sys/dev/bwn/if_bwn.c

   1 /*-
   2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer,
  10  *    without modification.
  11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  13  *    redistribution must be conditioned upon including a substantially
  14  *    similar Disclaimer requirement for further binary redistribution.
  15  *
  16  * NO WARRANTY
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  27  * THE POSSIBILITY OF SUCH DAMAGES.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 /*
  34  * The Broadcom Wireless LAN controller driver.
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/kernel.h>
  40 #include <sys/malloc.h>
  41 #include <sys/module.h>
  42 #include <sys/endian.h>
  43 #include <sys/errno.h>
  44 #include <sys/firmware.h>
  45 #include <sys/lock.h>
  46 #include <sys/mutex.h>
  47 #include <machine/bus.h>
  48 #include <machine/resource.h>
  49 #include <sys/bus.h>
  50 #include <sys/rman.h>
  51 #include <sys/socket.h>
  52 #include <sys/sockio.h>
  53
  54 #include <net/ethernet.h>
  55 #include <net/if.h>
  56 #include <net/if_var.h>
  57 #include <net/if_arp.h>
  58 #include <net/if_dl.h>
  59 #include <net/if_llc.h>
  60 #include <net/if_media.h>
  61 #include <net/if_types.h>
  62
  63 #include <dev/pci/pcivar.h>
  64 #include <dev/pci/pcireg.h>
  65 #include <dev/siba/siba_ids.h>
  66 #include <dev/siba/sibareg.h>
  67 #include <dev/siba/sibavar.h>
  68
  69 #include <net80211/ieee80211_var.h>
  70 #include <net80211/ieee80211_radiotap.h>
  71 #include <net80211/ieee80211_regdomain.h>
  72 #include <net80211/ieee80211_phy.h>
  73 #include <net80211/ieee80211_ratectl.h>
  74
  75 #include <dev/bwn/if_bwnreg.h>
  76 #include <dev/bwn/if_bwnvar.h>
  77
  78 #include <dev/bwn/if_bwn_debug.h>
  79 #include <dev/bwn/if_bwn_misc.h>
  80 #include <dev/bwn/if_bwn_phy_g.h>
  81 #include <dev/bwn/if_bwn_phy_lp.h>
  82
  83 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
  84     "Broadcom driver parameters");
  85
  86 /*
  87  * Tunable & sysctl variables.
  88  */
  89
  90 #ifdef BWN_DEBUG
  91 static  int bwn_debug = 0;
  92 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
  93     "Broadcom debugging printfs");
  94 #endif
  95
  96 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
  97 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
  98     "uses Bad Frames Preemption");
  99 static int      bwn_bluetooth = 1;
 100 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 101     "turns on Bluetooth Coexistence");
 102 static int      bwn_hwpctl = 0;
 103 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 104     "uses H/W power control");
 105 static int      bwn_msi_disable = 0;            /* MSI disabled  */
 106 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
 107 static int      bwn_usedma = 1;
 108 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 109     "uses DMA");
 110 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 111 static int      bwn_wme = 1;
 112 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 113     "uses WME support");
 114
 115 static void     bwn_attach_pre(struct bwn_softc *);
 116 static int      bwn_attach_post(struct bwn_softc *);
 117 static void     bwn_sprom_bugfixes(device_t);
 118 static int      bwn_init(struct bwn_softc *);
 119 static void     bwn_parent(struct ieee80211com *);
 120 static void     bwn_start(struct bwn_softc *);
 121 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 122 static int      bwn_attach_core(struct bwn_mac *);
 123 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 124 static int      bwn_chiptest(struct bwn_mac *);
 125 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 126 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 127                     uint16_t);
 128 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 129                     const struct bwn_channelinfo *, int);
 130 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 131                     const struct ieee80211_bpf_params *);
 132 static void     bwn_updateslot(struct ieee80211com *);
 133 static void     bwn_update_promisc(struct ieee80211com *);
 134 static void     bwn_wme_init(struct bwn_mac *);
 135 static int      bwn_wme_update(struct ieee80211com *);
 136 static void     bwn_wme_clear(struct bwn_softc *);
 137 static void     bwn_wme_load(struct bwn_mac *);
 138 static void     bwn_wme_loadparams(struct bwn_mac *,
 139                     const struct wmeParams *, uint16_t);
 140 static void     bwn_scan_start(struct ieee80211com *);
 141 static void     bwn_scan_end(struct ieee80211com *);
 142 static void     bwn_set_channel(struct ieee80211com *);
 143 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 144                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 145                     const uint8_t [IEEE80211_ADDR_LEN],
 146                     const uint8_t [IEEE80211_ADDR_LEN]);
 147 static void     bwn_vap_delete(struct ieee80211vap *);
 148 static void     bwn_stop(struct bwn_softc *);
 149 static int      bwn_core_init(struct bwn_mac *);
 150 static void     bwn_core_start(struct bwn_mac *);
 151 static void     bwn_core_exit(struct bwn_mac *);
 152 static void     bwn_bt_disable(struct bwn_mac *);
 153 static int      bwn_chip_init(struct bwn_mac *);
 154 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 155 static void     bwn_rate_init(struct bwn_mac *);
 156 static void     bwn_set_phytxctl(struct bwn_mac *);
 157 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 158 static void     bwn_bt_enable(struct bwn_mac *);
 159 static void     bwn_set_macaddr(struct bwn_mac *);
 160 static void     bwn_crypt_init(struct bwn_mac *);
 161 static void     bwn_chip_exit(struct bwn_mac *);
 162 static int      bwn_fw_fillinfo(struct bwn_mac *);
 163 static int      bwn_fw_loaducode(struct bwn_mac *);
 164 static int      bwn_gpio_init(struct bwn_mac *);
 165 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 166 static int      bwn_phy_init(struct bwn_mac *);
 167 static void     bwn_set_txantenna(struct bwn_mac *, int);
 168 static void     bwn_set_opmode(struct bwn_mac *);
 169 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 170 static uint8_t  bwn_plcp_getcck(const uint8_t);
 171 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 172 static void     bwn_pio_init(struct bwn_mac *);
 173 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 174 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 175                     int);
 176 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 177                     struct bwn_pio_rxqueue *, int);
 178 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 179 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 180                     uint16_t);
 181 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 182 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 183 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 184 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 185                     const struct bwn_txstatus *);
 186 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 187 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 188 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 189                     uint16_t);
 190 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 191                     uint32_t);
 192 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 193                     struct mbuf *);
 194 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 195 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 196                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 197 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 198                     uint16_t, uint32_t);
 199 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 200                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 201 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 202                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 203 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 204                     uint16_t, struct bwn_pio_txpkt **);
 205 static void     bwn_dma_init(struct bwn_mac *);
 206 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 207 static int      bwn_dma_mask2type(uint64_t);
 208 static uint64_t bwn_dma_mask(struct bwn_mac *);
 209 static uint16_t bwn_dma_base(int, int);
 210 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 211 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 212                     int, struct bwn_dmadesc_generic **,
 213                     struct bwn_dmadesc_meta **);
 214 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 215                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 216                     int, int);
 217 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 218 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 219 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 220 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 221 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 222 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 223                     int, struct bwn_dmadesc_generic **,
 224                     struct bwn_dmadesc_meta **);
 225 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 226                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 227                     int, int);
 228 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 229 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 230 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 231 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 232 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 233 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 234 static void     bwn_dma_setup(struct bwn_dma_ring *);
 235 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 236 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 237 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 238 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 239 static void     bwn_dma_rx(struct bwn_dma_ring *);
 240 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 241 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 242                     struct bwn_dmadesc_meta *);
 243 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 244 static int      bwn_dma_gettype(struct bwn_mac *);
 245 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 246 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 247 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 248 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 249 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 250                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 251                     int);
 252 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 253                     bus_size_t, int);
 254 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 255 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 256                     const struct bwn_txstatus *);
 257 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 258                     struct mbuf *);
 259 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 260 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 261                     uint8_t);
 262 static int      bwn_dma_attach(struct bwn_mac *);
 263 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 264                     int, int, int);
 265 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 266                     const struct bwn_txstatus *, uint16_t, int *);
 267 static void     bwn_dma_free(struct bwn_mac *);
 268 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 269 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 270                     const char *, struct bwn_fwfile *);
 271 static void     bwn_release_firmware(struct bwn_mac *);
 272 static void     bwn_do_release_fw(struct bwn_fwfile *);
 273 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 274 static int      bwn_fwinitvals_write(struct bwn_mac *,
 275                     const struct bwn_fwinitvals *, size_t, size_t);
 276 static uint16_t bwn_ant2phy(int);
 277 static void     bwn_mac_write_bssid(struct bwn_mac *);
 278 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 279                     const uint8_t *);
 280 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 281                     const uint8_t *, size_t, const uint8_t *);
 282 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 283                     const uint8_t *);
 284 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 285                     const uint8_t *);
 286 static void     bwn_phy_exit(struct bwn_mac *);
 287 static void     bwn_core_stop(struct bwn_mac *);
 288 static int      bwn_switch_band(struct bwn_softc *,
 289                     struct ieee80211_channel *);
 290 static void     bwn_phy_reset(struct bwn_mac *);
 291 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 292 static void     bwn_set_pretbtt(struct bwn_mac *);
 293 static int      bwn_intr(void *);
 294 static void     bwn_intrtask(void *, int);
 295 static void     bwn_restart(struct bwn_mac *, const char *);
 296 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 297 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 298 static void     bwn_intr_atim_end(struct bwn_mac *);
 299 static void     bwn_intr_beacon(struct bwn_mac *);
 300 static void     bwn_intr_pmq(struct bwn_mac *);
 301 static void     bwn_intr_noise(struct bwn_mac *);
 302 static void     bwn_intr_txeof(struct bwn_mac *);
 303 static void     bwn_hwreset(void *, int);
 304 static void     bwn_handle_fwpanic(struct bwn_mac *);
 305 static void     bwn_load_beacon0(struct bwn_mac *);
 306 static void     bwn_load_beacon1(struct bwn_mac *);
 307 static uint32_t bwn_jssi_read(struct bwn_mac *);
 308 static void     bwn_noise_gensample(struct bwn_mac *);
 309 static void     bwn_handle_txeof(struct bwn_mac *,
 310                     const struct bwn_txstatus *);
 311 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 312 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 313 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 314                     struct mbuf *);
 315 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 316 static int      bwn_set_txhdr(struct bwn_mac *,
 317                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 318                     uint16_t);
 319 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 320                     const uint8_t);
 321 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 322 static uint8_t  bwn_get_fbrate(uint8_t);
 323 static void     bwn_txpwr(void *, int);
 324 static void     bwn_tasks(void *);
 325 static void     bwn_task_15s(struct bwn_mac *);
 326 static void     bwn_task_30s(struct bwn_mac *);
 327 static void     bwn_task_60s(struct bwn_mac *);
 328 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 329                     uint8_t);
 330 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 331 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 332                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 333                     int, int);
 334 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 335 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 336 static void     bwn_watchdog(void *);
 337 static void     bwn_dma_stop(struct bwn_mac *);
 338 static void     bwn_pio_stop(struct bwn_mac *);
 339 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 340 static void     bwn_led_attach(struct bwn_mac *);
 341 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 342 static void     bwn_led_event(struct bwn_mac *, int);
 343 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 344 static void     bwn_led_blink_next(void *);
 345 static void     bwn_led_blink_end(void *);
 346 static void     bwn_rfswitch(void *);
 347 static void     bwn_rf_turnon(struct bwn_mac *);
 348 static void     bwn_rf_turnoff(struct bwn_mac *);
 349 static void     bwn_sysctl_node(struct bwn_softc *);
 350
 351 static struct resource_spec bwn_res_spec_legacy[] = {
 352         { SYS_RES_IRQ,          0,              RF_ACTIVE | RF_SHAREABLE },
 353         { -1,                   0,              0 }
 354 };
 355
 356 static struct resource_spec bwn_res_spec_msi[] = {
 357         { SYS_RES_IRQ,          1,              RF_ACTIVE },
 358         { -1,                   0,              0 }
 359 };
 360
 361 static const struct bwn_channelinfo bwn_chantable_bg = {
 362         .channels = {
 363                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 364                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 365                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 366                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 367                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 368         .nchannels = 14
 369 };
 370
 371 static const struct bwn_channelinfo bwn_chantable_a = {
 372         .channels = {
 373                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 374                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 375                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 376                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 377                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 378                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 379                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 380                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 381                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 382                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 383                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 384                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 385                 { 6080, 216, 30 } },
 386         .nchannels = 37
 387 };
 388
 389 static const struct bwn_channelinfo bwn_chantable_n = {
 390         .channels = {
 391                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 392                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 393                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 394                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 395                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 396                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 397                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 398                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 399                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 400                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 401                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 402                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 403                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 404                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 405                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 406                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 407                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 408                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 409                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 410                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 411                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 412                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 413                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 414                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 415                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 416                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 417                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 418                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 419                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 420                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 421                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 422                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 423                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 424                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 425                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 426                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 427                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 428         .nchannels = 110
 429 };
 430
 431 #define VENDOR_LED_ACT(vendor)                          \
 432 {                                                       \
 433         .vid = PCI_VENDOR_##vendor,                     \
 434         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 435 }
 436
 437 static const struct {
 438         uint16_t        vid;
 439         uint8_t         led_act[BWN_LED_MAX];
 440 } bwn_vendor_led_act[] = {
 441         VENDOR_LED_ACT(COMPAQ),
 442         VENDOR_LED_ACT(ASUSTEK)
 443 };
 444
 445 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 446         { BWN_VENDOR_LED_ACT_DEFAULT };
 447
 448 #undef VENDOR_LED_ACT
 449
 450 static const struct {
 451         int             on_dur;
 452         int             off_dur;
 453 } bwn_led_duration[109] = {
 454         [0]     = { 400, 100 },
 455         [2]     = { 150, 75 },
 456         [4]     = { 90, 45 },
 457         [11]    = { 66, 34 },
 458         [12]    = { 53, 26 },
 459         [18]    = { 42, 21 },
 460         [22]    = { 35, 17 },
 461         [24]    = { 32, 16 },
 462         [36]    = { 21, 10 },
 463         [48]    = { 16, 8 },
 464         [72]    = { 11, 5 },
 465         [96]    = { 9, 4 },
 466         [108]   = { 7, 3 }
 467 };
 468
 469 static const uint16_t bwn_wme_shm_offsets[] = {
 470         [0] = BWN_WME_BESTEFFORT,
 471         [1] = BWN_WME_BACKGROUND,
 472         [2] = BWN_WME_VOICE,
 473         [3] = BWN_WME_VIDEO,
 474 };
 475
 476 static const struct siba_devid bwn_devs[] = {
 477         SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
 478         SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
 479         SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
 480         SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
 481         SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
 482         SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
 483         SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
 484         SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
 485         SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
 486 };
 487
 488 static int
 489 bwn_probe(device_t dev)
 490 {
 491         int i;
 492
 493         for (i = 0; i < nitems(bwn_devs); i++) {
 494                 if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
 495                     siba_get_device(dev) == bwn_devs[i].sd_device &&
 496                     siba_get_revid(dev) == bwn_devs[i].sd_rev)
 497                         return (BUS_PROBE_DEFAULT);
 498         }
 499
 500         return (ENXIO);
 501 }
 502
 503 static int
 504 bwn_attach(device_t dev)
 505 {
 506         struct bwn_mac *mac;
 507         struct bwn_softc *sc = device_get_softc(dev);
 508         int error, i, msic, reg;
 509
 510         sc->sc_dev = dev;
 511 #ifdef BWN_DEBUG
 512         sc->sc_debug = bwn_debug;
 513 #endif
 514
 515         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 516                 bwn_attach_pre(sc);
 517                 bwn_sprom_bugfixes(dev);
 518                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 519         }
 520
 521         if (!TAILQ_EMPTY(&sc->sc_maclist)) {
 522                 if (siba_get_pci_device(dev) != 0x4313 &&
 523                     siba_get_pci_device(dev) != 0x431a &&
 524                     siba_get_pci_device(dev) != 0x4321) {
 525                         device_printf(sc->sc_dev,
 526                             "skip 802.11 cores\n");
 527                         return (ENODEV);
 528                 }
 529         }
 530
 531         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 532         mac->mac_sc = sc;
 533         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 534         if (bwn_bfp != 0)
 535                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 536
 537         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 538         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 539         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 540
 541         error = bwn_attach_core(mac);
 542         if (error)
 543                 goto fail0;
 544         bwn_led_attach(mac);
 545
 546         device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
 547             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 548             siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
 549             mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
 550             mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
 551             mac->mac_phy.rf_rev);
 552         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 553                 device_printf(sc->sc_dev, "DMA (%d bits)\n",
 554                     mac->mac_method.dma.dmatype);
 555         else
 556                 device_printf(sc->sc_dev, "PIO\n");
 557
 558         /*
 559          * setup PCI resources and interrupt.
 560          */
 561         if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
 562                 msic = pci_msi_count(dev);
 563                 if (bootverbose)
 564                         device_printf(sc->sc_dev, "MSI count : %d\n", msic);
 565         } else
 566                 msic = 0;
 567
 568         mac->mac_intr_spec = bwn_res_spec_legacy;
 569         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
 570                 if (pci_alloc_msi(dev, &msic) == 0) {
 571                         device_printf(sc->sc_dev,
 572                             "Using %d MSI messages\n", msic);
 573                         mac->mac_intr_spec = bwn_res_spec_msi;
 574                         mac->mac_msi = 1;
 575                 }
 576         }
 577
 578         error = bus_alloc_resources(dev, mac->mac_intr_spec,
 579             mac->mac_res_irq);
 580         if (error) {
 581                 device_printf(sc->sc_dev,
 582                     "couldn't allocate IRQ resources (%d)\n", error);
 583                 goto fail1;
 584         }
 585
 586         if (mac->mac_msi == 0)
 587                 error = bus_setup_intr(dev, mac->mac_res_irq[0],
 588                     INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 589                     &mac->mac_intrhand[0]);
 590         else {
 591                 for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 592                         error = bus_setup_intr(dev, mac->mac_res_irq[i],
 593                             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 594                             &mac->mac_intrhand[i]);
 595                         if (error != 0) {
 596                                 device_printf(sc->sc_dev,
 597                                     "couldn't setup interrupt (%d)\n", error);
 598                                 break;
 599                         }
 600                 }
 601         }
 602
 603         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 604
 605         /*
 606          * calls attach-post routine
 607          */
 608         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 609                 bwn_attach_post(sc);
 610
 611         return (0);
 612 fail1:
 613         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
 614                 pci_release_msi(dev);
 615 fail0:
 616         free(mac, M_DEVBUF);
 617         return (error);
 618 }
 619
 620 static int
 621 bwn_is_valid_ether_addr(uint8_t *addr)
 622 {
 623         char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
 624
 625         if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
 626                 return (FALSE);
 627
 628         return (TRUE);
 629 }
 630
 631 static int
 632 bwn_attach_post(struct bwn_softc *sc)
 633 {
 634         struct ieee80211com *ic = &sc->sc_ic;
 635
 636         ic->ic_softc = sc;
 637         ic->ic_name = device_get_nameunit(sc->sc_dev);
 638         /* XXX not right but it's not used anywhere important */
 639         ic->ic_phytype = IEEE80211_T_OFDM;
 640         ic->ic_opmode = IEEE80211_M_STA;
 641         ic->ic_caps =
 642                   IEEE80211_C_STA               /* station mode supported */
 643                 | IEEE80211_C_MONITOR           /* monitor mode */
 644                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 645                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 646                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 647                 | IEEE80211_C_WME               /* WME/WMM supported */
 648                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 649                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 650                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 651                 ;
 652
 653         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 654
 655         IEEE80211_ADDR_COPY(ic->ic_macaddr,
 656             bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
 657             siba_sprom_get_mac_80211a(sc->sc_dev) :
 658             siba_sprom_get_mac_80211bg(sc->sc_dev));
 659
 660         /* call MI attach routine. */
 661         ieee80211_ifattach(ic);
 662
 663         ic->ic_headroom = sizeof(struct bwn_txhdr);
 664
 665         /* override default methods */
 666         ic->ic_raw_xmit = bwn_raw_xmit;
 667         ic->ic_updateslot = bwn_updateslot;
 668         ic->ic_update_promisc = bwn_update_promisc;
 669         ic->ic_wme.wme_update = bwn_wme_update;
 670         ic->ic_scan_start = bwn_scan_start;
 671         ic->ic_scan_end = bwn_scan_end;
 672         ic->ic_set_channel = bwn_set_channel;
 673         ic->ic_vap_create = bwn_vap_create;
 674         ic->ic_vap_delete = bwn_vap_delete;
 675         ic->ic_transmit = bwn_transmit;
 676         ic->ic_parent = bwn_parent;
 677
 678         ieee80211_radiotap_attach(ic,
 679             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 680             BWN_TX_RADIOTAP_PRESENT,
 681             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 682             BWN_RX_RADIOTAP_PRESENT);
 683
 684         bwn_sysctl_node(sc);
 685
 686         if (bootverbose)
 687                 ieee80211_announce(ic);
 688         return (0);
 689 }
 690
 691 static void
 692 bwn_phy_detach(struct bwn_mac *mac)
 693 {
 694
 695         if (mac->mac_phy.detach != NULL)
 696                 mac->mac_phy.detach(mac);
 697 }
 698
 699 static int
 700 bwn_detach(device_t dev)
 701 {
 702         struct bwn_softc *sc = device_get_softc(dev);
 703         struct bwn_mac *mac = sc->sc_curmac;
 704         struct ieee80211com *ic = &sc->sc_ic;
 705         int i;
 706
 707         sc->sc_flags |= BWN_FLAG_INVALID;
 708
 709         if (device_is_attached(sc->sc_dev)) {
 710                 BWN_LOCK(sc);
 711                 bwn_stop(sc);
 712                 BWN_UNLOCK(sc);
 713                 bwn_dma_free(mac);
 714                 callout_drain(&sc->sc_led_blink_ch);
 715                 callout_drain(&sc->sc_rfswitch_ch);
 716                 callout_drain(&sc->sc_task_ch);
 717                 callout_drain(&sc->sc_watchdog_ch);
 718                 bwn_phy_detach(mac);
 719                 ieee80211_draintask(ic, &mac->mac_hwreset);
 720                 ieee80211_draintask(ic, &mac->mac_txpower);
 721                 ieee80211_ifdetach(ic);
 722         }
 723         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 724         taskqueue_free(sc->sc_tq);
 725
 726         for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 727                 if (mac->mac_intrhand[i] != NULL) {
 728                         bus_teardown_intr(dev, mac->mac_res_irq[i],
 729                             mac->mac_intrhand[i]);
 730                         mac->mac_intrhand[i] = NULL;
 731                 }
 732         }
 733         bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
 734         if (mac->mac_msi != 0)
 735                 pci_release_msi(dev);
 736         mbufq_drain(&sc->sc_snd);
 737         BWN_LOCK_DESTROY(sc);
 738         return (0);
 739 }
 740
 741 static void
 742 bwn_attach_pre(struct bwn_softc *sc)
 743 {
 744
 745         BWN_LOCK_INIT(sc);
 746         TAILQ_INIT(&sc->sc_maclist);
 747         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 748         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 749         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 750         mbufq_init(&sc->sc_snd, ifqmaxlen);
 751         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 752                 taskqueue_thread_enqueue, &sc->sc_tq);
 753         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 754                 "%s taskq", device_get_nameunit(sc->sc_dev));
 755 }
 756
 757 static void
 758 bwn_sprom_bugfixes(device_t dev)
 759 {
 760 #define BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)             \
 761         ((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&          \
 762          (siba_get_pci_device(dev) == _device) &&                       \
 763          (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&    \
 764          (siba_get_pci_subdevice(dev) == _subdevice))
 765
 766         if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
 767             siba_get_pci_subdevice(dev) == 0x4e &&
 768             siba_get_pci_revid(dev) > 0x40)
 769                 siba_sprom_set_bf_lo(dev,
 770                     siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
 771         if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
 772             siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
 773                 siba_sprom_set_bf_lo(dev,
 774                     siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
 775         if (siba_get_type(dev) == SIBA_TYPE_PCI) {
 776                 if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
 777                     BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
 778                     BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
 779                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
 780                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
 781                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
 782                     BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
 783                         siba_sprom_set_bf_lo(dev,
