sys/dev/bwn/if_bwn.c

   1 /*-
   2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer,
  10  *    without modification.
  11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  13  *    redistribution must be conditioned upon including a substantially
  14  *    similar Disclaimer requirement for further binary redistribution.
  15  *
  16  * NO WARRANTY
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  27  * THE POSSIBILITY OF SUCH DAMAGES.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 /*
  34  * The Broadcom Wireless LAN controller driver.
  35  */
  36
  37 #include "opt_bwn.h"
  38 #include "opt_wlan.h"
  39
  40 #include <sys/param.h>
  41 #include <sys/systm.h>
  42 #include <sys/kernel.h>
  43 #include <sys/malloc.h>
  44 #include <sys/module.h>
  45 #include <sys/endian.h>
  46 #include <sys/errno.h>
  47 #include <sys/firmware.h>
  48 #include <sys/lock.h>
  49 #include <sys/mutex.h>
  50 #include <machine/bus.h>
  51 #include <machine/resource.h>
  52 #include <sys/bus.h>
  53 #include <sys/rman.h>
  54 #include <sys/socket.h>
  55 #include <sys/sockio.h>
  56
  57 #include <net/ethernet.h>
  58 #include <net/if.h>
  59 #include <net/if_var.h>
  60 #include <net/if_arp.h>
  61 #include <net/if_dl.h>
  62 #include <net/if_llc.h>
  63 #include <net/if_media.h>
  64 #include <net/if_types.h>
  65
  66 #include <dev/pci/pcivar.h>
  67 #include <dev/pci/pcireg.h>
  68 #include <dev/siba/siba_ids.h>
  69 #include <dev/siba/sibareg.h>
  70 #include <dev/siba/sibavar.h>
  71
  72 #include <net80211/ieee80211_var.h>
  73 #include <net80211/ieee80211_radiotap.h>
  74 #include <net80211/ieee80211_regdomain.h>
  75 #include <net80211/ieee80211_phy.h>
  76 #include <net80211/ieee80211_ratectl.h>
  77
  78 #include <dev/bwn/if_bwnreg.h>
  79 #include <dev/bwn/if_bwnvar.h>
  80
  81 #include <dev/bwn/if_bwn_debug.h>
  82 #include <dev/bwn/if_bwn_misc.h>
  83 #include <dev/bwn/if_bwn_util.h>
  84 #include <dev/bwn/if_bwn_phy_common.h>
  85 #include <dev/bwn/if_bwn_phy_g.h>
  86 #include <dev/bwn/if_bwn_phy_lp.h>
  87 #include <dev/bwn/if_bwn_phy_n.h>
  88
  89 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
  90     "Broadcom driver parameters");
  91
  92 /*
  93  * Tunable & sysctl variables.
  94  */
  95
  96 #ifdef BWN_DEBUG
  97 static  int bwn_debug = 0;
  98 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
  99     "Broadcom debugging printfs");
 100 #endif
 101
 102 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
 103 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
 104     "uses Bad Frames Preemption");
 105 static int      bwn_bluetooth = 1;
 106 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 107     "turns on Bluetooth Coexistence");
 108 static int      bwn_hwpctl = 0;
 109 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 110     "uses H/W power control");
 111 static int      bwn_msi_disable = 0;            /* MSI disabled  */
 112 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
 113 static int      bwn_usedma = 1;
 114 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 115     "uses DMA");
 116 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 117 static int      bwn_wme = 1;
 118 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 119     "uses WME support");
 120
 121 static void     bwn_attach_pre(struct bwn_softc *);
 122 static int      bwn_attach_post(struct bwn_softc *);
 123 static void     bwn_sprom_bugfixes(device_t);
 124 static int      bwn_init(struct bwn_softc *);
 125 static void     bwn_parent(struct ieee80211com *);
 126 static void     bwn_start(struct bwn_softc *);
 127 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 128 static int      bwn_attach_core(struct bwn_mac *);
 129 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 130 static int      bwn_chiptest(struct bwn_mac *);
 131 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 132 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 133                     uint16_t);
 134 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 135                     const struct bwn_channelinfo *, const uint8_t []);
 136 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 137                     const struct ieee80211_bpf_params *);
 138 static void     bwn_updateslot(struct ieee80211com *);
 139 static void     bwn_update_promisc(struct ieee80211com *);
 140 static void     bwn_wme_init(struct bwn_mac *);
 141 static int      bwn_wme_update(struct ieee80211com *);
 142 static void     bwn_wme_clear(struct bwn_softc *);
 143 static void     bwn_wme_load(struct bwn_mac *);
 144 static void     bwn_wme_loadparams(struct bwn_mac *,
 145                     const struct wmeParams *, uint16_t);
 146 static void     bwn_scan_start(struct ieee80211com *);
 147 static void     bwn_scan_end(struct ieee80211com *);
 148 static void     bwn_set_channel(struct ieee80211com *);
 149 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 150                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 151                     const uint8_t [IEEE80211_ADDR_LEN],
 152                     const uint8_t [IEEE80211_ADDR_LEN]);
 153 static void     bwn_vap_delete(struct ieee80211vap *);
 154 static void     bwn_stop(struct bwn_softc *);
 155 static int      bwn_core_init(struct bwn_mac *);
 156 static void     bwn_core_start(struct bwn_mac *);
 157 static void     bwn_core_exit(struct bwn_mac *);
 158 static void     bwn_bt_disable(struct bwn_mac *);
 159 static int      bwn_chip_init(struct bwn_mac *);
 160 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 161 static void     bwn_rate_init(struct bwn_mac *);
 162 static void     bwn_set_phytxctl(struct bwn_mac *);
 163 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 164 static void     bwn_bt_enable(struct bwn_mac *);
 165 static void     bwn_set_macaddr(struct bwn_mac *);
 166 static void     bwn_crypt_init(struct bwn_mac *);
 167 static void     bwn_chip_exit(struct bwn_mac *);
 168 static int      bwn_fw_fillinfo(struct bwn_mac *);
 169 static int      bwn_fw_loaducode(struct bwn_mac *);
 170 static int      bwn_gpio_init(struct bwn_mac *);
 171 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 172 static int      bwn_phy_init(struct bwn_mac *);
 173 static void     bwn_set_txantenna(struct bwn_mac *, int);
 174 static void     bwn_set_opmode(struct bwn_mac *);
 175 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 176 static uint8_t  bwn_plcp_getcck(const uint8_t);
 177 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 178 static void     bwn_pio_init(struct bwn_mac *);
 179 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 180 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 181                     int);
 182 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 183                     struct bwn_pio_rxqueue *, int);
 184 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 185 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 186                     uint16_t);
 187 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 188 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 189 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 190 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 191                     const struct bwn_txstatus *);
 192 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 193 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 194 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 195                     uint16_t);
 196 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 197                     uint32_t);
 198 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 199                     struct mbuf *);
 200 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 201 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 202                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 203 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 204                     uint16_t, uint32_t);
 205 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 206                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 207 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 208                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 209 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 210                     uint16_t, struct bwn_pio_txpkt **);
 211 static void     bwn_dma_init(struct bwn_mac *);
 212 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 213 static int      bwn_dma_mask2type(uint64_t);
 214 static uint64_t bwn_dma_mask(struct bwn_mac *);
 215 static uint16_t bwn_dma_base(int, int);
 216 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 217 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 218                     int, struct bwn_dmadesc_generic **,
 219                     struct bwn_dmadesc_meta **);
 220 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 221                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 222                     int, int);
 223 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 224 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 225 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 226 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 227 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 228 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 229                     int, struct bwn_dmadesc_generic **,
 230                     struct bwn_dmadesc_meta **);
 231 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 233                     int, int);
 234 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 235 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 236 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 237 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 238 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 239 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 240 static void     bwn_dma_setup(struct bwn_dma_ring *);
 241 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 242 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 243 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 244 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 245 static void     bwn_dma_rx(struct bwn_dma_ring *);
 246 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 247 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 248                     struct bwn_dmadesc_meta *);
 249 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 250 static int      bwn_dma_gettype(struct bwn_mac *);
 251 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 252 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 253 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 254 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 255 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 256                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 257                     int);
 258 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 259                     bus_size_t, int);
 260 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 261 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 262                     const struct bwn_txstatus *);
 263 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 264                     struct mbuf *);
 265 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 266 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 267                     uint8_t);
 268 static int      bwn_dma_attach(struct bwn_mac *);
 269 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 270                     int, int, int);
 271 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 272                     const struct bwn_txstatus *, uint16_t, int *);
 273 static void     bwn_dma_free(struct bwn_mac *);
 274 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 275 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 276                     const char *, struct bwn_fwfile *);
 277 static void     bwn_release_firmware(struct bwn_mac *);
 278 static void     bwn_do_release_fw(struct bwn_fwfile *);
 279 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 280 static int      bwn_fwinitvals_write(struct bwn_mac *,
 281                     const struct bwn_fwinitvals *, size_t, size_t);
 282 static uint16_t bwn_ant2phy(int);
 283 static void     bwn_mac_write_bssid(struct bwn_mac *);
 284 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 285                     const uint8_t *);
 286 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 287                     const uint8_t *, size_t, const uint8_t *);
 288 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 289                     const uint8_t *);
 290 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 291                     const uint8_t *);
 292 static void     bwn_phy_exit(struct bwn_mac *);
 293 static void     bwn_core_stop(struct bwn_mac *);
 294 static int      bwn_switch_band(struct bwn_softc *,
 295                     struct ieee80211_channel *);
 296 static void     bwn_phy_reset(struct bwn_mac *);
 297 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 298 static void     bwn_set_pretbtt(struct bwn_mac *);
 299 static int      bwn_intr(void *);
 300 static void     bwn_intrtask(void *, int);
 301 static void     bwn_restart(struct bwn_mac *, const char *);
 302 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 303 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 304 static void     bwn_intr_atim_end(struct bwn_mac *);
 305 static void     bwn_intr_beacon(struct bwn_mac *);
 306 static void     bwn_intr_pmq(struct bwn_mac *);
 307 static void     bwn_intr_noise(struct bwn_mac *);
 308 static void     bwn_intr_txeof(struct bwn_mac *);
 309 static void     bwn_hwreset(void *, int);
 310 static void     bwn_handle_fwpanic(struct bwn_mac *);
 311 static void     bwn_load_beacon0(struct bwn_mac *);
 312 static void     bwn_load_beacon1(struct bwn_mac *);
 313 static uint32_t bwn_jssi_read(struct bwn_mac *);
 314 static void     bwn_noise_gensample(struct bwn_mac *);
 315 static void     bwn_handle_txeof(struct bwn_mac *,
 316                     const struct bwn_txstatus *);
 317 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 318 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 319 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 320                     struct mbuf *);
 321 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 322 static int      bwn_set_txhdr(struct bwn_mac *,
 323                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 324                     uint16_t);
 325 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 326                     const uint8_t);
 327 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 328 static uint8_t  bwn_get_fbrate(uint8_t);
 329 static void     bwn_txpwr(void *, int);
 330 static void     bwn_tasks(void *);
 331 static void     bwn_task_15s(struct bwn_mac *);
 332 static void     bwn_task_30s(struct bwn_mac *);
 333 static void     bwn_task_60s(struct bwn_mac *);
 334 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 335                     uint8_t);
 336 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 337 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 338                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 339                     int, int);
 340 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 341 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 342 static void     bwn_watchdog(void *);
 343 static void     bwn_dma_stop(struct bwn_mac *);
 344 static void     bwn_pio_stop(struct bwn_mac *);
 345 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 346 static void     bwn_led_attach(struct bwn_mac *);
 347 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 348 static void     bwn_led_event(struct bwn_mac *, int);
 349 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 350 static void     bwn_led_blink_next(void *);
 351 static void     bwn_led_blink_end(void *);
 352 static void     bwn_rfswitch(void *);
 353 static void     bwn_rf_turnon(struct bwn_mac *);
 354 static void     bwn_rf_turnoff(struct bwn_mac *);
 355 static void     bwn_sysctl_node(struct bwn_softc *);
 356
 357 static struct resource_spec bwn_res_spec_legacy[] = {
 358         { SYS_RES_IRQ,          0,              RF_ACTIVE | RF_SHAREABLE },
 359         { -1,                   0,              0 }
 360 };
 361
 362 static struct resource_spec bwn_res_spec_msi[] = {
 363         { SYS_RES_IRQ,          1,              RF_ACTIVE },
 364         { -1,                   0,              0 }
 365 };
 366
 367 static const struct bwn_channelinfo bwn_chantable_bg = {
 368         .channels = {
 369                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 370                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 371                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 372                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 373                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 374         .nchannels = 14
 375 };
 376
 377 static const struct bwn_channelinfo bwn_chantable_a = {
 378         .channels = {
 379                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 380                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 381                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 382                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 383                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 384                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 385                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 386                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 387                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 388                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 389                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 390                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 391                 { 6080, 216, 30 } },
 392         .nchannels = 37
 393 };
 394
 395 #if 0
 396 static const struct bwn_channelinfo bwn_chantable_n = {
 397         .channels = {
 398                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 399                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 400                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 401                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 402                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 403                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 404                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 405                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 406                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 407                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 408                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 409                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 410                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 411                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 412                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 413                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 414                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 415                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 416                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 417                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 418                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 419                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 420                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 421                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 422                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 423                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 424                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 425                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 426                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 427                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 428                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 429                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 430                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 431                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 432                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 433                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 434                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 435         .nchannels = 110
 436 };
 437 #endif
 438
 439 #define VENDOR_LED_ACT(vendor)                          \
 440 {                                                       \
 441         .vid = PCI_VENDOR_##vendor,                     \
 442         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 443 }
 444
 445 static const struct {
 446         uint16_t        vid;
 447         uint8_t         led_act[BWN_LED_MAX];
 448 } bwn_vendor_led_act[] = {
 449         VENDOR_LED_ACT(COMPAQ),
 450         VENDOR_LED_ACT(ASUSTEK)
 451 };
 452
 453 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 454         { BWN_VENDOR_LED_ACT_DEFAULT };
 455
 456 #undef VENDOR_LED_ACT
 457
 458 static const struct {
 459         int             on_dur;
 460         int             off_dur;
 461 } bwn_led_duration[109] = {
 462         [0]     = { 400, 100 },
 463         [2]     = { 150, 75 },
 464         [4]     = { 90, 45 },
 465         [11]    = { 66, 34 },
 466         [12]    = { 53, 26 },
 467         [18]    = { 42, 21 },
 468         [22]    = { 35, 17 },
 469         [24]    = { 32, 16 },
 470         [36]    = { 21, 10 },
 471         [48]    = { 16, 8 },
 472         [72]    = { 11, 5 },
 473         [96]    = { 9, 4 },
 474         [108]   = { 7, 3 }
 475 };
 476
 477 static const uint16_t bwn_wme_shm_offsets[] = {
 478         [0] = BWN_WME_BESTEFFORT,
 479         [1] = BWN_WME_BACKGROUND,
 480         [2] = BWN_WME_VOICE,
 481         [3] = BWN_WME_VIDEO,
 482 };
 483
 484 static const struct siba_devid bwn_devs[] = {
 485         SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
 486         SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
 487         SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
 488         SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
 489         SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
 490         SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
 491         SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
 492         SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
 493         SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
 494         SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
 495 };
 496
 497 static int
 498 bwn_probe(device_t dev)
 499 {
 500         int i;
 501
 502         for (i = 0; i < nitems(bwn_devs); i++) {
 503                 if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
 504                     siba_get_device(dev) == bwn_devs[i].sd_device &&
 505                     siba_get_revid(dev) == bwn_devs[i].sd_rev)
 506                         return (BUS_PROBE_DEFAULT);
 507         }
 508
 509         return (ENXIO);
 510 }
 511
 512 static int
 513 bwn_attach(device_t dev)
 514 {
 515         struct bwn_mac *mac;
 516         struct bwn_softc *sc = device_get_softc(dev);
 517         int error, i, msic, reg;
 518
 519         sc->sc_dev = dev;
 520 #ifdef BWN_DEBUG
 521         sc->sc_debug = bwn_debug;
 522 #endif
 523
 524         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 525                 bwn_attach_pre(sc);
 526                 bwn_sprom_bugfixes(dev);
 527                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 528         }
 529
 530         if (!TAILQ_EMPTY(&sc->sc_maclist)) {
 531                 if (siba_get_pci_device(dev) != 0x4313 &&
 532                     siba_get_pci_device(dev) != 0x431a &&
 533                     siba_get_pci_device(dev) != 0x4321) {
 534                         device_printf(sc->sc_dev,
 535                             "skip 802.11 cores\n");
 536                         return (ENODEV);
 537                 }
 538         }
 539
 540         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 541         mac->mac_sc = sc;
 542         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 543         if (bwn_bfp != 0)
 544                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 545
 546         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 547         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 548         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 549
 550         error = bwn_attach_core(mac);
 551         if (error)
 552                 goto fail0;
 553         bwn_led_attach(mac);
 554
 555         device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
 556             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 557             siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
 558             mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
 559             mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
 560             mac->mac_phy.rf_rev);
 561         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 562                 device_printf(sc->sc_dev, "DMA (%d bits)\n",
 563                     mac->mac_method.dma.dmatype);
 564         else
 565                 device_printf(sc->sc_dev, "PIO\n");
 566
 567 #ifdef  BWN_GPL_PHY
 568         device_printf(sc->sc_dev,
 569             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
 570 #endif
 571
 572         /*
 573          * setup PCI resources and interrupt.
