(iv->offset_size);
4309		offset = be16toh(iv->offset_size);
4310		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4311		offset &= BWN_FWINITVALS_OFFSET_MASK;
4312		if (offset >= 0x1000)
4313			goto fail;
4314		if (bit32) {
4315			if (array_size < sizeof(iv->data.d32))
4316				goto fail;
4317			array_size -= sizeof(iv->data.d32);
4318			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4319			iv = GET_NEXTIV32(iv);
4320		} else {
4321
4322			if (array_size < sizeof(iv->data.d16))
4323				goto fail;
4324			array_size -= sizeof(iv->data.d16);
4325			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4326
4327			iv = GET_NEXTIV16(iv);
4328		}
4329	}
4330	if (array_size != 0)
4331		goto fail;
4332	return (0);
4333fail:
4334	device_printf(sc->sc_dev, "initvals: invalid format\n");
4335	return (EPROTO);
4336#undef GET_NEXTIV16
4337#undef GET_NEXTIV32
4338}
4339
4340int
4341bwn_switch_channel(struct bwn_mac *mac, int chan)
4342{
4343	struct bwn_phy *phy = &(mac->mac_phy);
4344	struct bwn_softc *sc = mac->mac_sc;
4345	struct ieee80211com *ic = &sc->sc_ic;
4346	uint16_t channelcookie, savedcookie;
4347	int error;
4348
4349	if (chan == 0xffff)
4350		chan = phy->get_default_chan(mac);
4351
4352	channelcookie = chan;
4353	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4354		channelcookie |= 0x100;
4355	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4356	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4357	error = phy->switch_channel(mac, chan);
4358	if (error)
4359		goto fail;
4360
4361	mac->mac_phy.chan = chan;
4362	DELAY(8000);
4363	return (0);
4364fail:
4365	device_printf(sc->sc_dev, "failed to switch channel\n");
4366	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4367	return (error);
4368}
4369
4370static uint16_t
4371bwn_ant2phy(int antenna)
4372{
4373
4374	switch (antenna) {
4375	case BWN_ANT0:
4376		return (BWN_TX_PHY_ANT0);
4377	case BWN_ANT1:
4378		return (BWN_TX_PHY_ANT1);
4379	case BWN_ANT2:
4380		return (BWN_TX_PHY_ANT2);
4381	case BWN_ANT3:
4382		return (BWN_TX_PHY_ANT3);
4383	case BWN_ANTAUTO:
4384		return (BWN_TX_PHY_ANT01AUTO);
4385	}
4386	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4387	return (0);
4388}
4389
4390static void
4391bwn_wme_load(struct bwn_mac *mac)
4392{
4393	struct bwn_softc *sc = mac->mac_sc;
4394	int i;
4395
4396	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4397	    ("%s:%d: fail", __func__, __LINE__));
4398
4399	bwn_mac_suspend(mac);
4400	for (i = 0; i < N(sc->sc_wmeParams); i++)
4401		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4402		    bwn_wme_shm_offsets[i]);
4403	bwn_mac_enable(mac);
4404}
4405
4406static void
4407bwn_wme_loadparams(struct bwn_mac *mac,
4408    const struct wmeParams *p, uint16_t shm_offset)
4409{
4410#define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4411	struct bwn_softc *sc = mac->mac_sc;
4412	uint16_t params[BWN_NR_WMEPARAMS];
4413	int slot, tmp;
4414	unsigned int i;
4415
4416	slot = BWN_READ_2(mac, BWN_RNG) &
4417	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4418
4419	memset(&params, 0, sizeof(params));
4420
4421	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4422	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4423	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4424
4425	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4426	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4427	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4428	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4429	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4430	params[BWN_WMEPARAM_BSLOTS] = slot;
4431	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4432
4433	for (i = 0; i < N(params); i++) {
4434		if (i == BWN_WMEPARAM_STATUS) {
4435			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4436			    shm_offset + (i * 2));
4437			tmp |= 0x100;
4438			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4439			    tmp);
4440		} else {
4441			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4442			    params[i]);
4443		}
4444	}
4445}
4446
4447static void
4448bwn_mac_write_bssid(struct bwn_mac *mac)
4449{
4450	struct bwn_softc *sc = mac->mac_sc;
4451	uint32_t tmp;
4452	int i;
4453	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4454
4455	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4456	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4457	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4458	    IEEE80211_ADDR_LEN);
4459
4460	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4461		tmp = (uint32_t) (mac_bssid[i + 0]);
4462		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4463		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4464		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4465		bwn_ram_write(mac, 0x20 + i, tmp);
4466	}
4467}
4468
4469static void
4470bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4471    const uint8_t *macaddr)
4472{
4473	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4474	uint16_t data;
4475
4476	if (!mac)
4477		macaddr = zero;
4478
4479	offset |= 0x0020;
4480	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4481
4482	data = macaddr[0];
4483	data |= macaddr[1] << 8;
4484	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4485	data = macaddr[2];
4486	data |= macaddr[3] << 8;
4487	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4488	data = macaddr[4];
4489	data |= macaddr[5] << 8;
4490	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4491}
4492
4493static void
4494bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4495    const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4496{
4497	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4498	uint8_t per_sta_keys_start = 8;
4499
4500	if (BWN_SEC_NEWAPI(mac))
4501		per_sta_keys_start = 4;
4502
4503	KASSERT(index < mac->mac_max_nr_keys,
4504	    ("%s:%d: fail", __func__, __LINE__));
4505	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4506	    ("%s:%d: fail", __func__, __LINE__));
4507
4508	if (index >= per_sta_keys_start)
4509		bwn_key_macwrite(mac, index, NULL);
4510	if (key)
4511		memcpy(buf, key, key_len);
4512	bwn_key_write(mac, index, algorithm, buf);
4513	if (index >= per_sta_keys_start)
4514		bwn_key_macwrite(mac, index, mac_addr);
4515
4516	mac->mac_key[index].algorithm = algorithm;
4517}
4518
4519static void
4520bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4521{
4522	struct bwn_softc *sc = mac->mac_sc;
4523	uint32_t addrtmp[2] = { 0, 0 };
4524	uint8_t start = 8;
4525
4526	if (BWN_SEC_NEWAPI(mac))
4527		start = 4;
4528
4529	KASSERT(index >= start,
4530	    ("%s:%d: fail", __func__, __LINE__));
4531	index -= start;
4532
4533	if (addr) {
4534		addrtmp[0] = addr[0];
4535		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4536		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4537		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4538		addrtmp[1] = addr[4];
4539		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4540	}
4541
4542	if (siba_get_revid(sc->sc_dev) >= 5) {
4543		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4544		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4545	} else {
4546		if (index >= 8) {
4547			bwn_shm_write_4(mac, BWN_SHARED,
4548			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4549			bwn_shm_write_2(mac, BWN_SHARED,
4550			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4551		}
4552	}
4553}
4554
4555static void
4556bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4557    const uint8_t *key)
4558{
4559	unsigned int i;
4560	uint32_t offset;
4561	uint16_t kidx, value;
4562
4563	kidx = BWN_SEC_KEY2FW(mac, index);
4564	bwn_shm_write_2(mac, BWN_SHARED,
4565	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4566
4567	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4568	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4569		value = key[i];
4570		value |= (uint16_t)(key[i + 1]) << 8;
4571		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4572	}
4573}
4574
4575static void
4576bwn_phy_exit(struct bwn_mac *mac)
4577{
4578
4579	mac->mac_phy.rf_onoff(mac, 0);
4580	if (mac->mac_phy.exit != NULL)
4581		mac->mac_phy.exit(mac);
4582}
4583
4584static void
4585bwn_dma_free(struct bwn_mac *mac)
4586{
4587	struct bwn_dma *dma;
4588
4589	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4590		return;
4591	dma = &mac->mac_method.dma;
4592
4593	bwn_dma_ringfree(&dma->rx);
4594	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4595	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4596	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4597	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4598	bwn_dma_ringfree(&dma->mcast);
4599}
4600
4601static void
4602bwn_core_stop(struct bwn_mac *mac)
4603{
4604	struct bwn_softc *sc = mac->mac_sc;
4605
4606	BWN_ASSERT_LOCKED(sc);
4607
4608	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4609		return;
4610
4611	callout_stop(&sc->sc_rfswitch_ch);
4612	callout_stop(&sc->sc_task_ch);
4613	callout_stop(&sc->sc_watchdog_ch);
4614	sc->sc_watchdog_timer = 0;
4615	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4616	BWN_READ_4(mac, BWN_INTR_MASK);
4617	bwn_mac_suspend(mac);
4618
4619	mac->mac_status = BWN_MAC_STATUS_INITED;
4620}
4621
4622static int
4623bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4624{
4625	struct bwn_mac *up_dev = NULL;
4626	struct bwn_mac *down_dev;
4627	struct bwn_mac *mac;
4628	int err, status;
4629	uint8_t gmode;
4630
4631	BWN_ASSERT_LOCKED(sc);
4632
4633	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4634		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4635		    mac->mac_phy.supports_2ghz) {
4636			up_dev = mac;
4637			gmode = 1;
4638		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4639		    mac->mac_phy.supports_5ghz) {
4640			up_dev = mac;
4641			gmode = 0;
4642		} else {
4643			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4644			return (EINVAL);
4645		}
4646		if (up_dev != NULL)
4647			break;
4648	}
4649	if (up_dev == NULL) {
4650		device_printf(sc->sc_dev, "Could not find a device\n");
4651		return (ENODEV);
4652	}
4653	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4654		return (0);
4655
4656	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4657	    "switching to %s-GHz band\n",
4658	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4659
4660	down_dev = sc->sc_curmac;
4661	status = down_dev->mac_status;
4662	if (status >= BWN_MAC_STATUS_STARTED)
4663		bwn_core_stop(down_dev);
4664	if (status >= BWN_MAC_STATUS_INITED)
4665		bwn_core_exit(down_dev);
4666
4667	if (down_dev != up_dev)
4668		bwn_phy_reset(down_dev);
4669
4670	up_dev->mac_phy.gmode = gmode;
4671	if (status >= BWN_MAC_STATUS_INITED) {
4672		err = bwn_core_init(up_dev);
4673		if (err) {
4674			device_printf(sc->sc_dev,
4675			    "fatal: failed to initialize for %s-GHz\n",
4676			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4677			goto fail;
4678		}
4679	}
4680	if (status >= BWN_MAC_STATUS_STARTED)
4681		bwn_core_start(up_dev);
4682	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4683	sc->sc_curmac = up_dev;
4684
4685	return (0);
4686fail:
4687	sc->sc_curmac = NULL;
4688	return (err);
4689}
4690
4691static void
4692bwn_rf_turnon(struct bwn_mac *mac)
4693{
4694
4695	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4696
4697	bwn_mac_suspend(mac);
4698	mac->mac_phy.rf_onoff(mac, 1);
4699	mac->mac_phy.rf_on = 1;
4700	bwn_mac_enable(mac);
4701}
4702
4703static void
4704bwn_rf_turnoff(struct bwn_mac *mac)
4705{
4706
4707	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4708
4709	bwn_mac_suspend(mac);
4710	mac->mac_phy.rf_onoff(mac, 0);
4711	mac->mac_phy.rf_on = 0;
4712	bwn_mac_enable(mac);
4713}
4714
4715/*
4716 * SSB PHY reset.