 784                             siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
 785         }
 786 #undef  BWN_ISDEV
 787 }
 788
 789 static void
 790 bwn_parent(struct ieee80211com *ic)
 791 {
 792         struct bwn_softc *sc = ic->ic_softc;
 793         int startall = 0;
 794
 795         BWN_LOCK(sc);
 796         if (ic->ic_nrunning > 0) {
 797                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 798                         bwn_init(sc);
 799                         startall = 1;
 800                 } else
 801                         bwn_update_promisc(ic);
 802         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 803                 bwn_stop(sc);
 804         BWN_UNLOCK(sc);
 805
 806         if (startall)
 807                 ieee80211_start_all(ic);
 808 }
 809
 810 static int
 811 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 812 {
 813         struct bwn_softc *sc = ic->ic_softc;
 814         int error;
 815
 816         BWN_LOCK(sc);
 817         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 818                 BWN_UNLOCK(sc);
 819                 return (ENXIO);
 820         }
 821         error = mbufq_enqueue(&sc->sc_snd, m);
 822         if (error) {
 823                 BWN_UNLOCK(sc);
 824                 return (error);
 825         }
 826         bwn_start(sc);
 827         BWN_UNLOCK(sc);
 828         return (0);
 829 }
 830
 831 static void
 832 bwn_start(struct bwn_softc *sc)
 833 {
 834         struct bwn_mac *mac = sc->sc_curmac;
 835         struct ieee80211_frame *wh;
 836         struct ieee80211_node *ni;
 837         struct ieee80211_key *k;
 838         struct mbuf *m;
 839
 840         BWN_ASSERT_LOCKED(sc);
 841
 842         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 843             mac->mac_status < BWN_MAC_STATUS_STARTED)
 844                 return;
 845
 846         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 847                 if (bwn_tx_isfull(sc, m))
 848                         break;
 849                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 850                 if (ni == NULL) {
 851                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
 852                         m_freem(m);
 853                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 854                         continue;
 855                 }
 856                 wh = mtod(m, struct ieee80211_frame *);
 857                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 858                         k = ieee80211_crypto_encap(ni, m);
 859                         if (k == NULL) {
 860                                 if_inc_counter(ni->ni_vap->iv_ifp,
 861                                     IFCOUNTER_OERRORS, 1);
 862                                 ieee80211_free_node(ni);
 863                                 m_freem(m);
 864                                 continue;
 865                         }
 866                 }
 867                 wh = NULL;      /* Catch any invalid use */
 868                 if (bwn_tx_start(sc, ni, m) != 0) {
 869                         if (ni != NULL) {
 870                                 if_inc_counter(ni->ni_vap->iv_ifp,
 871                                     IFCOUNTER_OERRORS, 1);
 872                                 ieee80211_free_node(ni);
 873                         }
 874                         continue;
 875                 }
 876                 sc->sc_watchdog_timer = 5;
 877         }
 878 }
 879
 880 static int
 881 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
 882 {
 883         struct bwn_dma_ring *dr;
 884         struct bwn_mac *mac = sc->sc_curmac;
 885         struct bwn_pio_txqueue *tq;
 886         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 887
 888         BWN_ASSERT_LOCKED(sc);
 889
 890         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 891                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
 892                 if (dr->dr_stop == 1 ||
 893                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
 894                         dr->dr_stop = 1;
 895                         goto full;
 896                 }
 897         } else {
 898                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
 899                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
 900                     pktlen > (tq->tq_size - tq->tq_used))
 901                         goto full;
 902         }
 903         return (0);
 904 full:
 905         mbufq_prepend(&sc->sc_snd, m);
 906         return (1);
 907 }
 908
 909 static int
 910 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
 911 {
 912         struct bwn_mac *mac = sc->sc_curmac;
 913         int error;
 914
 915         BWN_ASSERT_LOCKED(sc);
 916
 917         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
 918                 m_freem(m);
 919                 return (ENXIO);
 920         }
 921
 922         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
 923             bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
 924         if (error) {
 925                 m_freem(m);
 926                 return (error);
 927         }
 928         return (0);
 929 }
 930
 931 static int
 932 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
 933 {
 934         struct bwn_pio_txpkt *tp;
 935         struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
 936         struct bwn_softc *sc = mac->mac_sc;
 937         struct bwn_txhdr txhdr;
 938         struct mbuf *m_new;
 939         uint32_t ctl32;
 940         int error;
 941         uint16_t ctl16;
 942
 943         BWN_ASSERT_LOCKED(sc);
 944
 945         /* XXX TODO send packets after DTIM */
 946
 947         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
 948         tp = TAILQ_FIRST(&tq->tq_pktlist);
 949         tp->tp_ni = ni;
 950         tp->tp_m = m;
 951
 952         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
 953         if (error) {
 954                 device_printf(sc->sc_dev, "tx fail\n");
 955                 return (error);
 956         }
 957
 958         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
 959         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 960         tq->tq_free--;
 961
 962         if (siba_get_revid(sc->sc_dev) >= 8) {
 963                 /*
 964                  * XXX please removes m_defrag(9)
 965                  */
 966                 m_new = m_defrag(m, M_NOWAIT);
 967                 if (m_new == NULL) {
 968                         device_printf(sc->sc_dev,
 969                             "%s: can't defrag TX buffer\n",
 970                             __func__);
 971                         return (ENOBUFS);
 972                 }
 973                 if (m_new->m_next != NULL)
 974                         device_printf(sc->sc_dev,
 975                             "TODO: fragmented packets for PIO\n");
 976                 tp->tp_m = m_new;
 977
 978                 /* send HEADER */
 979                 ctl32 = bwn_pio_write_multi_4(mac, tq,
 980                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
 981                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
 982                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 983                 /* send BODY */
 984                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
 985                     mtod(m_new, const void *), m_new->m_pkthdr.len);
 986                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
 987                     ctl32 | BWN_PIO8_TXCTL_EOF);
 988         } else {
 989                 ctl16 = bwn_pio_write_multi_2(mac, tq,
 990                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
 991                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
 992                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 993                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
 994                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
 995                     ctl16 | BWN_PIO_TXCTL_EOF);
 996         }
 997
 998         return (0);
 999 }
1000
1001 static struct bwn_pio_txqueue *
1002 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1003 {
1004
1005         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1006                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1007
1008         switch (prio) {
1009         case 0:
1010                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1011         case 1:
1012                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1013         case 2:
1014                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1015         case 3:
1016                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1017         }
1018         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1019         return (NULL);
1020 }
1021
1022 static int
1023 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1024 {
1025 #define BWN_GET_TXHDRCACHE(slot)                                        \
1026         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1027         struct bwn_dma *dma = &mac->mac_method.dma;
1028         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1029         struct bwn_dmadesc_generic *desc;
1030         struct bwn_dmadesc_meta *mt;
1031         struct bwn_softc *sc = mac->mac_sc;
1032         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1033         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1034
1035         BWN_ASSERT_LOCKED(sc);
1036         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1037
1038         /* XXX send after DTIM */
1039
1040         slot = bwn_dma_getslot(dr);
1041         dr->getdesc(dr, slot, &desc, &mt);
1042         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1043             ("%s:%d: fail", __func__, __LINE__));
1044
1045         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1046             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1047             BWN_DMA_COOKIE(dr, slot));
1048         if (error)
1049                 goto fail;
1050         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1051             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1052             &mt->mt_paddr, BUS_DMA_NOWAIT);
1053         if (error) {
1054                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1055                     __func__, error);
1056                 goto fail;
1057         }
1058         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1059             BUS_DMASYNC_PREWRITE);
1060         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1061         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1062             BUS_DMASYNC_PREWRITE);
1063
1064         slot = bwn_dma_getslot(dr);
1065         dr->getdesc(dr, slot, &desc, &mt);
1066         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1067             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1068         mt->mt_m = m;
1069         mt->mt_ni = ni;
1070
1071         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1072             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1073         if (error && error != EFBIG) {
1074                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1075                     __func__, error);
1076                 goto fail;
1077         }
1078         if (error) {    /* error == EFBIG */
1079                 struct mbuf *m_new;
1080
1081                 m_new = m_defrag(m, M_NOWAIT);
1082                 if (m_new == NULL) {
1083                         device_printf(sc->sc_dev,
1084                             "%s: can't defrag TX buffer\n",
1085                             __func__);
1086                         error = ENOBUFS;
1087                         goto fail;
1088                 } else {
1089                         m = m_new;
1090                 }
1091
1092                 mt->mt_m = m;
1093                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1094                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1095                 if (error) {
1096                         device_printf(sc->sc_dev,
1097                             "%s: can't load TX buffer (2) %d\n",
1098                             __func__, error);
1099                         goto fail;
1100                 }
1101         }
1102         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1103         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1104         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1105             BUS_DMASYNC_PREWRITE);
1106
1107         /* XXX send after DTIM */
1108
1109         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1110         return (0);
1111 fail:
1112         dr->dr_curslot = backup[0];
1113         dr->dr_usedslot = backup[1];
1114         return (error);
1115 #undef BWN_GET_TXHDRCACHE
1116 }
1117
1118 static void
1119 bwn_watchdog(void *arg)
1120 {
1121         struct bwn_softc *sc = arg;
1122
1123         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1124                 device_printf(sc->sc_dev, "device timeout\n");
1125                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1126         }
1127         callout_schedule(&sc->sc_watchdog_ch, hz);
1128 }
1129
1130 static int
1131 bwn_attach_core(struct bwn_mac *mac)
1132 {
1133         struct bwn_softc *sc = mac->mac_sc;
1134         int error, have_bg = 0, have_a = 0;
1135         uint32_t high;
1136
1137         KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1138             ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1139
1140         siba_powerup(sc->sc_dev, 0);
1141
1142         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1143         bwn_reset_core(mac,
1144             (high & BWN_TGSHIGH_HAVE_2GHZ) ? BWN_TGSLOW_SUPPORT_G : 0);
1145         error = bwn_phy_getinfo(mac, high);
1146         if (error)
1147                 goto fail;
1148
1149         have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1150         have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1151         if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1152             siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1153             siba_get_pci_device(sc->sc_dev) != 0x4324) {
1154                 have_a = have_bg = 0;
1155                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1156                         have_a = 1;
1157                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1158                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1159                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1160                         have_bg = 1;
1161                 else
1162                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1163                             mac->mac_phy.type));
1164         }
1165         /* XXX turns off PHY A because it's not supported */
1166         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1167             mac->mac_phy.type != BWN_PHYTYPE_N) {
1168                 have_a = 0;
1169                 have_bg = 1;
1170         }
1171
1172         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1173                 mac->mac_phy.attach = bwn_phy_g_attach;
1174                 mac->mac_phy.detach = bwn_phy_g_detach;
1175                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1176                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1177                 mac->mac_phy.init = bwn_phy_g_init;
1178                 mac->mac_phy.exit = bwn_phy_g_exit;
1179                 mac->mac_phy.phy_read = bwn_phy_g_read;
1180                 mac->mac_phy.phy_write = bwn_phy_g_write;
1181                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1182                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1183                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1184                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1185                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1186                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1187                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1188                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1189                 mac->mac_phy.set_im = bwn_phy_g_im;
1190                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1191                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1192                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1193                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1194         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1195                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1196                 mac->mac_phy.init = bwn_phy_lp_init;
1197                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1198                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1199                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1200                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1201                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1202                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1203                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1204                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1205                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1206                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1207                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1208         } else {
1209                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1210                     mac->mac_phy.type);
1211                 error = ENXIO;
1212                 goto fail;
1213         }
1214
1215         mac->mac_phy.gmode = have_bg;
1216         if (mac->mac_phy.attach != NULL) {
1217                 error = mac->mac_phy.attach(mac);
1218                 if (error) {
1219                         device_printf(sc->sc_dev, "failed\n");
1220                         goto fail;
1221                 }
1222         }
1223
1224         bwn_reset_core(mac, have_bg ? BWN_TGSLOW_SUPPORT_G : 0);
1225
1226         error = bwn_chiptest(mac);
1227         if (error)
1228                 goto fail;
1229         error = bwn_setup_channels(mac, have_bg, have_a);
1230         if (error) {
1231                 device_printf(sc->sc_dev, "failed to setup channels\n");
1232                 goto fail;
1233         }
1234
1235         if (sc->sc_curmac == NULL)
1236                 sc->sc_curmac = mac;
1237
1238         error = bwn_dma_attach(mac);
1239         if (error != 0) {
1240                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1241                 goto fail;
1242         }
1243
1244         mac->mac_phy.switch_analog(mac, 0);
1245
1246         siba_dev_down(sc->sc_dev, 0);
1247 fail:
1248         siba_powerdown(sc->sc_dev);
1249         return (error);
1250 }
1251
1252 void
1253 bwn_reset_core(struct bwn_mac *mac, uint32_t flags)
1254 {
1255         struct bwn_softc *sc = mac->mac_sc;
1256         uint32_t low, ctl;
1257
1258         flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1259
1260         siba_dev_up(sc->sc_dev, flags);
1261         DELAY(2000);
1262
1263         low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1264             ~BWN_TGSLOW_PHYRESET;
1265         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1266         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1267         DELAY(1000);
1268         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1269         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1270         DELAY(1000);
1271
1272         if (mac->mac_phy.switch_analog != NULL)
1273                 mac->mac_phy.switch_analog(mac, 1);
1274
1275         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1276         if (flags & BWN_TGSLOW_SUPPORT_G)
1277                 ctl |= BWN_MACCTL_GMODE;
1278         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1279 }
1280
1281 static int
1282 bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1283 {
1284         struct bwn_phy *phy = &mac->mac_phy;
1285         struct bwn_softc *sc = mac->mac_sc;
1286         uint32_t tmp;
1287
1288         /* PHY */
1289         tmp = BWN_READ_2(mac, BWN_PHYVER);
1290         phy->gmode = (tgshigh & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1291         phy->rf_on = 1;
1292         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1293         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1294         phy->rev = (tmp & BWN_PHYVER_VERSION);
1295         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1296             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1297                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1298             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1299             (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1300             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1301                 goto unsupphy;
1302
1303         /* RADIO */
1304         if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1305                 if (siba_get_chiprev(sc->sc_dev) == 0)
1306                         tmp = 0x3205017f;
1307                 else if (siba_get_chiprev(sc->sc_dev) == 1)
1308                         tmp = 0x4205017f;
1309                 else
1310                         tmp = 0x5205017f;
1311         } else {
1312                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1313                 tmp = BWN_READ_2(mac, BWN_RFDATALO);
1314                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1315                 tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1316         }
1317         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1318         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1319         phy->rf_manuf = (tmp & 0x00000fff);
1320         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1321                 goto unsupradio;
1322         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1323              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1324             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1325             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1326             (phy->type == BWN_PHYTYPE_N &&
1327              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1328             (phy->type == BWN_PHYTYPE_LP &&
1329              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1330                 goto unsupradio;
1331
1332         return (0);
1333 unsupphy:
1334         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1335             "analog %#x)\n",
1336             phy->type, phy->rev, phy->analog);
1337         return (ENXIO);
1338 unsupradio:
1339         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1340             "rev %#x)\n",
1341             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1342         return (ENXIO);
1343 }
1344
1345 static int
1346 bwn_chiptest(struct bwn_mac *mac)
1347 {
1348 #define TESTVAL0        0x55aaaa55
1349 #define TESTVAL1        0xaa5555aa
1350         struct bwn_softc *sc = mac->mac_sc;
1351         uint32_t v, backup;
1352
1353         BWN_LOCK(sc);
1354
1355         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1356
1357         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1358         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1359                 goto error;
1360         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1361         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1362                 goto error;
1363
1364         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1365
1366         if ((siba_get_revid(sc->sc_dev) >= 3) &&
1367             (siba_get_revid(sc->sc_dev) <= 10)) {
1368                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1369                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1370                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1371                         goto error;
1372                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1373                         goto error;
1374         }
1375         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1376
1377         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1378         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1379                 goto error;
1380
1381         BWN_UNLOCK(sc);
1382         return (0);
1383 error:
1384         BWN_UNLOCK(sc);
1385         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1386         return (ENODEV);
1387 }
1388
1389 #define IEEE80211_CHAN_HTG      (IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1390 #define IEEE80211_CHAN_HTA      (IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1391
1392 static int
1393 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1394 {
1395         struct bwn_softc *sc = mac->mac_sc;
1396         struct ieee80211com *ic = &sc->sc_ic;
1397
1398         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1399         ic->ic_nchans = 0;
1400
1401         if (have_bg)
1402                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1403                     &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1404         if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1405                 if (have_a)
1406                         bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1407                             &ic->ic_nchans, &bwn_chantable_n,
1408                             IEEE80211_CHAN_HTA);
1409         } else {
1410                 if (have_a)
1411                         bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1412                             &ic->ic_nchans, &bwn_chantable_a,
1413                             IEEE80211_CHAN_A);
1414         }
1415
1416         mac->mac_phy.supports_2ghz = have_bg;
1417         mac->mac_phy.supports_5ghz = have_a;
1418
1419         return (ic->ic_nchans == 0 ? ENXIO : 0);
1420 }
1421
1422 uint32_t
1423 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1424 {
1425         uint32_t ret;
1426
1427         BWN_ASSERT_LOCKED(mac->mac_sc);
1428
1429         if (way == BWN_SHARED) {
1430                 KASSERT((offset & 0x0001) == 0,
1431                     ("%s:%d warn", __func__, __LINE__));
1432                 if (offset & 0x0003) {
1433                         bwn_shm_ctlword(mac, way, offset >> 2);
1434                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1435                         ret <<= 16;
1436                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1437                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1438                         goto out;
1439                 }
1440                 offset >>= 2;
1441         }
1442         bwn_shm_ctlword(mac, way, offset);
1443         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1444 out:
1445         return (ret);
1446 }
1447
1448 uint16_t
1449 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1450 {
1451         uint16_t ret;
1452
1453         BWN_ASSERT_LOCKED(mac->mac_sc);
1454
1455         if (way == BWN_SHARED) {
1456                 KASSERT((offset & 0x0001) == 0,
1457                     ("%s:%d warn", __func__, __LINE__));
1458                 if (offset & 0x0003) {
1459                         bwn_shm_ctlword(mac, way, offset >> 2);
1460                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1461                         goto out;
1462                 }
1463                 offset >>= 2;
1464         }
1465         bwn_shm_ctlword(mac, way, offset);
1466         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1467 out:
1468
1469         return (ret);
1470 }
1471
1472 static void
1473 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1474     uint16_t offset)
1475 {
1476         uint32_t control;
1477
1478         control = way;
1479         control <<= 16;
1480         control |= offset;
1481         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1482 }
1483
1484 void
1485 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1486     uint32_t value)
1487 {
1488         BWN_ASSERT_LOCKED(mac->mac_sc);
1489
1490         if (way == BWN_SHARED) {
1491                 KASSERT((offset & 0x0001) == 0,
1492                     ("%s:%d warn", __func__, __LINE__));
1493                 if (offset & 0x0003) {
1494                         bwn_shm_ctlword(mac, way, offset >> 2);
1495                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1496                                     (value >> 16) & 0xffff);
1497                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1498                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1499                         return;
1500                 }
1501                 offset >>= 2;
1502         }
1503         bwn_shm_ctlword(mac, way, offset);
1504         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1505 }
1506
1507 void
1508 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1509     uint16_t value)
1510 {
1511         BWN_ASSERT_LOCKED(mac->mac_sc);
1512
1513         if (way == BWN_SHARED) {
1514                 KASSERT((offset & 0x0001) == 0,
1515                     ("%s:%d warn", __func__, __LINE__));
1516                 if (offset & 0x0003) {
1517                         bwn_shm_ctlword(mac, way, offset >> 2);
1518                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1519                         return;
1520                 }
1521                 offset >>= 2;
1522         }
1523         bwn_shm_ctlword(mac, way, offset);
1524         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1525 }
1526
1527 static void
1528 bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1529     int txpow)
1530 {
1531
1532         c->ic_freq = freq;
1533         c->ic_flags = flags;
1534         c->ic_ieee = ieee;
1535         c->ic_minpower = 0;
1536         c->ic_maxpower = 2 * txpow;
1537         c->ic_maxregpower = txpow;
1538 }
1539
1540 static void
1541 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1542     const struct bwn_channelinfo *ci, int flags)
1543 {
1544         struct ieee80211_channel *c;
1545         int i;
1546
1547         c = &chans[*nchans];
1548
1549         for (i = 0; i < ci->nchannels; i++) {
1550                 const struct bwn_channel *hc;
1551
1552                 hc = &ci->channels[i];
1553                 if (*nchans >= maxchans)
1554                         break;
1555                 bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1556                 c++, (*nchans)++;
1557                 if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1558                         /* g channel have a separate b-only entry */
1559                         if (*nchans >= maxchans)
1560                                 break;
1561                         c[0] = c[-1];
1562                         c[-1].ic_flags = IEEE80211_CHAN_B;
1563                         c++, (*nchans)++;
1564                 }
1565                 if (flags == IEEE80211_CHAN_HTG) {
1566                         /* HT g channel have a separate g-only entry */
1567                         if (*nchans >= maxchans)
1568                                 break;
1569                         c[-1].ic_flags = IEEE80211_CHAN_G;
1570                         c[0] = c[-1];
1571                         c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1572                         c[0].ic_flags |= IEEE80211_CHAN_HT20;   /* HT20 */
1573                         c++, (*nchans)++;
1574                 }
1575                 if (flags == IEEE80211_CHAN_HTA) {
1576                         /* HT a channel have a separate a-only entry */
1577                         if (*nchans >= maxchans)
1578                                 break;
1579                         c[-1].ic_flags = IEEE80211_CHAN_A;
1580                         c[0] = c[-1];
1581                         c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1582                         c[0].ic_flags |= IEEE80211_CHAN_HT20;   /* HT20 */
1583                         c++, (*nchans)++;
1584                 }
1585         }
1586 }
1587
1588 static int
1589 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1590         const struct ieee80211_bpf_params *params)
1591 {
1592         struct ieee80211com *ic = ni->ni_ic;
1593         struct bwn_softc *sc = ic->ic_softc;
1594         struct bwn_mac *mac = sc->sc_curmac;
1595         int error;
1596
1597         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1598             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1599                 m_freem(m);
1600                 return (ENETDOWN);
1601         }
1602
1603         BWN_LOCK(sc);
1604         if (bwn_tx_isfull(sc, m)) {
1605                 m_freem(m);
1606                 BWN_UNLOCK(sc);
1607                 return (ENOBUFS);
1608         }
1609
1610         error = bwn_tx_start(sc, ni, m);
1611         if (error == 0)
1612                 sc->sc_watchdog_timer = 5;
1613         BWN_UNLOCK(sc);
1614         return (error);
1615 }
1616
1617 /*
1618  * Callback from the 802.11 layer to update the slot time
1619  * based on the current setting.  We use it to notify the
1620  * firmware of ERP changes and the f/w takes care of things
1621  * like slot time and preamble.
1622  */
1623 static void
1624 bwn_updateslot(struct ieee80211com *ic)
1625 {
1626         struct bwn_softc *sc = ic->ic_softc;
1627         struct bwn_mac *mac;
1628
1629         BWN_LOCK(sc);
1630         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1631                 mac = (struct bwn_mac *)sc->sc_curmac;
1632                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1633         }
1634         BWN_UNLOCK(sc);
1635 }
1636
1637 /*
1638  * Callback from the 802.11 layer after a promiscuous mode change.
1639  * Note this interface does not check the operating mode as this
1640  * is an internal callback and we are expected to honor the current
1641  * state (e.g. this is used for setting the interface in promiscuous
1642  * mode when operating in hostap mode to do ACS).
1643  */
1644 static void
1645 bwn_update_promisc(struct ieee80211com *ic)
1646 {
1647         struct bwn_softc *sc = ic->ic_softc;
1648         struct bwn_mac *mac = sc->sc_curmac;
1649
1650         BWN_LOCK(sc);
1651         mac = sc->sc_curmac;
1652         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1653                 if (ic->ic_promisc > 0)
1654                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1655                 else
1656                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1657                 bwn_set_opmode(mac);
1658         }
1659         BWN_UNLOCK(sc);
1660 }
1661
1662 /*
1663  * Callback from the 802.11 layer to update WME parameters.