 574          */
 575         if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
 576                 msic = pci_msi_count(dev);
 577                 if (bootverbose)
 578                         device_printf(sc->sc_dev, "MSI count : %d\n", msic);
 579         } else
 580                 msic = 0;
 581
 582         mac->mac_intr_spec = bwn_res_spec_legacy;
 583         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
 584                 if (pci_alloc_msi(dev, &msic) == 0) {
 585                         device_printf(sc->sc_dev,
 586                             "Using %d MSI messages\n", msic);
 587                         mac->mac_intr_spec = bwn_res_spec_msi;
 588                         mac->mac_msi = 1;
 589                 }
 590         }
 591
 592         error = bus_alloc_resources(dev, mac->mac_intr_spec,
 593             mac->mac_res_irq);
 594         if (error) {
 595                 device_printf(sc->sc_dev,
 596                     "couldn't allocate IRQ resources (%d)\n", error);
 597                 goto fail1;
 598         }
 599
 600         if (mac->mac_msi == 0)
 601                 error = bus_setup_intr(dev, mac->mac_res_irq[0],
 602                     INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 603                     &mac->mac_intrhand[0]);
 604         else {
 605                 for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 606                         error = bus_setup_intr(dev, mac->mac_res_irq[i],
 607                             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 608                             &mac->mac_intrhand[i]);
 609                         if (error != 0) {
 610                                 device_printf(sc->sc_dev,
 611                                     "couldn't setup interrupt (%d)\n", error);
 612                                 break;
 613                         }
 614                 }
 615         }
 616
 617         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 618
 619         /*
 620          * calls attach-post routine
 621          */
 622         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 623                 bwn_attach_post(sc);
 624
 625         return (0);
 626 fail1:
 627         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
 628                 pci_release_msi(dev);
 629 fail0:
 630         free(mac, M_DEVBUF);
 631         return (error);
 632 }
 633
 634 static int
 635 bwn_is_valid_ether_addr(uint8_t *addr)
 636 {
 637         char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
 638
 639         if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
 640                 return (FALSE);
 641
 642         return (TRUE);
 643 }
 644
 645 static int
 646 bwn_attach_post(struct bwn_softc *sc)
 647 {
 648         struct ieee80211com *ic = &sc->sc_ic;
 649
 650         ic->ic_softc = sc;
 651         ic->ic_name = device_get_nameunit(sc->sc_dev);
 652         /* XXX not right but it's not used anywhere important */
 653         ic->ic_phytype = IEEE80211_T_OFDM;
 654         ic->ic_opmode = IEEE80211_M_STA;
 655         ic->ic_caps =
 656                   IEEE80211_C_STA               /* station mode supported */
 657                 | IEEE80211_C_MONITOR           /* monitor mode */
 658                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 659                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 660                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 661                 | IEEE80211_C_WME               /* WME/WMM supported */
 662                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 663 #if 0
 664                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 665 #endif
 666                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 667                 ;
 668
 669         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 670
 671         IEEE80211_ADDR_COPY(ic->ic_macaddr,
 672             bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
 673             siba_sprom_get_mac_80211a(sc->sc_dev) :
 674             siba_sprom_get_mac_80211bg(sc->sc_dev));
 675
 676         /* call MI attach routine. */
 677         ieee80211_ifattach(ic);
 678
 679         ic->ic_headroom = sizeof(struct bwn_txhdr);
 680
 681         /* override default methods */
 682         ic->ic_raw_xmit = bwn_raw_xmit;
 683         ic->ic_updateslot = bwn_updateslot;
 684         ic->ic_update_promisc = bwn_update_promisc;
 685         ic->ic_wme.wme_update = bwn_wme_update;
 686         ic->ic_scan_start = bwn_scan_start;
 687         ic->ic_scan_end = bwn_scan_end;
 688         ic->ic_set_channel = bwn_set_channel;
 689         ic->ic_vap_create = bwn_vap_create;
 690         ic->ic_vap_delete = bwn_vap_delete;
 691         ic->ic_transmit = bwn_transmit;
 692         ic->ic_parent = bwn_parent;
 693
 694         ieee80211_radiotap_attach(ic,
 695             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 696             BWN_TX_RADIOTAP_PRESENT,
 697             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 698             BWN_RX_RADIOTAP_PRESENT);
 699
 700         bwn_sysctl_node(sc);
 701
 702         if (bootverbose)
 703                 ieee80211_announce(ic);
 704         return (0);
 705 }
 706
 707 static void
 708 bwn_phy_detach(struct bwn_mac *mac)
 709 {
 710
 711         if (mac->mac_phy.detach != NULL)
 712                 mac->mac_phy.detach(mac);
 713 }
 714
 715 static int
 716 bwn_detach(device_t dev)
 717 {
 718         struct bwn_softc *sc = device_get_softc(dev);
 719         struct bwn_mac *mac = sc->sc_curmac;
 720         struct ieee80211com *ic = &sc->sc_ic;
 721         int i;
 722
 723         sc->sc_flags |= BWN_FLAG_INVALID;
 724
 725         if (device_is_attached(sc->sc_dev)) {
 726                 BWN_LOCK(sc);
 727                 bwn_stop(sc);
 728                 BWN_UNLOCK(sc);
 729                 bwn_dma_free(mac);
 730                 callout_drain(&sc->sc_led_blink_ch);
 731                 callout_drain(&sc->sc_rfswitch_ch);
 732                 callout_drain(&sc->sc_task_ch);
 733                 callout_drain(&sc->sc_watchdog_ch);
 734                 bwn_phy_detach(mac);
 735                 ieee80211_draintask(ic, &mac->mac_hwreset);
 736                 ieee80211_draintask(ic, &mac->mac_txpower);
 737                 ieee80211_ifdetach(ic);
 738         }
 739         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 740         taskqueue_free(sc->sc_tq);
 741
 742         for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 743                 if (mac->mac_intrhand[i] != NULL) {
 744                         bus_teardown_intr(dev, mac->mac_res_irq[i],
 745                             mac->mac_intrhand[i]);
 746                         mac->mac_intrhand[i] = NULL;
 747                 }
 748         }
 749         bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
 750         if (mac->mac_msi != 0)
 751                 pci_release_msi(dev);
 752         mbufq_drain(&sc->sc_snd);
 753         BWN_LOCK_DESTROY(sc);
 754         return (0);
 755 }
 756
 757 static void
 758 bwn_attach_pre(struct bwn_softc *sc)
 759 {
 760
 761         BWN_LOCK_INIT(sc);
 762         TAILQ_INIT(&sc->sc_maclist);
 763         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 764         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 765         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 766         mbufq_init(&sc->sc_snd, ifqmaxlen);
 767         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 768                 taskqueue_thread_enqueue, &sc->sc_tq);
 769         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 770                 "%s taskq", device_get_nameunit(sc->sc_dev));
 771 }
 772
 773 static void
 774 bwn_sprom_bugfixes(device_t dev)
 775 {
 776 #define BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)             \
 777         ((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&          \
 778          (siba_get_pci_device(dev) == _device) &&                       \
 779          (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&    \
 780          (siba_get_pci_subdevice(dev) == _subdevice))
 781
 782         if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
 783             siba_get_pci_subdevice(dev) == 0x4e &&
 784             siba_get_pci_revid(dev) > 0x40)
 785                 siba_sprom_set_bf_lo(dev,
 786                     siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
 787         if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
 788             siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
 789                 siba_sprom_set_bf_lo(dev,
 790                     siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
 791         if (siba_get_type(dev) == SIBA_TYPE_PCI) {
 792                 if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
 793                     BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
 794                     BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
 795                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
 796                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
 797                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
 798                     BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
 799                         siba_sprom_set_bf_lo(dev,
 800                             siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
 801         }
 802 #undef  BWN_ISDEV
 803 }
 804
 805 static void
 806 bwn_parent(struct ieee80211com *ic)
 807 {
 808         struct bwn_softc *sc = ic->ic_softc;
 809         int startall = 0;
 810
 811         BWN_LOCK(sc);
 812         if (ic->ic_nrunning > 0) {
 813                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 814                         bwn_init(sc);
 815                         startall = 1;
 816                 } else
 817                         bwn_update_promisc(ic);
 818         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 819                 bwn_stop(sc);
 820         BWN_UNLOCK(sc);
 821
 822         if (startall)
 823                 ieee80211_start_all(ic);
 824 }
 825
 826 static int
 827 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 828 {
 829         struct bwn_softc *sc = ic->ic_softc;
 830         int error;
 831
 832         BWN_LOCK(sc);
 833         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 834                 BWN_UNLOCK(sc);
 835                 return (ENXIO);
 836         }
 837         error = mbufq_enqueue(&sc->sc_snd, m);
 838         if (error) {
 839                 BWN_UNLOCK(sc);
 840                 return (error);
 841         }
 842         bwn_start(sc);
 843         BWN_UNLOCK(sc);
 844         return (0);
 845 }
 846
 847 static void
 848 bwn_start(struct bwn_softc *sc)
 849 {
 850         struct bwn_mac *mac = sc->sc_curmac;
 851         struct ieee80211_frame *wh;
 852         struct ieee80211_node *ni;
 853         struct ieee80211_key *k;
 854         struct mbuf *m;
 855
 856         BWN_ASSERT_LOCKED(sc);
 857
 858         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 859             mac->mac_status < BWN_MAC_STATUS_STARTED)
 860                 return;
 861
 862         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 863                 if (bwn_tx_isfull(sc, m))
 864                         break;
 865                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 866                 if (ni == NULL) {
 867                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
 868                         m_freem(m);
 869                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 870                         continue;
 871                 }
 872                 wh = mtod(m, struct ieee80211_frame *);
 873                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 874                         k = ieee80211_crypto_encap(ni, m);
 875                         if (k == NULL) {
 876                                 if_inc_counter(ni->ni_vap->iv_ifp,
 877                                     IFCOUNTER_OERRORS, 1);
 878                                 ieee80211_free_node(ni);
 879                                 m_freem(m);
 880                                 continue;
 881                         }
 882                 }
 883                 wh = NULL;      /* Catch any invalid use */
 884                 if (bwn_tx_start(sc, ni, m) != 0) {
 885                         if (ni != NULL) {
 886                                 if_inc_counter(ni->ni_vap->iv_ifp,
 887                                     IFCOUNTER_OERRORS, 1);
 888                                 ieee80211_free_node(ni);
 889                         }
 890                         continue;
 891                 }
 892                 sc->sc_watchdog_timer = 5;
 893         }
 894 }
 895
 896 static int
 897 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
 898 {
 899         struct bwn_dma_ring *dr;
 900         struct bwn_mac *mac = sc->sc_curmac;
 901         struct bwn_pio_txqueue *tq;
 902         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 903
 904         BWN_ASSERT_LOCKED(sc);
 905
 906         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 907                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
 908                 if (dr->dr_stop == 1 ||
 909                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
 910                         dr->dr_stop = 1;
 911                         goto full;
 912                 }
 913         } else {
 914                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
 915                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
 916                     pktlen > (tq->tq_size - tq->tq_used))
 917                         goto full;
 918         }
 919         return (0);
 920 full:
 921         mbufq_prepend(&sc->sc_snd, m);
 922         return (1);
 923 }
 924
 925 static int
 926 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
 927 {
 928         struct bwn_mac *mac = sc->sc_curmac;
 929         int error;
 930
 931         BWN_ASSERT_LOCKED(sc);
 932
 933         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
 934                 m_freem(m);
 935                 return (ENXIO);
 936         }
 937
 938         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
 939             bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
 940         if (error) {
 941                 m_freem(m);
 942                 return (error);
 943         }
 944         return (0);
 945 }
 946
 947 static int
 948 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
 949 {
 950         struct bwn_pio_txpkt *tp;
 951         struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
 952         struct bwn_softc *sc = mac->mac_sc;
 953         struct bwn_txhdr txhdr;
 954         struct mbuf *m_new;
 955         uint32_t ctl32;
 956         int error;
 957         uint16_t ctl16;
 958
 959         BWN_ASSERT_LOCKED(sc);
 960
 961         /* XXX TODO send packets after DTIM */
 962
 963         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
 964         tp = TAILQ_FIRST(&tq->tq_pktlist);
 965         tp->tp_ni = ni;
 966         tp->tp_m = m;
 967
 968         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
 969         if (error) {
 970                 device_printf(sc->sc_dev, "tx fail\n");
 971                 return (error);
 972         }
 973
 974         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
 975         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 976         tq->tq_free--;
 977
 978         if (siba_get_revid(sc->sc_dev) >= 8) {
 979                 /*
 980                  * XXX please removes m_defrag(9)
 981                  */
 982                 m_new = m_defrag(m, M_NOWAIT);
 983                 if (m_new == NULL) {
 984                         device_printf(sc->sc_dev,
 985                             "%s: can't defrag TX buffer\n",
 986                             __func__);
 987                         return (ENOBUFS);
 988                 }
 989                 if (m_new->m_next != NULL)
 990                         device_printf(sc->sc_dev,
 991                             "TODO: fragmented packets for PIO\n");
 992                 tp->tp_m = m_new;
 993
 994                 /* send HEADER */
 995                 ctl32 = bwn_pio_write_multi_4(mac, tq,
 996                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
 997                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
 998                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 999                 /* send BODY */
1000                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001                     mtod(m_new, const void *), m_new->m_pkthdr.len);
1002                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003                     ctl32 | BWN_PIO8_TXCTL_EOF);
1004         } else {
1005                 ctl16 = bwn_pio_write_multi_2(mac, tq,
1006                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011                     ctl16 | BWN_PIO_TXCTL_EOF);
1012         }
1013
1014         return (0);
1015 }
1016
1017 static struct bwn_pio_txqueue *
1018 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019 {
1020
1021         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024         switch (prio) {
1025         case 0:
1026                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027         case 1:
1028                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029         case 2:
1030                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031         case 3:
1032                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033         }
1034         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035         return (NULL);
1036 }
1037
1038 static int
1039 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040 {
1041 #define BWN_GET_TXHDRCACHE(slot)                                        \
1042         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043         struct bwn_dma *dma = &mac->mac_method.dma;
1044         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045         struct bwn_dmadesc_generic *desc;
1046         struct bwn_dmadesc_meta *mt;
1047         struct bwn_softc *sc = mac->mac_sc;
1048         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051         BWN_ASSERT_LOCKED(sc);
1052         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054         /* XXX send after DTIM */
1055
1056         slot = bwn_dma_getslot(dr);
1057         dr->getdesc(dr, slot, &desc, &mt);
1058         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059             ("%s:%d: fail", __func__, __LINE__));
1060
1061         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063             BWN_DMA_COOKIE(dr, slot));
1064         if (error)
1065                 goto fail;
1066         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068             &mt->mt_paddr, BUS_DMA_NOWAIT);
1069         if (error) {
1070                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071                     __func__, error);
1072                 goto fail;
1073         }
1074         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075             BUS_DMASYNC_PREWRITE);
1076         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078             BUS_DMASYNC_PREWRITE);
1079
1080         slot = bwn_dma_getslot(dr);
1081         dr->getdesc(dr, slot, &desc, &mt);
1082         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084         mt->mt_m = m;
1085         mt->mt_ni = ni;
1086
1087         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089         if (error && error != EFBIG) {
1090                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091                     __func__, error);
1092                 goto fail;
1093         }
1094         if (error) {    /* error == EFBIG */
1095                 struct mbuf *m_new;
1096
1097                 m_new = m_defrag(m, M_NOWAIT);
1098                 if (m_new == NULL) {
1099                         device_printf(sc->sc_dev,
1100                             "%s: can't defrag TX buffer\n",
1101                             __func__);
1102                         error = ENOBUFS;
1103                         goto fail;
1104                 } else {
1105                         m = m_new;
1106                 }
1107
1108                 mt->mt_m = m;
1109                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111                 if (error) {
1112                         device_printf(sc->sc_dev,
1113                             "%s: can't load TX buffer (2) %d\n",
1114                             __func__, error);
1115                         goto fail;
1116                 }
1117         }
1118         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121             BUS_DMASYNC_PREWRITE);
1122
1123         /* XXX send after DTIM */
1124
1125         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126         return (0);
1127 fail:
1128         dr->dr_curslot = backup[0];
1129         dr->dr_usedslot = backup[1];
1130         return (error);
1131 #undef BWN_GET_TXHDRCACHE
1132 }
1133
1134 static void
1135 bwn_watchdog(void *arg)
1136 {
1137         struct bwn_softc *sc = arg;
1138
1139         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140                 device_printf(sc->sc_dev, "device timeout\n");
1141                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142         }
1143         callout_schedule(&sc->sc_watchdog_ch, hz);
1144 }
1145
1146 static int
1147 bwn_attach_core(struct bwn_mac *mac)
1148 {
1149         struct bwn_softc *sc = mac->mac_sc;
1150         int error, have_bg = 0, have_a = 0;
1151
1152         KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1153             ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1154
1155         if (bwn_is_bus_siba(mac)) {
1156                 uint32_t high;
1157
1158                 siba_powerup(sc->sc_dev, 0);
1159                 high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1160                 have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1161                 have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1162                 if (high & BWN_TGSHIGH_DUALPHY) {
1163                         have_bg = 1;
1164                         have_a = 1;
1165                 }
1166 #if 0
1167                 device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1168                     " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1169                     __func__,
1170                     high,
1171                     have_a,
1172                     have_bg,
1173                     siba_get_pci_device(sc->sc_dev),
1174                     siba_get_chipid(sc->sc_dev));
1175 #endif
1176         } else {
1177                 device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1178                 error = ENXIO;
1179                 goto fail;
1180         }
1181
1182         /*
1183          * Guess at whether it has A-PHY or G-PHY.