4717 */
4718static void
4719bwn_phy_reset_siba(struct bwn_mac *mac)
4720{
4721	struct bwn_softc *sc = mac->mac_sc;
4722
4723	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4724	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4725	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4726	DELAY(1000);
4727	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4728	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4729	DELAY(1000);
4730}
4731
4732static void
4733bwn_phy_reset(struct bwn_mac *mac)
4734{
4735
4736	if (bwn_is_bus_siba(mac)) {
4737		bwn_phy_reset_siba(mac);
4738	} else {
4739		BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4740	}
4741}
4742
4743static int
4744bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4745{
4746	struct bwn_vap *bvp = BWN_VAP(vap);
4747	struct ieee80211com *ic= vap->iv_ic;
4748	enum ieee80211_state ostate = vap->iv_state;
4749	struct bwn_softc *sc = ic->ic_softc;
4750	struct bwn_mac *mac = sc->sc_curmac;
4751	int error;
4752
4753	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4754	    ieee80211_state_name[vap->iv_state],
4755	    ieee80211_state_name[nstate]);
4756
4757	error = bvp->bv_newstate(vap, nstate, arg);
4758	if (error != 0)
4759		return (error);
4760
4761	BWN_LOCK(sc);
4762
4763	bwn_led_newstate(mac, nstate);
4764
4765	/*
4766	 * Clear the BSSID when we stop a STA
4767	 */
4768	if (vap->iv_opmode == IEEE80211_M_STA) {
4769		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4770			/*
4771			 * Clear out the BSSID.  If we reassociate to
4772			 * the same AP, this will reinialize things
4773			 * correctly...
4774			 */
4775			if (ic->ic_opmode == IEEE80211_M_STA &&
4776			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4777				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4778				bwn_set_macaddr(mac);
4779			}
4780		}
4781	}
4782
4783	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4784	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4785		/* XXX nothing to do? */
4786	} else if (nstate == IEEE80211_S_RUN) {
4787		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4788		bwn_set_opmode(mac);
4789		bwn_set_pretbtt(mac);
4790		bwn_spu_setdelay(mac, 0);
4791		bwn_set_macaddr(mac);
4792	}
4793
4794	BWN_UNLOCK(sc);
4795
4796	return (error);
4797}
4798
4799static void
4800bwn_set_pretbtt(struct bwn_mac *mac)
4801{
4802	struct bwn_softc *sc = mac->mac_sc;
4803	struct ieee80211com *ic = &sc->sc_ic;
4804	uint16_t pretbtt;
4805
4806	if (ic->ic_opmode == IEEE80211_M_IBSS)
4807		pretbtt = 2;
4808	else
4809		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4810	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4811	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4812}
4813
4814static int
4815bwn_intr(void *arg)
4816{
4817	struct bwn_mac *mac = arg;
4818	struct bwn_softc *sc = mac->mac_sc;
4819	uint32_t reason;
4820
4821	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4822	    (sc->sc_flags & BWN_FLAG_INVALID))
4823		return (FILTER_STRAY);
4824
4825	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4826
4827	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4828	if (reason == 0xffffffff)	/* shared IRQ */
4829		return (FILTER_STRAY);
4830	reason &= mac->mac_intr_mask;
4831	if (reason == 0)
4832		return (FILTER_HANDLED);
4833	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4834
4835	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4836	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4837	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4838	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4839	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4840	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4841	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4842	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4843	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4844	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4845	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4846
4847	/* Disable interrupts. */
4848	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4849
4850	mac->mac_reason_intr = reason;
4851
4852	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4853	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4854
4855	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4856	return (FILTER_HANDLED);
4857}
4858
4859static void
4860bwn_intrtask(void *arg, int npending)
4861{
4862	struct bwn_mac *mac = arg;
4863	struct bwn_softc *sc = mac->mac_sc;
4864	uint32_t merged = 0;
4865	int i, tx = 0, rx = 0;
4866
4867	BWN_LOCK(sc);
4868	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4869	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4870		BWN_UNLOCK(sc);
4871		return;
4872	}
4873
4874	for (i = 0; i < N(mac->mac_reason); i++)
4875		merged |= mac->mac_reason[i];
4876
4877	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4878		device_printf(sc->sc_dev, "MAC trans error\n");
4879
4880	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4881		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4882		mac->mac_phy.txerrors--;
4883		if (mac->mac_phy.txerrors == 0) {
4884			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4885			bwn_restart(mac, "PHY TX errors");
4886		}
4887	}
4888
4889	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4890		if (merged & BWN_DMAINTR_FATALMASK) {
4891			device_printf(sc->sc_dev,
4892			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4893			    mac->mac_reason[0], mac->mac_reason[1],
4894			    mac->mac_reason[2], mac->mac_reason[3],
4895			    mac->mac_reason[4], mac->mac_reason[5]);
4896			bwn_restart(mac, "DMA error");
4897			BWN_UNLOCK(sc);
4898			return;
4899		}
4900		if (merged & BWN_DMAINTR_NONFATALMASK) {
4901			device_printf(sc->sc_dev,
4902			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4903			    mac->mac_reason[0], mac->mac_reason[1],
4904			    mac->mac_reason[2], mac->mac_reason[3],
4905			    mac->mac_reason[4], mac->mac_reason[5]);
4906		}
4907	}
4908
4909	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4910		bwn_intr_ucode_debug(mac);
4911	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4912		bwn_intr_tbtt_indication(mac);
4913	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4914		bwn_intr_atim_end(mac);
4915	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4916		bwn_intr_beacon(mac);
4917	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4918		bwn_intr_pmq(mac);
4919	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4920		bwn_intr_noise(mac);
4921
4922	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4923		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4924			bwn_dma_rx(mac->mac_method.dma.rx);
4925			rx = 1;
4926		}
4927	} else
4928		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4929
4930	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4931	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4932	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4933	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4934	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4935
4936	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4937		bwn_intr_txeof(mac);
4938		tx = 1;
4939	}
4940
4941	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4942
4943	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4944		int evt = BWN_LED_EVENT_NONE;
4945
4946		if (tx && rx) {
4947			if (sc->sc_rx_rate > sc->sc_tx_rate)
4948				evt = BWN_LED_EVENT_RX;
4949			else
4950				evt = BWN_LED_EVENT_TX;
4951		} else if (tx) {
4952			evt = BWN_LED_EVENT_TX;
4953		} else if (rx) {
4954			evt = BWN_LED_EVENT_RX;
4955		} else if (rx == 0) {
4956			evt = BWN_LED_EVENT_POLL;
4957		}
4958
4959		if (evt != BWN_LED_EVENT_NONE)
4960			bwn_led_event(mac, evt);
4961       }
4962
4963	if (mbufq_first(&sc->sc_snd) != NULL)
4964		bwn_start(sc);
4965
4966	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4967	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4968
4969	BWN_UNLOCK(sc);
4970}
4971
4972static void
4973bwn_restart(struct bwn_mac *mac, const char *msg)
4974{
4975	struct bwn_softc *sc = mac->mac_sc;
4976	struct ieee80211com *ic = &sc->sc_ic;
4977
4978	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4979		return;
4980
4981	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4982	ieee80211_runtask(ic, &mac->mac_hwreset);
4983}
4984
4985static void
4986bwn_intr_ucode_debug(struct bwn_mac *mac)
4987{
4988	struct bwn_softc *sc = mac->mac_sc;
4989	uint16_t reason;
4990
4991	if (mac->mac_fw.opensource == 0)
4992		return;
4993
4994	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4995	switch (reason) {
4996	case BWN_DEBUGINTR_PANIC:
4997		bwn_handle_fwpanic(mac);
4998		break;
4999	case BWN_DEBUGINTR_DUMP_SHM:
5000		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5001		break;
5002	case BWN_DEBUGINTR_DUMP_REGS:
5003		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5004		break;
5005	case BWN_DEBUGINTR_MARKER:
5006		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5007		break;
5008	default:
5009		device_printf(sc->sc_dev,
5010		    "ucode debug unknown reason: %#x\n", reason);
5011	}
5012
5013	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5014	    BWN_DEBUGINTR_ACK);
5015}
5016
5017static void
5018bwn_intr_tbtt_indication(struct bwn_mac *mac)
5019{
5020	struct bwn_softc *sc = mac->mac_sc;
5021	struct ieee80211com *ic = &sc->sc_ic;
5022
5023	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5024		bwn_psctl(mac, 0);
5025	if (ic->ic_opmode == IEEE80211_M_IBSS)
5026		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5027}
5028
5029static void
5030bwn_intr_atim_end(struct bwn_mac *mac)
5031{
5032
5033	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5034		BWN_WRITE_4(mac, BWN_MACCMD,
5035		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5036		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5037	}
5038}
5039
5040static void
5041bwn_intr_beacon(struct bwn_mac *mac)
5042{
5043	struct bwn_softc *sc = mac->mac_sc;
5044	struct ieee80211com *ic = &sc->sc_ic;
5045	uint32_t cmd, beacon0, beacon1;
5046
5047	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5048	    ic->ic_opmode == IEEE80211_M_MBSS)
5049		return;
5050
5051	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5052
5053	cmd = BWN_READ_4(mac, BWN_MACCMD);
5054	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5055	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5056
5057	if (beacon0 && beacon1) {
5058		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5059		mac->mac_intr_mask |= BWN_INTR_BEACON;
5060		return;
5061	}
5062
5063	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5064		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5065		bwn_load_beacon0(mac);
5066		bwn_load_beacon1(mac);
5067		cmd = BWN_READ_4(mac, BWN_MACCMD);
5068		cmd |= BWN_MACCMD_BEACON0_VALID;
5069		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5070	} else {
5071		if (!beacon0) {
5072			bwn_load_beacon0(mac);
5073			cmd = BWN_READ_4(mac, BWN_MACCMD);
5074			cmd |= BWN_MACCMD_BEACON0_VALID;
5075			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5076		} else if (!beacon1) {
5077			bwn_load_beacon1(mac);
5078			cmd = BWN_READ_4(mac, BWN_MACCMD);
5079			cmd |= BWN_MACCMD_BEACON1_VALID;
5080			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5081		}
5082	}
5083}
5084
5085static void
5086bwn_intr_pmq(struct bwn_mac *mac)
5087{
5088	uint32_t tmp;
5089
5090	while (1) {
5091		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5092		if (!(tmp & 0x00000008))
5093			break;
5094	}
5095	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5096}
5097
5098static void
5099bwn_intr_noise(struct bwn_mac *mac)
5100{
5101	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5102	uint16_t tmp;
5103	uint8_t noise[4];
5104	uint8_t i, j;
5105	int32_t average;
5106
5107	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5108		return;
5109
5110	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5111	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5112	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5113	    noise[3] == 0x7f)
5114		goto new;
5115
5116	KASSERT(mac->mac_noise.noi_nsamples < 8,
5117	    ("%s:%d: fail", __func__, __LINE__));
5118	i = mac->mac_noise.noi_nsamples;
5119	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5120	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5121	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5122	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5123	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5124	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5125	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5126	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5127	mac->mac_noise.noi_nsamples++;
5128	if (mac->mac_noise.noi_nsamples == 8) {
5129		average = 0;
5130		for (i = 0; i < 8; i++) {
5131			for (j = 0; j < 4; j++)