1664  */
1665 static int
1666 bwn_wme_update(struct ieee80211com *ic)
1667 {
1668         struct bwn_softc *sc = ic->ic_softc;
1669         struct bwn_mac *mac = sc->sc_curmac;
1670         struct wmeParams *wmep;
1671         int i;
1672
1673         BWN_LOCK(sc);
1674         mac = sc->sc_curmac;
1675         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1676                 bwn_mac_suspend(mac);
1677                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1678                         wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1679                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1680                 }
1681                 bwn_mac_enable(mac);
1682         }
1683         BWN_UNLOCK(sc);
1684         return (0);
1685 }
1686
1687 static void
1688 bwn_scan_start(struct ieee80211com *ic)
1689 {
1690         struct bwn_softc *sc = ic->ic_softc;
1691         struct bwn_mac *mac;
1692
1693         BWN_LOCK(sc);
1694         mac = sc->sc_curmac;
1695         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1696                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1697                 bwn_set_opmode(mac);
1698                 /* disable CFP update during scan */
1699                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1700         }
1701         BWN_UNLOCK(sc);
1702 }
1703
1704 static void
1705 bwn_scan_end(struct ieee80211com *ic)
1706 {
1707         struct bwn_softc *sc = ic->ic_softc;
1708         struct bwn_mac *mac;
1709
1710         BWN_LOCK(sc);
1711         mac = sc->sc_curmac;
1712         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1713                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1714                 bwn_set_opmode(mac);
1715                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1716         }
1717         BWN_UNLOCK(sc);
1718 }
1719
1720 static void
1721 bwn_set_channel(struct ieee80211com *ic)
1722 {
1723         struct bwn_softc *sc = ic->ic_softc;
1724         struct bwn_mac *mac = sc->sc_curmac;
1725         struct bwn_phy *phy = &mac->mac_phy;
1726         int chan, error;
1727
1728         BWN_LOCK(sc);
1729
1730         error = bwn_switch_band(sc, ic->ic_curchan);
1731         if (error)
1732                 goto fail;
1733         bwn_mac_suspend(mac);
1734         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1735         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1736         if (chan != phy->chan)
1737                 bwn_switch_channel(mac, chan);
1738
1739         /* TX power level */
1740         if (ic->ic_curchan->ic_maxpower != 0 &&
1741             ic->ic_curchan->ic_maxpower != phy->txpower) {
1742                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1743                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1744                     BWN_TXPWR_IGNORE_TSSI);
1745         }
1746
1747         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1748         if (phy->set_antenna)
1749                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1750
1751         if (sc->sc_rf_enabled != phy->rf_on) {
1752                 if (sc->sc_rf_enabled) {
1753                         bwn_rf_turnon(mac);
1754                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1755                                 device_printf(sc->sc_dev,
1756                                     "please turn on the RF switch\n");
1757                 } else
1758                         bwn_rf_turnoff(mac);
1759         }
1760
1761         bwn_mac_enable(mac);
1762
1763 fail:
1764         /*
1765          * Setup radio tap channel freq and flags
1766          */
1767         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1768                 htole16(ic->ic_curchan->ic_freq);
1769         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1770                 htole16(ic->ic_curchan->ic_flags & 0xffff);
1771
1772         BWN_UNLOCK(sc);
1773 }
1774
1775 static struct ieee80211vap *
1776 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1777     enum ieee80211_opmode opmode, int flags,
1778     const uint8_t bssid[IEEE80211_ADDR_LEN],
1779     const uint8_t mac[IEEE80211_ADDR_LEN])
1780 {
1781         struct ieee80211vap *vap;
1782         struct bwn_vap *bvp;
1783
1784         switch (opmode) {
1785         case IEEE80211_M_HOSTAP:
1786         case IEEE80211_M_MBSS:
1787         case IEEE80211_M_STA:
1788         case IEEE80211_M_WDS:
1789         case IEEE80211_M_MONITOR:
1790         case IEEE80211_M_IBSS:
1791         case IEEE80211_M_AHDEMO:
1792                 break;
1793         default:
1794                 return (NULL);
1795         }
1796
1797         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1798         vap = &bvp->bv_vap;
1799         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1800         /* override with driver methods */
1801         bvp->bv_newstate = vap->iv_newstate;
1802         vap->iv_newstate = bwn_newstate;
1803
1804         /* override max aid so sta's cannot assoc when we're out of sta id's */
1805         vap->iv_max_aid = BWN_STAID_MAX;
1806
1807         ieee80211_ratectl_init(vap);
1808
1809         /* complete setup */
1810         ieee80211_vap_attach(vap, ieee80211_media_change,
1811             ieee80211_media_status, mac);
1812         return (vap);
1813 }
1814
1815 static void
1816 bwn_vap_delete(struct ieee80211vap *vap)
1817 {
1818         struct bwn_vap *bvp = BWN_VAP(vap);
1819
1820         ieee80211_ratectl_deinit(vap);
1821         ieee80211_vap_detach(vap);
1822         free(bvp, M_80211_VAP);
1823 }
1824
1825 static int
1826 bwn_init(struct bwn_softc *sc)
1827 {
1828         struct bwn_mac *mac;
1829         int error;
1830
1831         BWN_ASSERT_LOCKED(sc);
1832
1833         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1834         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1835         sc->sc_filters = 0;
1836         bwn_wme_clear(sc);
1837         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1838         sc->sc_rf_enabled = 1;
1839
1840         mac = sc->sc_curmac;
1841         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1842                 error = bwn_core_init(mac);
1843                 if (error != 0)
1844                         return (error);
1845         }
1846         if (mac->mac_status == BWN_MAC_STATUS_INITED)
1847                 bwn_core_start(mac);
1848
1849         bwn_set_opmode(mac);
1850         bwn_set_pretbtt(mac);
1851         bwn_spu_setdelay(mac, 0);
1852         bwn_set_macaddr(mac);
1853
1854         sc->sc_flags |= BWN_FLAG_RUNNING;
1855         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1856         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1857
1858         return (0);
1859 }
1860
1861 static void
1862 bwn_stop(struct bwn_softc *sc)
1863 {
1864         struct bwn_mac *mac = sc->sc_curmac;
1865
1866         BWN_ASSERT_LOCKED(sc);
1867
1868         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1869                 /* XXX FIXME opmode not based on VAP */
1870                 bwn_set_opmode(mac);
1871                 bwn_set_macaddr(mac);
1872         }
1873
1874         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1875                 bwn_core_stop(mac);
1876
1877         callout_stop(&sc->sc_led_blink_ch);
1878         sc->sc_led_blinking = 0;
1879
1880         bwn_core_exit(mac);
1881         sc->sc_rf_enabled = 0;
1882
1883         sc->sc_flags &= ~BWN_FLAG_RUNNING;
1884 }
1885
1886 static void
1887 bwn_wme_clear(struct bwn_softc *sc)
1888 {
1889 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1890         struct wmeParams *p;
1891         unsigned int i;
1892
1893         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1894             ("%s:%d: fail", __func__, __LINE__));
1895
1896         for (i = 0; i < N(sc->sc_wmeParams); i++) {
1897                 p = &(sc->sc_wmeParams[i]);
1898
1899                 switch (bwn_wme_shm_offsets[i]) {
1900                 case BWN_WME_VOICE:
1901                         p->wmep_txopLimit = 0;
1902                         p->wmep_aifsn = 2;
1903                         /* XXX FIXME: log2(cwmin) */
1904                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1905                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1906                         break;
1907                 case BWN_WME_VIDEO:
1908                         p->wmep_txopLimit = 0;
1909                         p->wmep_aifsn = 2;
1910                         /* XXX FIXME: log2(cwmin) */
1911                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1912                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1913                         break;
1914                 case BWN_WME_BESTEFFORT:
1915                         p->wmep_txopLimit = 0;
1916                         p->wmep_aifsn = 3;
1917                         /* XXX FIXME: log2(cwmin) */
1918                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1919                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1920                         break;
1921                 case BWN_WME_BACKGROUND:
1922                         p->wmep_txopLimit = 0;
1923                         p->wmep_aifsn = 7;
1924                         /* XXX FIXME: log2(cwmin) */
1925                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1926                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1927                         break;
1928                 default:
1929                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1930                 }
1931         }
1932 }
1933
1934 static int
1935 bwn_core_init(struct bwn_mac *mac)
1936 {
1937         struct bwn_softc *sc = mac->mac_sc;
1938         uint64_t hf;
1939         int error;
1940
1941         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
1942             ("%s:%d: fail", __func__, __LINE__));
1943
1944         siba_powerup(sc->sc_dev, 0);
1945         if (!siba_dev_isup(sc->sc_dev))
1946                 bwn_reset_core(mac,
1947                     mac->mac_phy.gmode ? BWN_TGSLOW_SUPPORT_G : 0);
1948
1949         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
1950         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
1951         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
1952         BWN_GETTIME(mac->mac_phy.nexttime);
1953         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
1954         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
1955         mac->mac_stats.link_noise = -95;
1956         mac->mac_reason_intr = 0;
1957         bzero(mac->mac_reason, sizeof(mac->mac_reason));
1958         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
1959 #ifdef BWN_DEBUG
1960         if (sc->sc_debug & BWN_DEBUG_XMIT)
1961                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
1962 #endif
1963         mac->mac_suspended = 1;
1964         mac->mac_task_state = 0;
1965         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
1966
1967         mac->mac_phy.init_pre(mac);
1968
1969         siba_pcicore_intr(sc->sc_dev);
1970
1971         siba_fix_imcfglobug(sc->sc_dev);
1972         bwn_bt_disable(mac);
1973         if (mac->mac_phy.prepare_hw) {
1974                 error = mac->mac_phy.prepare_hw(mac);
1975                 if (error)
1976                         goto fail0;
1977         }
1978         error = bwn_chip_init(mac);
1979         if (error)
1980                 goto fail0;
1981         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
1982             siba_get_revid(sc->sc_dev));
1983         hf = bwn_hf_read(mac);
1984         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1985                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
1986                 if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
1987                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
1988                 if (mac->mac_phy.rev == 1)
1989                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
1990         }
1991         if (mac->mac_phy.rf_ver == 0x2050) {
1992                 if (mac->mac_phy.rf_rev < 6)
1993                         hf |= BWN_HF_FORCE_VCO_RECALC;
1994                 if (mac->mac_phy.rf_rev == 6)
1995                         hf |= BWN_HF_4318_TSSI;
1996         }
1997         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
1998                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
1999         if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2000             (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2001                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2002         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2003         bwn_hf_write(mac, hf);
2004
2005         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2006         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2007         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2008         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2009
2010         bwn_rate_init(mac);
2011         bwn_set_phytxctl(mac);
2012
2013         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2014             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2015         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2016
2017         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2018                 bwn_pio_init(mac);
2019         else
2020                 bwn_dma_init(mac);
2021         bwn_wme_init(mac);
2022         bwn_spu_setdelay(mac, 1);
2023         bwn_bt_enable(mac);
2024
2025         siba_powerup(sc->sc_dev,
2026             !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2027         bwn_set_macaddr(mac);
2028         bwn_crypt_init(mac);
2029
2030         /* XXX LED initializatin */
2031
2032         mac->mac_status = BWN_MAC_STATUS_INITED;
2033
2034         return (error);
2035
2036 fail0:
2037         siba_powerdown(sc->sc_dev);
2038         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2039             ("%s:%d: fail", __func__, __LINE__));
2040         return (error);
2041 }
2042
2043 static void
2044 bwn_core_start(struct bwn_mac *mac)
2045 {
2046         struct bwn_softc *sc = mac->mac_sc;
2047         uint32_t tmp;
2048
2049         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2050             ("%s:%d: fail", __func__, __LINE__));
2051
2052         if (siba_get_revid(sc->sc_dev) < 5)
2053                 return;
2054
2055         while (1) {
2056                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2057                 if (!(tmp & 0x00000001))
2058                         break;
2059                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2060         }
2061
2062         bwn_mac_enable(mac);
2063         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2064         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2065
2066         mac->mac_status = BWN_MAC_STATUS_STARTED;
2067 }
2068
2069 static void
2070 bwn_core_exit(struct bwn_mac *mac)
2071 {
2072         struct bwn_softc *sc = mac->mac_sc;
2073         uint32_t macctl;
2074
2075         BWN_ASSERT_LOCKED(mac->mac_sc);
2076
2077         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2078             ("%s:%d: fail", __func__, __LINE__));
2079
2080         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2081                 return;
2082         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2083
2084         macctl = BWN_READ_4(mac, BWN_MACCTL);
2085         macctl &= ~BWN_MACCTL_MCODE_RUN;
2086         macctl |= BWN_MACCTL_MCODE_JMP0;
2087         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2088
2089         bwn_dma_stop(mac);
2090         bwn_pio_stop(mac);
2091         bwn_chip_exit(mac);
2092         mac->mac_phy.switch_analog(mac, 0);
2093         siba_dev_down(sc->sc_dev, 0);
2094         siba_powerdown(sc->sc_dev);
2095 }
2096
2097 static void
2098 bwn_bt_disable(struct bwn_mac *mac)
2099 {
2100         struct bwn_softc *sc = mac->mac_sc;
2101
2102         (void)sc;
2103         /* XXX do nothing yet */
2104 }
2105
2106 static int
2107 bwn_chip_init(struct bwn_mac *mac)
2108 {
2109         struct bwn_softc *sc = mac->mac_sc;
2110         struct bwn_phy *phy = &mac->mac_phy;
2111         uint32_t macctl;
2112         int error;
2113
2114         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2115         if (phy->gmode)
2116                 macctl |= BWN_MACCTL_GMODE;
2117         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2118
2119         error = bwn_fw_fillinfo(mac);
2120         if (error)
2121                 return (error);
2122         error = bwn_fw_loaducode(mac);
2123         if (error)
2124                 return (error);
2125
2126         error = bwn_gpio_init(mac);
2127         if (error)
2128                 return (error);
2129
2130         error = bwn_fw_loadinitvals(mac);
2131         if (error) {
2132                 siba_gpio_set(sc->sc_dev, 0);
2133                 return (error);
2134         }
2135         phy->switch_analog(mac, 1);
2136         error = bwn_phy_init(mac);
2137         if (error) {
2138                 siba_gpio_set(sc->sc_dev, 0);
2139                 return (error);
2140         }
2141         if (phy->set_im)
2142                 phy->set_im(mac, BWN_IMMODE_NONE);
2143         if (phy->set_antenna)
2144                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2145         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2146
2147         if (phy->type == BWN_PHYTYPE_B)
2148                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2149         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2150         if (siba_get_revid(sc->sc_dev) < 5)
2151                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2152
2153         BWN_WRITE_4(mac, BWN_MACCTL,
2154             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2155         BWN_WRITE_4(mac, BWN_MACCTL,
2156             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2157         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2158
2159         bwn_set_opmode(mac);
2160         if (siba_get_revid(sc->sc_dev) < 3) {
2161                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2162                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2163                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2164                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2165         } else {
2166                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2167                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2168         }
2169         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2170         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2171         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2172         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2173         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2174         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2175         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2176         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
2177             siba_read_4(sc->sc_dev, SIBA_TGSLOW) | 0x00100000);
2178         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2179         return (error);
2180 }
2181
2182 /* read hostflags */
2183 uint64_t
2184 bwn_hf_read(struct bwn_mac *mac)
2185 {
2186         uint64_t ret;
2187
2188         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2189         ret <<= 16;
2190         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2191         ret <<= 16;
2192         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2193         return (ret);
2194 }
2195
2196 void
2197 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2198 {
2199
2200         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2201             (value & 0x00000000ffffull));
2202         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2203             (value & 0x0000ffff0000ull) >> 16);
2204         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2205             (value & 0xffff00000000ULL) >> 32);
2206 }
2207
2208 static void
2209 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2210 {
2211
2212         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2213         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2214 }
2215
2216 static void
2217 bwn_rate_init(struct bwn_mac *mac)
2218 {
2219
2220         switch (mac->mac_phy.type) {
2221         case BWN_PHYTYPE_A:
2222         case BWN_PHYTYPE_G:
2223         case BWN_PHYTYPE_LP:
2224         case BWN_PHYTYPE_N:
2225                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2226                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2227                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2228                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2229                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2230                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2231                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2232                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2233                         break;
2234                 /* FALLTHROUGH */
2235         case BWN_PHYTYPE_B:
2236                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2237                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2238                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2239                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2240                 break;
2241         default:
2242                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2243         }
2244 }
2245
2246 static void
2247 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2248 {
2249         uint16_t offset;
2250
2251         if (ofdm) {
2252                 offset = 0x480;
2253                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2254         } else {
2255                 offset = 0x4c0;
2256                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2257         }
2258         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2259             bwn_shm_read_2(mac, BWN_SHARED, offset));
2260 }
2261
2262 static uint8_t
2263 bwn_plcp_getcck(const uint8_t bitrate)
2264 {
2265
2266         switch (bitrate) {
2267         case BWN_CCK_RATE_1MB:
2268                 return (0x0a);
2269         case BWN_CCK_RATE_2MB:
2270                 return (0x14);
2271         case BWN_CCK_RATE_5MB:
2272                 return (0x37);
2273         case BWN_CCK_RATE_11MB:
2274                 return (0x6e);
2275         }
2276         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2277         return (0);
2278 }
2279
2280 static uint8_t
2281 bwn_plcp_getofdm(const uint8_t bitrate)
2282 {
2283
2284         switch (bitrate) {
2285         case BWN_OFDM_RATE_6MB:
2286                 return (0xb);
2287         case BWN_OFDM_RATE_9MB:
2288                 return (0xf);
2289         case BWN_OFDM_RATE_12MB:
2290                 return (0xa);
2291         case BWN_OFDM_RATE_18MB:
2292                 return (0xe);
2293         case BWN_OFDM_RATE_24MB:
2294                 return (0x9);
2295         case BWN_OFDM_RATE_36MB:
2296                 return (0xd);
2297         case BWN_OFDM_RATE_48MB:
2298                 return (0x8);
2299         case BWN_OFDM_RATE_54MB:
2300                 return (0xc);
2301         }
2302         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2303         return (0);
2304 }
2305
2306 static void
2307 bwn_set_phytxctl(struct bwn_mac *mac)
2308 {
2309         uint16_t ctl;
2310
2311         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2312             BWN_TX_PHY_TXPWR);
2313         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2314         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2315         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2316 }
2317
2318 static void
2319 bwn_pio_init(struct bwn_mac *mac)
2320 {
2321         struct bwn_pio *pio = &mac->mac_method.pio;
2322
2323         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2324             & ~BWN_MACCTL_BIGENDIAN);
2325         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2326
2327         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2328         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2329         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2330         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2331         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2332         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2333 }
2334
2335 static void
2336 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2337     int index)
2338 {
2339         struct bwn_pio_txpkt *tp;
2340         struct bwn_softc *sc = mac->mac_sc;
2341         unsigned int i;
2342
2343         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2344         tq->tq_index = index;
2345
2346         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2347         if (siba_get_revid(sc->sc_dev) >= 8)
2348                 tq->tq_size = 1920;
2349         else {
2350                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2351                 tq->tq_size -= 80;
2352         }
2353
2354         TAILQ_INIT(&tq->tq_pktlist);
2355         for (i = 0; i < N(tq->tq_pkts); i++) {
2356                 tp = &(tq->tq_pkts[i]);
2357                 tp->tp_index = i;
2358                 tp->tp_queue = tq;
2359                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2360         }
2361 }
2362
2363 static uint16_t
2364 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2365 {
2366         struct bwn_softc *sc = mac->mac_sc;
2367         static const uint16_t bases[] = {
2368                 BWN_PIO_BASE0,
2369                 BWN_PIO_BASE1,
2370                 BWN_PIO_BASE2,
2371                 BWN_PIO_BASE3,
2372                 BWN_PIO_BASE4,
2373                 BWN_PIO_BASE5,
2374                 BWN_PIO_BASE6,
2375                 BWN_PIO_BASE7,
2376         };
2377         static const uint16_t bases_rev11[] = {
2378                 BWN_PIO11_BASE0,
2379                 BWN_PIO11_BASE1,
2380                 BWN_PIO11_BASE2,
2381                 BWN_PIO11_BASE3,
2382                 BWN_PIO11_BASE4,
2383                 BWN_PIO11_BASE5,
2384         };
2385
2386         if (siba_get_revid(sc->sc_dev) >= 11) {
2387                 if (index >= N(bases_rev11))
2388                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2389                 return (bases_rev11[index]);
2390         }
2391         if (index >= N(bases))
2392                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2393         return (bases[index]);
2394 }
2395
2396 static void
2397 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2398     int index)
2399 {
2400         struct bwn_softc *sc = mac->mac_sc;
2401
2402         prq->prq_mac = mac;
2403         prq->prq_rev = siba_get_revid(sc->sc_dev);
2404         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2405         bwn_dma_rxdirectfifo(mac, index, 1);
2406 }
2407
2408 static void
2409 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2410 {
2411         if (tq == NULL)
2412                 return;
2413         bwn_pio_cancel_tx_packets(tq);
2414 }
2415
2416 static void
2417 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2418 {
2419
2420         bwn_destroy_pioqueue_tx(pio);
2421 }
2422
2423 static uint16_t
2424 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2425     uint16_t offset)
2426 {
2427
2428         return (BWN_READ_2(mac, tq->tq_base + offset));
2429 }
2430
2431 static void
2432 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2433 {
2434         uint32_t ctl;
2435         int type;
2436         uint16_t base;
2437
2438         type = bwn_dma_mask2type(bwn_dma_mask(mac));
2439         base = bwn_dma_base(type, idx);
2440         if (type == BWN_DMA_64BIT) {
2441                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2442                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2443                 if (enable)
2444                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2445                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2446         } else {
2447                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2448                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2449                 if (enable)
2450                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2451                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2452         }
2453 }
2454
2455 static uint64_t
2456 bwn_dma_mask(struct bwn_mac *mac)
2457 {
2458         uint32_t tmp;
2459         uint16_t base;
2460
2461         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2462         if (tmp & SIBA_TGSHIGH_DMA64)
2463                 return (BWN_DMA_BIT_MASK(64));
2464         base = bwn_dma_base(0, 0);
2465         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2466         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2467         if (tmp & BWN_DMA32_TXADDREXT_MASK)
2468                 return (BWN_DMA_BIT_MASK(32));
2469
2470         return (BWN_DMA_BIT_MASK(30));
2471 }
2472
2473 static int
2474 bwn_dma_mask2type(uint64_t dmamask)
2475 {
2476
2477         if (dmamask == BWN_DMA_BIT_MASK(30))
2478                 return (BWN_DMA_30BIT);
2479         if (dmamask == BWN_DMA_BIT_MASK(32))
2480                 return (BWN_DMA_32BIT);
2481         if (dmamask == BWN_DMA_BIT_MASK(64))
2482                 return (BWN_DMA_64BIT);
2483         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2484         return (BWN_DMA_30BIT);
2485 }
2486
2487 static void
2488 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2489 {
2490         struct bwn_pio_txpkt *tp;
2491         unsigned int i;
2492
2493         for (i = 0; i < N(tq->tq_pkts); i++) {
2494                 tp = &(tq->tq_pkts[i]);
2495                 if (tp->tp_m) {
2496                         m_freem(tp->tp_m);
2497                         tp->tp_m = NULL;
2498                 }
2499         }
2500 }
2501
2502 static uint16_t
2503 bwn_dma_base(int type, int controller_idx)
2504 {
2505         static const uint16_t map64[] = {
2506                 BWN_DMA64_BASE0,
2507                 BWN_DMA64_BASE1,
2508                 BWN_DMA64_BASE2,
2509                 BWN_DMA64_BASE3,
2510                 BWN_DMA64_BASE4,
2511                 BWN_DMA64_BASE5,
2512         };
2513         static const uint16_t map32[] = {
2514                 BWN_DMA32_BASE0,
2515                 BWN_DMA32_BASE1,
2516                 BWN_DMA32_BASE2,
2517                 BWN_DMA32_BASE3,
2518                 BWN_DMA32_BASE4,
2519                 BWN_DMA32_BASE5,
2520         };
2521
2522         if (type == BWN_DMA_64BIT) {
2523                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2524                     ("%s:%d: fail", __func__, __LINE__));
2525                 return (map64[controller_idx]);
2526         }
2527         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2528             ("%s:%d: fail", __func__, __LINE__));
2529         return (map32[controller_idx]);
2530 }
2531
2532 static void
2533 bwn_dma_init(struct bwn_mac *mac)
2534 {
2535         struct bwn_dma *dma = &mac->mac_method.dma;
2536
2537         /* setup TX DMA channels. */
2538         bwn_dma_setup(dma->wme[WME_AC_BK]);
2539         bwn_dma_setup(dma->wme[WME_AC_BE]);
2540         bwn_dma_setup(dma->wme[WME_AC_VI]);
2541         bwn_dma_setup(dma->wme[WME_AC_VO]);
2542         bwn_dma_setup(dma->mcast);
2543         /* setup RX DMA channel. */
2544         bwn_dma_setup(dma->rx);
2545 }
2546
2547 static struct bwn_dma_ring *
2548 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2549     int for_tx, int type)
2550 {
2551         struct bwn_dma *dma = &mac->mac_method.dma;
2552         struct bwn_dma_ring *dr;
2553         struct bwn_dmadesc_generic *desc;
2554         struct bwn_dmadesc_meta *mt;
2555         struct bwn_softc *sc = mac->mac_sc;
2556         int error, i;
2557
2558         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2559         if (dr == NULL)
2560                 goto out;
2561         dr->dr_numslots = BWN_RXRING_SLOTS;
2562         if (for_tx)
2563                 dr->dr_numslots = BWN_TXRING_SLOTS;
2564
2565         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2566             M_DEVBUF, M_NOWAIT | M_ZERO);
2567         if (dr->dr_meta == NULL)
2568                 goto fail0;
2569
2570         dr->dr_type = type;
2571         dr->dr_mac = mac;
2572         dr->dr_base = bwn_dma_base(type, controller_index);
2573         dr->dr_index = controller_index;
2574         if (type == BWN_DMA_64BIT) {
2575                 dr->getdesc = bwn_dma_64_getdesc;
2576                 dr->setdesc = bwn_dma_64_setdesc;
2577                 dr->start_transfer = bwn_dma_64_start_transfer;
2578                 dr->suspend = bwn_dma_64_suspend;
2579                 dr->resume = bwn_dma_64_resume;
2580                 dr->get_curslot = bwn_dma_64_get_curslot;
2581                 dr->set_curslot = bwn_dma_64_set_curslot;
2582         } else {
2583                 dr->getdesc = bwn_dma_32_getdesc;
2584                 dr->setdesc = bwn_dma_32_setdesc;
2585                 dr->start_transfer = bwn_dma_32_start_transfer;
2586                 dr->suspend = bwn_dma_32_suspend;
2587                 dr->resume = bwn_dma_32_resume;
2588                 dr->get_curslot = bwn_dma_32_get_curslot;
2589                 dr->set_curslot = bwn_dma_32_set_curslot;
2590         }
2591         if (for_tx) {
2592                 dr->dr_tx = 1;
2593                 dr->dr_curslot = -1;
2594         } else {
2595                 if (dr->dr_index == 0) {
2596                         dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2597                         dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2598                 } else
2599                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2600         }
2601
2602         error = bwn_dma_allocringmemory(dr);
2603         if (error)
2604                 goto fail2;
2605
2606         if (for_tx) {
2607                 /*
2608                  * Assumption: BWN_TXRING_SLOTS can be divided by
2609                  * BWN_TX_SLOTS_PER_FRAME
2610                  */
2611                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2612                     ("%s:%d: fail", __func__, __LINE__));
2613
2614                 dr->dr_txhdr_cache =
2615                     malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2616                         BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
2617                 KASSERT(dr->dr_txhdr_cache != NULL,
2618                     ("%s:%d: fail", __func__, __LINE__));
2619
2620                 /*
2621                  * Create TX ring DMA stuffs
2622                  */
2623                 error = bus_dma_tag_create(dma->parent_dtag,
2624                                     BWN_ALIGN, 0,
2625                                     BUS_SPACE_MAXADDR,
2626                                     BUS_SPACE_MAXADDR,