1184          * This is just used for resetting the core to probe things;
1185          * we will re-guess once it's all up and working.
1186          */
1187         bwn_reset_core(mac, have_bg);
1188
1189         /*
1190          * Get the PHY version.
1191          */
1192         error = bwn_phy_getinfo(mac, have_bg);
1193         if (error)
1194                 goto fail;
1195
1196         /*
1197          * This is the whitelist of devices which we "believe"
1198          * the SPROM PHY config from.  The rest are "guessed".
1199          */
1200         if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1201             siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1202             siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1203             siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1204             siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1205             siba_get_pci_device(sc->sc_dev) != 0x432b) {
1206                 have_a = have_bg = 0;
1207                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1208                         have_a = 1;
1209                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1210                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1211                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1212                         have_bg = 1;
1213                 else
1214                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1215                             mac->mac_phy.type));
1216         }
1217
1218         /*
1219          * XXX The PHY-G support doesn't do 5GHz operation.
1220          */
1221         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1222             mac->mac_phy.type != BWN_PHYTYPE_N) {
1223                 device_printf(sc->sc_dev,
1224                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
1225                     __func__);
1226                 have_a = 0;
1227                 have_bg = 1;
1228         }
1229
1230         mac->mac_phy.phy_n = NULL;
1231
1232         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1233                 mac->mac_phy.attach = bwn_phy_g_attach;
1234                 mac->mac_phy.detach = bwn_phy_g_detach;
1235                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1236                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1237                 mac->mac_phy.init = bwn_phy_g_init;
1238                 mac->mac_phy.exit = bwn_phy_g_exit;
1239                 mac->mac_phy.phy_read = bwn_phy_g_read;
1240                 mac->mac_phy.phy_write = bwn_phy_g_write;
1241                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1242                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1243                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1244                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1245                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1246                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1247                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1248                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1249                 mac->mac_phy.set_im = bwn_phy_g_im;
1250                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1251                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1252                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1253                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1254         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1255                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1256                 mac->mac_phy.init = bwn_phy_lp_init;
1257                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1258                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1259                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1260                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1261                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1262                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1263                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1264                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1265                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1266                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1267                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1268         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1269                 mac->mac_phy.attach = bwn_phy_n_attach;
1270                 mac->mac_phy.detach = bwn_phy_n_detach;
1271                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1272                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1273                 mac->mac_phy.init = bwn_phy_n_init;
1274                 mac->mac_phy.exit = bwn_phy_n_exit;
1275                 mac->mac_phy.phy_read = bwn_phy_n_read;
1276                 mac->mac_phy.phy_write = bwn_phy_n_write;
1277                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1278                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1279                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1280                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1281                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1282                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1283                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1284                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1285                 mac->mac_phy.set_im = bwn_phy_n_im;
1286                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1287                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1288                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1289                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1290         } else {
1291                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1292                     mac->mac_phy.type);
1293                 error = ENXIO;
1294                 goto fail;
1295         }
1296
1297         mac->mac_phy.gmode = have_bg;
1298         if (mac->mac_phy.attach != NULL) {
1299                 error = mac->mac_phy.attach(mac);
1300                 if (error) {
1301                         device_printf(sc->sc_dev, "failed\n");
1302                         goto fail;
1303                 }
1304         }
1305
1306         bwn_reset_core(mac, have_bg);
1307
1308         error = bwn_chiptest(mac);
1309         if (error)
1310                 goto fail;
1311         error = bwn_setup_channels(mac, have_bg, have_a);
1312         if (error) {
1313                 device_printf(sc->sc_dev, "failed to setup channels\n");
1314                 goto fail;
1315         }
1316
1317         if (sc->sc_curmac == NULL)
1318                 sc->sc_curmac = mac;
1319
1320         error = bwn_dma_attach(mac);
1321         if (error != 0) {
1322                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1323                 goto fail;
1324         }
1325
1326         mac->mac_phy.switch_analog(mac, 0);
1327
1328         siba_dev_down(sc->sc_dev, 0);
1329 fail:
1330         siba_powerdown(sc->sc_dev);
1331         return (error);
1332 }
1333
1334 /*
1335  * Reset - SIBA.
1336  *
1337  * XXX TODO: implement BCMA version!
1338  */
1339 void
1340 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1341 {
1342         struct bwn_softc *sc = mac->mac_sc;
1343         uint32_t low, ctl;
1344         uint32_t flags = 0;
1345
1346         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1347
1348         flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1349         if (g_mode)
1350                 flags |= BWN_TGSLOW_SUPPORT_G;
1351
1352         /* XXX N-PHY only; and hard-code to 20MHz for now */
1353         if (mac->mac_phy.type == BWN_PHYTYPE_N)
1354                 flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1355
1356         siba_dev_up(sc->sc_dev, flags);
1357         DELAY(2000);
1358
1359         /* Take PHY out of reset */
1360         low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1361             ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1362         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1363         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1364         DELAY(2000);
1365         low &= ~SIBA_TGSLOW_FGC;
1366         low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1367         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1368         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1369         DELAY(2000);
1370
1371         if (mac->mac_phy.switch_analog != NULL)
1372                 mac->mac_phy.switch_analog(mac, 1);
1373
1374         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1375         if (g_mode)
1376                 ctl |= BWN_MACCTL_GMODE;
1377         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1378 }
1379
1380 static int
1381 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1382 {
1383         struct bwn_phy *phy = &mac->mac_phy;
1384         struct bwn_softc *sc = mac->mac_sc;
1385         uint32_t tmp;
1386
1387         /* PHY */
1388         tmp = BWN_READ_2(mac, BWN_PHYVER);
1389         phy->gmode = gmode;
1390         phy->rf_on = 1;
1391         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1392         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1393         phy->rev = (tmp & BWN_PHYVER_VERSION);
1394         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1395             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1396                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1397             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1398             (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1399             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1400                 goto unsupphy;
1401
1402         /* RADIO */
1403         if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1404                 if (siba_get_chiprev(sc->sc_dev) == 0)
1405                         tmp = 0x3205017f;
1406                 else if (siba_get_chiprev(sc->sc_dev) == 1)
1407                         tmp = 0x4205017f;
1408                 else
1409                         tmp = 0x5205017f;
1410         } else {
1411                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1412                 tmp = BWN_READ_2(mac, BWN_RFDATALO);
1413                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1414                 tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1415         }
1416         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1417         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1418         phy->rf_manuf = (tmp & 0x00000fff);
1419
1420         /*
1421          * For now, just always do full init (ie, what bwn has traditionally
1422          * done)
1423          */
1424         phy->phy_do_full_init = 1;
1425
1426         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1427                 goto unsupradio;
1428         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1429              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1430             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1431             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1432             (phy->type == BWN_PHYTYPE_N &&
1433              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1434             (phy->type == BWN_PHYTYPE_LP &&
1435              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1436                 goto unsupradio;
1437
1438         return (0);
1439 unsupphy:
1440         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1441             "analog %#x)\n",
1442             phy->type, phy->rev, phy->analog);
1443         return (ENXIO);
1444 unsupradio:
1445         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1446             "rev %#x)\n",
1447             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1448         return (ENXIO);
1449 }
1450
1451 static int
1452 bwn_chiptest(struct bwn_mac *mac)
1453 {
1454 #define TESTVAL0        0x55aaaa55
1455 #define TESTVAL1        0xaa5555aa
1456         struct bwn_softc *sc = mac->mac_sc;
1457         uint32_t v, backup;
1458
1459         BWN_LOCK(sc);
1460
1461         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1462
1463         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1464         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1465                 goto error;
1466         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1467         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1468                 goto error;
1469
1470         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1471
1472         if ((siba_get_revid(sc->sc_dev) >= 3) &&
1473             (siba_get_revid(sc->sc_dev) <= 10)) {
1474                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1475                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1476                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1477                         goto error;
1478                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1479                         goto error;
1480         }
1481         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1482
1483         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1484         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1485                 goto error;
1486
1487         BWN_UNLOCK(sc);
1488         return (0);
1489 error:
1490         BWN_UNLOCK(sc);
1491         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1492         return (ENODEV);
1493 }
1494
1495 static int
1496 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1497 {
1498         struct bwn_softc *sc = mac->mac_sc;
1499         struct ieee80211com *ic = &sc->sc_ic;
1500         uint8_t bands[IEEE80211_MODE_BYTES];
1501
1502         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1503         ic->ic_nchans = 0;
1504
1505         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1506             __func__,
1507             have_bg,
1508             have_a);
1509
1510         if (have_bg) {
1511                 memset(bands, 0, sizeof(bands));
1512                 setbit(bands, IEEE80211_MODE_11B);
1513                 setbit(bands, IEEE80211_MODE_11G);
1514                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1515                     &ic->ic_nchans, &bwn_chantable_bg, bands);
1516         }
1517
1518         if (have_a) {
1519                 memset(bands, 0, sizeof(bands));
1520                 setbit(bands, IEEE80211_MODE_11A);
1521                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1522                     &ic->ic_nchans, &bwn_chantable_a, bands);
1523         }
1524
1525         mac->mac_phy.supports_2ghz = have_bg;
1526         mac->mac_phy.supports_5ghz = have_a;
1527
1528         return (ic->ic_nchans == 0 ? ENXIO : 0);
1529 }
1530
1531 uint32_t
1532 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1533 {
1534         uint32_t ret;
1535
1536         BWN_ASSERT_LOCKED(mac->mac_sc);
1537
1538         if (way == BWN_SHARED) {
1539                 KASSERT((offset & 0x0001) == 0,
1540                     ("%s:%d warn", __func__, __LINE__));
1541                 if (offset & 0x0003) {
1542                         bwn_shm_ctlword(mac, way, offset >> 2);
1543                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1544                         ret <<= 16;
1545                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1546                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1547                         goto out;
1548                 }
1549                 offset >>= 2;
1550         }
1551         bwn_shm_ctlword(mac, way, offset);
1552         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1553 out:
1554         return (ret);
1555 }
1556
1557 uint16_t
1558 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1559 {
1560         uint16_t ret;
1561
1562         BWN_ASSERT_LOCKED(mac->mac_sc);
1563
1564         if (way == BWN_SHARED) {
1565                 KASSERT((offset & 0x0001) == 0,
1566                     ("%s:%d warn", __func__, __LINE__));
1567                 if (offset & 0x0003) {
1568                         bwn_shm_ctlword(mac, way, offset >> 2);
1569                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1570                         goto out;
1571                 }
1572                 offset >>= 2;
1573         }
1574         bwn_shm_ctlword(mac, way, offset);
1575         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1576 out:
1577
1578         return (ret);
1579 }
1580
1581 static void
1582 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1583     uint16_t offset)
1584 {
1585         uint32_t control;
1586
1587         control = way;
1588         control <<= 16;
1589         control |= offset;
1590         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1591 }
1592
1593 void
1594 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1595     uint32_t value)
1596 {
1597         BWN_ASSERT_LOCKED(mac->mac_sc);
1598
1599         if (way == BWN_SHARED) {
1600                 KASSERT((offset & 0x0001) == 0,
1601                     ("%s:%d warn", __func__, __LINE__));
1602                 if (offset & 0x0003) {
1603                         bwn_shm_ctlword(mac, way, offset >> 2);
1604                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1605                                     (value >> 16) & 0xffff);
1606                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1607                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1608                         return;
1609                 }
1610                 offset >>= 2;
1611         }
1612         bwn_shm_ctlword(mac, way, offset);
1613         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1614 }
1615
1616 void
1617 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1618     uint16_t value)
1619 {
1620         BWN_ASSERT_LOCKED(mac->mac_sc);
1621
1622         if (way == BWN_SHARED) {
1623                 KASSERT((offset & 0x0001) == 0,
1624                     ("%s:%d warn", __func__, __LINE__));
1625                 if (offset & 0x0003) {
1626                         bwn_shm_ctlword(mac, way, offset >> 2);
1627                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1628                         return;
1629                 }
1630                 offset >>= 2;
1631         }
1632         bwn_shm_ctlword(mac, way, offset);
1633         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1634 }
1635
1636 static void
1637 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1638     const struct bwn_channelinfo *ci, const uint8_t bands[])
1639 {
1640         int i, error;
1641
1642         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1643                 const struct bwn_channel *hc = &ci->channels[i];
1644
1645                 error = ieee80211_add_channel(chans, maxchans, nchans,
1646                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1647         }
1648 }
1649
1650 static int
1651 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1652         const struct ieee80211_bpf_params *params)
1653 {
1654         struct ieee80211com *ic = ni->ni_ic;
1655         struct bwn_softc *sc = ic->ic_softc;
1656         struct bwn_mac *mac = sc->sc_curmac;
1657         int error;
1658
1659         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1660             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1661                 m_freem(m);
1662                 return (ENETDOWN);
1663         }
1664
1665         BWN_LOCK(sc);
1666         if (bwn_tx_isfull(sc, m)) {
1667                 m_freem(m);
1668                 BWN_UNLOCK(sc);
1669                 return (ENOBUFS);
1670         }
1671
1672         error = bwn_tx_start(sc, ni, m);
1673         if (error == 0)
1674                 sc->sc_watchdog_timer = 5;
1675         BWN_UNLOCK(sc);
1676         return (error);
1677 }
1678
1679 /*
1680  * Callback from the 802.11 layer to update the slot time
1681  * based on the current setting.  We use it to notify the
1682  * firmware of ERP changes and the f/w takes care of things
1683  * like slot time and preamble.
1684  */
1685 static void
1686 bwn_updateslot(struct ieee80211com *ic)
1687 {
1688         struct bwn_softc *sc = ic->ic_softc;
1689         struct bwn_mac *mac;
1690
1691         BWN_LOCK(sc);
1692         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1693                 mac = (struct bwn_mac *)sc->sc_curmac;
1694                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1695         }
1696         BWN_UNLOCK(sc);
1697 }
1698
1699 /*
1700  * Callback from the 802.11 layer after a promiscuous mode change.
1701  * Note this interface does not check the operating mode as this
1702  * is an internal callback and we are expected to honor the current
1703  * state (e.g. this is used for setting the interface in promiscuous
1704  * mode when operating in hostap mode to do ACS).
1705  */
1706 static void
1707 bwn_update_promisc(struct ieee80211com *ic)
1708 {
1709         struct bwn_softc *sc = ic->ic_softc;
1710         struct bwn_mac *mac = sc->sc_curmac;
1711
1712         BWN_LOCK(sc);
1713         mac = sc->sc_curmac;
1714         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1715                 if (ic->ic_promisc > 0)
1716                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1717                 else
1718                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1719                 bwn_set_opmode(mac);
1720         }
1721         BWN_UNLOCK(sc);
1722 }
1723
1724 /*
1725  * Callback from the 802.11 layer to update WME parameters.