5132				average += mac->mac_noise.noi_samples[i][j];
5133		}
5134		average = (((average / 32) * 125) + 64) / 128;
5135		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5136		if (tmp >= 8)
5137			average += 2;
5138		else
5139			average -= 25;
5140		average -= (tmp == 8) ? 72 : 48;
5141
5142		mac->mac_stats.link_noise = average;
5143		mac->mac_noise.noi_running = 0;
5144		return;
5145	}
5146new:
5147	bwn_noise_gensample(mac);
5148}
5149
5150static int
5151bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5152{
5153	struct bwn_mac *mac = prq->prq_mac;
5154	struct bwn_softc *sc = mac->mac_sc;
5155	unsigned int i;
5156
5157	BWN_ASSERT_LOCKED(sc);
5158
5159	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5160		return (0);
5161
5162	for (i = 0; i < 5000; i++) {
5163		if (bwn_pio_rxeof(prq) == 0)
5164			break;
5165	}
5166	if (i >= 5000)
5167		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5168	return ((i > 0) ? 1 : 0);
5169}
5170
5171static void
5172bwn_dma_rx(struct bwn_dma_ring *dr)
5173{
5174	int slot, curslot;
5175
5176	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5177	curslot = dr->get_curslot(dr);
5178	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5179	    ("%s:%d: fail", __func__, __LINE__));
5180
5181	slot = dr->dr_curslot;
5182	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5183		bwn_dma_rxeof(dr, &slot);
5184
5185	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5186	    BUS_DMASYNC_PREWRITE);
5187
5188	dr->set_curslot(dr, slot);
5189	dr->dr_curslot = slot;
5190}
5191
5192static void
5193bwn_intr_txeof(struct bwn_mac *mac)
5194{
5195	struct bwn_txstatus stat;
5196	uint32_t stat0, stat1;
5197	uint16_t tmp;
5198
5199	BWN_ASSERT_LOCKED(mac->mac_sc);
5200
5201	while (1) {
5202		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5203		if (!(stat0 & 0x00000001))
5204			break;
5205		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5206
5207		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5208		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5209		    __func__,
5210		    stat0,
5211		    stat1);
5212
5213		stat.cookie = (stat0 >> 16);
5214		stat.seq = (stat1 & 0x0000ffff);
5215		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5216		tmp = (stat0 & 0x0000ffff);
5217		stat.framecnt = ((tmp & 0xf000) >> 12);
5218		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5219		stat.sreason = ((tmp & 0x001c) >> 2);
5220		stat.pm = (tmp & 0x0080) ? 1 : 0;
5221		stat.im = (tmp & 0x0040) ? 1 : 0;
5222		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5223		stat.ack = (tmp & 0x0002) ? 1 : 0;
5224
5225		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5226		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5227		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5228		    __func__,
5229		    stat.cookie,
5230		    stat.seq,
5231		    stat.phy_stat,
5232		    stat.framecnt,
5233		    stat.rtscnt,
5234		    stat.sreason,
5235		    stat.pm,
5236		    stat.im,
5237		    stat.ampdu,
5238		    stat.ack);
5239
5240		bwn_handle_txeof(mac, &stat);
5241	}
5242}
5243
5244static void
5245bwn_hwreset(void *arg, int npending)
5246{
5247	struct bwn_mac *mac = arg;
5248	struct bwn_softc *sc = mac->mac_sc;
5249	int error = 0;
5250	int prev_status;
5251
5252	BWN_LOCK(sc);
5253
5254	prev_status = mac->mac_status;
5255	if (prev_status >= BWN_MAC_STATUS_STARTED)
5256		bwn_core_stop(mac);
5257	if (prev_status >= BWN_MAC_STATUS_INITED)
5258		bwn_core_exit(mac);
5259
5260	if (prev_status >= BWN_MAC_STATUS_INITED) {
5261		error = bwn_core_init(mac);
5262		if (error)
5263			goto out;
5264	}
5265	if (prev_status >= BWN_MAC_STATUS_STARTED)
5266		bwn_core_start(mac);
5267out:
5268	if (error) {
5269		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5270		sc->sc_curmac = NULL;
5271	}
5272	BWN_UNLOCK(sc);
5273}
5274
5275static void
5276bwn_handle_fwpanic(struct bwn_mac *mac)
5277{
5278	struct bwn_softc *sc = mac->mac_sc;
5279	uint16_t reason;
5280
5281	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5282	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5283
5284	if (reason == BWN_FWPANIC_RESTART)
5285		bwn_restart(mac, "ucode panic");
5286}
5287
5288static void
5289bwn_load_beacon0(struct bwn_mac *mac)
5290{
5291
5292	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5293}
5294
5295static void
5296bwn_load_beacon1(struct bwn_mac *mac)
5297{
5298
5299	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5300}
5301
5302static uint32_t
5303bwn_jssi_read(struct bwn_mac *mac)
5304{
5305	uint32_t val = 0;
5306
5307	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5308	val <<= 16;
5309	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5310
5311	return (val);
5312}
5313
5314static void
5315bwn_noise_gensample(struct bwn_mac *mac)
5316{
5317	uint32_t jssi = 0x7f7f7f7f;
5318
5319	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5320	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5321	BWN_WRITE_4(mac, BWN_MACCMD,
5322	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5323}
5324
5325static int
5326bwn_dma_freeslot(struct bwn_dma_ring *dr)
5327{
5328	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5329
5330	return (dr->dr_numslots - dr->dr_usedslot);
5331}
5332
5333static int
5334bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5335{
5336	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5337
5338	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5339	    ("%s:%d: fail", __func__, __LINE__));
5340	if (slot == dr->dr_numslots - 1)
5341		return (0);
5342	return (slot + 1);
5343}
5344
5345static void
5346bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5347{
5348	struct bwn_mac *mac = dr->dr_mac;
5349	struct bwn_softc *sc = mac->mac_sc;
5350	struct bwn_dma *dma = &mac->mac_method.dma;
5351	struct bwn_dmadesc_generic *desc;
5352	struct bwn_dmadesc_meta *meta;
5353	struct bwn_rxhdr4 *rxhdr;
5354	struct mbuf *m;
5355	uint32_t macstat;
5356	int32_t tmp;
5357	int cnt = 0;
5358	uint16_t len;
5359
5360	dr->getdesc(dr, *slot, &desc, &meta);
5361
5362	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5363	m = meta->mt_m;
5364
5365	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5366		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5367		return;
5368	}
5369
5370	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5371	len = le16toh(rxhdr->frame_len);
5372	if (len <= 0) {
5373		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5374		return;
5375	}
5376	if (bwn_dma_check_redzone(dr, m)) {
5377		device_printf(sc->sc_dev, "redzone error.\n");
5378		bwn_dma_set_redzone(dr, m);
5379		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5380		    BUS_DMASYNC_PREWRITE);
5381		return;
5382	}
5383	if (len > dr->dr_rx_bufsize) {
5384		tmp = len;
5385		while (1) {
5386			dr->getdesc(dr, *slot, &desc, &meta);
5387			bwn_dma_set_redzone(dr, meta->mt_m);
5388			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5389			    BUS_DMASYNC_PREWRITE);
5390			*slot = bwn_dma_nextslot(dr, *slot);
5391			cnt++;
5392			tmp -= dr->dr_rx_bufsize;
5393			if (tmp <= 0)
5394				break;
5395		}
5396		device_printf(sc->sc_dev, "too small buffer "
5397		       "(len %u buffer %u dropped %d)\n",
5398		       len, dr->dr_rx_bufsize, cnt);
5399		return;
5400	}
5401
5402	switch (mac->mac_fw.fw_hdr_format) {
5403	case BWN_FW_HDR_351:
5404	case BWN_FW_HDR_410:
5405		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5406		break;
5407	case BWN_FW_HDR_598:
5408		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5409		break;
5410	}
5411
5412	if (macstat & BWN_RX_MAC_FCSERR) {
5413		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5414			device_printf(sc->sc_dev, "RX drop\n");
5415			return;
5416		}
5417	}
5418
5419	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5420	m_adj(m, dr->dr_frameoffset);
5421
5422	bwn_rxeof(dr->dr_mac, m, rxhdr);
5423}
5424
5425static void
5426bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5427{
5428	struct bwn_softc *sc = mac->mac_sc;
5429	struct bwn_stats *stats = &mac->mac_stats;
5430
5431	BWN_ASSERT_LOCKED(mac->mac_sc);
5432
5433	if (status->im)
5434		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5435	if (status->ampdu)
5436		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5437	if (status->rtscnt) {
5438		if (status->rtscnt == 0xf)
5439			stats->rtsfail++;
5440		else
5441			stats->rts++;
5442	}
5443
5444	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5445		bwn_dma_handle_txeof(mac, status);
5446	} else {
5447		bwn_pio_handle_txeof(mac, status);
5448	}
5449
5450	bwn_phy_txpower_check(mac, 0);
5451}
5452
5453static uint8_t
5454bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5455{
5456	struct bwn_mac *mac = prq->prq_mac;
5457	struct bwn_softc *sc = mac->mac_sc;
5458	struct bwn_rxhdr4 rxhdr;
5459	struct mbuf *m;
5460	uint32_t ctl32, macstat, v32;
5461	unsigned int i, padding;
5462	uint16_t ctl16, len, totlen, v16;
5463	unsigned char *mp;
5464	char *data;
5465
5466	memset(&rxhdr, 0, sizeof(rxhdr));
5467
5468	if (prq->prq_rev >= 8) {
5469		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5470		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5471			return (0);
5472		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5473		    BWN_PIO8_RXCTL_FRAMEREADY);
5474		for (i = 0; i < 10; i++) {
5475			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5476			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5477				goto ready;
5478			DELAY(10);
5479		}
5480	} else {
5481		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5482		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5483			return (0);
5484		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5485		    BWN_PIO_RXCTL_FRAMEREADY);
5486		for (i = 0; i < 10; i++) {
5487			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5488			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5489				goto ready;
5490			DELAY(10);
5491		}
5492	}
5493	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5494	return (1);
5495ready:
5496	if (prq->prq_rev >= 8)
5497		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5498		    prq->prq_base + BWN_PIO8_RXDATA);
5499	else
5500		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5501		    prq->prq_base + BWN_PIO_RXDATA);
5502	len = le16toh(rxhdr.frame_len);
5503	if (len > 0x700) {
5504		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5505		goto error;
5506	}
5507	if (len == 0) {
5508		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5509		goto error;
5510	}
5511
5512	switch (mac->mac_fw.fw_hdr_format) {
5513	case BWN_FW_HDR_351:
5514	case BWN_FW_HDR_410:
5515		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5516		break;
5517	case BWN_FW_HDR_598:
5518		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5519		break;
5520	}
5521
5522	if (macstat & BWN_RX_MAC_FCSERR) {
5523		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5524			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5525			goto error;
5526		}
5527	}
5528
5529	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5530	totlen = len + padding;
5531	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5532	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5533	if (m == NULL) {
5534		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5535		goto error;
5536	}
5537	mp = mtod(m, unsigned char *);
5538	if (prq->prq_rev >= 8) {
5539		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5540		    prq->prq_base + BWN_PIO8_RXDATA);
5541		if (totlen & 3) {
5542			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5543			data = &(mp[totlen - 1]);
5544			switch (totlen & 3) {
5545			case 3:
5546				*data = (v32 >> 16);
5547				data--;
5548			case 2:
5549				*data = (v32 >> 8);
5550				data--;
5551			case 1:
5552				*data = v32;
5553			}
5554		}
5555	} else {
5556		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5557		    prq->prq_base + BWN_PIO_RXDATA);
5558		if (totlen & 1) {
5559			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5560			mp[totlen - 1] = v16;
5561		}
5562	}
5563
5564	m->m_len = m->m_pkthdr.len = totlen;
5565
5566	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5567
5568	return (1);
5569error:
5570	if (prq->prq_rev >= 8)
5571		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5572		    BWN_PIO8_RXCTL_DATAREADY);
5573	else
5574		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5575	return (1);
5576}
5577
5578static int
5579bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5580    struct bwn_dmadesc_meta *meta, int init)
5581{
5582	struct bwn_mac *mac = dr->dr_mac;
5583	struct bwn_dma *dma = &mac->mac_method.dma;
5584	struct bwn_rxhdr4 *hdr;
5585	bus_dmamap_t map;
5586	bus_addr_t paddr;
5587	struct mbuf *m;
5588	int error;
5589
5590	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5591	if (m == NULL) {
5592		error = ENOBUFS;
5593
5594		/*
5595		 * If the NIC is up and running, we need to:
5596		 * - Clear RX buffer's header.