2627                                     NULL, NULL,
2628                                     BWN_HDRSIZE(mac),
2629                                     1,
2630                                     BUS_SPACE_MAXSIZE_32BIT,
2631                                     0,
2632                                     NULL, NULL,
2633                                     &dr->dr_txring_dtag);
2634                 if (error) {
2635                         device_printf(sc->sc_dev,
2636                             "can't create TX ring DMA tag: TODO frees\n");
2637                         goto fail1;
2638                 }
2639
2640                 for (i = 0; i < dr->dr_numslots; i += 2) {
2641                         dr->getdesc(dr, i, &desc, &mt);
2642
2643                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2644                         mt->mt_m = NULL;
2645                         mt->mt_ni = NULL;
2646                         mt->mt_islast = 0;
2647                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2648                             &mt->mt_dmap);
2649                         if (error) {
2650                                 device_printf(sc->sc_dev,
2651                                      "can't create RX buf DMA map\n");
2652                                 goto fail1;
2653                         }
2654
2655                         dr->getdesc(dr, i + 1, &desc, &mt);
2656
2657                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2658                         mt->mt_m = NULL;
2659                         mt->mt_ni = NULL;
2660                         mt->mt_islast = 1;
2661                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2662                             &mt->mt_dmap);
2663                         if (error) {
2664                                 device_printf(sc->sc_dev,
2665                                      "can't create RX buf DMA map\n");
2666                                 goto fail1;
2667                         }
2668                 }
2669         } else {
2670                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2671                     &dr->dr_spare_dmap);
2672                 if (error) {
2673                         device_printf(sc->sc_dev,
2674                             "can't create RX buf DMA map\n");
2675                         goto out;               /* XXX wrong! */
2676                 }
2677
2678                 for (i = 0; i < dr->dr_numslots; i++) {
2679                         dr->getdesc(dr, i, &desc, &mt);
2680
2681                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2682                             &mt->mt_dmap);
2683                         if (error) {
2684                                 device_printf(sc->sc_dev,
2685                                     "can't create RX buf DMA map\n");
2686                                 goto out;       /* XXX wrong! */
2687                         }
2688                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2689                         if (error) {
2690                                 device_printf(sc->sc_dev,
2691                                     "failed to allocate RX buf\n");
2692                                 goto out;       /* XXX wrong! */
2693                         }
2694                 }
2695
2696                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2697                     BUS_DMASYNC_PREWRITE);
2698
2699                 dr->dr_usedslot = dr->dr_numslots;
2700         }
2701
2702       out:
2703         return (dr);
2704
2705 fail2:
2706         free(dr->dr_txhdr_cache, M_DEVBUF);
2707 fail1:
2708         free(dr->dr_meta, M_DEVBUF);
2709 fail0:
2710         free(dr, M_DEVBUF);
2711         return (NULL);
2712 }
2713
2714 static void
2715 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2716 {
2717
2718         if (dr == NULL)
2719                 return;
2720
2721         bwn_dma_free_descbufs(*dr);
2722         bwn_dma_free_ringmemory(*dr);
2723
2724         free((*dr)->dr_txhdr_cache, M_DEVBUF);
2725         free((*dr)->dr_meta, M_DEVBUF);
2726         free(*dr, M_DEVBUF);
2727
2728         *dr = NULL;
2729 }
2730
2731 static void
2732 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2733     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2734 {
2735         struct bwn_dmadesc32 *desc;
2736
2737         *meta = &(dr->dr_meta[slot]);
2738         desc = dr->dr_ring_descbase;
2739         desc = &(desc[slot]);
2740
2741         *gdesc = (struct bwn_dmadesc_generic *)desc;
2742 }
2743
2744 static void
2745 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2746     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2747     int start, int end, int irq)
2748 {
2749         struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2750         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2751         uint32_t addr, addrext, ctl;
2752         int slot;
2753
2754         slot = (int)(&(desc->dma.dma32) - descbase);
2755         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2756             ("%s:%d: fail", __func__, __LINE__));
2757
2758         addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2759         addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2760         addr |= siba_dma_translation(sc->sc_dev);
2761         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2762         if (slot == dr->dr_numslots - 1)
2763                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
2764         if (start)
2765                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
2766         if (end)
2767                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
2768         if (irq)
2769                 ctl |= BWN_DMA32_DCTL_IRQ;
2770         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2771             & BWN_DMA32_DCTL_ADDREXT_MASK;
2772
2773         desc->dma.dma32.control = htole32(ctl);
2774         desc->dma.dma32.address = htole32(addr);
2775 }
2776
2777 static void
2778 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2779 {
2780
2781         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2782             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2783 }
2784
2785 static void
2786 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2787 {
2788
2789         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2790             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2791 }
2792
2793 static void
2794 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2795 {
2796
2797         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2798             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2799 }
2800
2801 static int
2802 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2803 {
2804         uint32_t val;
2805
2806         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2807         val &= BWN_DMA32_RXDPTR;
2808
2809         return (val / sizeof(struct bwn_dmadesc32));
2810 }
2811
2812 static void
2813 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2814 {
2815
2816         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2817             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2818 }
2819
2820 static void
2821 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2822     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2823 {
2824         struct bwn_dmadesc64 *desc;
2825
2826         *meta = &(dr->dr_meta[slot]);
2827         desc = dr->dr_ring_descbase;
2828         desc = &(desc[slot]);
2829
2830         *gdesc = (struct bwn_dmadesc_generic *)desc;
2831 }
2832
2833 static void
2834 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2835     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2836     int start, int end, int irq)
2837 {
2838         struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2839         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2840         int slot;
2841         uint32_t ctl0 = 0, ctl1 = 0;
2842         uint32_t addrlo, addrhi;
2843         uint32_t addrext;
2844
2845         slot = (int)(&(desc->dma.dma64) - descbase);
2846         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2847             ("%s:%d: fail", __func__, __LINE__));
2848
2849         addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2850         addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2851         addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2852             30;
2853         addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2854         if (slot == dr->dr_numslots - 1)
2855                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2856         if (start)
2857                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2858         if (end)
2859                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2860         if (irq)
2861                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
2862         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2863         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2864             & BWN_DMA64_DCTL1_ADDREXT_MASK;
2865
2866         desc->dma.dma64.control0 = htole32(ctl0);
2867         desc->dma.dma64.control1 = htole32(ctl1);
2868         desc->dma.dma64.address_low = htole32(addrlo);
2869         desc->dma.dma64.address_high = htole32(addrhi);
2870 }
2871
2872 static void
2873 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2874 {
2875
2876         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2877             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2878 }
2879
2880 static void
2881 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2882 {
2883
2884         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2885             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2886 }
2887
2888 static void
2889 bwn_dma_64_resume(struct bwn_dma_ring *dr)
2890 {
2891
2892         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2893             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2894 }
2895
2896 static int
2897 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2898 {
2899         uint32_t val;
2900
2901         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2902         val &= BWN_DMA64_RXSTATDPTR;
2903
2904         return (val / sizeof(struct bwn_dmadesc64));
2905 }
2906
2907 static void
2908 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
2909 {
2910
2911         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
2912             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2913 }
2914
2915 static int
2916 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
2917 {
2918         struct bwn_mac *mac = dr->dr_mac;
2919         struct bwn_dma *dma = &mac->mac_method.dma;
2920         struct bwn_softc *sc = mac->mac_sc;
2921         int error;
2922
2923         error = bus_dma_tag_create(dma->parent_dtag,
2924                             BWN_ALIGN, 0,
2925                             BUS_SPACE_MAXADDR,
2926                             BUS_SPACE_MAXADDR,
2927                             NULL, NULL,
2928                             BWN_DMA_RINGMEMSIZE,
2929                             1,
2930                             BUS_SPACE_MAXSIZE_32BIT,
2931                             0,
2932                             NULL, NULL,
2933                             &dr->dr_ring_dtag);
2934         if (error) {
2935                 device_printf(sc->sc_dev,
2936                     "can't create TX ring DMA tag: TODO frees\n");
2937                 return (-1);
2938         }
2939
2940         error = bus_dmamem_alloc(dr->dr_ring_dtag,
2941             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
2942             &dr->dr_ring_dmap);
2943         if (error) {
2944                 device_printf(sc->sc_dev,
2945                     "can't allocate DMA mem: TODO frees\n");
2946                 return (-1);
2947         }
2948         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
2949             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
2950             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
2951         if (error) {
2952                 device_printf(sc->sc_dev,
2953                     "can't load DMA mem: TODO free\n");
2954                 return (-1);
2955         }
2956
2957         return (0);
2958 }
2959
2960 static void
2961 bwn_dma_setup(struct bwn_dma_ring *dr)
2962 {
2963         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2964         uint64_t ring64;
2965         uint32_t addrext, ring32, value;
2966         uint32_t trans = siba_dma_translation(sc->sc_dev);
2967
2968         if (dr->dr_tx) {
2969                 dr->dr_curslot = -1;
2970
2971                 if (dr->dr_type == BWN_DMA_64BIT) {
2972                         ring64 = (uint64_t)(dr->dr_ring_dmabase);
2973                         addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
2974                             >> 30;
2975                         value = BWN_DMA64_TXENABLE;
2976                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
2977                             & BWN_DMA64_TXADDREXT_MASK;
2978                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
2979                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
2980                             (ring64 & 0xffffffff));
2981                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
2982                             ((ring64 >> 32) &
2983                             ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
2984                 } else {
2985                         ring32 = (uint32_t)(dr->dr_ring_dmabase);
2986                         addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
2987                         value = BWN_DMA32_TXENABLE;
2988                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
2989                             & BWN_DMA32_TXADDREXT_MASK;
2990                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
2991                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
2992                             (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
2993                 }
2994                 return;
2995         }
2996
2997         /*
2998          * set for RX
2999          */
3000         dr->dr_usedslot = dr->dr_numslots;
3001
3002         if (dr->dr_type == BWN_DMA_64BIT) {
3003                 ring64 = (uint64_t)(dr->dr_ring_dmabase);
3004                 addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3005                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3006                 value |= BWN_DMA64_RXENABLE;
3007                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3008                     & BWN_DMA64_RXADDREXT_MASK;
3009                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3010                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3011                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3012                     ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3013                     | (trans << 1));
3014                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3015                     sizeof(struct bwn_dmadesc64));
3016         } else {
3017                 ring32 = (uint32_t)(dr->dr_ring_dmabase);
3018                 addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3019                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3020                 value |= BWN_DMA32_RXENABLE;
3021                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3022                     & BWN_DMA32_RXADDREXT_MASK;
3023                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3024                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3025                     (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3026                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3027                     sizeof(struct bwn_dmadesc32));
3028         }
3029 }
3030
3031 static void
3032 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3033 {
3034
3035         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3036         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3037             dr->dr_ring_dmap);
3038 }
3039
3040 static void
3041 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3042 {
3043
3044         if (dr->dr_tx) {
3045                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3046                 if (dr->dr_type == BWN_DMA_64BIT) {
3047                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3048                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3049                 } else
3050                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3051         } else {
3052                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3053                 if (dr->dr_type == BWN_DMA_64BIT) {
3054                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3055                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3056                 } else
3057                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3058         }
3059 }
3060
3061 static void
3062 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3063 {
3064         struct bwn_dmadesc_generic *desc;
3065         struct bwn_dmadesc_meta *meta;
3066         struct bwn_mac *mac = dr->dr_mac;
3067         struct bwn_dma *dma = &mac->mac_method.dma;
3068         struct bwn_softc *sc = mac->mac_sc;
3069         int i;
3070
3071         if (!dr->dr_usedslot)
3072                 return;
3073         for (i = 0; i < dr->dr_numslots; i++) {
3074                 dr->getdesc(dr, i, &desc, &meta);
3075
3076                 if (meta->mt_m == NULL) {
3077                         if (!dr->dr_tx)
3078                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3079                                     __func__);
3080                         continue;
3081                 }
3082                 if (dr->dr_tx) {
3083                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3084                                 bus_dmamap_unload(dr->dr_txring_dtag,
3085                                     meta->mt_dmap);
3086                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3087                                 bus_dmamap_unload(dma->txbuf_dtag,
3088                                     meta->mt_dmap);
3089                 } else
3090                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3091                 bwn_dma_free_descbuf(dr, meta);
3092         }
3093 }
3094
3095 static int
3096 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3097     int type)
3098 {
3099         struct bwn_softc *sc = mac->mac_sc;
3100         uint32_t value;
3101         int i;
3102         uint16_t offset;
3103
3104         for (i = 0; i < 10; i++) {
3105                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3106                     BWN_DMA32_TXSTATUS;
3107                 value = BWN_READ_4(mac, base + offset);
3108                 if (type == BWN_DMA_64BIT) {
3109                         value &= BWN_DMA64_TXSTAT;
3110                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3111                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3112                             value == BWN_DMA64_TXSTAT_STOPPED)
3113                                 break;
3114                 } else {
3115                         value &= BWN_DMA32_TXSTATE;
3116                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3117                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3118                             value == BWN_DMA32_TXSTAT_STOPPED)
3119                                 break;
3120                 }
3121                 DELAY(1000);
3122         }
3123         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3124         BWN_WRITE_4(mac, base + offset, 0);
3125         for (i = 0; i < 10; i++) {
3126                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3127                                                    BWN_DMA32_TXSTATUS;
3128                 value = BWN_READ_4(mac, base + offset);
3129                 if (type == BWN_DMA_64BIT) {
3130                         value &= BWN_DMA64_TXSTAT;
3131                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3132                                 i = -1;
3133                                 break;
3134                         }
3135                 } else {
3136                         value &= BWN_DMA32_TXSTATE;
3137                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3138                                 i = -1;
3139                                 break;
3140                         }
3141                 }
3142                 DELAY(1000);
3143         }
3144         if (i != -1) {
3145                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3146                 return (ENODEV);
3147         }
3148         DELAY(1000);
3149
3150         return (0);
3151 }
3152
3153 static int
3154 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3155     int type)
3156 {
3157         struct bwn_softc *sc = mac->mac_sc;
3158         uint32_t value;
3159         int i;
3160         uint16_t offset;
3161
3162         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3163         BWN_WRITE_4(mac, base + offset, 0);
3164         for (i = 0; i < 10; i++) {
3165                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3166                     BWN_DMA32_RXSTATUS;
3167                 value = BWN_READ_4(mac, base + offset);
3168                 if (type == BWN_DMA_64BIT) {
3169                         value &= BWN_DMA64_RXSTAT;
3170                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3171                                 i = -1;
3172                                 break;
3173                         }
3174                 } else {
3175                         value &= BWN_DMA32_RXSTATE;
3176                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3177                                 i = -1;
3178                                 break;
3179                         }
3180                 }
3181                 DELAY(1000);
3182         }
3183         if (i != -1) {
3184                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3185                 return (ENODEV);
3186         }
3187
3188         return (0);
3189 }
3190
3191 static void
3192 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3193     struct bwn_dmadesc_meta *meta)
3194 {
3195
3196         if (meta->mt_m != NULL) {
3197                 m_freem(meta->mt_m);
3198                 meta->mt_m = NULL;
3199         }
3200         if (meta->mt_ni != NULL) {
3201                 ieee80211_free_node(meta->mt_ni);
3202                 meta->mt_ni = NULL;
3203         }
3204 }
3205
3206 static void
3207 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3208 {
3209         struct bwn_rxhdr4 *rxhdr;
3210         unsigned char *frame;
3211
3212         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3213         rxhdr->frame_len = 0;
3214
3215         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3216             sizeof(struct bwn_plcp6) + 2,
3217             ("%s:%d: fail", __func__, __LINE__));
3218         frame = mtod(m, char *) + dr->dr_frameoffset;
3219         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3220 }
3221
3222 static uint8_t
3223 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3224 {
3225         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3226
3227         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3228             == 0xff);
3229 }
3230
3231 static void
3232 bwn_wme_init(struct bwn_mac *mac)
3233 {
3234
3235         bwn_wme_load(mac);
3236
3237         /* enable WME support. */
3238         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3239         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3240             BWN_IFSCTL_USE_EDCF);
3241 }
3242
3243 static void
3244 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3245 {
3246         struct bwn_softc *sc = mac->mac_sc;
3247         struct ieee80211com *ic = &sc->sc_ic;
3248         uint16_t delay; /* microsec */
3249
3250         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3251         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3252                 delay = 500;
3253         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3254                 delay = max(delay, (uint16_t)2400);
3255
3256         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3257 }
3258
3259 static void
3260 bwn_bt_enable(struct bwn_mac *mac)
3261 {
3262         struct bwn_softc *sc = mac->mac_sc;
3263         uint64_t hf;
3264
3265         if (bwn_bluetooth == 0)
3266                 return;
3267         if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3268                 return;
3269         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3270                 return;
3271
3272         hf = bwn_hf_read(mac);
3273         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3274                 hf |= BWN_HF_BT_COEXISTALT;
3275         else
3276                 hf |= BWN_HF_BT_COEXIST;
3277         bwn_hf_write(mac, hf);
3278 }
3279
3280 static void
3281 bwn_set_macaddr(struct bwn_mac *mac)
3282 {
3283
3284         bwn_mac_write_bssid(mac);
3285         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3286             mac->mac_sc->sc_ic.ic_macaddr);
3287 }
3288
3289 static void
3290 bwn_clear_keys(struct bwn_mac *mac)
3291 {
3292         int i;
3293
3294         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3295                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3296                     ("%s:%d: fail", __func__, __LINE__));
3297
3298                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3299                     NULL, BWN_SEC_KEYSIZE, NULL);
3300                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3301                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3302                             NULL, BWN_SEC_KEYSIZE, NULL);
3303                 }
3304                 mac->mac_key[i].keyconf = NULL;
3305         }
3306 }
3307
3308 static void
3309 bwn_crypt_init(struct bwn_mac *mac)
3310 {
3311         struct bwn_softc *sc = mac->mac_sc;
3312
3313         mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3314         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3315             ("%s:%d: fail", __func__, __LINE__));
3316         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3317         mac->mac_ktp *= 2;
3318         if (siba_get_revid(sc->sc_dev) >= 5)
3319                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3320         bwn_clear_keys(mac);
3321 }
3322
3323 static void
3324 bwn_chip_exit(struct bwn_mac *mac)
3325 {
3326         struct bwn_softc *sc = mac->mac_sc;
3327
3328         bwn_phy_exit(mac);
3329         siba_gpio_set(sc->sc_dev, 0);
3330 }
3331
3332 static int
3333 bwn_fw_fillinfo(struct bwn_mac *mac)
3334 {
3335         int error;
3336
3337         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3338         if (error == 0)
3339                 return (0);
3340         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3341         if (error == 0)
3342                 return (0);
3343         return (error);
3344 }
3345
3346 static int
3347 bwn_gpio_init(struct bwn_mac *mac)
3348 {
3349         struct bwn_softc *sc = mac->mac_sc;
3350         uint32_t mask = 0x1f, set = 0xf, value;
3351
3352         BWN_WRITE_4(mac, BWN_MACCTL,
3353             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3354         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3355             BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3356
3357         if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3358                 mask |= 0x0060;
3359                 set |= 0x0060;
3360         }
3361         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3362                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3363                     BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3364                 mask |= 0x0200;
3365                 set |= 0x0200;
3366         }
3367         if (siba_get_revid(sc->sc_dev) >= 2)
3368                 mask |= 0x0010;
3369
3370         value = siba_gpio_get(sc->sc_dev);
3371         if (value == -1)
3372                 return (0);
3373         siba_gpio_set(sc->sc_dev, (value & mask) | set);
3374
3375         return (0);
3376 }
3377
3378 static int
3379 bwn_fw_loadinitvals(struct bwn_mac *mac)
3380 {
3381 #define GETFWOFFSET(fwp, offset)                                \
3382         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3383         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3384         const struct bwn_fwhdr *hdr;
3385         struct bwn_fw *fw = &mac->mac_fw;
3386         int error;
3387
3388         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3389         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3390             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3391         if (error)
3392                 return (error);
3393         if (fw->initvals_band.fw) {
3394                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3395                 error = bwn_fwinitvals_write(mac,
3396                     GETFWOFFSET(fw->initvals_band, hdr_len),
3397                     be32toh(hdr->size),
3398                     fw->initvals_band.fw->datasize - hdr_len);
3399         }
3400         return (error);
3401 #undef GETFWOFFSET
3402 }
3403
3404 static int
3405 bwn_phy_init(struct bwn_mac *mac)
3406 {
3407         struct bwn_softc *sc = mac->mac_sc;
3408         int error;
3409
3410         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3411         mac->mac_phy.rf_onoff(mac, 1);
3412         error = mac->mac_phy.init(mac);
3413         if (error) {
3414                 device_printf(sc->sc_dev, "PHY init failed\n");
3415                 goto fail0;
3416         }
3417         error = bwn_switch_channel(mac,
3418             mac->mac_phy.get_default_chan(mac));
3419         if (error) {
3420                 device_printf(sc->sc_dev,
3421                     "failed to switch default channel\n");
3422                 goto fail1;
3423         }
3424         return (0);
3425 fail1:
3426         if (mac->mac_phy.exit)
3427                 mac->mac_phy.exit(mac);
3428 fail0:
3429         mac->mac_phy.rf_onoff(mac, 0);
3430
3431         return (error);
3432 }
3433
3434 static void
3435 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3436 {
3437         uint16_t ant;
3438         uint16_t tmp;
3439
3440         ant = bwn_ant2phy(antenna);
3441
3442         /* For ACK/CTS */
3443         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3444         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3445         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3446         /* For Probe Resposes */
3447         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3448         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3449         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3450 }
3451
3452 static void
3453 bwn_set_opmode(struct bwn_mac *mac)
3454 {
3455         struct bwn_softc *sc = mac->mac_sc;
3456         struct ieee80211com *ic = &sc->sc_ic;
3457         uint32_t ctl;
3458         uint16_t cfp_pretbtt;
3459
3460         ctl = BWN_READ_4(mac, BWN_MACCTL);
3461         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3462             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3463             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3464         ctl |= BWN_MACCTL_STA;
3465
3466         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3467             ic->ic_opmode == IEEE80211_M_MBSS)
3468                 ctl |= BWN_MACCTL_HOSTAP;
3469         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3470                 ctl &= ~BWN_MACCTL_STA;
3471         ctl |= sc->sc_filters;
3472
3473         if (siba_get_revid(sc->sc_dev) <= 4)
3474                 ctl |= BWN_MACCTL_PROMISC;
3475
3476         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3477
3478         cfp_pretbtt = 2;
3479         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3480                 if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3481                     siba_get_chiprev(sc->sc_dev) == 3)
3482                         cfp_pretbtt = 100;
3483                 else
3484                         cfp_pretbtt = 50;
3485         }
3486         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3487 }
3488
3489 static int
3490 bwn_dma_gettype(struct bwn_mac *mac)
3491 {
3492         uint32_t tmp;
3493         uint16_t base;
3494
3495         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3496         if (tmp & SIBA_TGSHIGH_DMA64)
3497                 return (BWN_DMA_64BIT);
3498         base = bwn_dma_base(0, 0);
3499         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3500         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3501         if (tmp & BWN_DMA32_TXADDREXT_MASK)
3502                 return (BWN_DMA_32BIT);
3503
3504         return (BWN_DMA_30BIT);
3505 }
3506
3507 static void
3508 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3509 {
3510         if (!error) {
3511                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3512                 *((bus_addr_t *)arg) = seg->ds_addr;
3513         }
3514 }
3515
3516 void
3517 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3518 {
3519         struct bwn_phy *phy = &mac->mac_phy;
3520         struct bwn_softc *sc = mac->mac_sc;
3521         unsigned int i, max_loop;
3522         uint16_t value;
3523         uint32_t buffer[5] = {
3524                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3525         };
3526
3527         if (ofdm) {
3528                 max_loop = 0x1e;
3529                 buffer[0] = 0x000201cc;
3530         } else {
3531                 max_loop = 0xfa;
3532                 buffer[0] = 0x000b846e;
3533         }
3534
3535         BWN_ASSERT_LOCKED(mac->mac_sc);
3536
3537         for (i = 0; i < 5; i++)
3538                 bwn_ram_write(mac, i * 4, buffer[i]);
3539
3540         BWN_WRITE_2(mac, 0x0568, 0x0000);
3541         BWN_WRITE_2(mac, 0x07c0,
3542             (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3543         value = ((phy->type == BWN_PHYTYPE_A) ? 0x41 : 0x40);
3544         BWN_WRITE_2(mac, 0x050c, value);
3545         if (phy->type == BWN_PHYTYPE_LP)
3546                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3547         BWN_WRITE_2(mac, 0x0508, 0x0000);
3548         BWN_WRITE_2(mac, 0x050a, 0x0000);
3549         BWN_WRITE_2(mac, 0x054c, 0x0000);
3550         BWN_WRITE_2(mac, 0x056a, 0x0014);
3551         BWN_WRITE_2(mac, 0x0568, 0x0826);
3552         BWN_WRITE_2(mac, 0x0500, 0x0000);
3553         if (phy->type == BWN_PHYTYPE_LP)
3554                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3555         else
3556                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3557
3558         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3559                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3560         for (i = 0x00; i < max_loop; i++) {