1726  */
1727 static int
1728 bwn_wme_update(struct ieee80211com *ic)
1729 {
1730         struct bwn_softc *sc = ic->ic_softc;
1731         struct bwn_mac *mac = sc->sc_curmac;
1732         struct wmeParams *wmep;
1733         int i;
1734
1735         BWN_LOCK(sc);
1736         mac = sc->sc_curmac;
1737         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1738                 bwn_mac_suspend(mac);
1739                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1740                         wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1741                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1742                 }
1743                 bwn_mac_enable(mac);
1744         }
1745         BWN_UNLOCK(sc);
1746         return (0);
1747 }
1748
1749 static void
1750 bwn_scan_start(struct ieee80211com *ic)
1751 {
1752         struct bwn_softc *sc = ic->ic_softc;
1753         struct bwn_mac *mac;
1754
1755         BWN_LOCK(sc);
1756         mac = sc->sc_curmac;
1757         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1758                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1759                 bwn_set_opmode(mac);
1760                 /* disable CFP update during scan */
1761                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1762         }
1763         BWN_UNLOCK(sc);
1764 }
1765
1766 static void
1767 bwn_scan_end(struct ieee80211com *ic)
1768 {
1769         struct bwn_softc *sc = ic->ic_softc;
1770         struct bwn_mac *mac;
1771
1772         BWN_LOCK(sc);
1773         mac = sc->sc_curmac;
1774         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1775                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1776                 bwn_set_opmode(mac);
1777                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1778         }
1779         BWN_UNLOCK(sc);
1780 }
1781
1782 static void
1783 bwn_set_channel(struct ieee80211com *ic)
1784 {
1785         struct bwn_softc *sc = ic->ic_softc;
1786         struct bwn_mac *mac = sc->sc_curmac;
1787         struct bwn_phy *phy = &mac->mac_phy;
1788         int chan, error;
1789
1790         BWN_LOCK(sc);
1791
1792         error = bwn_switch_band(sc, ic->ic_curchan);
1793         if (error)
1794                 goto fail;
1795         bwn_mac_suspend(mac);
1796         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1797         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1798         if (chan != phy->chan)
1799                 bwn_switch_channel(mac, chan);
1800
1801         /* TX power level */
1802         if (ic->ic_curchan->ic_maxpower != 0 &&
1803             ic->ic_curchan->ic_maxpower != phy->txpower) {
1804                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1805                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1806                     BWN_TXPWR_IGNORE_TSSI);
1807         }
1808
1809         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1810         if (phy->set_antenna)
1811                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1812
1813         if (sc->sc_rf_enabled != phy->rf_on) {
1814                 if (sc->sc_rf_enabled) {
1815                         bwn_rf_turnon(mac);
1816                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1817                                 device_printf(sc->sc_dev,
1818                                     "please turn on the RF switch\n");
1819                 } else
1820                         bwn_rf_turnoff(mac);
1821         }
1822
1823         bwn_mac_enable(mac);
1824
1825 fail:
1826         /*
1827          * Setup radio tap channel freq and flags
1828          */
1829         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1830                 htole16(ic->ic_curchan->ic_freq);
1831         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1832                 htole16(ic->ic_curchan->ic_flags & 0xffff);
1833
1834         BWN_UNLOCK(sc);
1835 }
1836
1837 static struct ieee80211vap *
1838 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1839     enum ieee80211_opmode opmode, int flags,
1840     const uint8_t bssid[IEEE80211_ADDR_LEN],
1841     const uint8_t mac[IEEE80211_ADDR_LEN])
1842 {
1843         struct ieee80211vap *vap;
1844         struct bwn_vap *bvp;
1845
1846         switch (opmode) {
1847         case IEEE80211_M_HOSTAP:
1848         case IEEE80211_M_MBSS:
1849         case IEEE80211_M_STA:
1850         case IEEE80211_M_WDS:
1851         case IEEE80211_M_MONITOR:
1852         case IEEE80211_M_IBSS:
1853         case IEEE80211_M_AHDEMO:
1854                 break;
1855         default:
1856                 return (NULL);
1857         }
1858
1859         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1860         vap = &bvp->bv_vap;
1861         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1862         /* override with driver methods */
1863         bvp->bv_newstate = vap->iv_newstate;
1864         vap->iv_newstate = bwn_newstate;
1865
1866         /* override max aid so sta's cannot assoc when we're out of sta id's */
1867         vap->iv_max_aid = BWN_STAID_MAX;
1868
1869         ieee80211_ratectl_init(vap);
1870
1871         /* complete setup */
1872         ieee80211_vap_attach(vap, ieee80211_media_change,
1873             ieee80211_media_status, mac);
1874         return (vap);
1875 }
1876
1877 static void
1878 bwn_vap_delete(struct ieee80211vap *vap)
1879 {
1880         struct bwn_vap *bvp = BWN_VAP(vap);
1881
1882         ieee80211_ratectl_deinit(vap);
1883         ieee80211_vap_detach(vap);
1884         free(bvp, M_80211_VAP);
1885 }
1886
1887 static int
1888 bwn_init(struct bwn_softc *sc)
1889 {
1890         struct bwn_mac *mac;
1891         int error;
1892
1893         BWN_ASSERT_LOCKED(sc);
1894
1895         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1896
1897         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1898         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1899         sc->sc_filters = 0;
1900         bwn_wme_clear(sc);
1901         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1902         sc->sc_rf_enabled = 1;
1903
1904         mac = sc->sc_curmac;
1905         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1906                 error = bwn_core_init(mac);
1907                 if (error != 0)
1908                         return (error);
1909         }
1910         if (mac->mac_status == BWN_MAC_STATUS_INITED)
1911                 bwn_core_start(mac);
1912
1913         bwn_set_opmode(mac);
1914         bwn_set_pretbtt(mac);
1915         bwn_spu_setdelay(mac, 0);
1916         bwn_set_macaddr(mac);
1917
1918         sc->sc_flags |= BWN_FLAG_RUNNING;
1919         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1920         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1921
1922         return (0);
1923 }
1924
1925 static void
1926 bwn_stop(struct bwn_softc *sc)
1927 {
1928         struct bwn_mac *mac = sc->sc_curmac;
1929
1930         BWN_ASSERT_LOCKED(sc);
1931
1932         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1933
1934         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1935                 /* XXX FIXME opmode not based on VAP */
1936                 bwn_set_opmode(mac);
1937                 bwn_set_macaddr(mac);
1938         }
1939
1940         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1941                 bwn_core_stop(mac);
1942
1943         callout_stop(&sc->sc_led_blink_ch);
1944         sc->sc_led_blinking = 0;
1945
1946         bwn_core_exit(mac);
1947         sc->sc_rf_enabled = 0;
1948
1949         sc->sc_flags &= ~BWN_FLAG_RUNNING;
1950 }
1951
1952 static void
1953 bwn_wme_clear(struct bwn_softc *sc)
1954 {
1955 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1956         struct wmeParams *p;
1957         unsigned int i;
1958
1959         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1960             ("%s:%d: fail", __func__, __LINE__));
1961
1962         for (i = 0; i < N(sc->sc_wmeParams); i++) {
1963                 p = &(sc->sc_wmeParams[i]);
1964
1965                 switch (bwn_wme_shm_offsets[i]) {
1966                 case BWN_WME_VOICE:
1967                         p->wmep_txopLimit = 0;
1968                         p->wmep_aifsn = 2;
1969                         /* XXX FIXME: log2(cwmin) */
1970                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1971                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1972                         break;
1973                 case BWN_WME_VIDEO:
1974                         p->wmep_txopLimit = 0;
1975                         p->wmep_aifsn = 2;
1976                         /* XXX FIXME: log2(cwmin) */
1977                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1978                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1979                         break;
1980                 case BWN_WME_BESTEFFORT:
1981                         p->wmep_txopLimit = 0;
1982                         p->wmep_aifsn = 3;
1983                         /* XXX FIXME: log2(cwmin) */
1984                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1985                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1986                         break;
1987                 case BWN_WME_BACKGROUND:
1988                         p->wmep_txopLimit = 0;
1989                         p->wmep_aifsn = 7;
1990                         /* XXX FIXME: log2(cwmin) */
1991                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1992                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1993                         break;
1994                 default:
1995                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1996                 }
1997         }
1998 }
1999
2000 static int
2001 bwn_core_init(struct bwn_mac *mac)
2002 {
2003         struct bwn_softc *sc = mac->mac_sc;
2004         uint64_t hf;
2005         int error;
2006
2007         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2008             ("%s:%d: fail", __func__, __LINE__));
2009
2010         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2011
2012         siba_powerup(sc->sc_dev, 0);
2013         if (!siba_dev_isup(sc->sc_dev))
2014                 bwn_reset_core(mac, mac->mac_phy.gmode);
2015
2016         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2017         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2018         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2019         BWN_GETTIME(mac->mac_phy.nexttime);
2020         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2021         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2022         mac->mac_stats.link_noise = -95;
2023         mac->mac_reason_intr = 0;
2024         bzero(mac->mac_reason, sizeof(mac->mac_reason));
2025         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2026 #ifdef BWN_DEBUG
2027         if (sc->sc_debug & BWN_DEBUG_XMIT)
2028                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2029 #endif
2030         mac->mac_suspended = 1;
2031         mac->mac_task_state = 0;
2032         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2033
2034         mac->mac_phy.init_pre(mac);
2035
2036         siba_pcicore_intr(sc->sc_dev);
2037
2038         siba_fix_imcfglobug(sc->sc_dev);
2039         bwn_bt_disable(mac);
2040         if (mac->mac_phy.prepare_hw) {
2041                 error = mac->mac_phy.prepare_hw(mac);
2042                 if (error)
2043                         goto fail0;
2044         }
2045         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2046         error = bwn_chip_init(mac);
2047         if (error)
2048                 goto fail0;
2049         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2050             siba_get_revid(sc->sc_dev));
2051         hf = bwn_hf_read(mac);
2052         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2053                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2054                 if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2055                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2056                 if (mac->mac_phy.rev == 1)
2057                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2058         }
2059         if (mac->mac_phy.rf_ver == 0x2050) {
2060                 if (mac->mac_phy.rf_rev < 6)
2061                         hf |= BWN_HF_FORCE_VCO_RECALC;
2062                 if (mac->mac_phy.rf_rev == 6)
2063                         hf |= BWN_HF_4318_TSSI;
2064         }
2065         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2066                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2067         if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2068             (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2069                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2070         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2071         bwn_hf_write(mac, hf);
2072
2073         /* Tell the firmware about the MAC capabilities */
2074         if (siba_get_revid(sc->sc_dev) >= 13) {
2075                 uint32_t cap;
2076                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2077                 DPRINTF(sc, BWN_DEBUG_RESET,
2078                     "%s: hw capabilities: 0x%08x\n",
2079                     __func__, cap);
2080                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2081                     cap & 0xffff);
2082                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2083                     (cap >> 16) & 0xffff);
2084         }
2085
2086         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2087         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2088         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2089         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2090
2091         bwn_rate_init(mac);
2092         bwn_set_phytxctl(mac);
2093
2094         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2095             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2096         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2097
2098         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2099                 bwn_pio_init(mac);
2100         else
2101                 bwn_dma_init(mac);
2102         bwn_wme_init(mac);
2103         bwn_spu_setdelay(mac, 1);
2104         bwn_bt_enable(mac);
2105
2106         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2107         siba_powerup(sc->sc_dev,
2108             !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2109         bwn_set_macaddr(mac);
2110         bwn_crypt_init(mac);
2111
2112         /* XXX LED initializatin */
2113
2114         mac->mac_status = BWN_MAC_STATUS_INITED;
2115
2116         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2117         return (error);
2118
2119 fail0:
2120         siba_powerdown(sc->sc_dev);
2121         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2122             ("%s:%d: fail", __func__, __LINE__));
2123         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2124         return (error);
2125 }
2126
2127 static void
2128 bwn_core_start(struct bwn_mac *mac)
2129 {
2130         struct bwn_softc *sc = mac->mac_sc;
2131         uint32_t tmp;
2132
2133         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2134             ("%s:%d: fail", __func__, __LINE__));
2135
2136         if (siba_get_revid(sc->sc_dev) < 5)
2137                 return;
2138
2139         while (1) {
2140                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2141                 if (!(tmp & 0x00000001))
2142                         break;
2143                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2144         }
2145
2146         bwn_mac_enable(mac);
2147         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2148         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2149
2150         mac->mac_status = BWN_MAC_STATUS_STARTED;
2151 }
2152
2153 static void
2154 bwn_core_exit(struct bwn_mac *mac)
2155 {
2156         struct bwn_softc *sc = mac->mac_sc;
2157         uint32_t macctl;
2158
2159         BWN_ASSERT_LOCKED(mac->mac_sc);
2160
2161         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2162             ("%s:%d: fail", __func__, __LINE__));
2163
2164         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2165                 return;
2166         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2167
2168         macctl = BWN_READ_4(mac, BWN_MACCTL);
2169         macctl &= ~BWN_MACCTL_MCODE_RUN;
2170         macctl |= BWN_MACCTL_MCODE_JMP0;
2171         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2172
2173         bwn_dma_stop(mac);
2174         bwn_pio_stop(mac);
2175         bwn_chip_exit(mac);
2176         mac->mac_phy.switch_analog(mac, 0);
2177         siba_dev_down(sc->sc_dev, 0);
2178         siba_powerdown(sc->sc_dev);
2179 }
2180
2181 static void
2182 bwn_bt_disable(struct bwn_mac *mac)
2183 {
2184         struct bwn_softc *sc = mac->mac_sc;
2185
2186         (void)sc;
2187         /* XXX do nothing yet */
2188 }
2189
2190 static int
2191 bwn_chip_init(struct bwn_mac *mac)
2192 {
2193         struct bwn_softc *sc = mac->mac_sc;
2194         struct bwn_phy *phy = &mac->mac_phy;
2195         uint32_t macctl;
2196         int error;
2197
2198         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2199         if (phy->gmode)
2200                 macctl |= BWN_MACCTL_GMODE;
2201         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2202
2203         error = bwn_fw_fillinfo(mac);
2204         if (error)
2205                 return (error);
2206         error = bwn_fw_loaducode(mac);
2207         if (error)
2208                 return (error);
2209
2210         error = bwn_gpio_init(mac);
2211         if (error)
2212                 return (error);
2213
2214         error = bwn_fw_loadinitvals(mac);
2215         if (error) {
2216                 siba_gpio_set(sc->sc_dev, 0);
2217                 return (error);
2218         }
2219         phy->switch_analog(mac, 1);
2220         error = bwn_phy_init(mac);
2221         if (error) {
2222                 siba_gpio_set(sc->sc_dev, 0);
2223                 return (error);
2224         }
2225         if (phy->set_im)
2226                 phy->set_im(mac, BWN_IMMODE_NONE);
2227         if (phy->set_antenna)
2228                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2229         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2230
2231         if (phy->type == BWN_PHYTYPE_B)
2232                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2233         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2234         if (siba_get_revid(sc->sc_dev) < 5)
2235                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2236
2237         BWN_WRITE_4(mac, BWN_MACCTL,
2238             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2239         BWN_WRITE_4(mac, BWN_MACCTL,
2240             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2241         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2242
2243         bwn_set_opmode(mac);
2244         if (siba_get_revid(sc->sc_dev) < 3) {
2245                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2246                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2247                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2248                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2249         } else {
2250                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2251                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2252         }
2253         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2254         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2255         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2256         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2257         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2258         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2259         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2260
2261         bwn_mac_phy_clock_set(mac, true);
2262
2263         /* SIBA powerup */
2264         /* XXX TODO: BCMA powerup */
2265         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2266         return (error);
2267 }
2268
2269 /* read hostflags */
2270 uint64_t
2271 bwn_hf_read(struct bwn_mac *mac)
2272 {
2273         uint64_t ret;
2274
2275         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2276         ret <<= 16;
2277         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2278         ret <<= 16;
2279         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2280         return (ret);
2281 }
2282
2283 void
2284 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2285 {
2286
2287         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2288             (value & 0x00000000ffffull));
2289         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2290             (value & 0x0000ffff0000ull) >> 16);
2291         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2292             (value & 0xffff00000000ULL) >> 32);
2293 }
2294
2295 static void
2296 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2297 {
2298
2299         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2300         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2301 }
2302
2303 static void
2304 bwn_rate_init(struct bwn_mac *mac)
2305 {
2306
2307         switch (mac->mac_phy.type) {
2308         case BWN_PHYTYPE_A:
2309         case BWN_PHYTYPE_G:
2310         case BWN_PHYTYPE_LP:
2311         case BWN_PHYTYPE_N:
2312                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2313                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2314                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2315                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2316                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2317                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2318                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2319                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2320                         break;
2321                 /* FALLTHROUGH */
2322         case BWN_PHYTYPE_B:
2323                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2324                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2325                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2326                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2327                 break;
2328         default:
2329                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2330         }
2331 }
2332
2333 static void
2334 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2335 {
2336         uint16_t offset;
2337
2338         if (ofdm) {
2339                 offset = 0x480;
2340                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2341         } else {
2342                 offset = 0x4c0;
2343                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2344         }
2345         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2346             bwn_shm_read_2(mac, BWN_SHARED, offset));