5597		 * - Restore RX descriptor settings.
5598		 */
5599		if (init)
5600			return (error);
5601		else
5602			goto back;
5603	}
5604	m->m_len = m->m_pkthdr.len = MCLBYTES;
5605
5606	bwn_dma_set_redzone(dr, m);
5607
5608	/*
5609	 * Try to load RX buf into temporary DMA map
5610	 */
5611	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5612	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5613	if (error) {
5614		m_freem(m);
5615
5616		/*
5617		 * See the comment above
5618		 */
5619		if (init)
5620			return (error);
5621		else
5622			goto back;
5623	}
5624
5625	if (!init)
5626		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5627	meta->mt_m = m;
5628	meta->mt_paddr = paddr;
5629
5630	/*
5631	 * Swap RX buf's DMA map with the loaded temporary one
5632	 */
5633	map = meta->mt_dmap;
5634	meta->mt_dmap = dr->dr_spare_dmap;
5635	dr->dr_spare_dmap = map;
5636
5637back:
5638	/*
5639	 * Clear RX buf header
5640	 */
5641	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5642	bzero(hdr, sizeof(*hdr));
5643	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5644	    BUS_DMASYNC_PREWRITE);
5645
5646	/*
5647	 * Setup RX buf descriptor
5648	 */
5649	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5650	    sizeof(*hdr), 0, 0, 0);
5651	return (error);
5652}
5653
5654static void
5655bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5656		 bus_size_t mapsz __unused, int error)
5657{
5658
5659	if (!error) {
5660		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5661		*((bus_addr_t *)arg) = seg->ds_addr;
5662	}
5663}
5664
5665static int
5666bwn_hwrate2ieeerate(int rate)
5667{
5668
5669	switch (rate) {
5670	case BWN_CCK_RATE_1MB:
5671		return (2);
5672	case BWN_CCK_RATE_2MB:
5673		return (4);
5674	case BWN_CCK_RATE_5MB:
5675		return (11);
5676	case BWN_CCK_RATE_11MB:
5677		return (22);
5678	case BWN_OFDM_RATE_6MB:
5679		return (12);
5680	case BWN_OFDM_RATE_9MB:
5681		return (18);
5682	case BWN_OFDM_RATE_12MB:
5683		return (24);
5684	case BWN_OFDM_RATE_18MB:
5685		return (36);
5686	case BWN_OFDM_RATE_24MB:
5687		return (48);
5688	case BWN_OFDM_RATE_36MB:
5689		return (72);
5690	case BWN_OFDM_RATE_48MB:
5691		return (96);
5692	case BWN_OFDM_RATE_54MB:
5693		return (108);
5694	default:
5695		printf("Ooops\n");
5696		return (0);
5697	}
5698}
5699
5700/*
5701 * Post process the RX provided RSSI.
5702 *
5703 * Valid for A, B, G, LP PHYs.
5704 */
5705static int8_t
5706bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5707    int ofdm, int adjust_2053, int adjust_2050)
5708{
5709	struct bwn_phy *phy = &mac->mac_phy;
5710	struct bwn_phy_g *gphy = &phy->phy_g;
5711	int tmp;
5712
5713	switch (phy->rf_ver) {
5714	case 0x2050:
5715		if (ofdm) {
5716			tmp = in_rssi;
5717			if (tmp > 127)
5718				tmp -= 256;
5719			tmp = tmp * 73 / 64;
5720			if (adjust_2050)
5721				tmp += 25;
5722			else
5723				tmp -= 3;
5724		} else {
5725			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5726			    & BWN_BFL_RSSI) {
5727				if (in_rssi > 63)
5728					in_rssi = 63;
5729				tmp = gphy->pg_nrssi_lt[in_rssi];
5730				tmp = (31 - tmp) * -131 / 128 - 57;
5731			} else {
5732				tmp = in_rssi;
5733				tmp = (31 - tmp) * -149 / 128 - 68;
5734			}
5735			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5736				tmp += 25;
5737		}
5738		break;
5739	case 0x2060:
5740		if (in_rssi > 127)
5741			tmp = in_rssi - 256;
5742		else
5743			tmp = in_rssi;
5744		break;
5745	default:
5746		tmp = in_rssi;
5747		tmp = (tmp - 11) * 103 / 64;
5748		if (adjust_2053)
5749			tmp -= 109;
5750		else
5751			tmp -= 83;
5752	}
5753
5754	return (tmp);
5755}
5756
5757static void
5758bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5759{
5760	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5761	struct bwn_plcp6 *plcp;
5762	struct bwn_softc *sc = mac->mac_sc;
5763	struct ieee80211_frame_min *wh;
5764	struct ieee80211_node *ni;
5765	struct ieee80211com *ic = &sc->sc_ic;
5766	uint32_t macstat;
5767	int padding, rate, rssi = 0, noise = 0, type;
5768	uint16_t phytype, phystat0, phystat3, chanstat;
5769	unsigned char *mp = mtod(m, unsigned char *);
5770	static int rx_mac_dec_rpt = 0;
5771
5772	BWN_ASSERT_LOCKED(sc);
5773
5774	phystat0 = le16toh(rxhdr->phy_status0);
5775
5776	/*
5777	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5778	 * used for LP-PHY.
5779	 */
5780	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5781
5782	switch (mac->mac_fw.fw_hdr_format) {
5783	case BWN_FW_HDR_351:
5784	case BWN_FW_HDR_410:
5785		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5786		chanstat = le16toh(rxhdr->ps4.r351.channel);
5787		break;
5788	case BWN_FW_HDR_598:
5789		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5790		chanstat = le16toh(rxhdr->ps4.r598.channel);
5791		break;
5792	}
5793
5794
5795	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5796
5797	if (macstat & BWN_RX_MAC_FCSERR)
5798		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5799	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5800		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5801	if (macstat & BWN_RX_MAC_DECERR)
5802		goto drop;
5803
5804	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5805	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5806		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5807		    m->m_pkthdr.len);
5808		goto drop;
5809	}
5810	plcp = (struct bwn_plcp6 *)(mp + padding);
5811	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5812	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5813		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5814		    m->m_pkthdr.len);
5815		goto drop;
5816	}
5817	wh = mtod(m, struct ieee80211_frame_min *);
5818
5819	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5820		device_printf(sc->sc_dev,
5821		    "RX decryption attempted (old %d keyidx %#x)\n",
5822		    BWN_ISOLDFMT(mac),
5823		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5824
5825	if (phystat0 & BWN_RX_PHYST0_OFDM)
5826		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5827		    phytype == BWN_PHYTYPE_A);
5828	else
5829		rate = bwn_plcp_get_cckrate(mac, plcp);
5830	if (rate == -1) {
5831		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5832			goto drop;
5833	}
5834	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5835
5836	/* rssi/noise */
5837	switch (phytype) {
5838	case BWN_PHYTYPE_A:
5839	case BWN_PHYTYPE_B:
5840	case BWN_PHYTYPE_G:
5841	case BWN_PHYTYPE_LP:
5842		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5843		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5844		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5845		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5846		break;
5847	case BWN_PHYTYPE_N:
5848		/* Broadcom has code for min/avg, but always used max */
5849		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5850			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5851		else
5852			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5853#if 0
5854		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5855		    "%s: power0=%d, power1=%d, power2=%d\n",
5856		    __func__,
5857		    rxhdr->phy.n.power0,
5858		    rxhdr->phy.n.power1,
5859		    rxhdr->ps2.n.power2);
5860#endif
5861		break;
5862	default:
5863		/* XXX TODO: implement rssi for other PHYs */
5864		break;
5865	}
5866
5867	/*
5868	 * RSSI here is absolute, not relative to the noise floor.
5869	 */
5870	noise = mac->mac_stats.link_noise;
5871	rssi = rssi - noise;
5872
5873	/* RX radio tap */
5874	if (ieee80211_radiotap_active(ic))
5875		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5876	m_adj(m, -IEEE80211_CRC_LEN);
5877
5878	BWN_UNLOCK(sc);
5879
5880	ni = ieee80211_find_rxnode(ic, wh);
5881	if (ni != NULL) {
5882		type = ieee80211_input(ni, m, rssi, noise);
5883		ieee80211_free_node(ni);
5884	} else
5885		type = ieee80211_input_all(ic, m, rssi, noise);
5886
5887	BWN_LOCK(sc);
5888	return;
5889drop:
5890	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5891}
5892
5893static void
5894bwn_dma_handle_txeof(struct bwn_mac *mac,
5895    const struct bwn_txstatus *status)
5896{
5897	struct bwn_dma *dma = &mac->mac_method.dma;
5898	struct bwn_dma_ring *dr;
5899	struct bwn_dmadesc_generic *desc;
5900	struct bwn_dmadesc_meta *meta;
5901	struct bwn_softc *sc = mac->mac_sc;
5902	int slot;
5903	int retrycnt = 0;
5904
5905	BWN_ASSERT_LOCKED(sc);
5906
5907	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5908	if (dr == NULL) {
5909		device_printf(sc->sc_dev, "failed to parse cookie\n");
5910		return;
5911	}
5912	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5913
5914	while (1) {
5915		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5916		    ("%s:%d: fail", __func__, __LINE__));
5917		dr->getdesc(dr, slot, &desc, &meta);
5918
5919		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5920			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5921		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5922			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5923
5924		if (meta->mt_islast) {
5925			KASSERT(meta->mt_m != NULL,
5926			    ("%s:%d: fail", __func__, __LINE__));
5927
5928			/*
5929			 * If we don't get an ACK, then we should log the
5930			 * full framecnt.  That may be 0 if it's a PHY
5931			 * failure, so ensure that gets logged as some
5932			 * retry attempt.