3561                 value = BWN_READ_2(mac, 0x050e);
3562                 if (value & 0x0080)
3563                         break;
3564                 DELAY(10);
3565         }
3566         for (i = 0x00; i < 0x0a; i++) {
3567                 value = BWN_READ_2(mac, 0x050e);
3568                 if (value & 0x0400)
3569                         break;
3570                 DELAY(10);
3571         }
3572         for (i = 0x00; i < 0x19; i++) {
3573                 value = BWN_READ_2(mac, 0x0690);
3574                 if (!(value & 0x0100))
3575                         break;
3576                 DELAY(10);
3577         }
3578         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3579                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3580 }
3581
3582 void
3583 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3584 {
3585         uint32_t macctl;
3586
3587         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3588
3589         macctl = BWN_READ_4(mac, BWN_MACCTL);
3590         if (macctl & BWN_MACCTL_BIGENDIAN)
3591                 printf("TODO: need swap\n");
3592
3593         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3594         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3595         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3596 }
3597
3598 void
3599 bwn_mac_suspend(struct bwn_mac *mac)
3600 {
3601         struct bwn_softc *sc = mac->mac_sc;
3602         int i;
3603         uint32_t tmp;
3604
3605         KASSERT(mac->mac_suspended >= 0,
3606             ("%s:%d: fail", __func__, __LINE__));
3607
3608         if (mac->mac_suspended == 0) {
3609                 bwn_psctl(mac, BWN_PS_AWAKE);
3610                 BWN_WRITE_4(mac, BWN_MACCTL,
3611                             BWN_READ_4(mac, BWN_MACCTL)
3612                             & ~BWN_MACCTL_ON);
3613                 BWN_READ_4(mac, BWN_MACCTL);
3614                 for (i = 35; i; i--) {
3615                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3616                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3617                                 goto out;
3618                         DELAY(10);
3619                 }
3620                 for (i = 40; i; i--) {
3621                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3622                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3623                                 goto out;
3624                         DELAY(1000);
3625                 }
3626                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3627         }
3628 out:
3629         mac->mac_suspended++;
3630 }
3631
3632 void
3633 bwn_mac_enable(struct bwn_mac *mac)
3634 {
3635         struct bwn_softc *sc = mac->mac_sc;
3636         uint16_t state;
3637
3638         state = bwn_shm_read_2(mac, BWN_SHARED,
3639             BWN_SHARED_UCODESTAT);
3640         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3641             state != BWN_SHARED_UCODESTAT_SLEEP)
3642                 device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3643
3644         mac->mac_suspended--;
3645         KASSERT(mac->mac_suspended >= 0,
3646             ("%s:%d: fail", __func__, __LINE__));
3647         if (mac->mac_suspended == 0) {
3648                 BWN_WRITE_4(mac, BWN_MACCTL,
3649                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3650                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3651                 BWN_READ_4(mac, BWN_MACCTL);
3652                 BWN_READ_4(mac, BWN_INTR_REASON);
3653                 bwn_psctl(mac, 0);
3654         }
3655 }
3656
3657 void
3658 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3659 {
3660         struct bwn_softc *sc = mac->mac_sc;
3661         int i;
3662         uint16_t ucstat;
3663
3664         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3665             ("%s:%d: fail", __func__, __LINE__));
3666         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3667             ("%s:%d: fail", __func__, __LINE__));
3668
3669         /* XXX forcibly awake and hwps-off */
3670
3671         BWN_WRITE_4(mac, BWN_MACCTL,
3672             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3673             ~BWN_MACCTL_HWPS);
3674         BWN_READ_4(mac, BWN_MACCTL);
3675         if (siba_get_revid(sc->sc_dev) >= 5) {
3676                 for (i = 0; i < 100; i++) {
3677                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3678                             BWN_SHARED_UCODESTAT);
3679                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3680                                 break;
3681                         DELAY(10);
3682                 }
3683         }
3684 }
3685
3686 static int
3687 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3688 {
3689         struct bwn_softc *sc = mac->mac_sc;
3690         struct bwn_fw *fw = &mac->mac_fw;
3691         const uint8_t rev = siba_get_revid(sc->sc_dev);
3692         const char *filename;
3693         uint32_t high;
3694         int error;
3695
3696         /* microcode */
3697         if (rev >= 5 && rev <= 10)
3698                 filename = "ucode5";
3699         else if (rev >= 11 && rev <= 12)
3700                 filename = "ucode11";
3701         else if (rev == 13)
3702                 filename = "ucode13";
3703         else if (rev == 14)
3704                 filename = "ucode14";
3705         else if (rev >= 15)
3706                 filename = "ucode15";
3707         else {
3708                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3709                 bwn_release_firmware(mac);
3710                 return (EOPNOTSUPP);
3711         }
3712         error = bwn_fw_get(mac, type, filename, &fw->ucode);
3713         if (error) {
3714                 bwn_release_firmware(mac);
3715                 return (error);
3716         }
3717
3718         /* PCM */
3719         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3720         if (rev >= 5 && rev <= 10) {
3721                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3722                 if (error == ENOENT)
3723                         fw->no_pcmfile = 1;
3724                 else if (error) {
3725                         bwn_release_firmware(mac);
3726                         return (error);
3727                 }
3728         } else if (rev < 11) {
3729                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3730                 return (EOPNOTSUPP);
3731         }
3732
3733         /* initvals */
3734         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3735         switch (mac->mac_phy.type) {
3736         case BWN_PHYTYPE_A:
3737                 if (rev < 5 || rev > 10)
3738                         goto fail1;
3739                 if (high & BWN_TGSHIGH_HAVE_2GHZ)
3740                         filename = "a0g1initvals5";
3741                 else
3742                         filename = "a0g0initvals5";
3743                 break;
3744         case BWN_PHYTYPE_G:
3745                 if (rev >= 5 && rev <= 10)
3746                         filename = "b0g0initvals5";
3747                 else if (rev >= 13)
3748                         filename = "b0g0initvals13";
3749                 else
3750                         goto fail1;
3751                 break;
3752         case BWN_PHYTYPE_LP:
3753                 if (rev == 13)
3754                         filename = "lp0initvals13";
3755                 else if (rev == 14)
3756                         filename = "lp0initvals14";
3757                 else if (rev >= 15)
3758                         filename = "lp0initvals15";
3759                 else
3760                         goto fail1;
3761                 break;
3762         case BWN_PHYTYPE_N:
3763                 if (rev >= 11 && rev <= 12)
3764                         filename = "n0initvals11";
3765                 else
3766                         goto fail1;
3767                 break;
3768         default:
3769                 goto fail1;
3770         }
3771         error = bwn_fw_get(mac, type, filename, &fw->initvals);
3772         if (error) {
3773                 bwn_release_firmware(mac);
3774                 return (error);
3775         }
3776
3777         /* bandswitch initvals */
3778         switch (mac->mac_phy.type) {
3779         case BWN_PHYTYPE_A:
3780                 if (rev >= 5 && rev <= 10) {
3781                         if (high & BWN_TGSHIGH_HAVE_2GHZ)
3782                                 filename = "a0g1bsinitvals5";
3783                         else
3784                                 filename = "a0g0bsinitvals5";
3785                 } else if (rev >= 11)
3786                         filename = NULL;
3787                 else
3788                         goto fail1;
3789                 break;
3790         case BWN_PHYTYPE_G:
3791                 if (rev >= 5 && rev <= 10)
3792                         filename = "b0g0bsinitvals5";
3793                 else if (rev >= 11)
3794                         filename = NULL;
3795                 else
3796                         goto fail1;
3797                 break;
3798         case BWN_PHYTYPE_LP:
3799                 if (rev == 13)
3800                         filename = "lp0bsinitvals13";
3801                 else if (rev == 14)
3802                         filename = "lp0bsinitvals14";
3803                 else if (rev >= 15)
3804                         filename = "lp0bsinitvals15";
3805                 else
3806                         goto fail1;
3807                 break;
3808         case BWN_PHYTYPE_N:
3809                 if (rev >= 11 && rev <= 12)
3810                         filename = "n0bsinitvals11";
3811                 else
3812                         goto fail1;
3813                 break;
3814         default:
3815                 goto fail1;
3816         }
3817         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
3818         if (error) {
3819                 bwn_release_firmware(mac);
3820                 return (error);
3821         }
3822         return (0);
3823 fail1:
3824         device_printf(sc->sc_dev, "no INITVALS for rev %d\n", rev);
3825         bwn_release_firmware(mac);
3826         return (EOPNOTSUPP);
3827 }
3828
3829 static int
3830 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
3831     const char *name, struct bwn_fwfile *bfw)
3832 {
3833         const struct bwn_fwhdr *hdr;
3834         struct bwn_softc *sc = mac->mac_sc;
3835         const struct firmware *fw;
3836         char namebuf[64];
3837
3838         if (name == NULL) {
3839                 bwn_do_release_fw(bfw);
3840                 return (0);
3841         }
3842         if (bfw->filename != NULL) {
3843                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
3844                         return (0);
3845                 bwn_do_release_fw(bfw);
3846         }
3847
3848         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
3849             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
3850             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
3851         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
3852         fw = firmware_get(namebuf);
3853         if (fw == NULL) {
3854                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
3855                     namebuf);
3856                 return (ENOENT);
3857         }
3858         if (fw->datasize < sizeof(struct bwn_fwhdr))
3859                 goto fail;
3860         hdr = (const struct bwn_fwhdr *)(fw->data);
3861         switch (hdr->type) {
3862         case BWN_FWTYPE_UCODE:
3863         case BWN_FWTYPE_PCM:
3864                 if (be32toh(hdr->size) !=
3865                     (fw->datasize - sizeof(struct bwn_fwhdr)))
3866                         goto fail;
3867                 /* FALLTHROUGH */
3868         case BWN_FWTYPE_IV:
3869                 if (hdr->ver != 1)
3870                         goto fail;
3871                 break;
3872         default:
3873                 goto fail;
3874         }
3875         bfw->filename = name;
3876         bfw->fw = fw;
3877         bfw->type = type;
3878         return (0);
3879 fail:
3880         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
3881         if (fw != NULL)
3882                 firmware_put(fw, FIRMWARE_UNLOAD);
3883         return (EPROTO);
3884 }
3885
3886 static void
3887 bwn_release_firmware(struct bwn_mac *mac)
3888 {
3889
3890         bwn_do_release_fw(&mac->mac_fw.ucode);
3891         bwn_do_release_fw(&mac->mac_fw.pcm);
3892         bwn_do_release_fw(&mac->mac_fw.initvals);
3893         bwn_do_release_fw(&mac->mac_fw.initvals_band);
3894 }
3895
3896 static void
3897 bwn_do_release_fw(struct bwn_fwfile *bfw)
3898 {
3899
3900         if (bfw->fw != NULL)
3901                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
3902         bfw->fw = NULL;
3903         bfw->filename = NULL;
3904 }
3905
3906 static int
3907 bwn_fw_loaducode(struct bwn_mac *mac)
3908 {
3909 #define GETFWOFFSET(fwp, offset)        \
3910         ((const uint32_t *)((const char *)fwp.fw->data + offset))
3911 #define GETFWSIZE(fwp, offset)  \
3912         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
3913         struct bwn_softc *sc = mac->mac_sc;
3914         const uint32_t *data;
3915         unsigned int i;
3916         uint32_t ctl;
3917         uint16_t date, fwcaps, time;
3918         int error = 0;
3919
3920         ctl = BWN_READ_4(mac, BWN_MACCTL);
3921         ctl |= BWN_MACCTL_MCODE_JMP0;
3922         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
3923             __LINE__));
3924         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3925         for (i = 0; i < 64; i++)
3926                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
3927         for (i = 0; i < 4096; i += 2)
3928                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
3929
3930         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3931         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
3932         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3933              i++) {
3934                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3935                 DELAY(10);
3936         }
3937
3938         if (mac->mac_fw.pcm.fw) {
3939                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
3940                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
3941                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
3942                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
3943                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
3944                     sizeof(struct bwn_fwhdr)); i++) {
3945                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3946                         DELAY(10);
3947                 }
3948         }
3949
3950         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
3951         BWN_WRITE_4(mac, BWN_MACCTL,
3952             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
3953             BWN_MACCTL_MCODE_RUN);
3954
3955         for (i = 0; i < 21; i++) {
3956                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
3957                         break;
3958                 if (i >= 20) {
3959                         device_printf(sc->sc_dev, "ucode timeout\n");
3960                         error = ENXIO;
3961                         goto error;
3962                 }
3963                 DELAY(50000);
3964         }
3965         BWN_READ_4(mac, BWN_INTR_REASON);
3966
3967         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
3968         if (mac->mac_fw.rev <= 0x128) {
3969                 device_printf(sc->sc_dev, "the firmware is too old\n");
3970                 error = EOPNOTSUPP;
3971                 goto error;
3972         }
3973         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
3974             BWN_SHARED_UCODE_PATCH);
3975         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
3976         mac->mac_fw.opensource = (date == 0xffff);
3977         if (bwn_wme != 0)
3978                 mac->mac_flags |= BWN_MAC_FLAG_WME;
3979         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
3980
3981         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
3982         if (mac->mac_fw.opensource == 0) {
3983                 device_printf(sc->sc_dev,
3984                     "firmware version (rev %u patch %u date %#x time %#x)\n",
3985                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
3986                 if (mac->mac_fw.no_pcmfile)
3987                         device_printf(sc->sc_dev,
3988                             "no HW crypto acceleration due to pcm5\n");
3989         } else {
3990                 mac->mac_fw.patch = time;
3991                 fwcaps = bwn_fwcaps_read(mac);
3992                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
3993                         device_printf(sc->sc_dev,
3994                             "disabling HW crypto acceleration\n");
3995                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
3996                 }
3997                 if (!(fwcaps & BWN_FWCAPS_WME)) {
3998                         device_printf(sc->sc_dev, "disabling WME support\n");
3999                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4000                 }
4001         }
4002
4003         if (BWN_ISOLDFMT(mac))
4004                 device_printf(sc->sc_dev, "using old firmware image\n");
4005
4006         return (0);
4007
4008 error:
4009         BWN_WRITE_4(mac, BWN_MACCTL,
4010             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4011             BWN_MACCTL_MCODE_JMP0);
4012
4013         return (error);
4014 #undef GETFWSIZE
4015 #undef GETFWOFFSET
4016 }
4017
4018 /* OpenFirmware only */
4019 static uint16_t
4020 bwn_fwcaps_read(struct bwn_mac *mac)
4021 {
4022
4023         KASSERT(mac->mac_fw.opensource == 1,
4024             ("%s:%d: fail", __func__, __LINE__));
4025         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4026 }
4027
4028 static int
4029 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4030     size_t count, size_t array_size)
4031 {
4032 #define GET_NEXTIV16(iv)                                                \
4033         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4034             sizeof(uint16_t) + sizeof(uint16_t)))
4035 #define GET_NEXTIV32(iv)                                                \
4036         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4037             sizeof(uint16_t) + sizeof(uint32_t)))
4038         struct bwn_softc *sc = mac->mac_sc;
4039         const struct bwn_fwinitvals *iv;
4040         uint16_t offset;
4041         size_t i;
4042         uint8_t bit32;
4043
4044         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4045             ("%s:%d: fail", __func__, __LINE__));
4046         iv = ivals;
4047         for (i = 0; i < count; i++) {
4048                 if (array_size < sizeof(iv->offset_size))
4049                         goto fail;
4050                 array_size -= sizeof(iv->offset_size);
4051                 offset = be16toh(iv->offset_size);
4052                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4053                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4054                 if (offset >= 0x1000)
4055                         goto fail;
4056                 if (bit32) {
4057                         if (array_size < sizeof(iv->data.d32))
4058                                 goto fail;
4059                         array_size -= sizeof(iv->data.d32);
4060                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4061                         iv = GET_NEXTIV32(iv);
4062                 } else {
4063
4064                         if (array_size < sizeof(iv->data.d16))
4065                                 goto fail;
4066                         array_size -= sizeof(iv->data.d16);
4067                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4068
4069                         iv = GET_NEXTIV16(iv);
4070                 }
4071         }
4072         if (array_size != 0)
4073                 goto fail;
4074         return (0);
4075 fail:
4076         device_printf(sc->sc_dev, "initvals: invalid format\n");
4077         return (EPROTO);
4078 #undef GET_NEXTIV16
4079 #undef GET_NEXTIV32
4080 }
4081
4082 int
4083 bwn_switch_channel(struct bwn_mac *mac, int chan)
4084 {
4085         struct bwn_phy *phy = &(mac->mac_phy);
4086         struct bwn_softc *sc = mac->mac_sc;
4087         struct ieee80211com *ic = &sc->sc_ic;
4088         uint16_t channelcookie, savedcookie;
4089         int error;
4090
4091         if (chan == 0xffff)
4092                 chan = phy->get_default_chan(mac);
4093
4094         channelcookie = chan;
4095         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4096                 channelcookie |= 0x100;
4097         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4098         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4099         error = phy->switch_channel(mac, chan);
4100         if (error)
4101                 goto fail;
4102
4103         mac->mac_phy.chan = chan;
4104         DELAY(8000);
4105         return (0);
4106 fail:
4107         device_printf(sc->sc_dev, "failed to switch channel\n");
4108         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4109         return (error);
4110 }
4111
4112 static uint16_t
4113 bwn_ant2phy(int antenna)
4114 {
4115
4116         switch (antenna) {
4117         case BWN_ANT0:
4118                 return (BWN_TX_PHY_ANT0);
4119         case BWN_ANT1:
4120                 return (BWN_TX_PHY_ANT1);
4121         case BWN_ANT2:
4122                 return (BWN_TX_PHY_ANT2);
4123         case BWN_ANT3:
4124                 return (BWN_TX_PHY_ANT3);
4125         case BWN_ANTAUTO:
4126                 return (BWN_TX_PHY_ANT01AUTO);
4127         }
4128         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4129         return (0);
4130 }
4131
4132 static void
4133 bwn_wme_load(struct bwn_mac *mac)
4134 {
4135         struct bwn_softc *sc = mac->mac_sc;
4136         int i;
4137
4138         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4139             ("%s:%d: fail", __func__, __LINE__));
4140
4141         bwn_mac_suspend(mac);
4142         for (i = 0; i < N(sc->sc_wmeParams); i++)
4143                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4144                     bwn_wme_shm_offsets[i]);
4145         bwn_mac_enable(mac);
4146 }
4147
4148 static void
4149 bwn_wme_loadparams(struct bwn_mac *mac,
4150     const struct wmeParams *p, uint16_t shm_offset)
4151 {
4152 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4153         struct bwn_softc *sc = mac->mac_sc;
4154         uint16_t params[BWN_NR_WMEPARAMS];
4155         int slot, tmp;
4156         unsigned int i;
4157
4158         slot = BWN_READ_2(mac, BWN_RNG) &
4159             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4160
4161         memset(&params, 0, sizeof(params));
4162
4163         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4164             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4165             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4166
4167         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4168         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4169         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4170         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4171         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4172         params[BWN_WMEPARAM_BSLOTS] = slot;
4173         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4174
4175         for (i = 0; i < N(params); i++) {
4176                 if (i == BWN_WMEPARAM_STATUS) {
4177                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4178                             shm_offset + (i * 2));
4179                         tmp |= 0x100;
4180                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4181                             tmp);
4182                 } else {
4183                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4184                             params[i]);
4185                 }
4186         }
4187 }
4188
4189 static void
4190 bwn_mac_write_bssid(struct bwn_mac *mac)
4191 {
4192         struct bwn_softc *sc = mac->mac_sc;
4193         uint32_t tmp;
4194         int i;
4195         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4196
4197         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4198         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4199         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4200             IEEE80211_ADDR_LEN);
4201
4202         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4203                 tmp = (uint32_t) (mac_bssid[i + 0]);
4204                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4205                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4206                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4207                 bwn_ram_write(mac, 0x20 + i, tmp);
4208         }
4209 }
4210
4211 static void
4212 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4213     const uint8_t *macaddr)
4214 {
4215         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4216         uint16_t data;
4217
4218         if (!mac)
4219                 macaddr = zero;
4220
4221         offset |= 0x0020;
4222         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4223
4224         data = macaddr[0];
4225         data |= macaddr[1] << 8;
4226         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4227         data = macaddr[2];
4228         data |= macaddr[3] << 8;
4229         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4230         data = macaddr[4];
4231         data |= macaddr[5] << 8;
4232         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4233 }
4234
4235 static void
4236 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4237     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4238 {
4239         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4240         uint8_t per_sta_keys_start = 8;
4241
4242         if (BWN_SEC_NEWAPI(mac))
4243                 per_sta_keys_start = 4;
4244
4245         KASSERT(index < mac->mac_max_nr_keys,
4246             ("%s:%d: fail", __func__, __LINE__));
4247         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4248             ("%s:%d: fail", __func__, __LINE__));
4249
4250         if (index >= per_sta_keys_start)
4251                 bwn_key_macwrite(mac, index, NULL);
4252         if (key)
4253                 memcpy(buf, key, key_len);
4254         bwn_key_write(mac, index, algorithm, buf);
4255         if (index >= per_sta_keys_start)
4256                 bwn_key_macwrite(mac, index, mac_addr);
4257
4258         mac->mac_key[index].algorithm = algorithm;
4259 }
4260
4261 static void
4262 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4263 {
4264         struct bwn_softc *sc = mac->mac_sc;
4265         uint32_t addrtmp[2] = { 0, 0 };
4266         uint8_t start = 8;
4267
4268         if (BWN_SEC_NEWAPI(mac))
4269                 start = 4;
4270
4271         KASSERT(index >= start,
4272             ("%s:%d: fail", __func__, __LINE__));
4273         index -= start;
4274
4275         if (addr) {
4276                 addrtmp[0] = addr[0];
4277                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4278                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4279                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4280                 addrtmp[1] = addr[4];
4281                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4282         }
4283
4284         if (siba_get_revid(sc->sc_dev) >= 5) {
4285                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4286                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4287         } else {
4288                 if (index >= 8) {
4289                         bwn_shm_write_4(mac, BWN_SHARED,
4290                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4291                         bwn_shm_write_2(mac, BWN_SHARED,
4292                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4293                 }
4294         }
4295 }
4296
4297 static void
4298 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4299     const uint8_t *key)
4300 {
4301         unsigned int i;
4302         uint32_t offset;
4303         uint16_t kidx, value;
4304
4305         kidx = BWN_SEC_KEY2FW(mac, index);
4306         bwn_shm_write_2(mac, BWN_SHARED,
4307             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4308
4309         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4310         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4311                 value = key[i];
4312                 value |= (uint16_t)(key[i + 1]) << 8;
4313                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4314         }
4315 }
4316
4317 static void
4318 bwn_phy_exit(struct bwn_mac *mac)
4319 {
4320
4321         mac->mac_phy.rf_onoff(mac, 0);
4322         if (mac->mac_phy.exit != NULL)
4323                 mac->mac_phy.exit(mac);
4324 }
4325
4326 static void
4327 bwn_dma_free(struct bwn_mac *mac)
4328 {
4329         struct bwn_dma *dma;
4330
4331         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4332                 return;
4333         dma = &mac->mac_method.dma;
4334
4335         bwn_dma_ringfree(&dma->rx);
4336         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4337         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4338         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4339         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4340         bwn_dma_ringfree(&dma->mcast);
4341 }
4342
4343 static void
4344 bwn_core_stop(struct bwn_mac *mac)
4345 {
4346         struct bwn_softc *sc = mac->mac_sc;
4347
4348         BWN_ASSERT_LOCKED(sc);
4349
4350         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4351                 return;
4352
4353         callout_stop(&sc->sc_rfswitch_ch);
4354         callout_stop(&sc->sc_task_ch);
4355         callout_stop(&sc->sc_watchdog_ch);
4356         sc->sc_watchdog_timer = 0;
4357         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4358         BWN_READ_4(mac, BWN_INTR_MASK);
4359         bwn_mac_suspend(mac);
4360
4361         mac->mac_status = BWN_MAC_STATUS_INITED;
4362 }
4363
4364 static int
4365 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4366 {
4367         struct bwn_mac *up_dev = NULL;
4368         struct bwn_mac *down_dev;
4369         struct bwn_mac *mac;
4370         int err, status;
4371         uint8_t gmode;
4372
4373         BWN_ASSERT_LOCKED(sc);
4374
4375         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4376                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4377                     mac->mac_phy.supports_2ghz) {
4378                         up_dev = mac;
4379                         gmode = 1;
4380                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4381                     mac->mac_phy.supports_5ghz) {
4382                         up_dev = mac;
4383                         gmode = 0;
4384                 } else {
4385                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4386                         return (EINVAL);
4387                 }
4388                 if (up_dev != NULL)
4389                         break;
4390         }
4391         if (up_dev == NULL) {
4392                 device_printf(sc->sc_dev, "Could not find a device\n");
4393                 return (ENODEV);
4394         }
4395         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4396                 return (0);
4397
4398         device_printf(sc->sc_dev, "switching to %s-GHz band\n",
4399             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4400
4401         down_dev = sc->sc_curmac;
4402         status = down_dev->mac_status;
4403         if (status >= BWN_MAC_STATUS_STARTED)
4404                 bwn_core_stop(down_dev);
4405         if (status >= BWN_MAC_STATUS_INITED)
4406                 bwn_core_exit(down_dev);
4407
4408         if (down_dev != up_dev)
4409                 bwn_phy_reset(down_dev);
4410
4411         up_dev->mac_phy.gmode = gmode;
4412         if (status >= BWN_MAC_STATUS_INITED) {
4413                 err = bwn_core_init(up_dev);
4414                 if (err) {
4415                         device_printf(sc->sc_dev,
4416                             "fatal: failed to initialize for %s-GHz\n",
4417                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4418                         goto fail;
4419                 }
4420         }
4421         if (status >= BWN_MAC_STATUS_STARTED)
4422                 bwn_core_start(up_dev);
4423         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4424         sc->sc_curmac = up_dev;
4425
4426         return (0);
4427 fail:
4428         sc->sc_curmac = NULL;
4429         return (err);
4430 }
4431
4432 static void
4433 bwn_rf_turnon(struct bwn_mac *mac)
4434 {
4435
4436         bwn_mac_suspend(mac);
4437         mac->mac_phy.rf_onoff(mac, 1);
4438         mac->mac_phy.rf_on = 1;
4439         bwn_mac_enable(mac);
4440 }
4441
4442 static void
4443 bwn_rf_turnoff(struct bwn_mac *mac)
4444 {
4445
4446         bwn_mac_suspend(mac);
4447         mac->mac_phy.rf_onoff(mac, 0);
4448         mac->mac_phy.rf_on = 0;
4449         bwn_mac_enable(mac);
4450 }
4451
4452 static void
4453 bwn_phy_reset(struct bwn_mac *mac)
4454 {
4455         struct bwn_softc *sc = mac->mac_sc;
4456
4457         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4458             ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4459              BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4460         DELAY(1000);
4461         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4462             (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC) |
4463             BWN_TGSLOW_PHYRESET);
4464         DELAY(1000);
4465 }
4466
4467 static int
4468 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4469 {
4470         struct bwn_vap *bvp = BWN_VAP(vap);
4471         struct ieee80211com *ic= vap->iv_ic;
4472         enum ieee80211_state ostate = vap->iv_state;
4473         struct bwn_softc *sc = ic->ic_softc;
4474         struct bwn_mac *mac = sc->sc_curmac;
4475         int error;
4476
4477         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4478             ieee80211_state_name[vap->iv_state],
4479             ieee80211_state_name[nstate]);
4480
4481         error = bvp->bv_newstate(vap, nstate, arg);
4482         if (error != 0)
4483                 return (error);
4484
4485         BWN_LOCK(sc);
4486
4487         bwn_led_newstate(mac, nstate);
4488
4489         /*
4490          * Clear the BSSID when we stop a STA
4491          */
4492         if (vap->iv_opmode == IEEE80211_M_STA) {
4493                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4494                         /*
4495                          * Clear out the BSSID.  If we reassociate to
4496                          * the same AP, this will reinialize things
4497                          * correctly...