2347 }
2348
2349 static uint8_t
2350 bwn_plcp_getcck(const uint8_t bitrate)
2351 {
2352
2353         switch (bitrate) {
2354         case BWN_CCK_RATE_1MB:
2355                 return (0x0a);
2356         case BWN_CCK_RATE_2MB:
2357                 return (0x14);
2358         case BWN_CCK_RATE_5MB:
2359                 return (0x37);
2360         case BWN_CCK_RATE_11MB:
2361                 return (0x6e);
2362         }
2363         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2364         return (0);
2365 }
2366
2367 static uint8_t
2368 bwn_plcp_getofdm(const uint8_t bitrate)
2369 {
2370
2371         switch (bitrate) {
2372         case BWN_OFDM_RATE_6MB:
2373                 return (0xb);
2374         case BWN_OFDM_RATE_9MB:
2375                 return (0xf);
2376         case BWN_OFDM_RATE_12MB:
2377                 return (0xa);
2378         case BWN_OFDM_RATE_18MB:
2379                 return (0xe);
2380         case BWN_OFDM_RATE_24MB:
2381                 return (0x9);
2382         case BWN_OFDM_RATE_36MB:
2383                 return (0xd);
2384         case BWN_OFDM_RATE_48MB:
2385                 return (0x8);
2386         case BWN_OFDM_RATE_54MB:
2387                 return (0xc);
2388         }
2389         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2390         return (0);
2391 }
2392
2393 static void
2394 bwn_set_phytxctl(struct bwn_mac *mac)
2395 {
2396         uint16_t ctl;
2397
2398         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2399             BWN_TX_PHY_TXPWR);
2400         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2401         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2402         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2403 }
2404
2405 static void
2406 bwn_pio_init(struct bwn_mac *mac)
2407 {
2408         struct bwn_pio *pio = &mac->mac_method.pio;
2409
2410         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2411             & ~BWN_MACCTL_BIGENDIAN);
2412         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2413
2414         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2415         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2416         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2417         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2418         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2419         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2420 }
2421
2422 static void
2423 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2424     int index)
2425 {
2426         struct bwn_pio_txpkt *tp;
2427         struct bwn_softc *sc = mac->mac_sc;
2428         unsigned int i;
2429
2430         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2431         tq->tq_index = index;
2432
2433         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2434         if (siba_get_revid(sc->sc_dev) >= 8)
2435                 tq->tq_size = 1920;
2436         else {
2437                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2438                 tq->tq_size -= 80;
2439         }
2440
2441         TAILQ_INIT(&tq->tq_pktlist);
2442         for (i = 0; i < N(tq->tq_pkts); i++) {
2443                 tp = &(tq->tq_pkts[i]);
2444                 tp->tp_index = i;
2445                 tp->tp_queue = tq;
2446                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2447         }
2448 }
2449
2450 static uint16_t
2451 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2452 {
2453         struct bwn_softc *sc = mac->mac_sc;
2454         static const uint16_t bases[] = {
2455                 BWN_PIO_BASE0,
2456                 BWN_PIO_BASE1,
2457                 BWN_PIO_BASE2,
2458                 BWN_PIO_BASE3,
2459                 BWN_PIO_BASE4,
2460                 BWN_PIO_BASE5,
2461                 BWN_PIO_BASE6,
2462                 BWN_PIO_BASE7,
2463         };
2464         static const uint16_t bases_rev11[] = {
2465                 BWN_PIO11_BASE0,
2466                 BWN_PIO11_BASE1,
2467                 BWN_PIO11_BASE2,
2468                 BWN_PIO11_BASE3,
2469                 BWN_PIO11_BASE4,
2470                 BWN_PIO11_BASE5,
2471         };
2472
2473         if (siba_get_revid(sc->sc_dev) >= 11) {
2474                 if (index >= N(bases_rev11))
2475                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2476                 return (bases_rev11[index]);
2477         }
2478         if (index >= N(bases))
2479                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2480         return (bases[index]);
2481 }
2482
2483 static void
2484 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2485     int index)
2486 {
2487         struct bwn_softc *sc = mac->mac_sc;
2488
2489         prq->prq_mac = mac;
2490         prq->prq_rev = siba_get_revid(sc->sc_dev);
2491         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2492         bwn_dma_rxdirectfifo(mac, index, 1);
2493 }
2494
2495 static void
2496 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2497 {
2498         if (tq == NULL)
2499                 return;
2500         bwn_pio_cancel_tx_packets(tq);
2501 }
2502
2503 static void
2504 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2505 {
2506
2507         bwn_destroy_pioqueue_tx(pio);
2508 }
2509
2510 static uint16_t
2511 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2512     uint16_t offset)
2513 {
2514
2515         return (BWN_READ_2(mac, tq->tq_base + offset));
2516 }
2517
2518 static void
2519 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2520 {
2521         uint32_t ctl;
2522         int type;
2523         uint16_t base;
2524
2525         type = bwn_dma_mask2type(bwn_dma_mask(mac));
2526         base = bwn_dma_base(type, idx);
2527         if (type == BWN_DMA_64BIT) {
2528                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2529                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2530                 if (enable)
2531                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2532                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2533         } else {
2534                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2535                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2536                 if (enable)
2537                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2538                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2539         }
2540 }
2541
2542 static uint64_t
2543 bwn_dma_mask(struct bwn_mac *mac)
2544 {
2545         uint32_t tmp;
2546         uint16_t base;
2547
2548         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2549         if (tmp & SIBA_TGSHIGH_DMA64)
2550                 return (BWN_DMA_BIT_MASK(64));
2551         base = bwn_dma_base(0, 0);
2552         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2553         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2554         if (tmp & BWN_DMA32_TXADDREXT_MASK)
2555                 return (BWN_DMA_BIT_MASK(32));
2556
2557         return (BWN_DMA_BIT_MASK(30));
2558 }
2559
2560 static int
2561 bwn_dma_mask2type(uint64_t dmamask)
2562 {
2563
2564         if (dmamask == BWN_DMA_BIT_MASK(30))
2565                 return (BWN_DMA_30BIT);
2566         if (dmamask == BWN_DMA_BIT_MASK(32))
2567                 return (BWN_DMA_32BIT);
2568         if (dmamask == BWN_DMA_BIT_MASK(64))
2569                 return (BWN_DMA_64BIT);
2570         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2571         return (BWN_DMA_30BIT);
2572 }
2573
2574 static void
2575 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2576 {
2577         struct bwn_pio_txpkt *tp;
2578         unsigned int i;
2579
2580         for (i = 0; i < N(tq->tq_pkts); i++) {
2581                 tp = &(tq->tq_pkts[i]);
2582                 if (tp->tp_m) {
2583                         m_freem(tp->tp_m);
2584                         tp->tp_m = NULL;
2585                 }
2586         }
2587 }
2588
2589 static uint16_t
2590 bwn_dma_base(int type, int controller_idx)
2591 {
2592         static const uint16_t map64[] = {
2593                 BWN_DMA64_BASE0,
2594                 BWN_DMA64_BASE1,
2595                 BWN_DMA64_BASE2,
2596                 BWN_DMA64_BASE3,
2597                 BWN_DMA64_BASE4,
2598                 BWN_DMA64_BASE5,
2599         };
2600         static const uint16_t map32[] = {
2601                 BWN_DMA32_BASE0,
2602                 BWN_DMA32_BASE1,
2603                 BWN_DMA32_BASE2,
2604                 BWN_DMA32_BASE3,
2605                 BWN_DMA32_BASE4,
2606                 BWN_DMA32_BASE5,
2607         };
2608
2609         if (type == BWN_DMA_64BIT) {
2610                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2611                     ("%s:%d: fail", __func__, __LINE__));
2612                 return (map64[controller_idx]);
2613         }
2614         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2615             ("%s:%d: fail", __func__, __LINE__));
2616         return (map32[controller_idx]);
2617 }
2618
2619 static void
2620 bwn_dma_init(struct bwn_mac *mac)
2621 {
2622         struct bwn_dma *dma = &mac->mac_method.dma;
2623
2624         /* setup TX DMA channels. */
2625         bwn_dma_setup(dma->wme[WME_AC_BK]);
2626         bwn_dma_setup(dma->wme[WME_AC_BE]);
2627         bwn_dma_setup(dma->wme[WME_AC_VI]);
2628         bwn_dma_setup(dma->wme[WME_AC_VO]);
2629         bwn_dma_setup(dma->mcast);
2630         /* setup RX DMA channel. */
2631         bwn_dma_setup(dma->rx);
2632 }
2633
2634 static struct bwn_dma_ring *
2635 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2636     int for_tx, int type)
2637 {
2638         struct bwn_dma *dma = &mac->mac_method.dma;
2639         struct bwn_dma_ring *dr;
2640         struct bwn_dmadesc_generic *desc;
2641         struct bwn_dmadesc_meta *mt;
2642         struct bwn_softc *sc = mac->mac_sc;
2643         int error, i;
2644
2645         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2646         if (dr == NULL)
2647                 goto out;
2648         dr->dr_numslots = BWN_RXRING_SLOTS;
2649         if (for_tx)
2650                 dr->dr_numslots = BWN_TXRING_SLOTS;
2651
2652         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2653             M_DEVBUF, M_NOWAIT | M_ZERO);
2654         if (dr->dr_meta == NULL)
2655                 goto fail0;
2656
2657         dr->dr_type = type;
2658         dr->dr_mac = mac;
2659         dr->dr_base = bwn_dma_base(type, controller_index);
2660         dr->dr_index = controller_index;
2661         if (type == BWN_DMA_64BIT) {
2662                 dr->getdesc = bwn_dma_64_getdesc;
2663                 dr->setdesc = bwn_dma_64_setdesc;
2664                 dr->start_transfer = bwn_dma_64_start_transfer;
2665                 dr->suspend = bwn_dma_64_suspend;
2666                 dr->resume = bwn_dma_64_resume;
2667                 dr->get_curslot = bwn_dma_64_get_curslot;
2668                 dr->set_curslot = bwn_dma_64_set_curslot;
2669         } else {
2670                 dr->getdesc = bwn_dma_32_getdesc;
2671                 dr->setdesc = bwn_dma_32_setdesc;
2672                 dr->start_transfer = bwn_dma_32_start_transfer;
2673                 dr->suspend = bwn_dma_32_suspend;
2674                 dr->resume = bwn_dma_32_resume;
2675                 dr->get_curslot = bwn_dma_32_get_curslot;
2676                 dr->set_curslot = bwn_dma_32_set_curslot;
2677         }
2678         if (for_tx) {
2679                 dr->dr_tx = 1;
2680                 dr->dr_curslot = -1;
2681         } else {
2682                 if (dr->dr_index == 0) {
2683                         switch (mac->mac_fw.fw_hdr_format) {
2684                         case BWN_FW_HDR_351:
2685                         case BWN_FW_HDR_410:
2686                                 dr->dr_rx_bufsize =
2687                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
2688                                 dr->dr_frameoffset =
2689                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
2690                                 break;
2691                         case BWN_FW_HDR_598:
2692                                 dr->dr_rx_bufsize =
2693                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
2694                                 dr->dr_frameoffset =
2695                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
2696                                 break;
2697                         }
2698                 } else
2699                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2700         }
2701
2702         error = bwn_dma_allocringmemory(dr);
2703         if (error)
2704                 goto fail2;
2705
2706         if (for_tx) {
2707                 /*
2708                  * Assumption: BWN_TXRING_SLOTS can be divided by
2709                  * BWN_TX_SLOTS_PER_FRAME
2710                  */
2711                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2712                     ("%s:%d: fail", __func__, __LINE__));
2713
2714                 dr->dr_txhdr_cache = contigmalloc(
2715                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2716                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2717                     0, BUS_SPACE_MAXADDR, 8, 0);
2718                 if (dr->dr_txhdr_cache == NULL) {
2719                         device_printf(sc->sc_dev,
2720                             "can't allocate TX header DMA memory\n");
2721                         goto fail1;
2722                 }
2723
2724                 /*
2725                  * Create TX ring DMA stuffs
2726                  */
2727                 error = bus_dma_tag_create(dma->parent_dtag,
2728                                     BWN_ALIGN, 0,
2729                                     BUS_SPACE_MAXADDR,
2730                                     BUS_SPACE_MAXADDR,
2731                                     NULL, NULL,
2732                                     BWN_HDRSIZE(mac),
2733                                     1,
2734                                     BUS_SPACE_MAXSIZE_32BIT,
2735                                     0,
2736                                     NULL, NULL,
2737                                     &dr->dr_txring_dtag);
2738                 if (error) {
2739                         device_printf(sc->sc_dev,
2740                             "can't create TX ring DMA tag: TODO frees\n");
2741                         goto fail2;
2742                 }
2743
2744                 for (i = 0; i < dr->dr_numslots; i += 2) {
2745                         dr->getdesc(dr, i, &desc, &mt);
2746
2747                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2748                         mt->mt_m = NULL;
2749                         mt->mt_ni = NULL;
2750                         mt->mt_islast = 0;
2751                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2752                             &mt->mt_dmap);
2753                         if (error) {
2754                                 device_printf(sc->sc_dev,
2755                                      "can't create RX buf DMA map\n");
2756                                 goto fail2;
2757                         }
2758
2759                         dr->getdesc(dr, i + 1, &desc, &mt);
2760
2761                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2762                         mt->mt_m = NULL;
2763                         mt->mt_ni = NULL;
2764                         mt->mt_islast = 1;
2765                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2766                             &mt->mt_dmap);
2767                         if (error) {
2768                                 device_printf(sc->sc_dev,
2769                                      "can't create RX buf DMA map\n");
2770                                 goto fail2;
2771                         }
2772                 }
2773         } else {
2774                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2775                     &dr->dr_spare_dmap);
2776                 if (error) {
2777                         device_printf(sc->sc_dev,
2778                             "can't create RX buf DMA map\n");
2779                         goto out;               /* XXX wrong! */
2780                 }
2781
2782                 for (i = 0; i < dr->dr_numslots; i++) {
2783                         dr->getdesc(dr, i, &desc, &mt);
2784
2785                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2786                             &mt->mt_dmap);
2787                         if (error) {
2788                                 device_printf(sc->sc_dev,
2789                                     "can't create RX buf DMA map\n");
2790                                 goto out;       /* XXX wrong! */
2791                         }
2792                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2793                         if (error) {
2794                                 device_printf(sc->sc_dev,
2795                                     "failed to allocate RX buf\n");
2796                                 goto out;       /* XXX wrong! */
2797                         }
2798                 }
2799
2800                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2801                     BUS_DMASYNC_PREWRITE);
2802
2803                 dr->dr_usedslot = dr->dr_numslots;
2804         }
2805
2806       out:
2807         return (dr);
2808
2809 fail2:
2810         if (dr->dr_txhdr_cache != NULL) {
2811                 contigfree(dr->dr_txhdr_cache,
2812                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2813                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2814         }
2815 fail1:
2816         free(dr->dr_meta, M_DEVBUF);
2817 fail0:
2818         free(dr, M_DEVBUF);
2819         return (NULL);
2820 }
2821
2822 static void
2823 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2824 {
2825
2826         if (dr == NULL)
2827                 return;
2828
2829         bwn_dma_free_descbufs(*dr);
2830         bwn_dma_free_ringmemory(*dr);
2831
2832         if ((*dr)->dr_txhdr_cache != NULL) {
2833                 contigfree((*dr)->dr_txhdr_cache,
2834                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2835                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2836         }
2837         free((*dr)->dr_meta, M_DEVBUF);
2838         free(*dr, M_DEVBUF);
2839
2840         *dr = NULL;
2841 }
2842
2843 static void
2844 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2845     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2846 {
2847         struct bwn_dmadesc32 *desc;
2848
2849         *meta = &(dr->dr_meta[slot]);
2850         desc = dr->dr_ring_descbase;
2851         desc = &(desc[slot]);
2852
2853         *gdesc = (struct bwn_dmadesc_generic *)desc;
2854 }
2855
2856 static void
2857 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2858     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2859     int start, int end, int irq)
2860 {
2861         struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2862         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2863         uint32_t addr, addrext, ctl;
2864         int slot;
2865
2866         slot = (int)(&(desc->dma.dma32) - descbase);
2867         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2868             ("%s:%d: fail", __func__, __LINE__));
2869
2870         addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2871         addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2872         addr |= siba_dma_translation(sc->sc_dev);
2873         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2874         if (slot == dr->dr_numslots - 1)
2875                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
2876         if (start)
2877                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
2878         if (end)
2879                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
2880         if (irq)
2881                 ctl |= BWN_DMA32_DCTL_IRQ;
2882         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2883             & BWN_DMA32_DCTL_ADDREXT_MASK;
2884
2885         desc->dma.dma32.control = htole32(ctl);
2886         desc->dma.dma32.address = htole32(addr);
2887 }
2888
2889 static void
2890 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2891 {
2892
2893         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2894             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2895 }
2896
2897 static void
2898 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2899 {
2900
2901         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2902             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2903 }
2904
2905 static void
2906 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2907 {
2908
2909         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2910             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2911 }
2912
2913 static int
2914 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2915 {
2916         uint32_t val;
2917
2918         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2919         val &= BWN_DMA32_RXDPTR;
2920
2921         return (val / sizeof(struct bwn_dmadesc32));
2922 }
2923
2924 static void
2925 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2926 {
2927
2928         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2929             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2930 }
2931
2932 static void
2933 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2934     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2935 {
2936         struct bwn_dmadesc64 *desc;
2937
2938         *meta = &(dr->dr_meta[slot]);
2939         desc = dr->dr_ring_descbase;
2940         desc = &(desc[slot]);
2941
2942         *gdesc = (struct bwn_dmadesc_generic *)desc;
2943 }
2944
2945 static void
2946 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2947     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2948     int start, int end, int irq)
2949 {
2950         struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2951         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2952         int slot;
2953         uint32_t ctl0 = 0, ctl1 = 0;
2954         uint32_t addrlo, addrhi;
2955         uint32_t addrext;
2956
2957         slot = (int)(&(desc->dma.dma64) - descbase);
2958         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2959             ("%s:%d: fail", __func__, __LINE__));
2960
2961         addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2962         addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2963         addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2964             30;
2965         addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2966         if (slot == dr->dr_numslots - 1)
2967                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2968         if (start)
2969                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2970         if (end)
2971                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2972         if (irq)
2973                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
2974         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2975         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2976             & BWN_DMA64_DCTL1_ADDREXT_MASK;