5933			 */
5934			if (status->ack) {
5935				retrycnt = status->framecnt - 1;
5936			} else {
5937				retrycnt = status->framecnt;
5938				if (retrycnt == 0)
5939					retrycnt = 1;
5940			}
5941			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5942			    status->ack ?
5943			      IEEE80211_RATECTL_TX_SUCCESS :
5944			      IEEE80211_RATECTL_TX_FAILURE,
5945			    &retrycnt, 0);
5946			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5947			meta->mt_ni = NULL;
5948			meta->mt_m = NULL;
5949		} else
5950			KASSERT(meta->mt_m == NULL,
5951			    ("%s:%d: fail", __func__, __LINE__));
5952
5953		dr->dr_usedslot--;
5954		if (meta->mt_islast)
5955			break;
5956		slot = bwn_dma_nextslot(dr, slot);
5957	}
5958	sc->sc_watchdog_timer = 0;
5959	if (dr->dr_stop) {
5960		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5961		    ("%s:%d: fail", __func__, __LINE__));
5962		dr->dr_stop = 0;
5963	}
5964}
5965
5966static void
5967bwn_pio_handle_txeof(struct bwn_mac *mac,
5968    const struct bwn_txstatus *status)
5969{
5970	struct bwn_pio_txqueue *tq;
5971	struct bwn_pio_txpkt *tp = NULL;
5972	struct bwn_softc *sc = mac->mac_sc;
5973	int retrycnt = 0;
5974
5975	BWN_ASSERT_LOCKED(sc);
5976
5977	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5978	if (tq == NULL)
5979		return;
5980
5981	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5982	tq->tq_free++;
5983
5984	if (tp->tp_ni != NULL) {
5985		/*
5986		 * Do any tx complete callback.  Note this must
5987		 * be done before releasing the node reference.
5988		 */
5989
5990		/*
5991		 * If we don't get an ACK, then we should log the
5992		 * full framecnt.  That may be 0 if it's a PHY
5993		 * failure, so ensure that gets logged as some
5994		 * retry attempt.
5995		 */
5996		if (status->ack) {
5997			retrycnt = status->framecnt - 1;
5998		} else {
5999			retrycnt = status->framecnt;
6000			if (retrycnt == 0)
6001				retrycnt = 1;
6002		}
6003		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6004		    status->ack ?
6005		      IEEE80211_RATECTL_TX_SUCCESS :
6006		      IEEE80211_RATECTL_TX_FAILURE,
6007		    &retrycnt, 0);
6008
6009		if (tp->tp_m->m_flags & M_TXCB)
6010			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6011		ieee80211_free_node(tp->tp_ni);
6012		tp->tp_ni = NULL;
6013	}
6014	m_freem(tp->tp_m);
6015	tp->tp_m = NULL;
6016	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6017
6018	sc->sc_watchdog_timer = 0;
6019}
6020
6021static void
6022bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6023{
6024	struct bwn_softc *sc = mac->mac_sc;
6025	struct bwn_phy *phy = &mac->mac_phy;
6026	struct ieee80211com *ic = &sc->sc_ic;
6027	unsigned long now;
6028	bwn_txpwr_result_t result;
6029
6030	BWN_GETTIME(now);
6031
6032	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6033		return;
6034	phy->nexttime = now + 2 * 1000;
6035
6036	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6037	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6038		return;
6039
6040	if (phy->recalc_txpwr != NULL) {
6041		result = phy->recalc_txpwr(mac,
6042		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6043		if (result == BWN_TXPWR_RES_DONE)
6044			return;
6045		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6046		    ("%s: fail", __func__));
6047		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6048
6049		ieee80211_runtask(ic, &mac->mac_txpower);
6050	}
6051}
6052
6053static uint16_t
6054bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6055{
6056
6057	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6058}
6059
6060static uint32_t
6061bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6062{
6063
6064	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6065}
6066
6067static void
6068bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6069{
6070
6071	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6072}
6073
6074static void
6075bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6076{
6077
6078	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6079}
6080
6081static int
6082bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6083{
6084
6085	switch (rate) {
6086	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6087	case 12:
6088		return (BWN_OFDM_RATE_6MB);
6089	case 18:
6090		return (BWN_OFDM_RATE_9MB);
6091	case 24:
6092		return (BWN_OFDM_RATE_12MB);
6093	case 36:
6094		return (BWN_OFDM_RATE_18MB);
6095	case 48:
6096		return (BWN_OFDM_RATE_24MB);
6097	case 72:
6098		return (BWN_OFDM_RATE_36MB);
6099	case 96:
6100		return (BWN_OFDM_RATE_48MB);
6101	case 108:
6102		return (BWN_OFDM_RATE_54MB);
6103	/* CCK rates (NB: not IEEE std, device-specific) */
6104	case 2:
6105		return (BWN_CCK_RATE_1MB);
6106	case 4:
6107		return (BWN_CCK_RATE_2MB);
6108	case 11:
6109		return (BWN_CCK_RATE_5MB);
6110	case 22:
6111		return (BWN_CCK_RATE_11MB);
6112	}
6113
6114	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6115	return (BWN_CCK_RATE_1MB);
6116}
6117
6118static uint16_t
6119bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6120{
6121	struct bwn_phy *phy = &mac->mac_phy;
6122	uint16_t control = 0;
6123	uint16_t bw;
6124
6125	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6126	bw = BWN_TXH_PHY1_BW_20;
6127
6128	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6129		control = bw;
6130	} else {
6131		control = bw;
6132		/* Figure out coding rate and modulation */
6133		/* XXX TODO: table-ize, for MCS transmit */
6134		/* Note: this is BWN_*_RATE values */
6135		switch (bitrate) {
6136		case BWN_CCK_RATE_1MB:
6137			control |= 0;
6138			break;
6139		case BWN_CCK_RATE_2MB:
6140			control |= 1;
6141			break;
6142		case BWN_CCK_RATE_5MB:
6143			control |= 2;
6144			break;
6145		case BWN_CCK_RATE_11MB:
6146			control |= 3;
6147			break;
6148		case BWN_OFDM_RATE_6MB:
6149			control |= BWN_TXH_PHY1_CRATE_1_2;
6150			control |= BWN_TXH_PHY1_MODUL_BPSK;
6151			break;
6152		case BWN_OFDM_RATE_9MB:
6153			control |= BWN_TXH_PHY1_CRATE_3_4;
6154			control |= BWN_TXH_PHY1_MODUL_BPSK;
6155			break;
6156		case BWN_OFDM_RATE_12MB:
6157			control |= BWN_TXH_PHY1_CRATE_1_2;
6158			control |= BWN_TXH_PHY1_MODUL_QPSK;
6159			break;
6160		case BWN_OFDM_RATE_18MB:
6161			control |= BWN_TXH_PHY1_CRATE_3_4;
6162			control |= BWN_TXH_PHY1_MODUL_QPSK;
6163			break;
6164		case BWN_OFDM_RATE_24MB:
6165			control |= BWN_TXH_PHY1_CRATE_1_2;
6166			control |= BWN_TXH_PHY1_MODUL_QAM16;
6167			break;
6168		case BWN_OFDM_RATE_36MB:
6169			control |= BWN_TXH_PHY1_CRATE_3_4;
6170			control |= BWN_TXH_PHY1_MODUL_QAM16;
6171			break;
6172		case BWN_OFDM_RATE_48MB:
6173			control |= BWN_TXH_PHY1_CRATE_1_2;
6174			control |= BWN_TXH_PHY1_MODUL_QAM64;
6175			break;
6176		case BWN_OFDM_RATE_54MB:
6177			control |= BWN_TXH_PHY1_CRATE_3_4;
6178			control |= BWN_TXH_PHY1_MODUL_QAM64;
6179			break;
6180		default:
6181			break;
6182		}
6183		control |= BWN_TXH_PHY1_MODE_SISO;
6184	}
6185
6186	return control;
6187}
6188
6189static int
6190bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6191    struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6192{
6193	const struct bwn_phy *phy = &mac->mac_phy;
6194	struct bwn_softc *sc = mac->mac_sc;
6195	struct ieee80211_frame *wh;
6196	struct ieee80211_frame *protwh;
6197	struct ieee80211_frame_cts *cts;
6198	struct ieee80211_frame_rts *rts;
6199	const struct ieee80211_txparam *tp;
6200	struct ieee80211vap *vap = ni->ni_vap;
6201	struct ieee80211com *ic = &sc->sc_ic;
6202	struct mbuf *mprot;
6203	unsigned int len;
6204	uint32_t macctl = 0;
6205	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6206	uint16_t phyctl = 0;
6207	uint8_t rate, rate_fb;
6208	int fill_phy_ctl1 = 0;
6209
6210	wh = mtod(m, struct ieee80211_frame *);
6211	memset(txhdr, 0, sizeof(*txhdr));
6212
6213	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6214	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6215	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6216
6217	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6218	    || (phy->type == BWN_PHYTYPE_HT))
6219		fill_phy_ctl1 = 1;
6220
6221	/*
6222	 * Find TX rate
6223	 */
6224	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6225	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6226		rate = rate_fb = tp->mgmtrate;
6227	else if (ismcast)
6228		rate = rate_fb = tp->mcastrate;
6229	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6230		rate = rate_fb = tp->ucastrate;
6231	else {
6232		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6233		rate = ni->ni_txrate;
6234
6235		if (rix > 0)
6236			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6237			    IEEE80211_RATE_VAL;
6238		else
6239			rate_fb = rate;
6240	}
6241
6242	sc->sc_tx_rate = rate;
6243
6244	/* Note: this maps the select ieee80211 rate to hardware rate */
6245	rate = bwn_ieeerate2hwrate(sc, rate);
6246	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6247
6248	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6249	    bwn_plcp_getcck(rate);
6250	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6251	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6252
6253	/* XXX rate/rate_fb is the hardware rate */
6254	if ((rate_fb == rate) ||
6255	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6256	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6257		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6258	else
6259		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6260		    m->m_pkthdr.len, rate, isshort);
6261
6262	/* XXX TX encryption */
6263
6264	switch (mac->mac_fw.fw_hdr_format) {
6265	case BWN_FW_HDR_351:
6266		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6267		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6268		break;
6269	case BWN_FW_HDR_410:
6270		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6271		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6272		break;
6273	case BWN_FW_HDR_598:
6274		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6275		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6276		break;
6277	}
6278
6279	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6280	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6281
6282	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6283	    BWN_TX_EFT_FB_CCK;
6284	txhdr->chan = phy->chan;
6285	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6286	    BWN_TX_PHY_ENC_CCK;
6287	/* XXX preamble? obey net80211 */
6288	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6289	     rate == BWN_CCK_RATE_11MB))
6290		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6291
6292	if (! phy->gmode)
6293		macctl |= BWN_TX_MAC_5GHZ;
6294
6295	/* XXX TX antenna selection */
6296
6297	switch (bwn_antenna_sanitize(mac, 0)) {
6298	case 0:
6299		phyctl |= BWN_TX_PHY_ANT01AUTO;
6300		break;
6301	case 1:
6302		phyctl |= BWN_TX_PHY_ANT0;
6303		break;
6304	case 2:
6305		phyctl |= BWN_TX_PHY_ANT1;
6306		break;
6307	case 3:
6308		phyctl |= BWN_TX_PHY_ANT2;
6309		break;
6310	case 4:
6311		phyctl |= BWN_TX_PHY_ANT3;
6312		break;
6313	default:
6314		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6315	}
6316
6317	if (!ismcast)
6318		macctl |= BWN_TX_MAC_ACK;
6319
6320	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6321	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6322	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6323		macctl |= BWN_TX_MAC_LONGFRAME;
6324
6325	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6326		/* Note: don't fall back to CCK rates for 5G */
6327		if (phy->gmode)
6328			rts_rate = BWN_CCK_RATE_1MB;
6329		else
6330			rts_rate = BWN_OFDM_RATE_6MB;
6331		rts_rate_fb = bwn_get_fbrate(rts_rate);
6332
6333		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6334		protdur = ieee80211_compute_duration(ic->ic_rt,
6335		    m->m_pkthdr.len, rate, isshort) +
6336		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6337
6338		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6339
6340			switch (mac->mac_fw.fw_hdr_format) {
6341			case BWN_FW_HDR_351:
6342				cts = (struct ieee80211_frame_cts *)
6343				    txhdr->body.r351.rts_frame;
6344				break;
6345			case BWN_FW_HDR_410:
6346				cts = (struct ieee80211_frame_cts *)
6347				    txhdr->body.r410.rts_frame;
6348				break;
6349			case BWN_FW_HDR_598:
6350				cts = (struct ieee80211_frame_cts *)
6351				    txhdr->body.r598.rts_frame;
6352				break;
6353			}
6354
6355			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6356			    protdur);
6357			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6358			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6359			    mprot->m_pkthdr.len);
6360			m_freem(mprot);
6361			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6362			len = sizeof(struct ieee80211_frame_cts);
6363		} else {
6364			switch (mac->mac_fw.fw_hdr_format) {
6365			case BWN_FW_HDR_351:
6366				rts = (struct ieee80211_frame_rts *)
6367				    txhdr->body.r351.rts_frame;
6368				break;
6369			case BWN_FW_HDR_410:
6370				rts = (struct ieee80211_frame_rts *)
6371				    txhdr->body.r410.rts_frame;
6372				break;
6373			case BWN_FW_HDR_598:
6374				rts = (struct ieee80211_frame_rts *)
6375				    txhdr->body.r598.rts_frame;
6376				break;
6377			}
6378
6379			/* XXX rate/rate_fb is the hardware rate */
6380			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6381			    isshort);
6382			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6383			    wh->i_addr2, protdur);
6384			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6385			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6386			    mprot->m_pkthdr.len);
6387			m_freem(mprot);
6388			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6389			len = sizeof(struct ieee80211_frame_rts);
6390		}
6391		len += IEEE80211_CRC_LEN;
6392
6393		switch (mac->mac_fw.fw_hdr_format) {
6394		case BWN_FW_HDR_351:
6395			bwn_plcp_genhdr((struct bwn_plcp4 *)
6396			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6397			break;
6398		case BWN_FW_HDR_410:
6399			bwn_plcp_genhdr((struct bwn_plcp4 *)
6400			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6401			break;
6402		case BWN_FW_HDR_598:
6403			bwn_plcp_genhdr((struct bwn_plcp4 *)
6404			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6405			break;
6406		}
6407
6408		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6409		    rts_rate_fb);
6410
6411		switch (mac->mac_fw.fw_hdr_format) {
6412		case BWN_FW_HDR_351:
6413			protwh = (struct ieee80211_frame *)
6414			    &txhdr->body.r351.rts_frame;
6415			break;
6416		case BWN_FW_HDR_410:
6417			protwh = (struct ieee80211_frame *)
6418			    &txhdr->body.r410.rts_frame;
6419			break;
6420		case BWN_FW_HDR_598:
6421			protwh = (struct ieee80211_frame *)
6422			    &txhdr->body.r598.rts_frame;
6423			break;
6424		}
6425
6426		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6427
6428		if (BWN_ISOFDMRATE(rts_rate)) {
6429			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6430			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6431		} else {
6432			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6433			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6434		}
6435		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6436		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6437
6438		if (fill_phy_ctl1) {
6439			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6440			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6441		}
6442	}
6443
6444	if (fill_phy_ctl1) {
6445		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6446		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6447	}
6448
6449	switch (mac->mac_fw.fw_hdr_format) {
6450	case BWN_FW_HDR_351:
6451		txhdr->body.r351.cookie = htole16(cookie);
6452		break;
6453	case BWN_FW_HDR_410:
6454		txhdr->body.r410.cookie = htole16(cookie);
6455		break;
6456	case BWN_FW_HDR_598:
6457		txhdr->body.r598.cookie = htole16(cookie);
6458		break;
6459	}
6460
6461	txhdr->macctl = htole32(macctl);
6462	txhdr->phyctl = htole16(phyctl);
6463
6464	/*
6465	 * TX radio tap
6466	 */
6467	if (ieee80211_radiotap_active_vap(vap)) {
6468		sc->sc_tx_th.wt_flags = 0;
6469		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6470			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6471		if (isshort &&
6472		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6473		     rate == BWN_CCK_RATE_11MB))
6474			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6475		sc->sc_tx_th.wt_rate = rate;
6476
6477		ieee80211_radiotap_tx(vap, m);
6478	}
6479
6480	return (0);
6481}
6482
6483static void
6484bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6485    const uint8_t rate)
6486{
6487	uint32_t d, plen;
6488	uint8_t *raw = plcp->o.raw;
6489
6490	if (BWN_ISOFDMRATE(rate)) {
6491		d = bwn_plcp_getofdm(rate);
6492		KASSERT(!(octets & 0xf000),
6493		    ("%s:%d: fail", __func__, __LINE__));
6494		d |= (octets << 5);
6495		plcp->o.data = htole32(d);
6496	} else {
6497		plen = octets * 16 / rate;
6498		if ((octets * 16 % rate) > 0) {
6499			plen++;
6500			if ((rate == BWN_CCK_RATE_11MB)
6501			    && ((octets * 8 % 11) < 4)) {
6502				raw[1] = 0x84;
6503			} else
6504				raw[1] = 0x04;
6505		} else
6506			raw[1] = 0x04;
6507		plcp->o.data |= htole32(plen << 16);
6508		raw[0] = bwn_plcp_getcck(rate);
6509	}
6510}
6511
6512static uint8_t
6513bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6514{
6515	struct bwn_softc *sc = mac->mac_sc;
6516	uint8_t mask;
6517
6518	if (n == 0)
6519		return (0);
6520	if (mac->mac_phy.gmode)
6521		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6522	else
6523		mask = siba_sprom_get_ant_a(sc->sc_dev);
6524	if (!(mask & (1 << (n - 1))))
6525		return (0);
6526	return (n);
6527}
6528
6529/*
6530 * Return a fallback rate for the given rate.
6531 *
6532 * Note: Don't fall back from OFDM to CCK.
6533 */
6534static uint8_t
6535bwn_get_fbrate(uint8_t bitrate)
6536{
6537	switch (bitrate) {
6538	/* CCK */
6539	case BWN_CCK_RATE_1MB:
6540		return (BWN_CCK_RATE_1MB);
6541	case BWN_CCK_RATE_2MB:
6542		return (BWN_CCK_RATE_1MB);
6543	case BWN_CCK_RATE_5MB:
6544		return (BWN_CCK_RATE_2MB);
6545	case BWN_CCK_RATE_11MB:
6546		return (BWN_CCK_RATE_5MB);
6547
6548	/* OFDM */
6549	case BWN_OFDM_RATE_6MB:
6550		return (BWN_OFDM_RATE_6MB);
6551	case BWN_OFDM_RATE_9MB:
6552		return (BWN_OFDM_RATE_6MB);
6553	case BWN_OFDM_RATE_12MB:
6554		return (BWN_OFDM_RATE_9MB);
6555	case BWN_OFDM_RATE_18MB:
6556		return (BWN_OFDM_RATE_12MB);
6557	case BWN_OFDM_RATE_24MB:
6558		return (BWN_OFDM_RATE_18MB);
6559	case BWN_OFDM_RATE_36MB:
6560		return (BWN_OFDM_RATE_24MB);
6561	case BWN_OFDM_RATE_48MB:
6562		return (BWN_OFDM_RATE_36MB);
6563	case BWN_OFDM_RATE_54MB:
6564		return (BWN_OFDM_RATE_48MB);
6565	}
6566	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6567	return (0);
6568}
6569
6570static uint32_t
6571bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6572    uint32_t ctl, const void *_data, int len)
6573{
6574	struct bwn_softc *sc = mac->mac_sc;
6575	uint32_t value = 0;
6576	const uint8_t *data = _data;
6577
6578	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6579	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6580	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6581
6582	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6583	    tq->tq_base + BWN_PIO8_TXDATA);
6584	if (len & 3) {
6585		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6586		    BWN_PIO8_TXCTL_24_31);
6587		data = &(data[len - 1]);
6588		switch (len & 3) {
6589		case 3:
6590			ctl |= BWN_PIO8_TXCTL_16_23;
6591			value |= (uint32_t)(*data) << 16;
6592			data--;
6593		case 2:
6594			ctl |= BWN_PIO8_TXCTL_8_15;
6595			value |= (uint32_t)(*data) << 8;
6596			data--;
6597		case 1:
6598			value |= (uint32_t)(*data);
6599		}
6600		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6601		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6602	}
6603
6604	return (ctl);
6605}
6606
6607static void
6608bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6609    uint16_t offset, uint32_t value)
6610{
6611
6612	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6613}
6614
6615static uint16_t
6616bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6617    uint16_t ctl, const void *_data, int len)
6618{
6619	struct bwn_softc *sc = mac->mac_sc;
6620	const uint8_t *data = _data;
6621
6622	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6623	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6624
6625	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6626	    tq->tq_base + BWN_PIO_TXDATA);
6627	if (len & 1) {
6628		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6629		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6630		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6631	}
6632
6633	return (ctl);
6634}
6635
6636static uint16_t
6637bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6638    uint16_t ctl, struct mbuf *m0)
6639{
6640	int i, j = 0;
6641	uint16_t data = 0;
6642	const uint8_t *buf;
6643	struct mbuf *m = m0;
6644
6645	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6646	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6647
6648	for (; m != NULL; m = m->m_next) {
6649		buf = mtod(m, const uint8_t *);
6650		for (i = 0; i < m->m_len; i++) {
6651			if (!((j++) % 2))
6652				data |= buf[i];
6653			else {
6654				data |= (buf[i] << 8);
6655				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6656				data = 0;
6657			}
6658		}
6659	}
6660	if (m0->m_pkthdr.len % 2) {
6661		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6662		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6663		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6664	}
6665
6666	return (ctl);
6667}
6668
6669static void
6670bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6671{
6672
6673	/* XXX should exit if 5GHz band .. */
6674	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6675		return;
6676
6677	BWN_WRITE_2(mac, 0x684, 510 + time);
6678	/* Disabled in Linux b43, can adversely effect performance */
6679#if 0