4498                          */
4499                         if (ic->ic_opmode == IEEE80211_M_STA &&
4500                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4501                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4502                                 bwn_set_macaddr(mac);
4503                         }
4504                 }
4505         }
4506
4507         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4508             vap->iv_opmode == IEEE80211_M_AHDEMO) {
4509                 /* XXX nothing to do? */
4510         } else if (nstate == IEEE80211_S_RUN) {
4511                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4512                 bwn_set_opmode(mac);
4513                 bwn_set_pretbtt(mac);
4514                 bwn_spu_setdelay(mac, 0);
4515                 bwn_set_macaddr(mac);
4516         }
4517
4518         BWN_UNLOCK(sc);
4519
4520         return (error);
4521 }
4522
4523 static void
4524 bwn_set_pretbtt(struct bwn_mac *mac)
4525 {
4526         struct bwn_softc *sc = mac->mac_sc;
4527         struct ieee80211com *ic = &sc->sc_ic;
4528         uint16_t pretbtt;
4529
4530         if (ic->ic_opmode == IEEE80211_M_IBSS)
4531                 pretbtt = 2;
4532         else
4533                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4534         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4535         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4536 }
4537
4538 static int
4539 bwn_intr(void *arg)
4540 {
4541         struct bwn_mac *mac = arg;
4542         struct bwn_softc *sc = mac->mac_sc;
4543         uint32_t reason;
4544
4545         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4546             (sc->sc_flags & BWN_FLAG_INVALID))
4547                 return (FILTER_STRAY);
4548
4549         reason = BWN_READ_4(mac, BWN_INTR_REASON);
4550         if (reason == 0xffffffff)       /* shared IRQ */
4551                 return (FILTER_STRAY);
4552         reason &= mac->mac_intr_mask;
4553         if (reason == 0)
4554                 return (FILTER_HANDLED);
4555
4556         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4557         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4558         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4559         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4560         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4561         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4562         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4563         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4564         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4565         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4566         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4567
4568         /* Disable interrupts. */
4569         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4570
4571         mac->mac_reason_intr = reason;
4572
4573         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4574         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4575
4576         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4577         return (FILTER_HANDLED);
4578 }
4579
4580 static void
4581 bwn_intrtask(void *arg, int npending)
4582 {
4583         struct bwn_mac *mac = arg;
4584         struct bwn_softc *sc = mac->mac_sc;
4585         uint32_t merged = 0;
4586         int i, tx = 0, rx = 0;
4587
4588         BWN_LOCK(sc);
4589         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4590             (sc->sc_flags & BWN_FLAG_INVALID)) {
4591                 BWN_UNLOCK(sc);
4592                 return;
4593         }
4594
4595         for (i = 0; i < N(mac->mac_reason); i++)
4596                 merged |= mac->mac_reason[i];
4597
4598         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4599                 device_printf(sc->sc_dev, "MAC trans error\n");
4600
4601         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4602                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4603                 mac->mac_phy.txerrors--;
4604                 if (mac->mac_phy.txerrors == 0) {
4605                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4606                         bwn_restart(mac, "PHY TX errors");
4607                 }
4608         }
4609
4610         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4611                 if (merged & BWN_DMAINTR_FATALMASK) {
4612                         device_printf(sc->sc_dev,
4613                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4614                             mac->mac_reason[0], mac->mac_reason[1],
4615                             mac->mac_reason[2], mac->mac_reason[3],
4616                             mac->mac_reason[4], mac->mac_reason[5]);
4617                         bwn_restart(mac, "DMA error");
4618                         BWN_UNLOCK(sc);
4619                         return;
4620                 }
4621                 if (merged & BWN_DMAINTR_NONFATALMASK) {
4622                         device_printf(sc->sc_dev,
4623                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
4624                             mac->mac_reason[0], mac->mac_reason[1],
4625                             mac->mac_reason[2], mac->mac_reason[3],
4626                             mac->mac_reason[4], mac->mac_reason[5]);
4627                 }
4628         }
4629
4630         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4631                 bwn_intr_ucode_debug(mac);
4632         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4633                 bwn_intr_tbtt_indication(mac);
4634         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4635                 bwn_intr_atim_end(mac);
4636         if (mac->mac_reason_intr & BWN_INTR_BEACON)
4637                 bwn_intr_beacon(mac);
4638         if (mac->mac_reason_intr & BWN_INTR_PMQ)
4639                 bwn_intr_pmq(mac);
4640         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4641                 bwn_intr_noise(mac);
4642
4643         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4644                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4645                         bwn_dma_rx(mac->mac_method.dma.rx);
4646                         rx = 1;
4647                 }
4648         } else
4649                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4650
4651         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4652         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4653         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4654         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4655         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4656
4657         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4658                 bwn_intr_txeof(mac);
4659                 tx = 1;
4660         }
4661
4662         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4663
4664         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4665                 int evt = BWN_LED_EVENT_NONE;
4666
4667                 if (tx && rx) {
4668                         if (sc->sc_rx_rate > sc->sc_tx_rate)
4669                                 evt = BWN_LED_EVENT_RX;
4670                         else
4671                                 evt = BWN_LED_EVENT_TX;
4672                 } else if (tx) {
4673                         evt = BWN_LED_EVENT_TX;
4674                 } else if (rx) {
4675                         evt = BWN_LED_EVENT_RX;
4676                 } else if (rx == 0) {
4677                         evt = BWN_LED_EVENT_POLL;
4678                 }
4679
4680                 if (evt != BWN_LED_EVENT_NONE)
4681                         bwn_led_event(mac, evt);
4682        }
4683
4684         if (mbufq_first(&sc->sc_snd) != NULL)
4685                 bwn_start(sc);
4686
4687         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4688         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4689
4690         BWN_UNLOCK(sc);
4691 }
4692
4693 static void
4694 bwn_restart(struct bwn_mac *mac, const char *msg)
4695 {
4696         struct bwn_softc *sc = mac->mac_sc;
4697         struct ieee80211com *ic = &sc->sc_ic;
4698
4699         if (mac->mac_status < BWN_MAC_STATUS_INITED)
4700                 return;
4701
4702         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4703         ieee80211_runtask(ic, &mac->mac_hwreset);
4704 }
4705
4706 static void
4707 bwn_intr_ucode_debug(struct bwn_mac *mac)
4708 {
4709         struct bwn_softc *sc = mac->mac_sc;
4710         uint16_t reason;
4711
4712         if (mac->mac_fw.opensource == 0)
4713                 return;
4714
4715         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4716         switch (reason) {
4717         case BWN_DEBUGINTR_PANIC:
4718                 bwn_handle_fwpanic(mac);
4719                 break;
4720         case BWN_DEBUGINTR_DUMP_SHM:
4721                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4722                 break;
4723         case BWN_DEBUGINTR_DUMP_REGS:
4724                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4725                 break;
4726         case BWN_DEBUGINTR_MARKER:
4727                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4728                 break;
4729         default:
4730                 device_printf(sc->sc_dev,
4731                     "ucode debug unknown reason: %#x\n", reason);
4732         }
4733
4734         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4735             BWN_DEBUGINTR_ACK);
4736 }
4737
4738 static void
4739 bwn_intr_tbtt_indication(struct bwn_mac *mac)
4740 {
4741         struct bwn_softc *sc = mac->mac_sc;
4742         struct ieee80211com *ic = &sc->sc_ic;
4743
4744         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4745                 bwn_psctl(mac, 0);
4746         if (ic->ic_opmode == IEEE80211_M_IBSS)
4747                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4748 }
4749
4750 static void
4751 bwn_intr_atim_end(struct bwn_mac *mac)
4752 {
4753
4754         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4755                 BWN_WRITE_4(mac, BWN_MACCMD,
4756                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4757                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4758         }
4759 }
4760
4761 static void
4762 bwn_intr_beacon(struct bwn_mac *mac)
4763 {
4764         struct bwn_softc *sc = mac->mac_sc;
4765         struct ieee80211com *ic = &sc->sc_ic;
4766         uint32_t cmd, beacon0, beacon1;
4767
4768         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4769             ic->ic_opmode == IEEE80211_M_MBSS)
4770                 return;
4771
4772         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
4773
4774         cmd = BWN_READ_4(mac, BWN_MACCMD);
4775         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
4776         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
4777
4778         if (beacon0 && beacon1) {
4779                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
4780                 mac->mac_intr_mask |= BWN_INTR_BEACON;
4781                 return;
4782         }
4783
4784         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
4785                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
4786                 bwn_load_beacon0(mac);
4787                 bwn_load_beacon1(mac);
4788                 cmd = BWN_READ_4(mac, BWN_MACCMD);
4789                 cmd |= BWN_MACCMD_BEACON0_VALID;
4790                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4791         } else {
4792                 if (!beacon0) {
4793                         bwn_load_beacon0(mac);
4794                         cmd = BWN_READ_4(mac, BWN_MACCMD);
4795                         cmd |= BWN_MACCMD_BEACON0_VALID;
4796                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4797                 } else if (!beacon1) {
4798                         bwn_load_beacon1(mac);
4799                         cmd = BWN_READ_4(mac, BWN_MACCMD);
4800                         cmd |= BWN_MACCMD_BEACON1_VALID;
4801                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4802                 }
4803         }
4804 }
4805
4806 static void
4807 bwn_intr_pmq(struct bwn_mac *mac)
4808 {
4809         uint32_t tmp;
4810
4811         while (1) {
4812                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
4813                 if (!(tmp & 0x00000008))
4814                         break;
4815         }
4816         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
4817 }
4818
4819 static void
4820 bwn_intr_noise(struct bwn_mac *mac)
4821 {
4822         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
4823         uint16_t tmp;
4824         uint8_t noise[4];
4825         uint8_t i, j;
4826         int32_t average;
4827
4828         if (mac->mac_phy.type != BWN_PHYTYPE_G)
4829                 return;
4830
4831         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
4832         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
4833         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
4834             noise[3] == 0x7f)
4835                 goto new;
4836
4837         KASSERT(mac->mac_noise.noi_nsamples < 8,
4838             ("%s:%d: fail", __func__, __LINE__));
4839         i = mac->mac_noise.noi_nsamples;
4840         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
4841         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
4842         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
4843         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
4844         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
4845         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
4846         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
4847         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
4848         mac->mac_noise.noi_nsamples++;
4849         if (mac->mac_noise.noi_nsamples == 8) {
4850                 average = 0;
4851                 for (i = 0; i < 8; i++) {
4852                         for (j = 0; j < 4; j++)
4853                                 average += mac->mac_noise.noi_samples[i][j];
4854                 }
4855                 average = (((average / 32) * 125) + 64) / 128;
4856                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
4857                 if (tmp >= 8)
4858                         average += 2;
4859                 else
4860                         average -= 25;
4861                 average -= (tmp == 8) ? 72 : 48;
4862
4863                 mac->mac_stats.link_noise = average;
4864                 mac->mac_noise.noi_running = 0;
4865                 return;
4866         }
4867 new:
4868         bwn_noise_gensample(mac);
4869 }
4870
4871 static int
4872 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
4873 {
4874         struct bwn_mac *mac = prq->prq_mac;
4875         struct bwn_softc *sc = mac->mac_sc;
4876         unsigned int i;
4877
4878         BWN_ASSERT_LOCKED(sc);
4879
4880         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4881                 return (0);
4882
4883         for (i = 0; i < 5000; i++) {
4884                 if (bwn_pio_rxeof(prq) == 0)
4885                         break;
4886         }
4887         if (i >= 5000)
4888                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
4889         return ((i > 0) ? 1 : 0);
4890 }
4891
4892 static void
4893 bwn_dma_rx(struct bwn_dma_ring *dr)
4894 {
4895         int slot, curslot;
4896
4897         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
4898         curslot = dr->get_curslot(dr);
4899         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
4900             ("%s:%d: fail", __func__, __LINE__));
4901
4902         slot = dr->dr_curslot;
4903         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
4904                 bwn_dma_rxeof(dr, &slot);
4905
4906         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
4907             BUS_DMASYNC_PREWRITE);
4908
4909         dr->set_curslot(dr, slot);
4910         dr->dr_curslot = slot;
4911 }
4912
4913 static void
4914 bwn_intr_txeof(struct bwn_mac *mac)
4915 {
4916         struct bwn_txstatus stat;
4917         uint32_t stat0, stat1;
4918         uint16_t tmp;
4919
4920         BWN_ASSERT_LOCKED(mac->mac_sc);
4921
4922         while (1) {
4923                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
4924                 if (!(stat0 & 0x00000001))
4925                         break;
4926                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
4927
4928                 stat.cookie = (stat0 >> 16);
4929                 stat.seq = (stat1 & 0x0000ffff);
4930                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
4931                 tmp = (stat0 & 0x0000ffff);
4932                 stat.framecnt = ((tmp & 0xf000) >> 12);
4933                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
4934                 stat.sreason = ((tmp & 0x001c) >> 2);
4935                 stat.pm = (tmp & 0x0080) ? 1 : 0;
4936                 stat.im = (tmp & 0x0040) ? 1 : 0;
4937                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
4938                 stat.ack = (tmp & 0x0002) ? 1 : 0;
4939
4940                 bwn_handle_txeof(mac, &stat);
4941         }
4942 }
4943
4944 static void
4945 bwn_hwreset(void *arg, int npending)
4946 {
4947         struct bwn_mac *mac = arg;
4948         struct bwn_softc *sc = mac->mac_sc;
4949         int error = 0;
4950         int prev_status;
4951
4952         BWN_LOCK(sc);
4953
4954         prev_status = mac->mac_status;
4955         if (prev_status >= BWN_MAC_STATUS_STARTED)
4956                 bwn_core_stop(mac);
4957         if (prev_status >= BWN_MAC_STATUS_INITED)
4958                 bwn_core_exit(mac);
4959
4960         if (prev_status >= BWN_MAC_STATUS_INITED) {
4961                 error = bwn_core_init(mac);
4962                 if (error)
4963                         goto out;
4964         }
4965         if (prev_status >= BWN_MAC_STATUS_STARTED)
4966                 bwn_core_start(mac);
4967 out:
4968         if (error) {
4969                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
4970                 sc->sc_curmac = NULL;
4971         }
4972         BWN_UNLOCK(sc);
4973 }
4974
4975 static void
4976 bwn_handle_fwpanic(struct bwn_mac *mac)
4977 {
4978         struct bwn_softc *sc = mac->mac_sc;
4979         uint16_t reason;
4980
4981         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
4982         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
4983
4984         if (reason == BWN_FWPANIC_RESTART)
4985                 bwn_restart(mac, "ucode panic");
4986 }
4987
4988 static void
4989 bwn_load_beacon0(struct bwn_mac *mac)
4990 {
4991
4992         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4993 }
4994
4995 static void
4996 bwn_load_beacon1(struct bwn_mac *mac)
4997 {
4998
4999         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5000 }
5001
5002 static uint32_t
5003 bwn_jssi_read(struct bwn_mac *mac)
5004 {
5005         uint32_t val = 0;
5006
5007         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5008         val <<= 16;
5009         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5010
5011         return (val);
5012 }
5013
5014 static void
5015 bwn_noise_gensample(struct bwn_mac *mac)
5016 {
5017         uint32_t jssi = 0x7f7f7f7f;
5018
5019         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5020         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5021         BWN_WRITE_4(mac, BWN_MACCMD,
5022             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5023 }
5024
5025 static int
5026 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5027 {
5028         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5029
5030         return (dr->dr_numslots - dr->dr_usedslot);
5031 }
5032
5033 static int
5034 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5035 {
5036         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5037
5038         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5039             ("%s:%d: fail", __func__, __LINE__));
5040         if (slot == dr->dr_numslots - 1)
5041                 return (0);
5042         return (slot + 1);
5043 }
5044
5045 static void
5046 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5047 {
5048         struct bwn_mac *mac = dr->dr_mac;
5049         struct bwn_softc *sc = mac->mac_sc;
5050         struct bwn_dma *dma = &mac->mac_method.dma;
5051         struct bwn_dmadesc_generic *desc;
5052         struct bwn_dmadesc_meta *meta;
5053         struct bwn_rxhdr4 *rxhdr;
5054         struct mbuf *m;
5055         uint32_t macstat;
5056         int32_t tmp;
5057         int cnt = 0;
5058         uint16_t len;
5059
5060         dr->getdesc(dr, *slot, &desc, &meta);
5061
5062         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5063         m = meta->mt_m;
5064
5065         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5066                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5067                 return;
5068         }
5069
5070         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5071         len = le16toh(rxhdr->frame_len);
5072         if (len <= 0) {
5073                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5074                 return;
5075         }
5076         if (bwn_dma_check_redzone(dr, m)) {
5077                 device_printf(sc->sc_dev, "redzone error.\n");
5078                 bwn_dma_set_redzone(dr, m);
5079                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5080                     BUS_DMASYNC_PREWRITE);
5081                 return;
5082         }
5083         if (len > dr->dr_rx_bufsize) {
5084                 tmp = len;
5085                 while (1) {
5086                         dr->getdesc(dr, *slot, &desc, &meta);
5087                         bwn_dma_set_redzone(dr, meta->mt_m);
5088                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5089                             BUS_DMASYNC_PREWRITE);
5090                         *slot = bwn_dma_nextslot(dr, *slot);
5091                         cnt++;
5092                         tmp -= dr->dr_rx_bufsize;
5093                         if (tmp <= 0)
5094                                 break;
5095                 }
5096                 device_printf(sc->sc_dev, "too small buffer "
5097                        "(len %u buffer %u dropped %d)\n",
5098                        len, dr->dr_rx_bufsize, cnt);
5099                 return;
5100         }
5101         macstat = le32toh(rxhdr->mac_status);
5102         if (macstat & BWN_RX_MAC_FCSERR) {
5103                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5104                         device_printf(sc->sc_dev, "RX drop\n");
5105                         return;
5106                 }
5107         }
5108
5109         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5110         m_adj(m, dr->dr_frameoffset);
5111
5112         bwn_rxeof(dr->dr_mac, m, rxhdr);
5113 }
5114
5115 static void
5116 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5117 {
5118         struct bwn_dma_ring *dr;
5119         struct bwn_dmadesc_generic *desc;
5120         struct bwn_dmadesc_meta *meta;
5121         struct bwn_pio_txqueue *tq;
5122         struct bwn_pio_txpkt *tp = NULL;
5123         struct bwn_softc *sc = mac->mac_sc;
5124         struct bwn_stats *stats = &mac->mac_stats;
5125         struct ieee80211_node *ni;
5126         struct ieee80211vap *vap;
5127         int retrycnt = 0, slot;
5128
5129         BWN_ASSERT_LOCKED(mac->mac_sc);
5130
5131         if (status->im)
5132                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5133         if (status->ampdu)
5134                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5135         if (status->rtscnt) {
5136                 if (status->rtscnt == 0xf)
5137                         stats->rtsfail++;
5138                 else
5139                         stats->rts++;
5140         }
5141
5142         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5143                 if (status->ack) {
5144                         dr = bwn_dma_parse_cookie(mac, status,
5145                             status->cookie, &slot);
5146                         if (dr == NULL) {
5147                                 device_printf(sc->sc_dev,
5148                                     "failed to parse cookie\n");
5149                                 return;
5150                         }
5151                         while (1) {
5152                                 dr->getdesc(dr, slot, &desc, &meta);
5153                                 if (meta->mt_islast) {
5154                                         ni = meta->mt_ni;
5155                                         vap = ni->ni_vap;
5156                                         ieee80211_ratectl_tx_complete(vap, ni,
5157                                             status->ack ?