2977
2978         desc->dma.dma64.control0 = htole32(ctl0);
2979         desc->dma.dma64.control1 = htole32(ctl1);
2980         desc->dma.dma64.address_low = htole32(addrlo);
2981         desc->dma.dma64.address_high = htole32(addrhi);
2982 }
2983
2984 static void
2985 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2986 {
2987
2988         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2989             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2990 }
2991
2992 static void
2993 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2994 {
2995
2996         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2997             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2998 }
2999
3000 static void
3001 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3002 {
3003
3004         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3005             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3006 }
3007
3008 static int
3009 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3010 {
3011         uint32_t val;
3012
3013         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3014         val &= BWN_DMA64_RXSTATDPTR;
3015
3016         return (val / sizeof(struct bwn_dmadesc64));
3017 }
3018
3019 static void
3020 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3021 {
3022
3023         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3024             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3025 }
3026
3027 static int
3028 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3029 {
3030         struct bwn_mac *mac = dr->dr_mac;
3031         struct bwn_dma *dma = &mac->mac_method.dma;
3032         struct bwn_softc *sc = mac->mac_sc;
3033         int error;
3034
3035         error = bus_dma_tag_create(dma->parent_dtag,
3036                             BWN_ALIGN, 0,
3037                             BUS_SPACE_MAXADDR,
3038                             BUS_SPACE_MAXADDR,
3039                             NULL, NULL,
3040                             BWN_DMA_RINGMEMSIZE,
3041                             1,
3042                             BUS_SPACE_MAXSIZE_32BIT,
3043                             0,
3044                             NULL, NULL,
3045                             &dr->dr_ring_dtag);
3046         if (error) {
3047                 device_printf(sc->sc_dev,
3048                     "can't create TX ring DMA tag: TODO frees\n");
3049                 return (-1);
3050         }
3051
3052         error = bus_dmamem_alloc(dr->dr_ring_dtag,
3053             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3054             &dr->dr_ring_dmap);
3055         if (error) {
3056                 device_printf(sc->sc_dev,
3057                     "can't allocate DMA mem: TODO frees\n");
3058                 return (-1);
3059         }
3060         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3061             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3062             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3063         if (error) {
3064                 device_printf(sc->sc_dev,
3065                     "can't load DMA mem: TODO free\n");
3066                 return (-1);
3067         }
3068
3069         return (0);
3070 }
3071
3072 static void
3073 bwn_dma_setup(struct bwn_dma_ring *dr)
3074 {
3075         struct bwn_softc *sc = dr->dr_mac->mac_sc;
3076         uint64_t ring64;
3077         uint32_t addrext, ring32, value;
3078         uint32_t trans = siba_dma_translation(sc->sc_dev);
3079
3080         if (dr->dr_tx) {
3081                 dr->dr_curslot = -1;
3082
3083                 if (dr->dr_type == BWN_DMA_64BIT) {
3084                         ring64 = (uint64_t)(dr->dr_ring_dmabase);
3085                         addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3086                             >> 30;
3087                         value = BWN_DMA64_TXENABLE;
3088                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3089                             & BWN_DMA64_TXADDREXT_MASK;
3090                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3091                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3092                             (ring64 & 0xffffffff));
3093                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3094                             ((ring64 >> 32) &
3095                             ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3096                 } else {
3097                         ring32 = (uint32_t)(dr->dr_ring_dmabase);
3098                         addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3099                         value = BWN_DMA32_TXENABLE;
3100                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3101                             & BWN_DMA32_TXADDREXT_MASK;
3102                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3103                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3104                             (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3105                 }
3106                 return;
3107         }
3108
3109         /*
3110          * set for RX
3111          */
3112         dr->dr_usedslot = dr->dr_numslots;
3113
3114         if (dr->dr_type == BWN_DMA_64BIT) {
3115                 ring64 = (uint64_t)(dr->dr_ring_dmabase);
3116                 addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3117                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3118                 value |= BWN_DMA64_RXENABLE;
3119                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3120                     & BWN_DMA64_RXADDREXT_MASK;
3121                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3122                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3123                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3124                     ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3125                     | (trans << 1));
3126                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3127                     sizeof(struct bwn_dmadesc64));
3128         } else {
3129                 ring32 = (uint32_t)(dr->dr_ring_dmabase);
3130                 addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3131                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3132                 value |= BWN_DMA32_RXENABLE;
3133                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3134                     & BWN_DMA32_RXADDREXT_MASK;
3135                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3136                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3137                     (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3138                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3139                     sizeof(struct bwn_dmadesc32));
3140         }
3141 }
3142
3143 static void
3144 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3145 {
3146
3147         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3148         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3149             dr->dr_ring_dmap);
3150 }
3151
3152 static void
3153 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3154 {
3155
3156         if (dr->dr_tx) {
3157                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3158                 if (dr->dr_type == BWN_DMA_64BIT) {
3159                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3160                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3161                 } else
3162                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3163         } else {
3164                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3165                 if (dr->dr_type == BWN_DMA_64BIT) {
3166                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3167                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3168                 } else
3169                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3170         }
3171 }
3172
3173 static void
3174 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3175 {
3176         struct bwn_dmadesc_generic *desc;
3177         struct bwn_dmadesc_meta *meta;
3178         struct bwn_mac *mac = dr->dr_mac;
3179         struct bwn_dma *dma = &mac->mac_method.dma;
3180         struct bwn_softc *sc = mac->mac_sc;
3181         int i;
3182
3183         if (!dr->dr_usedslot)
3184                 return;
3185         for (i = 0; i < dr->dr_numslots; i++) {
3186                 dr->getdesc(dr, i, &desc, &meta);
3187
3188                 if (meta->mt_m == NULL) {
3189                         if (!dr->dr_tx)
3190                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3191                                     __func__);
3192                         continue;
3193                 }
3194                 if (dr->dr_tx) {
3195                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3196                                 bus_dmamap_unload(dr->dr_txring_dtag,
3197                                     meta->mt_dmap);
3198                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3199                                 bus_dmamap_unload(dma->txbuf_dtag,
3200                                     meta->mt_dmap);
3201                 } else
3202                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3203                 bwn_dma_free_descbuf(dr, meta);
3204         }
3205 }
3206
3207 static int
3208 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3209     int type)
3210 {
3211         struct bwn_softc *sc = mac->mac_sc;
3212         uint32_t value;
3213         int i;
3214         uint16_t offset;
3215
3216         for (i = 0; i < 10; i++) {
3217                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3218                     BWN_DMA32_TXSTATUS;
3219                 value = BWN_READ_4(mac, base + offset);
3220                 if (type == BWN_DMA_64BIT) {
3221                         value &= BWN_DMA64_TXSTAT;
3222                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3223                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3224                             value == BWN_DMA64_TXSTAT_STOPPED)
3225                                 break;
3226                 } else {
3227                         value &= BWN_DMA32_TXSTATE;
3228                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3229                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3230                             value == BWN_DMA32_TXSTAT_STOPPED)
3231                                 break;
3232                 }
3233                 DELAY(1000);
3234         }
3235         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3236         BWN_WRITE_4(mac, base + offset, 0);
3237         for (i = 0; i < 10; i++) {
3238                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3239                                                    BWN_DMA32_TXSTATUS;
3240                 value = BWN_READ_4(mac, base + offset);
3241                 if (type == BWN_DMA_64BIT) {
3242                         value &= BWN_DMA64_TXSTAT;
3243                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3244                                 i = -1;
3245                                 break;
3246                         }
3247                 } else {
3248                         value &= BWN_DMA32_TXSTATE;
3249                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3250                                 i = -1;
3251                                 break;
3252                         }
3253                 }
3254                 DELAY(1000);
3255         }
3256         if (i != -1) {
3257                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3258                 return (ENODEV);
3259         }
3260         DELAY(1000);
3261
3262         return (0);
3263 }
3264
3265 static int
3266 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3267     int type)
3268 {
3269         struct bwn_softc *sc = mac->mac_sc;
3270         uint32_t value;
3271         int i;
3272         uint16_t offset;
3273
3274         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3275         BWN_WRITE_4(mac, base + offset, 0);
3276         for (i = 0; i < 10; i++) {
3277                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3278                     BWN_DMA32_RXSTATUS;
3279                 value = BWN_READ_4(mac, base + offset);
3280                 if (type == BWN_DMA_64BIT) {
3281                         value &= BWN_DMA64_RXSTAT;
3282                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3283                                 i = -1;
3284                                 break;
3285                         }
3286                 } else {
3287                         value &= BWN_DMA32_RXSTATE;
3288                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3289                                 i = -1;
3290                                 break;
3291                         }
3292                 }
3293                 DELAY(1000);
3294         }
3295         if (i != -1) {
3296                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3297                 return (ENODEV);
3298         }
3299
3300         return (0);
3301 }
3302
3303 static void
3304 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3305     struct bwn_dmadesc_meta *meta)
3306 {
3307
3308         if (meta->mt_m != NULL) {
3309                 m_freem(meta->mt_m);
3310                 meta->mt_m = NULL;
3311         }
3312         if (meta->mt_ni != NULL) {
3313                 ieee80211_free_node(meta->mt_ni);
3314                 meta->mt_ni = NULL;
3315         }
3316 }
3317
3318 static void
3319 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3320 {
3321         struct bwn_rxhdr4 *rxhdr;
3322         unsigned char *frame;
3323
3324         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3325         rxhdr->frame_len = 0;
3326
3327         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3328             sizeof(struct bwn_plcp6) + 2,
3329             ("%s:%d: fail", __func__, __LINE__));
3330         frame = mtod(m, char *) + dr->dr_frameoffset;
3331         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3332 }
3333
3334 static uint8_t
3335 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3336 {
3337         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3338
3339         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3340             == 0xff);
3341 }
3342
3343 static void
3344 bwn_wme_init(struct bwn_mac *mac)
3345 {
3346
3347         bwn_wme_load(mac);
3348
3349         /* enable WME support. */
3350         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3351         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3352             BWN_IFSCTL_USE_EDCF);
3353 }
3354
3355 static void
3356 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3357 {
3358         struct bwn_softc *sc = mac->mac_sc;
3359         struct ieee80211com *ic = &sc->sc_ic;
3360         uint16_t delay; /* microsec */
3361
3362         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3363         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3364                 delay = 500;
3365         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3366                 delay = max(delay, (uint16_t)2400);
3367
3368         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3369 }
3370
3371 static void
3372 bwn_bt_enable(struct bwn_mac *mac)
3373 {
3374         struct bwn_softc *sc = mac->mac_sc;
3375         uint64_t hf;
3376
3377         if (bwn_bluetooth == 0)
3378                 return;
3379         if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3380                 return;
3381         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3382                 return;
3383
3384         hf = bwn_hf_read(mac);
3385         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3386                 hf |= BWN_HF_BT_COEXISTALT;
3387         else
3388                 hf |= BWN_HF_BT_COEXIST;
3389         bwn_hf_write(mac, hf);
3390 }
3391
3392 static void
3393 bwn_set_macaddr(struct bwn_mac *mac)
3394 {
3395
3396         bwn_mac_write_bssid(mac);
3397         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3398             mac->mac_sc->sc_ic.ic_macaddr);
3399 }
3400
3401 static void
3402 bwn_clear_keys(struct bwn_mac *mac)
3403 {
3404         int i;
3405
3406         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3407                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3408                     ("%s:%d: fail", __func__, __LINE__));
3409
3410                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3411                     NULL, BWN_SEC_KEYSIZE, NULL);
3412                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3413                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3414                             NULL, BWN_SEC_KEYSIZE, NULL);
3415                 }
3416                 mac->mac_key[i].keyconf = NULL;
3417         }
3418 }
3419
3420 static void
3421 bwn_crypt_init(struct bwn_mac *mac)
3422 {
3423         struct bwn_softc *sc = mac->mac_sc;
3424
3425         mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3426         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3427             ("%s:%d: fail", __func__, __LINE__));
3428         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3429         mac->mac_ktp *= 2;
3430         if (siba_get_revid(sc->sc_dev) >= 5)
3431                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3432         bwn_clear_keys(mac);
3433 }
3434
3435 static void
3436 bwn_chip_exit(struct bwn_mac *mac)
3437 {
3438         struct bwn_softc *sc = mac->mac_sc;
3439
3440         bwn_phy_exit(mac);
3441         siba_gpio_set(sc->sc_dev, 0);
3442 }
3443
3444 static int
3445 bwn_fw_fillinfo(struct bwn_mac *mac)
3446 {
3447         int error;
3448
3449         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3450         if (error == 0)
3451                 return (0);
3452         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3453         if (error == 0)
3454                 return (0);
3455         return (error);
3456 }
3457
3458 static int
3459 bwn_gpio_init(struct bwn_mac *mac)
3460 {
3461         struct bwn_softc *sc = mac->mac_sc;
3462         uint32_t mask = 0x1f, set = 0xf, value;
3463
3464         BWN_WRITE_4(mac, BWN_MACCTL,
3465             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3466         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3467             BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3468
3469         if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3470                 mask |= 0x0060;
3471                 set |= 0x0060;
3472         }
3473         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3474                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3475                     BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3476                 mask |= 0x0200;
3477                 set |= 0x0200;
3478         }
3479         if (siba_get_revid(sc->sc_dev) >= 2)
3480                 mask |= 0x0010;
3481
3482         value = siba_gpio_get(sc->sc_dev);
3483         if (value == -1)
3484                 return (0);
3485         siba_gpio_set(sc->sc_dev, (value & mask) | set);
3486
3487         return (0);
3488 }
3489
3490 static int
3491 bwn_fw_loadinitvals(struct bwn_mac *mac)
3492 {
3493 #define GETFWOFFSET(fwp, offset)                                \
3494         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3495         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3496         const struct bwn_fwhdr *hdr;
3497         struct bwn_fw *fw = &mac->mac_fw;
3498         int error;
3499
3500         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3501         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3502             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3503         if (error)
3504                 return (error);
3505         if (fw->initvals_band.fw) {
3506                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3507                 error = bwn_fwinitvals_write(mac,
3508                     GETFWOFFSET(fw->initvals_band, hdr_len),
3509                     be32toh(hdr->size),
3510                     fw->initvals_band.fw->datasize - hdr_len);
3511         }
3512         return (error);
3513 #undef GETFWOFFSET
3514 }
3515
3516 static int
3517 bwn_phy_init(struct bwn_mac *mac)
3518 {
3519         struct bwn_softc *sc = mac->mac_sc;
3520         int error;
3521
3522         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3523         mac->mac_phy.rf_onoff(mac, 1);
3524         error = mac->mac_phy.init(mac);
3525         if (error) {
3526                 device_printf(sc->sc_dev, "PHY init failed\n");
3527                 goto fail0;
3528         }
3529         error = bwn_switch_channel(mac,
3530             mac->mac_phy.get_default_chan(mac));
3531         if (error) {
3532                 device_printf(sc->sc_dev,
3533                     "failed to switch default channel\n");
3534                 goto fail1;
3535         }
3536         return (0);
3537 fail1:
3538         if (mac->mac_phy.exit)
3539                 mac->mac_phy.exit(mac);
3540 fail0:
3541         mac->mac_phy.rf_onoff(mac, 0);
3542
3543         return (error);
3544 }
3545
3546 static void
3547 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3548 {
3549         uint16_t ant;
3550         uint16_t tmp;
3551
3552         ant = bwn_ant2phy(antenna);
3553
3554         /* For ACK/CTS */
3555         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3556         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3557         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3558         /* For Probe Resposes */
3559         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3560         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3561         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3562 }
3563
3564 static void
3565 bwn_set_opmode(struct bwn_mac *mac)
3566 {
3567         struct bwn_softc *sc = mac->mac_sc;
3568         struct ieee80211com *ic = &sc->sc_ic;
3569         uint32_t ctl;
3570         uint16_t cfp_pretbtt;
3571
3572         ctl = BWN_READ_4(mac, BWN_MACCTL);
3573         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3574             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3575             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3576         ctl |= BWN_MACCTL_STA;
3577
3578         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3579             ic->ic_opmode == IEEE80211_M_MBSS)
3580                 ctl |= BWN_MACCTL_HOSTAP;
3581         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3582                 ctl &= ~BWN_MACCTL_STA;
3583         ctl |= sc->sc_filters;
3584
3585         if (siba_get_revid(sc->sc_dev) <= 4)
3586                 ctl |= BWN_MACCTL_PROMISC;
3587
3588         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3589
3590         cfp_pretbtt = 2;