6680	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6681#endif
6682}
6683
6684static struct bwn_dma_ring *
6685bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6686{
6687
6688	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6689		return (mac->mac_method.dma.wme[WME_AC_BE]);
6690
6691	switch (prio) {
6692	case 3:
6693		return (mac->mac_method.dma.wme[WME_AC_VO]);
6694	case 2:
6695		return (mac->mac_method.dma.wme[WME_AC_VI]);
6696	case 0:
6697		return (mac->mac_method.dma.wme[WME_AC_BE]);
6698	case 1:
6699		return (mac->mac_method.dma.wme[WME_AC_BK]);
6700	}
6701	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6702	return (NULL);
6703}
6704
6705static int
6706bwn_dma_getslot(struct bwn_dma_ring *dr)
6707{
6708	int slot;
6709
6710	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6711
6712	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6713	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6714	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6715
6716	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6717	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6718	dr->dr_curslot = slot;
6719	dr->dr_usedslot++;
6720
6721	return (slot);
6722}
6723
6724static struct bwn_pio_txqueue *
6725bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6726    struct bwn_pio_txpkt **pack)
6727{
6728	struct bwn_pio *pio = &mac->mac_method.pio;
6729	struct bwn_pio_txqueue *tq = NULL;
6730	unsigned int index;
6731
6732	switch (cookie & 0xf000) {
6733	case 0x1000:
6734		tq = &pio->wme[WME_AC_BK];
6735		break;
6736	case 0x2000:
6737		tq = &pio->wme[WME_AC_BE];
6738		break;
6739	case 0x3000:
6740		tq = &pio->wme[WME_AC_VI];
6741		break;
6742	case 0x4000:
6743		tq = &pio->wme[WME_AC_VO];
6744		break;
6745	case 0x5000:
6746		tq = &pio->mcast;
6747		break;
6748	}
6749	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6750	if (tq == NULL)
6751		return (NULL);
6752	index = (cookie & 0x0fff);
6753	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6754	if (index >= N(tq->tq_pkts))
6755		return (NULL);
6756	*pack = &tq->tq_pkts[index];
6757	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6758	return (tq);
6759}
6760
6761static void
6762bwn_txpwr(void *arg, int npending)
6763{
6764	struct bwn_mac *mac = arg;
6765	struct bwn_softc *sc = mac->mac_sc;
6766
6767	BWN_LOCK(sc);
6768	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6769	    mac->mac_phy.set_txpwr != NULL)
6770		mac->mac_phy.set_txpwr(mac);
6771	BWN_UNLOCK(sc);
6772}
6773
6774static void
6775bwn_task_15s(struct bwn_mac *mac)
6776{
6777	uint16_t reg;
6778
6779	if (mac->mac_fw.opensource) {
6780		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6781		if (reg) {
6782			bwn_restart(mac, "fw watchdog");
6783			return;
6784		}
6785		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6786	}
6787	if (mac->mac_phy.task_15s)
6788		mac->mac_phy.task_15s(mac);
6789
6790	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6791}
6792
6793static void
6794bwn_task_30s(struct bwn_mac *mac)
6795{
6796
6797	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6798		return;
6799	mac->mac_noise.noi_running = 1;
6800	mac->mac_noise.noi_nsamples = 0;
6801
6802	bwn_noise_gensample(mac);
6803}
6804
6805static void
6806bwn_task_60s(struct bwn_mac *mac)
6807{
6808
6809	if (mac->mac_phy.task_60s)
6810		mac->mac_phy.task_60s(mac);
6811	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6812}
6813
6814static void
6815bwn_tasks(void *arg)
6816{
6817	struct bwn_mac *mac = arg;
6818	struct bwn_softc *sc = mac->mac_sc;
6819
6820	BWN_ASSERT_LOCKED(sc);
6821	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6822		return;
6823
6824	if (mac->mac_task_state % 4 == 0)
6825		bwn_task_60s(mac);
6826	if (mac->mac_task_state % 2 == 0)
6827		bwn_task_30s(mac);
6828	bwn_task_15s(mac);
6829
6830	mac->mac_task_state++;
6831	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6832}
6833
6834static int
6835bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6836{
6837	struct bwn_softc *sc = mac->mac_sc;
6838
6839	KASSERT(a == 0, ("not support APHY\n"));
6840
6841	switch (plcp->o.raw[0] & 0xf) {
6842	case 0xb:
6843		return (BWN_OFDM_RATE_6MB);
6844	case 0xf:
6845		return (BWN_OFDM_RATE_9MB);
6846	case 0xa:
6847		return (BWN_OFDM_RATE_12MB);
6848	case 0xe:
6849		return (BWN_OFDM_RATE_18MB);
6850	case 0x9:
6851		return (BWN_OFDM_RATE_24MB);
6852	case 0xd:
6853		return (BWN_OFDM_RATE_36MB);
6854	case 0x8:
6855		return (BWN_OFDM_RATE_48MB);
6856	case 0xc:
6857		return (BWN_OFDM_RATE_54MB);
6858	}
6859	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6860	    plcp->o.raw[0] & 0xf);
6861	return (-1);
6862}
6863
6864static int
6865bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6866{
6867	struct bwn_softc *sc = mac->mac_sc;
6868
6869	switch (plcp->o.raw[0]) {
6870	case 0x0a:
6871		return (BWN_CCK_RATE_1MB);
6872	case 0x14:
6873		return (BWN_CCK_RATE_2MB);
6874	case 0x37:
6875		return (BWN_CCK_RATE_5MB);
6876	case 0x6e:
6877		return (BWN_CCK_RATE_11MB);
6878	}
6879	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6880	return (-1);
6881}
6882
6883static void
6884bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6885    const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6886    int rssi, int noise)
6887{
6888	struct bwn_softc *sc = mac->mac_sc;
6889	const struct ieee80211_frame_min *wh;
6890	uint64_t tsf;
6891	uint16_t low_mactime_now;
6892	uint16_t mt;
6893
6894	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6895		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6896
6897	wh = mtod(m, const struct ieee80211_frame_min *);
6898	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6899		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6900
6901	bwn_tsf_read(mac, &tsf);
6902	low_mactime_now = tsf;
6903	tsf = tsf & ~0xffffULL;
6904
6905	switch (mac->mac_fw.fw_hdr_format) {
6906	case BWN_FW_HDR_351:
6907	case BWN_FW_HDR_410:
6908		mt = le16toh(rxhdr->ps4.r351.mac_time);
6909		break;
6910	case BWN_FW_HDR_598:
6911		mt = le16toh(rxhdr->ps4.r598.mac_time);
6912		break;
6913	}
6914
6915	tsf += mt;
6916	if (low_mactime_now < mt)
6917		tsf -= 0x10000;
6918
6919	sc->sc_rx_th.wr_tsf = tsf;
6920	sc->sc_rx_th.wr_rate = rate;
6921	sc->sc_rx_th.wr_antsignal = rssi;
6922	sc->sc_rx_th.wr_antnoise = noise;
6923}
6924
6925static void
6926bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6927{
6928	uint32_t low, high;
6929
6930	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6931	    ("%s:%d: fail", __func__, __LINE__));
6932
6933	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6934	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6935	*tsf = high;
6936	*tsf <<= 32;
6937	*tsf |= low;
6938}
6939
6940static int
6941bwn_dma_attach(struct bwn_mac *mac)
6942{
6943	struct bwn_dma *dma = &mac->mac_method.dma;
6944	struct bwn_softc *sc = mac->mac_sc;
6945	bus_addr_t lowaddr = 0;
6946	int error;
6947
6948	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6949		return (0);
6950
6951	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6952
6953	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6954
6955	dma->dmatype = bwn_dma_gettype(mac);
6956	if (dma->dmatype == BWN_DMA_30BIT)
6957		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6958	else if (dma->dmatype == BWN_DMA_32BIT)
6959		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6960	else
6961		lowaddr = BUS_SPACE_MAXADDR;
6962
6963	/*
6964	 * Create top level DMA tag
6965	 */
6966	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6967			       BWN_ALIGN, 0,		/* alignment, bounds */
6968			       lowaddr,			/* lowaddr */
6969			       BUS_SPACE_MAXADDR,	/* highaddr */
6970			       NULL, NULL,		/* filter, filterarg */
6971			       BUS_SPACE_MAXSIZE,	/* maxsize */
6972			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6973			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6974			       0,			/* flags */
6975			       NULL, NULL,		/* lockfunc, lockarg */
6976			       &dma->parent_dtag);
6977	if (error) {
6978		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6979		return (error);
6980	}
6981
6982	/*
6983	 * Create TX/RX mbuf DMA tag
6984	 */
6985	error = bus_dma_tag_create(dma->parent_dtag,
6986				1,
6987				0,
6988				BUS_SPACE_MAXADDR,
6989				BUS_SPACE_MAXADDR,
6990				NULL, NULL,
6991				MCLBYTES,
6992				1,
6993				BUS_SPACE_MAXSIZE_32BIT,
6994				0,
6995				NULL, NULL,
6996				&dma->rxbuf_dtag);
6997	if (error) {
6998		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6999		goto fail0;
7000	}
7001	error = bus_dma_tag_create(dma->parent_dtag,
7002				1,
7003				0,
7004				BUS_SPACE_MAXADDR,
7005				BUS_SPACE_MAXADDR,
7006				NULL, NULL,
7007				MCLBYTES,
7008				1,
7009				BUS_SPACE_MAXSIZE_32BIT,
7010				0,
7011				NULL, NULL,
7012				&dma->txbuf_dtag);
7013	if (error) {
7014		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7015		goto fail1;
7016	}
7017
7018	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7019	if (!dma->wme[WME_AC_BK])
7020		goto fail2;
7021
7022	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7023	if (!dma->wme[WME_AC_BE])
7024		goto fail3;
7025
7026	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7027	if (!dma->wme[WME_AC_VI])
7028		goto fail4;
7029
7030	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7031	if (!dma->wme[WME_AC_VO])
7032		goto fail5;
7033
7034	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7035	if (!dma->mcast)
7036		goto fail6;
7037	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7038	if (!dma->rx)
7039		goto fail7;
7040
7041	return (error);
7042
7043fail7:	bwn_dma_ringfree(&dma->mcast);
7044fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7045fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7046fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7047fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7048fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7049fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7050fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7051	return (error);
7052}
7053
7054static struct bwn_dma_ring *
7055bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7056    uint16_t cookie, int *slot)
7057{
7058	struct bwn_dma *dma = &mac->mac_method.dma;
7059	struct bwn_dma_ring *dr;
7060	struct bwn_softc *sc = mac->mac_sc;
7061
7062	BWN_ASSERT_LOCKED(mac->mac_sc);
7063
7064	switch (cookie & 0xf000) {
7065	case 0x1000:
7066		dr = dma->wme[WME_AC_BK];
7067		break;
7068	case 0x2000:
7069		dr = dma->wme[WME_AC_BE];
7070		break;
7071	case 0x3000:
7072		dr = dma->wme[WME_AC_VI];
7073		break;
7074	case 0x4000:
7075		dr = dma->wme[WME_AC_VO];
7076		break;
7077	case 0x5000:
7078		dr = dma->mcast;
7079		break;
7080	default:
7081		dr = NULL;
7082		KASSERT(0 == 1,
7083		    ("invalid cookie value %d", cookie & 0xf000));
7084	}
7085	*slot = (cookie & 0x0fff);
7086	if (*slot < 0 || *slot >= dr->dr_numslots) {
7087		/*
7088		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7089		 * that it occurs events which have same H/W sequence numbers.