5158                                               IEEE80211_RATECTL_TX_SUCCESS :
5159                                               IEEE80211_RATECTL_TX_FAILURE,
5160                                             &retrycnt, 0);
5161                                         break;
5162                                 }
5163                                 slot = bwn_dma_nextslot(dr, slot);
5164                         }
5165                 }
5166                 bwn_dma_handle_txeof(mac, status);
5167         } else {
5168                 if (status->ack) {
5169                         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5170                         if (tq == NULL) {
5171                                 device_printf(sc->sc_dev,
5172                                     "failed to parse cookie\n");
5173                                 return;
5174                         }
5175                         ni = tp->tp_ni;
5176                         vap = ni->ni_vap;
5177                         ieee80211_ratectl_tx_complete(vap, ni,
5178                             status->ack ?
5179                               IEEE80211_RATECTL_TX_SUCCESS :
5180                               IEEE80211_RATECTL_TX_FAILURE,
5181                             &retrycnt, 0);
5182                 }
5183                 bwn_pio_handle_txeof(mac, status);
5184         }
5185
5186         bwn_phy_txpower_check(mac, 0);
5187 }
5188
5189 static uint8_t
5190 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5191 {
5192         struct bwn_mac *mac = prq->prq_mac;
5193         struct bwn_softc *sc = mac->mac_sc;
5194         struct bwn_rxhdr4 rxhdr;
5195         struct mbuf *m;
5196         uint32_t ctl32, macstat, v32;
5197         unsigned int i, padding;
5198         uint16_t ctl16, len, totlen, v16;
5199         unsigned char *mp;
5200         char *data;
5201
5202         memset(&rxhdr, 0, sizeof(rxhdr));
5203
5204         if (prq->prq_rev >= 8) {
5205                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5206                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5207                         return (0);
5208                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5209                     BWN_PIO8_RXCTL_FRAMEREADY);
5210                 for (i = 0; i < 10; i++) {
5211                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5212                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5213                                 goto ready;
5214                         DELAY(10);
5215                 }
5216         } else {
5217                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5218                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5219                         return (0);
5220                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5221                     BWN_PIO_RXCTL_FRAMEREADY);
5222                 for (i = 0; i < 10; i++) {
5223                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5224                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5225                                 goto ready;
5226                         DELAY(10);
5227                 }
5228         }
5229         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5230         return (1);
5231 ready:
5232         if (prq->prq_rev >= 8)
5233                 siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5234                     prq->prq_base + BWN_PIO8_RXDATA);
5235         else
5236                 siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5237                     prq->prq_base + BWN_PIO_RXDATA);
5238         len = le16toh(rxhdr.frame_len);
5239         if (len > 0x700) {
5240                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5241                 goto error;
5242         }
5243         if (len == 0) {
5244                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5245                 goto error;
5246         }
5247
5248         macstat = le32toh(rxhdr.mac_status);
5249         if (macstat & BWN_RX_MAC_FCSERR) {
5250                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5251                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5252                         goto error;
5253                 }
5254         }
5255
5256         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5257         totlen = len + padding;
5258         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5259         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5260         if (m == NULL) {
5261                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5262                 goto error;
5263         }
5264         mp = mtod(m, unsigned char *);
5265         if (prq->prq_rev >= 8) {
5266                 siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5267                     prq->prq_base + BWN_PIO8_RXDATA);
5268                 if (totlen & 3) {
5269                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5270                         data = &(mp[totlen - 1]);
5271                         switch (totlen & 3) {
5272                         case 3:
5273                                 *data = (v32 >> 16);
5274                                 data--;
5275                         case 2:
5276                                 *data = (v32 >> 8);
5277                                 data--;
5278                         case 1:
5279                                 *data = v32;
5280                         }
5281                 }
5282         } else {
5283                 siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5284                     prq->prq_base + BWN_PIO_RXDATA);
5285                 if (totlen & 1) {
5286                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5287                         mp[totlen - 1] = v16;
5288                 }
5289         }
5290
5291         m->m_len = m->m_pkthdr.len = totlen;
5292
5293         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5294
5295         return (1);
5296 error:
5297         if (prq->prq_rev >= 8)
5298                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5299                     BWN_PIO8_RXCTL_DATAREADY);
5300         else
5301                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5302         return (1);
5303 }
5304
5305 static int
5306 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5307     struct bwn_dmadesc_meta *meta, int init)
5308 {
5309         struct bwn_mac *mac = dr->dr_mac;
5310         struct bwn_dma *dma = &mac->mac_method.dma;
5311         struct bwn_rxhdr4 *hdr;
5312         bus_dmamap_t map;
5313         bus_addr_t paddr;
5314         struct mbuf *m;
5315         int error;
5316
5317         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5318         if (m == NULL) {
5319                 error = ENOBUFS;
5320
5321                 /*
5322                  * If the NIC is up and running, we need to:
5323                  * - Clear RX buffer's header.
5324                  * - Restore RX descriptor settings.
5325                  */
5326                 if (init)
5327                         return (error);
5328                 else
5329                         goto back;
5330         }
5331         m->m_len = m->m_pkthdr.len = MCLBYTES;
5332
5333         bwn_dma_set_redzone(dr, m);
5334
5335         /*
5336          * Try to load RX buf into temporary DMA map
5337          */
5338         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5339             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5340         if (error) {
5341                 m_freem(m);
5342
5343                 /*
5344                  * See the comment above
5345                  */
5346                 if (init)
5347                         return (error);
5348                 else
5349                         goto back;
5350         }
5351
5352         if (!init)
5353                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5354         meta->mt_m = m;
5355         meta->mt_paddr = paddr;
5356
5357         /*
5358          * Swap RX buf's DMA map with the loaded temporary one
5359          */
5360         map = meta->mt_dmap;
5361         meta->mt_dmap = dr->dr_spare_dmap;
5362         dr->dr_spare_dmap = map;
5363
5364 back:
5365         /*
5366          * Clear RX buf header
5367          */
5368         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5369         bzero(hdr, sizeof(*hdr));
5370         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5371             BUS_DMASYNC_PREWRITE);
5372
5373         /*
5374          * Setup RX buf descriptor
5375          */
5376         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5377             sizeof(*hdr), 0, 0, 0);
5378         return (error);
5379 }
5380
5381 static void
5382 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5383                  bus_size_t mapsz __unused, int error)
5384 {
5385
5386         if (!error) {
5387                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5388                 *((bus_addr_t *)arg) = seg->ds_addr;
5389         }
5390 }
5391
5392 static int
5393 bwn_hwrate2ieeerate(int rate)
5394 {
5395
5396         switch (rate) {
5397         case BWN_CCK_RATE_1MB:
5398                 return (2);
5399         case BWN_CCK_RATE_2MB:
5400                 return (4);
5401         case BWN_CCK_RATE_5MB:
5402                 return (11);
5403         case BWN_CCK_RATE_11MB:
5404                 return (22);
5405         case BWN_OFDM_RATE_6MB:
5406                 return (12);
5407         case BWN_OFDM_RATE_9MB:
5408                 return (18);
5409         case BWN_OFDM_RATE_12MB:
5410                 return (24);
5411         case BWN_OFDM_RATE_18MB:
5412                 return (36);
5413         case BWN_OFDM_RATE_24MB:
5414                 return (48);
5415         case BWN_OFDM_RATE_36MB:
5416                 return (72);
5417         case BWN_OFDM_RATE_48MB:
5418                 return (96);
5419         case BWN_OFDM_RATE_54MB:
5420                 return (108);
5421         default:
5422                 printf("Ooops\n");
5423                 return (0);
5424         }
5425 }
5426
5427 static void
5428 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5429 {
5430         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5431         struct bwn_plcp6 *plcp;
5432         struct bwn_softc *sc = mac->mac_sc;
5433         struct ieee80211_frame_min *wh;
5434         struct ieee80211_node *ni;
5435         struct ieee80211com *ic = &sc->sc_ic;
5436         uint32_t macstat;
5437         int padding, rate, rssi = 0, noise = 0, type;
5438         uint16_t phytype, phystat0, phystat3, chanstat;
5439         unsigned char *mp = mtod(m, unsigned char *);
5440         static int rx_mac_dec_rpt = 0;
5441
5442         BWN_ASSERT_LOCKED(sc);
5443
5444         phystat0 = le16toh(rxhdr->phy_status0);
5445         phystat3 = le16toh(rxhdr->phy_status3);
5446         macstat = le32toh(rxhdr->mac_status);
5447         chanstat = le16toh(rxhdr->channel);
5448         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5449
5450         if (macstat & BWN_RX_MAC_FCSERR)
5451                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5452         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5453                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5454         if (macstat & BWN_RX_MAC_DECERR)
5455                 goto drop;
5456
5457         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5458         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5459                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5460                     m->m_pkthdr.len);
5461                 goto drop;
5462         }
5463         plcp = (struct bwn_plcp6 *)(mp + padding);
5464         m_adj(m, sizeof(struct bwn_plcp6) + padding);
5465         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5466                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5467                     m->m_pkthdr.len);
5468                 goto drop;
5469         }
5470         wh = mtod(m, struct ieee80211_frame_min *);
5471
5472         if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5473                 device_printf(sc->sc_dev,
5474                     "RX decryption attempted (old %d keyidx %#x)\n",
5475                     BWN_ISOLDFMT(mac),
5476                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5477
5478         /* XXX calculating RSSI & noise & antenna */
5479
5480         if (phystat0 & BWN_RX_PHYST0_OFDM)
5481                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
5482                     phytype == BWN_PHYTYPE_A);
5483         else
5484                 rate = bwn_plcp_get_cckrate(mac, plcp);
5485         if (rate == -1) {
5486                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5487                         goto drop;
5488         }
5489         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5490
5491         /* RX radio tap */
5492         if (ieee80211_radiotap_active(ic))
5493                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5494         m_adj(m, -IEEE80211_CRC_LEN);
5495
5496         rssi = rxhdr->phy.abg.rssi;     /* XXX incorrect RSSI calculation? */
5497         noise = mac->mac_stats.link_noise;
5498
5499         BWN_UNLOCK(sc);
5500
5501         ni = ieee80211_find_rxnode(ic, wh);
5502         if (ni != NULL) {
5503                 type = ieee80211_input(ni, m, rssi, noise);
5504                 ieee80211_free_node(ni);
5505         } else
5506                 type = ieee80211_input_all(ic, m, rssi, noise);
5507
5508         BWN_LOCK(sc);
5509         return;
5510 drop:
5511         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5512 }
5513
5514 static void
5515 bwn_dma_handle_txeof(struct bwn_mac *mac,
5516     const struct bwn_txstatus *status)
5517 {
5518         struct bwn_dma *dma = &mac->mac_method.dma;
5519         struct bwn_dma_ring *dr;
5520         struct bwn_dmadesc_generic *desc;
5521         struct bwn_dmadesc_meta *meta;
5522         struct bwn_softc *sc = mac->mac_sc;
5523         int slot;
5524
5525         BWN_ASSERT_LOCKED(sc);
5526
5527         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5528         if (dr == NULL) {
5529                 device_printf(sc->sc_dev, "failed to parse cookie\n");
5530                 return;
5531         }
5532         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5533
5534         while (1) {
5535                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
5536                     ("%s:%d: fail", __func__, __LINE__));
5537                 dr->getdesc(dr, slot, &desc, &meta);
5538
5539                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5540                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5541                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5542                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5543
5544                 if (meta->mt_islast) {
5545                         KASSERT(meta->mt_m != NULL,
5546                             ("%s:%d: fail", __func__, __LINE__));
5547
5548                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5549                         meta->mt_ni = NULL;
5550                         meta->mt_m = NULL;
5551                 } else
5552                         KASSERT(meta->mt_m == NULL,
5553                             ("%s:%d: fail", __func__, __LINE__));
5554
5555                 dr->dr_usedslot--;
5556                 if (meta->mt_islast)
5557                         break;
5558                 slot = bwn_dma_nextslot(dr, slot);
5559         }
5560         sc->sc_watchdog_timer = 0;
5561         if (dr->dr_stop) {
5562                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5563                     ("%s:%d: fail", __func__, __LINE__));
5564                 dr->dr_stop = 0;
5565         }
5566 }
5567
5568 static void
5569 bwn_pio_handle_txeof(struct bwn_mac *mac,
5570     const struct bwn_txstatus *status)
5571 {
5572         struct bwn_pio_txqueue *tq;
5573         struct bwn_pio_txpkt *tp = NULL;
5574         struct bwn_softc *sc = mac->mac_sc;
5575
5576         BWN_ASSERT_LOCKED(sc);
5577
5578         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5579         if (tq == NULL)
5580                 return;
5581
5582         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5583         tq->tq_free++;
5584
5585         if (tp->tp_ni != NULL) {
5586                 /*
5587                  * Do any tx complete callback.  Note this must
5588                  * be done before releasing the node reference.
5589                  */
5590                 if (tp->tp_m->m_flags & M_TXCB)
5591                         ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5592                 ieee80211_free_node(tp->tp_ni);
5593                 tp->tp_ni = NULL;
5594         }
5595         m_freem(tp->tp_m);
5596         tp->tp_m = NULL;
5597         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5598
5599         sc->sc_watchdog_timer = 0;
5600 }
5601
5602 static void
5603 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5604 {
5605         struct bwn_softc *sc = mac->mac_sc;
5606         struct bwn_phy *phy = &mac->mac_phy;
5607         struct ieee80211com *ic = &sc->sc_ic;
5608         unsigned long now;
5609         int result;
5610
5611         BWN_GETTIME(now);
5612
5613         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5614                 return;
5615         phy->nexttime = now + 2 * 1000;
5616
5617         if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5618             siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5619                 return;
5620
5621         if (phy->recalc_txpwr != NULL) {
5622                 result = phy->recalc_txpwr(mac,
5623                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5624                 if (result == BWN_TXPWR_RES_DONE)
5625                         return;
5626                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
5627                     ("%s: fail", __func__));
5628                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
5629
5630                 ieee80211_runtask(ic, &mac->mac_txpower);
5631         }
5632 }
5633
5634 static uint16_t
5635 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
5636 {
5637
5638         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
5639 }
5640
5641 static uint32_t
5642 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
5643 {
5644
5645         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
5646 }
5647
5648 static void
5649 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
5650 {
5651
5652         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
5653 }
5654
5655 static void
5656 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
5657 {
5658
5659         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
5660 }
5661
5662 static int
5663 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
5664 {
5665
5666         switch (rate) {
5667         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
5668         case 12:
5669                 return (BWN_OFDM_RATE_6MB);
5670         case 18:
5671                 return (BWN_OFDM_RATE_9MB);
5672         case 24:
5673                 return (BWN_OFDM_RATE_12MB);
5674         case 36:
5675                 return (BWN_OFDM_RATE_18MB);
5676         case 48:
5677                 return (BWN_OFDM_RATE_24MB);
5678         case 72:
5679                 return (BWN_OFDM_RATE_36MB);
5680         case 96:
5681                 return (BWN_OFDM_RATE_48MB);
5682         case 108:
5683                 return (BWN_OFDM_RATE_54MB);
5684         /* CCK rates (NB: not IEEE std, device-specific) */
5685         case 2:
5686                 return (BWN_CCK_RATE_1MB);
5687         case 4:
5688                 return (BWN_CCK_RATE_2MB);
5689         case 11:
5690                 return (BWN_CCK_RATE_5MB);
5691         case 22:
5692                 return (BWN_CCK_RATE_11MB);
5693         }
5694
5695         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
5696         return (BWN_CCK_RATE_1MB);
5697 }
5698
5699 static int
5700 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
5701     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
5702 {
5703         const struct bwn_phy *phy = &mac->mac_phy;
5704         struct bwn_softc *sc = mac->mac_sc;
5705         struct ieee80211_frame *wh;
5706         struct ieee80211_frame *protwh;
5707         struct ieee80211_frame_cts *cts;
5708         struct ieee80211_frame_rts *rts;
5709         const struct ieee80211_txparam *tp;
5710         struct ieee80211vap *vap = ni->ni_vap;
5711         struct ieee80211com *ic = &sc->sc_ic;
5712         struct mbuf *mprot;
5713         unsigned int len;
5714         uint32_t macctl = 0;
5715         int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
5716         uint16_t phyctl = 0;
5717         uint8_t rate, rate_fb;
5718
5719         wh = mtod(m, struct ieee80211_frame *);
5720         memset(txhdr, 0, sizeof(*txhdr));
5721
5722         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
5723         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
5724         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
5725
5726         /*
5727          * Find TX rate
5728          */
5729         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
5730         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
5731                 rate = rate_fb = tp->mgmtrate;
5732         else if (ismcast)
5733                 rate = rate_fb = tp->mcastrate;
5734         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
5735                 rate = rate_fb = tp->ucastrate;
5736         else {
5737                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
5738                 rate = ni->ni_txrate;
5739
5740                 if (rix > 0)
5741                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
5742                             IEEE80211_RATE_VAL;
5743                 else
5744                         rate_fb = rate;
5745         }
5746
5747         sc->sc_tx_rate = rate;
5748
5749         rate = bwn_ieeerate2hwrate(sc, rate);
5750         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
5751
5752         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
5753             bwn_plcp_getcck(rate);
5754         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
5755         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
5756
5757         if ((rate_fb == rate) ||
5758             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
5759             (*(u_int16_t *)wh->i_dur == htole16(0)))
5760                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
5761         else
5762                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
5763                     m->m_pkthdr.len, rate, isshort);
5764
5765         /* XXX TX encryption */
5766         bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
5767             (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
5768             (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
5769             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
5770         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
5771             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
5772
5773         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
5774             BWN_TX_EFT_FB_CCK;
5775         txhdr->chan = phy->chan;
5776         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
5777             BWN_TX_PHY_ENC_CCK;
5778         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5779              rate == BWN_CCK_RATE_11MB))
5780                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
5781
5782         /* XXX TX antenna selection */
5783
5784         switch (bwn_antenna_sanitize(mac, 0)) {
5785         case 0:
5786                 phyctl |= BWN_TX_PHY_ANT01AUTO;
5787                 break;
5788         case 1:
5789                 phyctl |= BWN_TX_PHY_ANT0;
5790                 break;
5791         case 2:
5792                 phyctl |= BWN_TX_PHY_ANT1;
5793                 break;
5794         case 3:
5795                 phyctl |= BWN_TX_PHY_ANT2;
5796                 break;
5797         case 4:
5798                 phyctl |= BWN_TX_PHY_ANT3;
5799                 break;
5800         default:
5801                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5802         }
5803
5804         if (!ismcast)
5805                 macctl |= BWN_TX_MAC_ACK;
5806
5807         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
5808         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
5809             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
5810                 macctl |= BWN_TX_MAC_LONGFRAME;
5811
5812         if (ic->ic_flags & IEEE80211_F_USEPROT) {
5813                 /* XXX RTS rate is always 1MB??? */
5814                 rts_rate = BWN_CCK_RATE_1MB;
5815                 rts_rate_fb = bwn_get_fbrate(rts_rate);
5816
5817                 protdur = ieee80211_compute_duration(ic->ic_rt,
5818                     m->m_pkthdr.len, rate, isshort) +
5819                     + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
5820
5821                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
5822                         cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
5823                             (txhdr->body.old.rts_frame) :
5824                             (txhdr->body.new.rts_frame));
5825                         mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
5826                             protdur);
5827                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5828                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
5829                             mprot->m_pkthdr.len);
5830                         m_freem(mprot);
5831                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
5832                         len = sizeof(struct ieee80211_frame_cts);
5833                 } else {
5834                         rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
5835                             (txhdr->body.old.rts_frame) :
5836                             (txhdr->body.new.rts_frame));
5837                         protdur += ieee80211_ack_duration(ic->ic_rt, rate,
5838                             isshort);
5839                         mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
5840                             wh->i_addr2, protdur);
5841                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5842                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
5843                             mprot->m_pkthdr.len);
5844                         m_freem(mprot);
5845                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
5846                         len = sizeof(struct ieee80211_frame_rts);
5847                 }
5848                 len += IEEE80211_CRC_LEN;
5849                 bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
5850                     &txhdr->body.old.rts_plcp :
5851                     &txhdr->body.new.rts_plcp), len, rts_rate);
5852                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
5853                     rts_rate_fb);
5854
5855                 protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
5856                     (&txhdr->body.old.rts_frame) :
5857                     (&txhdr->body.new.rts_frame));
5858                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
5859
5860                 if (BWN_ISOFDMRATE(rts_rate)) {
5861                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
5862                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
5863                 } else {
5864                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
5865                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
5866                 }
5867                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
5868                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
5869         }
5870
5871         if (BWN_ISOLDFMT(mac))
5872                 txhdr->body.old.cookie = htole16(cookie);
5873         else
5874                 txhdr->body.new.cookie = htole16(cookie);
5875
5876         txhdr->macctl = htole32(macctl);
5877         txhdr->phyctl = htole16(phyctl);
5878
5879         /*
5880          * TX radio tap
5881          */
5882         if (ieee80211_radiotap_active_vap(vap)) {
5883                 sc->sc_tx_th.wt_flags = 0;
5884                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
5885                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5886                 if (isshort &&
5887                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5888                      rate == BWN_CCK_RATE_11MB))
5889                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
5890                 sc->sc_tx_th.wt_rate = rate;
5891
5892                 ieee80211_radiotap_tx(vap, m);
5893         }
5894
5895         return (0);
5896 }
5897
5898 static void
5899 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
5900     const uint8_t rate)
5901 {
5902         uint32_t d, plen;
5903         uint8_t *raw = plcp->o.raw;
5904
5905         if (BWN_ISOFDMRATE(rate)) {
5906                 d = bwn_plcp_getofdm(rate);
5907                 KASSERT(!(octets & 0xf000),
5908                     ("%s:%d: fail", __func__, __LINE__));
5909                 d |= (octets << 5);
5910                 plcp->o.data = htole32(d);
5911         } else {
5912                 plen = octets * 16 / rate;
5913                 if ((octets * 16 % rate) > 0) {
5914                         plen++;
5915                         if ((rate == BWN_CCK_RATE_11MB)
5916                             && ((octets * 8 % 11) < 4)) {
5917                                 raw[1] = 0x84;
5918                         } else
5919                                 raw[1] = 0x04;
5920                 } else
5921                         raw[1] = 0x04;
5922                 plcp->o.data |= htole32(plen << 16);
5923                 raw[0] = bwn_plcp_getcck(rate);
5924         }
5925 }
5926
5927 static uint8_t
5928 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
5929 {
5930         struct bwn_softc *sc = mac->mac_sc;
5931         uint8_t mask;
5932
5933         if (n == 0)
5934                 return (0);
5935         if (mac->mac_phy.gmode)
5936                 mask = siba_sprom_get_ant_bg(sc->sc_dev);
5937         else
5938                 mask = siba_sprom_get_ant_a(sc->sc_dev);
5939         if (!(mask & (1 << (n - 1))))
5940                 return (0);
5941         return (n);
5942 }
5943
5944 static uint8_t
5945 bwn_get_fbrate(uint8_t bitrate)
5946 {
5947         switch (bitrate) {
5948         case BWN_CCK_RATE_1MB:
5949                 return (BWN_CCK_RATE_1MB);
5950         case BWN_CCK_RATE_2MB:
5951                 return (BWN_CCK_RATE_1MB);
5952         case BWN_CCK_RATE_5MB:
5953                 return (BWN_CCK_RATE_2MB);
5954         case BWN_CCK_RATE_11MB:
5955                 return (BWN_CCK_RATE_5MB);
5956         case BWN_OFDM_RATE_6MB:
5957                 return (BWN_CCK_RATE_5MB);
5958         case BWN_OFDM_RATE_9MB:
5959                 return (BWN_OFDM_RATE_6MB);
5960         case BWN_OFDM_RATE_12MB:
5961                 return (BWN_OFDM_RATE_9MB);
5962         case BWN_OFDM_RATE_18MB:
5963                 return (BWN_OFDM_RATE_12MB);
5964         case BWN_OFDM_RATE_24MB:
5965                 return (BWN_OFDM_RATE_18MB);
5966         case BWN_OFDM_RATE_36MB:
5967                 return (BWN_OFDM_RATE_24MB);
5968         case BWN_OFDM_RATE_48MB:
5969                 return (BWN_OFDM_RATE_36MB);
5970         case BWN_OFDM_RATE_54MB:
5971                 return (BWN_OFDM_RATE_48MB);
5972         }
5973         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5974         return (0);
5975 }
5976
5977 static uint32_t
5978 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
5979     uint32_t ctl, const void *_data, int len)