3591         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3592                 if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3593                     siba_get_chiprev(sc->sc_dev) == 3)
3594                         cfp_pretbtt = 100;
3595                 else
3596                         cfp_pretbtt = 50;
3597         }
3598         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3599 }
3600
3601 static int
3602 bwn_dma_gettype(struct bwn_mac *mac)
3603 {
3604         uint32_t tmp;
3605         uint16_t base;
3606
3607         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3608         if (tmp & SIBA_TGSHIGH_DMA64)
3609                 return (BWN_DMA_64BIT);
3610         base = bwn_dma_base(0, 0);
3611         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3612         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3613         if (tmp & BWN_DMA32_TXADDREXT_MASK)
3614                 return (BWN_DMA_32BIT);
3615
3616         return (BWN_DMA_30BIT);
3617 }
3618
3619 static void
3620 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3621 {
3622         if (!error) {
3623                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3624                 *((bus_addr_t *)arg) = seg->ds_addr;
3625         }
3626 }
3627
3628 void
3629 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3630 {
3631         struct bwn_phy *phy = &mac->mac_phy;
3632         struct bwn_softc *sc = mac->mac_sc;
3633         unsigned int i, max_loop;
3634         uint16_t value;
3635         uint32_t buffer[5] = {
3636                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3637         };
3638
3639         if (ofdm) {
3640                 max_loop = 0x1e;
3641                 buffer[0] = 0x000201cc;
3642         } else {
3643                 max_loop = 0xfa;
3644                 buffer[0] = 0x000b846e;
3645         }
3646
3647         BWN_ASSERT_LOCKED(mac->mac_sc);
3648
3649         for (i = 0; i < 5; i++)
3650                 bwn_ram_write(mac, i * 4, buffer[i]);
3651
3652         BWN_WRITE_2(mac, 0x0568, 0x0000);
3653         BWN_WRITE_2(mac, 0x07c0,
3654             (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3655
3656         value = (ofdm ? 0x41 : 0x40);
3657         BWN_WRITE_2(mac, 0x050c, value);
3658
3659         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3660             phy->type == BWN_PHYTYPE_LCN)
3661                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3662         BWN_WRITE_2(mac, 0x0508, 0x0000);
3663         BWN_WRITE_2(mac, 0x050a, 0x0000);
3664         BWN_WRITE_2(mac, 0x054c, 0x0000);
3665         BWN_WRITE_2(mac, 0x056a, 0x0014);
3666         BWN_WRITE_2(mac, 0x0568, 0x0826);
3667         BWN_WRITE_2(mac, 0x0500, 0x0000);
3668
3669         /* XXX TODO: n phy pa override? */
3670
3671         switch (phy->type) {
3672         case BWN_PHYTYPE_N:
3673         case BWN_PHYTYPE_LCN:
3674                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3675                 break;
3676         case BWN_PHYTYPE_LP:
3677                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3678                 break;
3679         default:
3680                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3681                 break;
3682         }
3683
3684         /* flush */
3685         BWN_READ_2(mac, 0x0502);
3686
3687         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3688                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3689         for (i = 0x00; i < max_loop; i++) {
3690                 value = BWN_READ_2(mac, 0x050e);
3691                 if (value & 0x0080)
3692                         break;
3693                 DELAY(10);
3694         }
3695         for (i = 0x00; i < 0x0a; i++) {
3696                 value = BWN_READ_2(mac, 0x050e);
3697                 if (value & 0x0400)
3698                         break;
3699                 DELAY(10);
3700         }
3701         for (i = 0x00; i < 0x19; i++) {
3702                 value = BWN_READ_2(mac, 0x0690);
3703                 if (!(value & 0x0100))
3704                         break;
3705                 DELAY(10);
3706         }
3707         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3708                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3709 }
3710
3711 void
3712 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3713 {
3714         uint32_t macctl;
3715
3716         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3717
3718         macctl = BWN_READ_4(mac, BWN_MACCTL);
3719         if (macctl & BWN_MACCTL_BIGENDIAN)
3720                 printf("TODO: need swap\n");
3721
3722         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3723         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3724         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3725 }
3726
3727 void
3728 bwn_mac_suspend(struct bwn_mac *mac)
3729 {
3730         struct bwn_softc *sc = mac->mac_sc;
3731         int i;
3732         uint32_t tmp;
3733
3734         KASSERT(mac->mac_suspended >= 0,
3735             ("%s:%d: fail", __func__, __LINE__));
3736
3737         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3738             __func__, mac->mac_suspended);
3739
3740         if (mac->mac_suspended == 0) {
3741                 bwn_psctl(mac, BWN_PS_AWAKE);
3742                 BWN_WRITE_4(mac, BWN_MACCTL,
3743                             BWN_READ_4(mac, BWN_MACCTL)
3744                             & ~BWN_MACCTL_ON);
3745                 BWN_READ_4(mac, BWN_MACCTL);
3746                 for (i = 35; i; i--) {
3747                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3748                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3749                                 goto out;
3750                         DELAY(10);
3751                 }
3752                 for (i = 40; i; i--) {
3753                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3754                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3755                                 goto out;
3756                         DELAY(1000);
3757                 }
3758                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3759         }
3760 out:
3761         mac->mac_suspended++;
3762 }
3763
3764 void
3765 bwn_mac_enable(struct bwn_mac *mac)
3766 {
3767         struct bwn_softc *sc = mac->mac_sc;
3768         uint16_t state;
3769
3770         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3771             __func__, mac->mac_suspended);
3772
3773         state = bwn_shm_read_2(mac, BWN_SHARED,
3774             BWN_SHARED_UCODESTAT);
3775         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3776             state != BWN_SHARED_UCODESTAT_SLEEP) {
3777                 DPRINTF(sc, BWN_DEBUG_FW,
3778                     "%s: warn: firmware state (%d)\n",
3779                     __func__, state);
3780         }
3781
3782         mac->mac_suspended--;
3783         KASSERT(mac->mac_suspended >= 0,
3784             ("%s:%d: fail", __func__, __LINE__));
3785         if (mac->mac_suspended == 0) {
3786                 BWN_WRITE_4(mac, BWN_MACCTL,
3787                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3788                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3789                 BWN_READ_4(mac, BWN_MACCTL);
3790                 BWN_READ_4(mac, BWN_INTR_REASON);
3791                 bwn_psctl(mac, 0);
3792         }
3793 }
3794
3795 void
3796 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3797 {
3798         struct bwn_softc *sc = mac->mac_sc;
3799         int i;
3800         uint16_t ucstat;
3801
3802         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3803             ("%s:%d: fail", __func__, __LINE__));
3804         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3805             ("%s:%d: fail", __func__, __LINE__));
3806
3807         /* XXX forcibly awake and hwps-off */
3808
3809         BWN_WRITE_4(mac, BWN_MACCTL,
3810             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3811             ~BWN_MACCTL_HWPS);
3812         BWN_READ_4(mac, BWN_MACCTL);
3813         if (siba_get_revid(sc->sc_dev) >= 5) {
3814                 for (i = 0; i < 100; i++) {
3815                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3816                             BWN_SHARED_UCODESTAT);
3817                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3818                                 break;
3819                         DELAY(10);
3820                 }
3821         }
3822         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3823             ucstat);
3824 }
3825
3826 static int
3827 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3828 {
3829         struct bwn_softc *sc = mac->mac_sc;
3830         struct bwn_fw *fw = &mac->mac_fw;
3831         const uint8_t rev = siba_get_revid(sc->sc_dev);
3832         const char *filename;
3833         uint32_t high;
3834         int error;
3835
3836         /* microcode */
3837         filename = NULL;
3838         switch (rev) {
3839         case 42:
3840                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3841                         filename = "ucode42";
3842                 break;
3843         case 40:
3844                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3845                         filename = "ucode40";
3846                 break;
3847         case 33:
3848                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3849                         filename = "ucode33_lcn40";
3850                 break;
3851         case 30:
3852                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3853                         filename = "ucode30_mimo";
3854                 break;
3855         case 29:
3856                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3857                         filename = "ucode29_mimo";
3858                 break;
3859         case 26:
3860                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3861                         filename = "ucode26_mimo";
3862                 break;
3863         case 28:
3864         case 25:
3865                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3866                         filename = "ucode25_mimo";
3867                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3868                         filename = "ucode25_lcn";
3869                 break;
3870         case 24:
3871                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3872                         filename = "ucode24_lcn";
3873                 break;
3874         case 23:
3875                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3876                         filename = "ucode16_mimo";
3877                 break;
3878         case 16:
3879         case 17:
3880         case 18:
3881         case 19:
3882                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3883                         filename = "ucode16_mimo";
3884                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3885                         filename = "ucode16_lp";
3886                 break;
3887         case 15:
3888                 filename = "ucode15";
3889                 break;
3890         case 14:
3891                 filename = "ucode14";
3892                 break;
3893         case 13:
3894                 filename = "ucode13";
3895                 break;
3896         case 12:
3897         case 11:
3898                 filename = "ucode11";
3899                 break;
3900         case 10:
3901         case 9:
3902         case 8:
3903         case 7:
3904         case 6:
3905         case 5:
3906                 filename = "ucode5";
3907                 break;
3908         default:
3909                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3910                 bwn_release_firmware(mac);
3911                 return (EOPNOTSUPP);
3912         }
3913
3914         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3915         error = bwn_fw_get(mac, type, filename, &fw->ucode);
3916         if (error) {
3917                 bwn_release_firmware(mac);
3918                 return (error);
3919         }
3920
3921         /* PCM */
3922         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3923         if (rev >= 5 && rev <= 10) {
3924                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3925                 if (error == ENOENT)
3926                         fw->no_pcmfile = 1;
3927                 else if (error) {
3928                         bwn_release_firmware(mac);
3929                         return (error);
3930                 }
3931         } else if (rev < 11) {
3932                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3933                 return (EOPNOTSUPP);
3934         }
3935
3936         /* initvals */
3937         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3938         switch (mac->mac_phy.type) {
3939         case BWN_PHYTYPE_A:
3940                 if (rev < 5 || rev > 10)
3941                         goto fail1;
3942                 if (high & BWN_TGSHIGH_HAVE_2GHZ)
3943                         filename = "a0g1initvals5";
3944                 else
3945                         filename = "a0g0initvals5";
3946                 break;
3947         case BWN_PHYTYPE_G:
3948                 if (rev >= 5 && rev <= 10)
3949                         filename = "b0g0initvals5";
3950                 else if (rev >= 13)
3951                         filename = "b0g0initvals13";
3952                 else
3953                         goto fail1;
3954                 break;
3955         case BWN_PHYTYPE_LP:
3956                 if (rev == 13)
3957                         filename = "lp0initvals13";
3958                 else if (rev == 14)
3959                         filename = "lp0initvals14";
3960                 else if (rev >= 15)
3961                         filename = "lp0initvals15";
3962                 else
3963                         goto fail1;
3964                 break;
3965         case BWN_PHYTYPE_N:
3966                 if (rev == 30)
3967                         filename = "n16initvals30";
3968                 else if (rev == 28 || rev == 25)
3969                         filename = "n0initvals25";
3970                 else if (rev == 24)
3971                         filename = "n0initvals24";
3972                 else if (rev == 23)
3973                         filename = "n0initvals16";
3974                 else if (rev >= 16 && rev <= 18)
3975                         filename = "n0initvals16";
3976                 else if (rev >= 11 && rev <= 12)
3977                         filename = "n0initvals11";
3978                 else
3979                         goto fail1;
3980                 break;
3981         default:
3982                 goto fail1;
3983         }
3984         error = bwn_fw_get(mac, type, filename, &fw->initvals);
3985         if (error) {
3986                 bwn_release_firmware(mac);
3987                 return (error);
3988         }
3989
3990         /* bandswitch initvals */
3991         switch (mac->mac_phy.type) {
3992         case BWN_PHYTYPE_A:
3993                 if (rev >= 5 && rev <= 10) {
3994                         if (high & BWN_TGSHIGH_HAVE_2GHZ)
3995                                 filename = "a0g1bsinitvals5";
3996                         else
3997                                 filename = "a0g0bsinitvals5";
3998                 } else if (rev >= 11)
3999                         filename = NULL;
4000                 else
4001                         goto fail1;
4002                 break;
4003         case BWN_PHYTYPE_G:
4004                 if (rev >= 5 && rev <= 10)
4005                         filename = "b0g0bsinitvals5";
4006                 else if (rev >= 11)
4007                         filename = NULL;
4008                 else
4009                         goto fail1;
4010                 break;
4011         case BWN_PHYTYPE_LP:
4012                 if (rev == 13)
4013                         filename = "lp0bsinitvals13";
4014                 else if (rev == 14)
4015                         filename = "lp0bsinitvals14";
4016                 else if (rev >= 15)
4017                         filename = "lp0bsinitvals15";
4018                 else
4019                         goto fail1;
4020                 break;
4021         case BWN_PHYTYPE_N:
4022                 if (rev == 30)
4023                         filename = "n16bsinitvals30";
4024                 else if (rev == 28 || rev == 25)
4025                         filename = "n0bsinitvals25";
4026                 else if (rev == 24)
4027                         filename = "n0bsinitvals24";
4028                 else if (rev == 23)
4029                         filename = "n0bsinitvals16";
4030                 else if (rev >= 16 && rev <= 18)
4031                         filename = "n0bsinitvals16";
4032                 else if (rev >= 11 && rev <= 12)
4033                         filename = "n0bsinitvals11";
4034                 else
4035                         goto fail1;
4036                 break;
4037         default:
4038                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
4039                     mac->mac_phy.type);
4040                 goto fail1;
4041         }
4042         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4043         if (error) {
4044                 bwn_release_firmware(mac);
4045                 return (error);
4046         }
4047         return (0);
4048 fail1:
4049         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4050             rev, mac->mac_phy.type);
4051         bwn_release_firmware(mac);
4052         return (EOPNOTSUPP);
4053 }
4054
4055 static int
4056 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4057     const char *name, struct bwn_fwfile *bfw)
4058 {
4059         const struct bwn_fwhdr *hdr;
4060         struct bwn_softc *sc = mac->mac_sc;
4061         const struct firmware *fw;
4062         char namebuf[64];
4063
4064         if (name == NULL) {
4065                 bwn_do_release_fw(bfw);
4066                 return (0);
4067         }
4068         if (bfw->filename != NULL) {
4069                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4070                         return (0);
4071                 bwn_do_release_fw(bfw);
4072         }
4073
4074         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4075             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4076             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4077         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
4078         fw = firmware_get(namebuf);
4079         if (fw == NULL) {
4080                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4081                     namebuf);
4082                 return (ENOENT);
4083         }
4084         if (fw->datasize < sizeof(struct bwn_fwhdr))
4085                 goto fail;
4086         hdr = (const struct bwn_fwhdr *)(fw->data);
4087         switch (hdr->type) {
4088         case BWN_FWTYPE_UCODE:
4089         case BWN_FWTYPE_PCM:
4090                 if (be32toh(hdr->size) !=
4091                     (fw->datasize - sizeof(struct bwn_fwhdr)))
4092                         goto fail;
4093                 /* FALLTHROUGH */
4094         case BWN_FWTYPE_IV:
4095                 if (hdr->ver != 1)
4096                         goto fail;
4097                 break;
4098         default:
4099                 goto fail;
4100         }
4101         bfw->filename = name;
4102         bfw->fw = fw;
4103         bfw->type = type;
4104         return (0);
4105 fail:
4106         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4107         if (fw != NULL)
4108                 firmware_put(fw, FIRMWARE_UNLOAD);
4109         return (EPROTO);
4110 }
4111
4112 static void
4113 bwn_release_firmware(struct bwn_mac *mac)
4114 {
4115
4116         bwn_do_release_fw(&mac->mac_fw.ucode);
4117         bwn_do_release_fw(&mac->mac_fw.pcm);
4118         bwn_do_release_fw(&mac->mac_fw.initvals);
4119         bwn_do_release_fw(&mac->mac_fw.initvals_band);
4120 }
4121
4122 static void
4123 bwn_do_release_fw(struct bwn_fwfile *bfw)
4124 {
4125
4126         if (bfw->fw != NULL)
4127                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4128         bfw->fw = NULL;
4129         bfw->filename = NULL;
4130 }
4131
4132 static int
4133 bwn_fw_loaducode(struct bwn_mac *mac)
4134 {
4135 #define GETFWOFFSET(fwp, offset)        \
4136         ((const uint32_t *)((const char *)fwp.fw->data + offset))
4137 #define GETFWSIZE(fwp, offset)  \
4138         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
4139         struct bwn_softc *sc = mac->mac_sc;
4140         const uint32_t *data;
4141         unsigned int i;
4142         uint32_t ctl;
4143         uint16_t date, fwcaps, time;
4144         int error = 0;
4145
4146         ctl = BWN_READ_4(mac, BWN_MACCTL);
4147         ctl |= BWN_MACCTL_MCODE_JMP0;
4148         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4149             __LINE__));
4150         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4151         for (i = 0; i < 64; i++)
4152                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4153         for (i = 0; i < 4096; i += 2)
4154                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4155
4156         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4157         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4158         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4159              i++) {
4160                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4161                 DELAY(10);
4162         }
4163
4164         if (mac->mac_fw.pcm.fw) {
4165                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4166                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4167                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4168                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4169                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4170                     sizeof(struct bwn_fwhdr)); i++) {
4171                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4172                         DELAY(10);
4173                 }
4174         }
4175
4176         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4177         BWN_WRITE_4(mac, BWN_MACCTL,
4178             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4179             BWN_MACCTL_MCODE_RUN);
4180
4181         for (i = 0; i < 21; i++) {
4182                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4183                         break;
4184                 if (i >= 20) {
4185                         device_printf(sc->sc_dev, "ucode timeout\n");
4186                         error = ENXIO;
4187                         goto error;
4188                 }
4189                 DELAY(50000);
4190         }
4191         BWN_READ_4(mac, BWN_INTR_REASON);
4192
4193         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4194         if (mac->mac_fw.rev <= 0x128) {
4195                 device_printf(sc->sc_dev, "the firmware is too old\n");
4196                 error = EOPNOTSUPP;
4197                 goto error;
4198         }
4199
4200         /*
4201          * Determine firmware header version; needed for TX/RX packet
4202          * handling.