7090		 * When it's occurred just prints a WARNING msgs and ignores.
7091		 */
7092		KASSERT(status->seq == dma->lastseq,
7093		    ("%s:%d: fail", __func__, __LINE__));
7094		device_printf(sc->sc_dev,
7095		    "out of slot ranges (0 < %d < %d)\n", *slot,
7096		    dr->dr_numslots);
7097		return (NULL);
7098	}
7099	dma->lastseq = status->seq;
7100	return (dr);
7101}
7102
7103static void
7104bwn_dma_stop(struct bwn_mac *mac)
7105{
7106	struct bwn_dma *dma;
7107
7108	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7109		return;
7110	dma = &mac->mac_method.dma;
7111
7112	bwn_dma_ringstop(&dma->rx);
7113	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7114	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7115	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7116	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7117	bwn_dma_ringstop(&dma->mcast);
7118}
7119
7120static void
7121bwn_dma_ringstop(struct bwn_dma_ring **dr)
7122{
7123
7124	if (dr == NULL)
7125		return;
7126
7127	bwn_dma_cleanup(*dr);
7128}
7129
7130static void
7131bwn_pio_stop(struct bwn_mac *mac)
7132{
7133	struct bwn_pio *pio;
7134
7135	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7136		return;
7137	pio = &mac->mac_method.pio;
7138
7139	bwn_destroy_queue_tx(&pio->mcast);
7140	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7141	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7142	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7143	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7144}
7145
7146static void
7147bwn_led_attach(struct bwn_mac *mac)
7148{
7149	struct bwn_softc *sc = mac->mac_sc;
7150	const uint8_t *led_act = NULL;
7151	uint16_t val[BWN_LED_MAX];
7152	int i;
7153
7154	sc->sc_led_idle = (2350 * hz) / 1000;
7155	sc->sc_led_blink = 1;
7156
7157	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7158		if (siba_get_pci_subvendor(sc->sc_dev) ==
7159		    bwn_vendor_led_act[i].vid) {
7160			led_act = bwn_vendor_led_act[i].led_act;
7161			break;
7162		}
7163	}
7164	if (led_act == NULL)
7165		led_act = bwn_default_led_act;
7166
7167	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7168	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7169	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7170	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7171
7172	for (i = 0; i < BWN_LED_MAX; ++i) {
7173		struct bwn_led *led = &sc->sc_leds[i];
7174
7175		if (val[i] == 0xff) {
7176			led->led_act = led_act[i];
7177		} else {
7178			if (val[i] & BWN_LED_ACT_LOW)
7179				led->led_flags |= BWN_LED_F_ACTLOW;
7180			led->led_act = val[i] & BWN_LED_ACT_MASK;
7181		}
7182		led->led_mask = (1 << i);
7183
7184		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7185		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7186		    led->led_act == BWN_LED_ACT_BLINK) {
7187			led->led_flags |= BWN_LED_F_BLINK;
7188			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7189				led->led_flags |= BWN_LED_F_POLLABLE;
7190			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7191				led->led_flags |= BWN_LED_F_SLOW;
7192
7193			if (sc->sc_blink_led == NULL) {
7194				sc->sc_blink_led = led;
7195				if (led->led_flags & BWN_LED_F_SLOW)
7196					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7197			}
7198		}
7199
7200		DPRINTF(sc, BWN_DEBUG_LED,
7201		    "%dth led, act %d, lowact %d\n", i,
7202		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7203	}
7204	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7205}
7206
7207static __inline uint16_t
7208bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7209{
7210
7211	if (led->led_flags & BWN_LED_F_ACTLOW)
7212		on = !on;
7213	if (on)
7214		val |= led->led_mask;
7215	else
7216		val &= ~led->led_mask;
7217	return val;
7218}
7219
7220static void
7221bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7222{
7223	struct bwn_softc *sc = mac->mac_sc;
7224	struct ieee80211com *ic = &sc->sc_ic;
7225	uint16_t val;
7226	int i;
7227
7228	if (nstate == IEEE80211_S_INIT) {
7229		callout_stop(&sc->sc_led_blink_ch);
7230		sc->sc_led_blinking = 0;
7231	}
7232
7233	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7234		return;
7235
7236	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7237	for (i = 0; i < BWN_LED_MAX; ++i) {
7238		struct bwn_led *led = &sc->sc_leds[i];
7239		int on;
7240
7241		if (led->led_act == BWN_LED_ACT_UNKN ||
7242		    led->led_act == BWN_LED_ACT_NULL)
7243			continue;
7244
7245		if ((led->led_flags & BWN_LED_F_BLINK) &&
7246		    nstate != IEEE80211_S_INIT)
7247			continue;
7248
7249		switch (led->led_act) {
7250		case BWN_LED_ACT_ON:    /* Always on */
7251			on = 1;
7252			break;
7253		case BWN_LED_ACT_OFF:   /* Always off */
7254		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7255			on = 0;
7256			break;
7257		default:
7258			on = 1;
7259			switch (nstate) {
7260			case IEEE80211_S_INIT:
7261				on = 0;
7262				break;
7263			case IEEE80211_S_RUN:
7264				if (led->led_act == BWN_LED_ACT_11G &&
7265				    ic->ic_curmode != IEEE80211_MODE_11G)
7266					on = 0;
7267				break;
7268			default:
7269				if (led->led_act == BWN_LED_ACT_ASSOC)
7270					on = 0;
7271				break;
7272			}
7273			break;
7274		}
7275
7276		val = bwn_led_onoff(led, val, on);
7277	}
7278	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7279}
7280
7281static void
7282bwn_led_event(struct bwn_mac *mac, int event)
7283{
7284	struct bwn_softc *sc = mac->mac_sc;
7285	struct bwn_led *led = sc->sc_blink_led;
7286	int rate;
7287
7288	if (event == BWN_LED_EVENT_POLL) {
7289		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7290			return;
7291		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7292			return;
7293	}
7294
7295	sc->sc_led_ticks = ticks;
7296	if (sc->sc_led_blinking)
7297		return;
7298
7299	switch (event) {
7300	case BWN_LED_EVENT_RX:
7301		rate = sc->sc_rx_rate;
7302		break;
7303	case BWN_LED_EVENT_TX:
7304		rate = sc->sc_tx_rate;
7305		break;
7306	case BWN_LED_EVENT_POLL:
7307		rate = 0;
7308		break;
7309	default:
7310		panic("unknown LED event %d\n", event);
7311		break;
7312	}
7313	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7314	    bwn_led_duration[rate].off_dur);
7315}
7316
7317static void
7318bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7319{
7320	struct bwn_softc *sc = mac->mac_sc;
7321	struct bwn_led *led = sc->sc_blink_led;
7322	uint16_t val;
7323
7324	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7325	val = bwn_led_onoff(led, val, 1);
7326	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7327
7328	if (led->led_flags & BWN_LED_F_SLOW) {
7329		BWN_LED_SLOWDOWN(on_dur);
7330		BWN_LED_SLOWDOWN(off_dur);
7331	}
7332
7333	sc->sc_led_blinking = 1;
7334	sc->sc_led_blink_offdur = off_dur;
7335
7336	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7337}
7338
7339static void
7340bwn_led_blink_next(void *arg)
7341{
7342	struct bwn_mac *mac = arg;
7343	struct bwn_softc *sc = mac->mac_sc;
7344	uint16_t val;
7345
7346	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7347	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7348	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7349
7350	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7351	    bwn_led_blink_end, mac);
7352}
7353
7354static void
7355bwn_led_blink_end(void *arg)
7356{
7357	struct bwn_mac *mac = arg;
7358	struct bwn_softc *sc = mac->mac_sc;
7359
7360	sc->sc_led_blinking = 0;
7361}
7362
7363static int
7364bwn_suspend(device_t dev)
7365{
7366	struct bwn_softc *sc = device_get_softc(dev);
7367
7368	BWN_LOCK(sc);
7369	bwn_stop(sc);
7370	BWN_UNLOCK(sc);
7371	return (0);
7372}
7373
7374static int
7375bwn_resume(device_t dev)
7376{
7377	struct bwn_softc *sc = device_get_softc(dev);
7378	int error = EDOOFUS;
7379
7380	BWN_LOCK(sc);
7381	if (sc->sc_ic.ic_nrunning > 0)
7382		error = bwn_init(sc);
7383	BWN_UNLOCK(sc);
7384	if (error == 0)
7385		ieee80211_start_all(&sc->sc_ic);
7386	return (0);
7387}
7388
7389static void
7390bwn_rfswitch(void *arg)
7391{
7392	struct bwn_softc *sc = arg;
7393	struct bwn_mac *mac = sc->sc_curmac;
7394	int cur = 0, prev = 0;
7395
7396	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7397	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7398
7399	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7400	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7401		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7402			& BWN_RF_HWENABLED_HI_MASK))
7403			cur = 1;
7404	} else {
7405		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7406		    & BWN_RF_HWENABLED_LO_MASK)
7407			cur = 1;
7408	}
7409
7410	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7411		prev = 1;
7412
7413	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7414	    __func__, cur, prev);
7415
7416	if (cur != prev) {
7417		if (cur)
7418			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7419		else
7420			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7421
7422		device_printf(sc->sc_dev,
7423		    "status of RF switch is changed to %s\n",
7424		    cur ? "ON" : "OFF");
7425		if (cur != mac->mac_phy.rf_on) {
7426			if (cur)
7427				bwn_rf_turnon(mac);
7428			else
7429				bwn_rf_turnoff(mac);
7430		}
7431	}
7432
7433	callout_schedule(&sc->sc_rfswitch_ch, hz);
7434}
7435
7436static void
7437bwn_sysctl_node(struct bwn_softc *sc)
7438{
7439	device_t dev = sc->sc_dev;
7440	struct bwn_mac *mac;
7441	struct bwn_stats *stats;
7442
7443	/* XXX assume that count of MAC is only 1. */
7444
7445	if ((mac = sc->sc_curmac) == NULL)
7446		return;
7447	stats = &mac->mac_stats;
7448
7449	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7450	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7451	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7452	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7453	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7455	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7456	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7457	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7458
7459#ifdef BWN_DEBUG
7460	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7461	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7462	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7463#endif
7464}
7465
7466static device_method_t bwn_methods[] = {
7467	/* Device interface */
7468	DEVMETHOD(device_probe,		bwn_probe),
7469	DEVMETHOD(device_attach,	bwn_attach),
7470	DEVMETHOD(device_detach,	bwn_detach),
7471	DEVMETHOD(device_suspend,	bwn_suspend),
7472	DEVMETHOD(device_resume,	bwn_resume),
7473	DEVMETHOD_END
7474};
7475static driver_t bwn_driver = {
7476	"bwn",
7477	bwn_methods,
7478	sizeof(struct bwn_softc)
7479};
7480static devclass_t bwn_devclass;
7481DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7482MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7483MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7484MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7485MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7486MODULE_VERSION(bwn, 1);
7487