5980 {
5981         struct bwn_softc *sc = mac->mac_sc;
5982         uint32_t value = 0;
5983         const uint8_t *data = _data;
5984
5985         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
5986             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
5987         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
5988
5989         siba_write_multi_4(sc->sc_dev, data, (len & ~3),
5990             tq->tq_base + BWN_PIO8_TXDATA);
5991         if (len & 3) {
5992                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
5993                     BWN_PIO8_TXCTL_24_31);
5994                 data = &(data[len - 1]);
5995                 switch (len & 3) {
5996                 case 3:
5997                         ctl |= BWN_PIO8_TXCTL_16_23;
5998                         value |= (uint32_t)(*data) << 16;
5999                         data--;
6000                 case 2:
6001                         ctl |= BWN_PIO8_TXCTL_8_15;
6002                         value |= (uint32_t)(*data) << 8;
6003                         data--;
6004                 case 1:
6005                         value |= (uint32_t)(*data);
6006                 }
6007                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6008                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6009         }
6010
6011         return (ctl);
6012 }
6013
6014 static void
6015 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6016     uint16_t offset, uint32_t value)
6017 {
6018
6019         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6020 }
6021
6022 static uint16_t
6023 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6024     uint16_t ctl, const void *_data, int len)
6025 {
6026         struct bwn_softc *sc = mac->mac_sc;
6027         const uint8_t *data = _data;
6028
6029         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6030         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6031
6032         siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6033             tq->tq_base + BWN_PIO_TXDATA);
6034         if (len & 1) {
6035                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6036                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6037                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6038         }
6039
6040         return (ctl);
6041 }
6042
6043 static uint16_t
6044 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6045     uint16_t ctl, struct mbuf *m0)
6046 {
6047         int i, j = 0;
6048         uint16_t data = 0;
6049         const uint8_t *buf;
6050         struct mbuf *m = m0;
6051
6052         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6053         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6054
6055         for (; m != NULL; m = m->m_next) {
6056                 buf = mtod(m, const uint8_t *);
6057                 for (i = 0; i < m->m_len; i++) {
6058                         if (!((j++) % 2))
6059                                 data |= buf[i];
6060                         else {
6061                                 data |= (buf[i] << 8);
6062                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6063                                 data = 0;
6064                         }
6065                 }
6066         }
6067         if (m0->m_pkthdr.len % 2) {
6068                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6069                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6070                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6071         }
6072
6073         return (ctl);
6074 }
6075
6076 static void
6077 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6078 {
6079
6080         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6081                 return;
6082         BWN_WRITE_2(mac, 0x684, 510 + time);
6083         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6084 }
6085
6086 static struct bwn_dma_ring *
6087 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6088 {
6089
6090         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6091                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6092
6093         switch (prio) {
6094         case 3:
6095                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6096         case 2:
6097                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6098         case 0:
6099                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6100         case 1:
6101                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6102         }
6103         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6104         return (NULL);
6105 }
6106
6107 static int
6108 bwn_dma_getslot(struct bwn_dma_ring *dr)
6109 {
6110         int slot;
6111
6112         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6113
6114         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6115         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6116         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6117
6118         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6119         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6120         dr->dr_curslot = slot;
6121         dr->dr_usedslot++;
6122
6123         return (slot);
6124 }
6125
6126 static struct bwn_pio_txqueue *
6127 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6128     struct bwn_pio_txpkt **pack)
6129 {
6130         struct bwn_pio *pio = &mac->mac_method.pio;
6131         struct bwn_pio_txqueue *tq = NULL;
6132         unsigned int index;
6133
6134         switch (cookie & 0xf000) {
6135         case 0x1000:
6136                 tq = &pio->wme[WME_AC_BK];
6137                 break;
6138         case 0x2000:
6139                 tq = &pio->wme[WME_AC_BE];
6140                 break;
6141         case 0x3000:
6142                 tq = &pio->wme[WME_AC_VI];
6143                 break;
6144         case 0x4000:
6145                 tq = &pio->wme[WME_AC_VO];
6146                 break;
6147         case 0x5000:
6148                 tq = &pio->mcast;
6149                 break;
6150         }
6151         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6152         if (tq == NULL)
6153                 return (NULL);
6154         index = (cookie & 0x0fff);
6155         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6156         if (index >= N(tq->tq_pkts))
6157                 return (NULL);
6158         *pack = &tq->tq_pkts[index];
6159         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6160         return (tq);
6161 }
6162
6163 static void
6164 bwn_txpwr(void *arg, int npending)
6165 {
6166         struct bwn_mac *mac = arg;
6167         struct bwn_softc *sc = mac->mac_sc;
6168
6169         BWN_LOCK(sc);
6170         if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6171             mac->mac_phy.set_txpwr != NULL)
6172                 mac->mac_phy.set_txpwr(mac);
6173         BWN_UNLOCK(sc);
6174 }
6175
6176 static void
6177 bwn_task_15s(struct bwn_mac *mac)
6178 {
6179         uint16_t reg;
6180
6181         if (mac->mac_fw.opensource) {
6182                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6183                 if (reg) {
6184                         bwn_restart(mac, "fw watchdog");
6185                         return;
6186                 }
6187                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6188         }
6189         if (mac->mac_phy.task_15s)
6190                 mac->mac_phy.task_15s(mac);
6191
6192         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6193 }
6194
6195 static void
6196 bwn_task_30s(struct bwn_mac *mac)
6197 {
6198
6199         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6200                 return;
6201         mac->mac_noise.noi_running = 1;
6202         mac->mac_noise.noi_nsamples = 0;
6203
6204         bwn_noise_gensample(mac);
6205 }
6206
6207 static void
6208 bwn_task_60s(struct bwn_mac *mac)
6209 {
6210
6211         if (mac->mac_phy.task_60s)
6212                 mac->mac_phy.task_60s(mac);
6213         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6214 }
6215
6216 static void
6217 bwn_tasks(void *arg)
6218 {
6219         struct bwn_mac *mac = arg;
6220         struct bwn_softc *sc = mac->mac_sc;
6221
6222         BWN_ASSERT_LOCKED(sc);
6223         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6224                 return;
6225
6226         if (mac->mac_task_state % 4 == 0)
6227                 bwn_task_60s(mac);
6228         if (mac->mac_task_state % 2 == 0)
6229                 bwn_task_30s(mac);
6230         bwn_task_15s(mac);
6231
6232         mac->mac_task_state++;
6233         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6234 }
6235
6236 static int
6237 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6238 {
6239         struct bwn_softc *sc = mac->mac_sc;
6240
6241         KASSERT(a == 0, ("not support APHY\n"));
6242
6243         switch (plcp->o.raw[0] & 0xf) {
6244         case 0xb:
6245                 return (BWN_OFDM_RATE_6MB);
6246         case 0xf:
6247                 return (BWN_OFDM_RATE_9MB);
6248         case 0xa:
6249                 return (BWN_OFDM_RATE_12MB);
6250         case 0xe:
6251                 return (BWN_OFDM_RATE_18MB);
6252         case 0x9:
6253                 return (BWN_OFDM_RATE_24MB);
6254         case 0xd:
6255                 return (BWN_OFDM_RATE_36MB);
6256         case 0x8:
6257                 return (BWN_OFDM_RATE_48MB);
6258         case 0xc:
6259                 return (BWN_OFDM_RATE_54MB);
6260         }
6261         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6262             plcp->o.raw[0] & 0xf);
6263         return (-1);
6264 }
6265
6266 static int
6267 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6268 {
6269         struct bwn_softc *sc = mac->mac_sc;
6270
6271         switch (plcp->o.raw[0]) {
6272         case 0x0a:
6273                 return (BWN_CCK_RATE_1MB);
6274         case 0x14:
6275                 return (BWN_CCK_RATE_2MB);
6276         case 0x37:
6277                 return (BWN_CCK_RATE_5MB);
6278         case 0x6e:
6279                 return (BWN_CCK_RATE_11MB);
6280         }
6281         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6282         return (-1);
6283 }
6284
6285 static void
6286 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6287     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6288     int rssi, int noise)
6289 {
6290         struct bwn_softc *sc = mac->mac_sc;
6291         const struct ieee80211_frame_min *wh;
6292         uint64_t tsf;
6293         uint16_t low_mactime_now;
6294
6295         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6296                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6297
6298         wh = mtod(m, const struct ieee80211_frame_min *);
6299         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6300                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6301
6302         bwn_tsf_read(mac, &tsf);
6303         low_mactime_now = tsf;
6304         tsf = tsf & ~0xffffULL;
6305         tsf += le16toh(rxhdr->mac_time);
6306         if (low_mactime_now < le16toh(rxhdr->mac_time))
6307                 tsf -= 0x10000;
6308
6309         sc->sc_rx_th.wr_tsf = tsf;
6310         sc->sc_rx_th.wr_rate = rate;
6311         sc->sc_rx_th.wr_antsignal = rssi;
6312         sc->sc_rx_th.wr_antnoise = noise;
6313 }
6314
6315 static void
6316 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6317 {
6318         uint32_t low, high;
6319
6320         KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6321             ("%s:%d: fail", __func__, __LINE__));
6322
6323         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6324         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6325         *tsf = high;
6326         *tsf <<= 32;
6327         *tsf |= low;
6328 }
6329
6330 static int
6331 bwn_dma_attach(struct bwn_mac *mac)
6332 {
6333         struct bwn_dma *dma = &mac->mac_method.dma;
6334         struct bwn_softc *sc = mac->mac_sc;
6335         bus_addr_t lowaddr = 0;
6336         int error;
6337
6338         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6339                 return (0);
6340
6341         KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6342
6343         mac->mac_flags |= BWN_MAC_FLAG_DMA;
6344
6345         dma->dmatype = bwn_dma_gettype(mac);
6346         if (dma->dmatype == BWN_DMA_30BIT)
6347                 lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6348         else if (dma->dmatype == BWN_DMA_32BIT)
6349                 lowaddr = BUS_SPACE_MAXADDR_32BIT;
6350         else
6351                 lowaddr = BUS_SPACE_MAXADDR;
6352
6353         /*
6354          * Create top level DMA tag
6355          */
6356         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), /* parent */
6357                                BWN_ALIGN, 0,            /* alignment, bounds */
6358                                lowaddr,                 /* lowaddr */
6359                                BUS_SPACE_MAXADDR,       /* highaddr */
6360                                NULL, NULL,              /* filter, filterarg */
6361                                BUS_SPACE_MAXSIZE,       /* maxsize */
6362                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
6363                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
6364                                0,                       /* flags */
6365                                NULL, NULL,              /* lockfunc, lockarg */
6366                                &dma->parent_dtag);
6367         if (error) {
6368                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6369                 return (error);
6370         }
6371
6372         /*
6373          * Create TX/RX mbuf DMA tag
6374          */
6375         error = bus_dma_tag_create(dma->parent_dtag,
6376                                 1,
6377                                 0,
6378                                 BUS_SPACE_MAXADDR,
6379                                 BUS_SPACE_MAXADDR,
6380                                 NULL, NULL,
6381                                 MCLBYTES,
6382                                 1,
6383                                 BUS_SPACE_MAXSIZE_32BIT,
6384                                 0,
6385                                 NULL, NULL,
6386                                 &dma->rxbuf_dtag);
6387         if (error) {
6388                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6389                 goto fail0;
6390         }
6391         error = bus_dma_tag_create(dma->parent_dtag,
6392                                 1,
6393                                 0,
6394                                 BUS_SPACE_MAXADDR,
6395                                 BUS_SPACE_MAXADDR,
6396                                 NULL, NULL,
6397                                 MCLBYTES,
6398                                 1,
6399                                 BUS_SPACE_MAXSIZE_32BIT,
6400                                 0,
6401                                 NULL, NULL,
6402                                 &dma->txbuf_dtag);
6403         if (error) {
6404                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6405                 goto fail1;
6406         }
6407
6408         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6409         if (!dma->wme[WME_AC_BK])
6410                 goto fail2;
6411
6412         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6413         if (!dma->wme[WME_AC_BE])
6414                 goto fail3;
6415
6416         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6417         if (!dma->wme[WME_AC_VI])
6418                 goto fail4;
6419
6420         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6421         if (!dma->wme[WME_AC_VO])
6422                 goto fail5;
6423
6424         dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6425         if (!dma->mcast)
6426                 goto fail6;
6427         dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6428         if (!dma->rx)
6429                 goto fail7;
6430
6431         return (error);
6432
6433 fail7:  bwn_dma_ringfree(&dma->mcast);
6434 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
6435 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
6436 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
6437 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
6438 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
6439 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
6440 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
6441         return (error);
6442 }
6443
6444 static struct bwn_dma_ring *
6445 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
6446     uint16_t cookie, int *slot)
6447 {
6448         struct bwn_dma *dma = &mac->mac_method.dma;
6449         struct bwn_dma_ring *dr;
6450         struct bwn_softc *sc = mac->mac_sc;
6451
6452         BWN_ASSERT_LOCKED(mac->mac_sc);
6453
6454         switch (cookie & 0xf000) {
6455         case 0x1000:
6456                 dr = dma->wme[WME_AC_BK];
6457                 break;
6458         case 0x2000:
6459                 dr = dma->wme[WME_AC_BE];
6460                 break;
6461         case 0x3000:
6462                 dr = dma->wme[WME_AC_VI];
6463                 break;
6464         case 0x4000:
6465                 dr = dma->wme[WME_AC_VO];
6466                 break;
6467         case 0x5000:
6468                 dr = dma->mcast;
6469                 break;
6470         default:
6471                 dr = NULL;
6472                 KASSERT(0 == 1,
6473                     ("invalid cookie value %d", cookie & 0xf000));
6474         }
6475         *slot = (cookie & 0x0fff);
6476         if (*slot < 0 || *slot >= dr->dr_numslots) {
6477                 /*
6478                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
6479                  * that it occurs events which have same H/W sequence numbers.
6480                  * When it's occurred just prints a WARNING msgs and ignores.
6481                  */
6482                 KASSERT(status->seq == dma->lastseq,
6483                     ("%s:%d: fail", __func__, __LINE__));
6484                 device_printf(sc->sc_dev,
6485                     "out of slot ranges (0 < %d < %d)\n", *slot,
6486                     dr->dr_numslots);
6487                 return (NULL);
6488         }
6489         dma->lastseq = status->seq;
6490         return (dr);
6491 }
6492
6493 static void
6494 bwn_dma_stop(struct bwn_mac *mac)
6495 {
6496         struct bwn_dma *dma;
6497
6498         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
6499                 return;
6500         dma = &mac->mac_method.dma;
6501
6502         bwn_dma_ringstop(&dma->rx);
6503         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
6504         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
6505         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
6506         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
6507         bwn_dma_ringstop(&dma->mcast);
6508 }
6509
6510 static void
6511 bwn_dma_ringstop(struct bwn_dma_ring **dr)
6512 {
6513
6514         if (dr == NULL)
6515                 return;
6516
6517         bwn_dma_cleanup(*dr);
6518 }
6519
6520 static void
6521 bwn_pio_stop(struct bwn_mac *mac)
6522 {
6523         struct bwn_pio *pio;
6524
6525         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
6526                 return;
6527         pio = &mac->mac_method.pio;
6528
6529         bwn_destroy_queue_tx(&pio->mcast);
6530         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
6531         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
6532         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
6533         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
6534 }
6535
6536 static void
6537 bwn_led_attach(struct bwn_mac *mac)
6538 {
6539         struct bwn_softc *sc = mac->mac_sc;
6540         const uint8_t *led_act = NULL;
6541         uint16_t val[BWN_LED_MAX];
6542         int i;
6543
6544         sc->sc_led_idle = (2350 * hz) / 1000;
6545         sc->sc_led_blink = 1;
6546
6547         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
6548                 if (siba_get_pci_subvendor(sc->sc_dev) ==
6549                     bwn_vendor_led_act[i].vid) {
6550                         led_act = bwn_vendor_led_act[i].led_act;
6551                         break;
6552                 }
6553         }
6554         if (led_act == NULL)
6555                 led_act = bwn_default_led_act;
6556
6557         val[0] = siba_sprom_get_gpio0(sc->sc_dev);
6558         val[1] = siba_sprom_get_gpio1(sc->sc_dev);
6559         val[2] = siba_sprom_get_gpio2(sc->sc_dev);
6560         val[3] = siba_sprom_get_gpio3(sc->sc_dev);
6561
6562         for (i = 0; i < BWN_LED_MAX; ++i) {
6563                 struct bwn_led *led = &sc->sc_leds[i];
6564
6565                 if (val[i] == 0xff) {
6566                         led->led_act = led_act[i];
6567                 } else {
6568                         if (val[i] & BWN_LED_ACT_LOW)
6569                                 led->led_flags |= BWN_LED_F_ACTLOW;
6570                         led->led_act = val[i] & BWN_LED_ACT_MASK;
6571                 }
6572                 led->led_mask = (1 << i);
6573
6574                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
6575                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
6576                     led->led_act == BWN_LED_ACT_BLINK) {
6577                         led->led_flags |= BWN_LED_F_BLINK;
6578                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
6579                                 led->led_flags |= BWN_LED_F_POLLABLE;
6580                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
6581                                 led->led_flags |= BWN_LED_F_SLOW;
6582
6583                         if (sc->sc_blink_led == NULL) {
6584                                 sc->sc_blink_led = led;
6585                                 if (led->led_flags & BWN_LED_F_SLOW)
6586                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
6587                         }
6588                 }
6589
6590                 DPRINTF(sc, BWN_DEBUG_LED,
6591                     "%dth led, act %d, lowact %d\n", i,
6592                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
6593         }
6594         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
6595 }
6596
6597 static __inline uint16_t
6598 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
6599 {
6600
6601         if (led->led_flags & BWN_LED_F_ACTLOW)
6602                 on = !on;
6603         if (on)
6604                 val |= led->led_mask;
6605         else
6606                 val &= ~led->led_mask;
6607         return val;
6608 }
6609
6610 static void
6611 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
6612 {
6613         struct bwn_softc *sc = mac->mac_sc;
6614         struct ieee80211com *ic = &sc->sc_ic;
6615         uint16_t val;
6616         int i;
6617
6618         if (nstate == IEEE80211_S_INIT) {
6619                 callout_stop(&sc->sc_led_blink_ch);
6620                 sc->sc_led_blinking = 0;
6621         }
6622
6623         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
6624                 return;
6625
6626         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6627         for (i = 0; i < BWN_LED_MAX; ++i) {
6628                 struct bwn_led *led = &sc->sc_leds[i];
6629                 int on;
6630
6631                 if (led->led_act == BWN_LED_ACT_UNKN ||
6632                     led->led_act == BWN_LED_ACT_NULL)
6633                         continue;
6634
6635                 if ((led->led_flags & BWN_LED_F_BLINK) &&
6636                     nstate != IEEE80211_S_INIT)
6637                         continue;
6638
6639                 switch (led->led_act) {
6640                 case BWN_LED_ACT_ON:    /* Always on */
6641                         on = 1;
6642                         break;
6643                 case BWN_LED_ACT_OFF:   /* Always off */
6644                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
6645                         on = 0;
6646                         break;
6647                 default:
6648                         on = 1;
6649                         switch (nstate) {
6650                         case IEEE80211_S_INIT:
6651                                 on = 0;
6652                                 break;
6653                         case IEEE80211_S_RUN:
6654                                 if (led->led_act == BWN_LED_ACT_11G &&
6655                                     ic->ic_curmode != IEEE80211_MODE_11G)
6656                                         on = 0;
6657                                 break;
6658                         default:
6659                                 if (led->led_act == BWN_LED_ACT_ASSOC)
6660                                         on = 0;
6661                                 break;
6662                         }
6663                         break;
6664                 }
6665
6666                 val = bwn_led_onoff(led, val, on);
6667         }
6668         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6669 }
6670
6671 static void
6672 bwn_led_event(struct bwn_mac *mac, int event)
6673 {
6674         struct bwn_softc *sc = mac->mac_sc;
6675         struct bwn_led *led = sc->sc_blink_led;
6676         int rate;
6677
6678         if (event == BWN_LED_EVENT_POLL) {
6679                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
6680                         return;
6681                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6682                         return;
6683         }
6684
6685         sc->sc_led_ticks = ticks;
6686         if (sc->sc_led_blinking)
6687                 return;
6688
6689         switch (event) {
6690         case BWN_LED_EVENT_RX:
6691                 rate = sc->sc_rx_rate;
6692                 break;
6693         case BWN_LED_EVENT_TX:
6694                 rate = sc->sc_tx_rate;
6695                 break;
6696         case BWN_LED_EVENT_POLL:
6697                 rate = 0;
6698                 break;
6699         default:
6700                 panic("unknown LED event %d\n", event);
6701                 break;
6702         }
6703         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
6704             bwn_led_duration[rate].off_dur);
6705 }
6706
6707 static void
6708 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
6709 {
6710         struct bwn_softc *sc = mac->mac_sc;
6711         struct bwn_led *led = sc->sc_blink_led;
6712         uint16_t val;
6713
6714         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6715         val = bwn_led_onoff(led, val, 1);
6716         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6717
6718         if (led->led_flags & BWN_LED_F_SLOW) {
6719                 BWN_LED_SLOWDOWN(on_dur);
6720                 BWN_LED_SLOWDOWN(off_dur);
6721         }
6722
6723         sc->sc_led_blinking = 1;
6724         sc->sc_led_blink_offdur = off_dur;
6725
6726         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
6727 }
6728
6729 static void
6730 bwn_led_blink_next(void *arg)
6731 {
6732         struct bwn_mac *mac = arg;
6733         struct bwn_softc *sc = mac->mac_sc;
6734         uint16_t val;
6735
6736         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6737         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
6738         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6739
6740         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
6741             bwn_led_blink_end, mac);
6742 }
6743
6744 static void
6745 bwn_led_blink_end(void *arg)
6746 {
6747         struct bwn_mac *mac = arg;
6748         struct bwn_softc *sc = mac->mac_sc;
6749
6750         sc->sc_led_blinking = 0;
6751 }
6752
6753 static int
6754 bwn_suspend(device_t dev)
6755 {
6756         struct bwn_softc *sc = device_get_softc(dev);
6757
6758         BWN_LOCK(sc);
6759         bwn_stop(sc);
6760         BWN_UNLOCK(sc);
6761         return (0);
6762 }
6763
6764 static int
6765 bwn_resume(device_t dev)
6766 {
6767         struct bwn_softc *sc = device_get_softc(dev);
6768         int error = EDOOFUS;
6769
6770         BWN_LOCK(sc);
6771         if (sc->sc_ic.ic_nrunning > 0)
6772                 error = bwn_init(sc);
6773         BWN_UNLOCK(sc);
6774         if (error == 0)
6775                 ieee80211_start_all(&sc->sc_ic);
6776         return (0);
6777 }
6778
6779 static void
6780 bwn_rfswitch(void *arg)
6781 {
6782         struct bwn_softc *sc = arg;
6783         struct bwn_mac *mac = sc->sc_curmac;
6784         int cur = 0, prev = 0;
6785
6786         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
6787             ("%s: invalid MAC status %d", __func__, mac->mac_status));
6788
6789         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
6790                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
6791                         & BWN_RF_HWENABLED_HI_MASK))
6792                         cur = 1;
6793         } else {
6794                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
6795                     & BWN_RF_HWENABLED_LO_MASK)
6796                         cur = 1;
6797         }
6798
6799         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
6800                 prev = 1;
6801
6802         if (cur != prev) {
6803                 if (cur)
6804                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
6805                 else
6806                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
6807
6808                 device_printf(sc->sc_dev,
6809                     "status of RF switch is changed to %s\n",
6810                     cur ? "ON" : "OFF");
6811                 if (cur != mac->mac_phy.rf_on) {
6812                         if (cur)
6813                                 bwn_rf_turnon(mac);
6814                         else
6815                                 bwn_rf_turnoff(mac);
6816                 }
6817         }
6818
6819         callout_schedule(&sc->sc_rfswitch_ch, hz);
6820 }
6821
6822 static void
6823 bwn_sysctl_node(struct bwn_softc *sc)
6824 {
6825         device_t dev = sc->sc_dev;
6826         struct bwn_mac *mac;
6827         struct bwn_stats *stats;
6828
6829         /* XXX assume that count of MAC is only 1. */
6830
6831         if ((mac = sc->sc_curmac) == NULL)
6832                 return;
6833         stats = &mac->mac_stats;
6834
6835         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6836             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6837             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
6838         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6839             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6840             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
6841         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6842             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6843             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
6844
6845 #ifdef BWN_DEBUG
6846         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
6847             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6848             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
6849 #endif
6850 }
6851
6852 static device_method_t bwn_methods[] = {
6853         /* Device interface */
6854         DEVMETHOD(device_probe,         bwn_probe),
6855         DEVMETHOD(device_attach,        bwn_attach),
6856         DEVMETHOD(device_detach,        bwn_detach),
6857         DEVMETHOD(device_suspend,       bwn_suspend),
6858         DEVMETHOD(device_resume,        bwn_resume),
6859         DEVMETHOD_END
6860 };
6861 static driver_t bwn_driver = {
6862         "bwn",
6863         bwn_methods,
6864         sizeof(struct bwn_softc)
6865 };
6866 static devclass_t bwn_devclass;
6867 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
6868 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
6869 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
6870 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
6871 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);