4203          */
4204         if (mac->mac_fw.rev >= 598)
4205                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4206         else if (mac->mac_fw.rev >= 410)
4207                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4208         else
4209                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4210
4211         /*
4212          * We don't support rev 598 or later; that requires
4213          * another round of changes to the TX/RX descriptor
4214          * and status layout.
4215          *
4216          * So, complain this is the case and exit out, rather
4217          * than attaching and then failing.
4218          */
4219 #if 0
4220         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4221                 device_printf(sc->sc_dev,
4222                     "firmware is too new (>=598); not supported\n");
4223                 error = EOPNOTSUPP;
4224                 goto error;
4225         }
4226 #endif
4227
4228         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4229             BWN_SHARED_UCODE_PATCH);
4230         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4231         mac->mac_fw.opensource = (date == 0xffff);
4232         if (bwn_wme != 0)
4233                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4234         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4235
4236         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4237         if (mac->mac_fw.opensource == 0) {
4238                 device_printf(sc->sc_dev,
4239                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4240                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4241                 if (mac->mac_fw.no_pcmfile)
4242                         device_printf(sc->sc_dev,
4243                             "no HW crypto acceleration due to pcm5\n");
4244         } else {
4245                 mac->mac_fw.patch = time;
4246                 fwcaps = bwn_fwcaps_read(mac);
4247                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4248                         device_printf(sc->sc_dev,
4249                             "disabling HW crypto acceleration\n");
4250                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4251                 }
4252                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4253                         device_printf(sc->sc_dev, "disabling WME support\n");
4254                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4255                 }
4256         }
4257
4258         if (BWN_ISOLDFMT(mac))
4259                 device_printf(sc->sc_dev, "using old firmware image\n");
4260
4261         return (0);
4262
4263 error:
4264         BWN_WRITE_4(mac, BWN_MACCTL,
4265             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4266             BWN_MACCTL_MCODE_JMP0);
4267
4268         return (error);
4269 #undef GETFWSIZE
4270 #undef GETFWOFFSET
4271 }
4272
4273 /* OpenFirmware only */
4274 static uint16_t
4275 bwn_fwcaps_read(struct bwn_mac *mac)
4276 {
4277
4278         KASSERT(mac->mac_fw.opensource == 1,
4279             ("%s:%d: fail", __func__, __LINE__));
4280         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4281 }
4282
4283 static int
4284 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4285     size_t count, size_t array_size)
4286 {
4287 #define GET_NEXTIV16(iv)                                                \
4288         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4289             sizeof(uint16_t) + sizeof(uint16_t)))
4290 #define GET_NEXTIV32(iv)                                                \
4291         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4292             sizeof(uint16_t) + sizeof(uint32_t)))
4293         struct bwn_softc *sc = mac->mac_sc;
4294         const struct bwn_fwinitvals *iv;
4295         uint16_t offset;
4296         size_t i;
4297         uint8_t bit32;
4298
4299         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4300             ("%s:%d: fail", __func__, __LINE__));
4301         iv = ivals;
4302         for (i = 0; i < count; i++) {
4303                 if (array_size < sizeof(iv->offset_size))
4304                         goto fail;
4305                 array_size -= sizeof(iv->offset_size);
4306                 offset = be16toh(iv->offset_size);
4307                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4308                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4309                 if (offset >= 0x1000)
4310                         goto fail;
4311                 if (bit32) {
4312                         if (array_size < sizeof(iv->data.d32))
4313                                 goto fail;
4314                         array_size -= sizeof(iv->data.d32);
4315                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4316                         iv = GET_NEXTIV32(iv);
4317                 } else {
4318
4319                         if (array_size < sizeof(iv->data.d16))
4320                                 goto fail;
4321                         array_size -= sizeof(iv->data.d16);
4322                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4323
4324                         iv = GET_NEXTIV16(iv);
4325                 }
4326         }
4327         if (array_size != 0)
4328                 goto fail;
4329         return (0);
4330 fail:
4331         device_printf(sc->sc_dev, "initvals: invalid format\n");
4332         return (EPROTO);
4333 #undef GET_NEXTIV16
4334 #undef GET_NEXTIV32
4335 }
4336
4337 int
4338 bwn_switch_channel(struct bwn_mac *mac, int chan)
4339 {
4340         struct bwn_phy *phy = &(mac->mac_phy);
4341         struct bwn_softc *sc = mac->mac_sc;
4342         struct ieee80211com *ic = &sc->sc_ic;
4343         uint16_t channelcookie, savedcookie;
4344         int error;
4345
4346         if (chan == 0xffff)
4347                 chan = phy->get_default_chan(mac);
4348
4349         channelcookie = chan;
4350         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4351                 channelcookie |= 0x100;
4352         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4353         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4354         error = phy->switch_channel(mac, chan);
4355         if (error)
4356                 goto fail;
4357
4358         mac->mac_phy.chan = chan;
4359         DELAY(8000);
4360         return (0);
4361 fail:
4362         device_printf(sc->sc_dev, "failed to switch channel\n");
4363         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4364         return (error);
4365 }
4366
4367 static uint16_t
4368 bwn_ant2phy(int antenna)
4369 {
4370
4371         switch (antenna) {
4372         case BWN_ANT0:
4373                 return (BWN_TX_PHY_ANT0);
4374         case BWN_ANT1:
4375                 return (BWN_TX_PHY_ANT1);
4376         case BWN_ANT2:
4377                 return (BWN_TX_PHY_ANT2);
4378         case BWN_ANT3:
4379                 return (BWN_TX_PHY_ANT3);
4380         case BWN_ANTAUTO:
4381                 return (BWN_TX_PHY_ANT01AUTO);
4382         }
4383         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4384         return (0);
4385 }
4386
4387 static void
4388 bwn_wme_load(struct bwn_mac *mac)
4389 {
4390         struct bwn_softc *sc = mac->mac_sc;
4391         int i;
4392
4393         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4394             ("%s:%d: fail", __func__, __LINE__));
4395
4396         bwn_mac_suspend(mac);
4397         for (i = 0; i < N(sc->sc_wmeParams); i++)
4398                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4399                     bwn_wme_shm_offsets[i]);
4400         bwn_mac_enable(mac);
4401 }
4402
4403 static void
4404 bwn_wme_loadparams(struct bwn_mac *mac,
4405     const struct wmeParams *p, uint16_t shm_offset)
4406 {
4407 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4408         struct bwn_softc *sc = mac->mac_sc;
4409         uint16_t params[BWN_NR_WMEPARAMS];
4410         int slot, tmp;
4411         unsigned int i;
4412
4413         slot = BWN_READ_2(mac, BWN_RNG) &
4414             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4415
4416         memset(&params, 0, sizeof(params));
4417
4418         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4419             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4420             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4421
4422         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4423         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4424         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4425         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4426         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4427         params[BWN_WMEPARAM_BSLOTS] = slot;
4428         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4429
4430         for (i = 0; i < N(params); i++) {
4431                 if (i == BWN_WMEPARAM_STATUS) {
4432                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4433                             shm_offset + (i * 2));
4434                         tmp |= 0x100;
4435                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4436                             tmp);
4437                 } else {
4438                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4439                             params[i]);
4440                 }
4441         }
4442 }
4443
4444 static void
4445 bwn_mac_write_bssid(struct bwn_mac *mac)
4446 {
4447         struct bwn_softc *sc = mac->mac_sc;
4448         uint32_t tmp;
4449         int i;
4450         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4451
4452         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4453         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4454         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4455             IEEE80211_ADDR_LEN);
4456
4457         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4458                 tmp = (uint32_t) (mac_bssid[i + 0]);
4459                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4460                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4461                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4462                 bwn_ram_write(mac, 0x20 + i, tmp);
4463         }
4464 }
4465
4466 static void
4467 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4468     const uint8_t *macaddr)
4469 {
4470         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4471         uint16_t data;
4472
4473         if (!mac)
4474                 macaddr = zero;
4475
4476         offset |= 0x0020;
4477         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4478
4479         data = macaddr[0];
4480         data |= macaddr[1] << 8;
4481         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4482         data = macaddr[2];
4483         data |= macaddr[3] << 8;
4484         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4485         data = macaddr[4];
4486         data |= macaddr[5] << 8;
4487         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4488 }
4489
4490 static void
4491 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4492     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4493 {
4494         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4495         uint8_t per_sta_keys_start = 8;
4496
4497         if (BWN_SEC_NEWAPI(mac))
4498                 per_sta_keys_start = 4;
4499
4500         KASSERT(index < mac->mac_max_nr_keys,
4501             ("%s:%d: fail", __func__, __LINE__));
4502         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4503             ("%s:%d: fail", __func__, __LINE__));
4504
4505         if (index >= per_sta_keys_start)
4506                 bwn_key_macwrite(mac, index, NULL);
4507         if (key)
4508                 memcpy(buf, key, key_len);
4509         bwn_key_write(mac, index, algorithm, buf);
4510         if (index >= per_sta_keys_start)
4511                 bwn_key_macwrite(mac, index, mac_addr);
4512
4513         mac->mac_key[index].algorithm = algorithm;
4514 }
4515
4516 static void
4517 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4518 {
4519         struct bwn_softc *sc = mac->mac_sc;
4520         uint32_t addrtmp[2] = { 0, 0 };
4521         uint8_t start = 8;
4522
4523         if (BWN_SEC_NEWAPI(mac))
4524                 start = 4;
4525
4526         KASSERT(index >= start,
4527             ("%s:%d: fail", __func__, __LINE__));
4528         index -= start;
4529
4530         if (addr) {
4531                 addrtmp[0] = addr[0];
4532                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4533                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4534                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4535                 addrtmp[1] = addr[4];
4536                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4537         }
4538
4539         if (siba_get_revid(sc->sc_dev) >= 5) {
4540                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4541                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4542         } else {
4543                 if (index >= 8) {
4544                         bwn_shm_write_4(mac, BWN_SHARED,
4545                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4546                         bwn_shm_write_2(mac, BWN_SHARED,
4547                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4548                 }
4549         }
4550 }
4551
4552 static void
4553 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4554     const uint8_t *key)
4555 {
4556         unsigned int i;
4557         uint32_t offset;
4558         uint16_t kidx, value;
4559
4560         kidx = BWN_SEC_KEY2FW(mac, index);
4561         bwn_shm_write_2(mac, BWN_SHARED,
4562             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4563
4564         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4565         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4566                 value = key[i];
4567                 value |= (uint16_t)(key[i + 1]) << 8;
4568                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4569         }
4570 }
4571
4572 static void
4573 bwn_phy_exit(struct bwn_mac *mac)
4574 {
4575
4576         mac->mac_phy.rf_onoff(mac, 0);
4577         if (mac->mac_phy.exit != NULL)
4578                 mac->mac_phy.exit(mac);
4579 }
4580
4581 static void
4582 bwn_dma_free(struct bwn_mac *mac)
4583 {
4584         struct bwn_dma *dma;
4585
4586         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4587                 return;
4588         dma = &mac->mac_method.dma;
4589
4590         bwn_dma_ringfree(&dma->rx);
4591         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4592         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4593         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4594         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4595         bwn_dma_ringfree(&dma->mcast);
4596 }
4597
4598 static void
4599 bwn_core_stop(struct bwn_mac *mac)
4600 {
4601         struct bwn_softc *sc = mac->mac_sc;
4602
4603         BWN_ASSERT_LOCKED(sc);
4604
4605         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4606                 return;
4607
4608         callout_stop(&sc->sc_rfswitch_ch);
4609         callout_stop(&sc->sc_task_ch);
4610         callout_stop(&sc->sc_watchdog_ch);
4611         sc->sc_watchdog_timer = 0;
4612         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4613         BWN_READ_4(mac, BWN_INTR_MASK);
4614         bwn_mac_suspend(mac);
4615
4616         mac->mac_status = BWN_MAC_STATUS_INITED;
4617 }
4618
4619 static int
4620 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4621 {
4622         struct bwn_mac *up_dev = NULL;
4623         struct bwn_mac *down_dev;
4624         struct bwn_mac *mac;
4625         int err, status;
4626         uint8_t gmode;
4627
4628         BWN_ASSERT_LOCKED(sc);
4629
4630         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4631                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4632                     mac->mac_phy.supports_2ghz) {
4633                         up_dev = mac;
4634                         gmode = 1;
4635                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4636                     mac->mac_phy.supports_5ghz) {
4637                         up_dev = mac;
4638                         gmode = 0;
4639                 } else {
4640                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4641                         return (EINVAL);
4642                 }
4643                 if (up_dev != NULL)
4644                         break;
4645         }
4646         if (up_dev == NULL) {
4647                 device_printf(sc->sc_dev, "Could not find a device\n");
4648                 return (ENODEV);
4649         }
4650         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4651                 return (0);
4652
4653         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4654             "switching to %s-GHz band\n",
4655             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4656
4657         down_dev = sc->sc_curmac;
4658         status = down_dev->mac_status;
4659         if (status >= BWN_MAC_STATUS_STARTED)
4660                 bwn_core_stop(down_dev);
4661         if (status >= BWN_MAC_STATUS_INITED)
4662                 bwn_core_exit(down_dev);
4663
4664         if (down_dev != up_dev)
4665                 bwn_phy_reset(down_dev);
4666
4667         up_dev->mac_phy.gmode = gmode;
4668         if (status >= BWN_MAC_STATUS_INITED) {
4669                 err = bwn_core_init(up_dev);
4670                 if (err) {
4671                         device_printf(sc->sc_dev,
4672                             "fatal: failed to initialize for %s-GHz\n",
4673                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4674                         goto fail;
4675                 }
4676         }
4677         if (status >= BWN_MAC_STATUS_STARTED)
4678                 bwn_core_start(up_dev);
4679         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4680         sc->sc_curmac = up_dev;
4681
4682         return (0);
4683 fail:
4684         sc->sc_curmac = NULL;
4685         return (err);
4686 }
4687
4688 static void
4689 bwn_rf_turnon(struct bwn_mac *mac)
4690 {
4691
4692         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4693
4694         bwn_mac_suspend(mac);
4695         mac->mac_phy.rf_onoff(mac, 1);
4696         mac->mac_phy.rf_on = 1;
4697         bwn_mac_enable(mac);
4698 }
4699
4700 static void
4701 bwn_rf_turnoff(struct bwn_mac *mac)
4702 {
4703
4704         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4705
4706         bwn_mac_suspend(mac);
4707         mac->mac_phy.rf_onoff(mac, 0);
4708         mac->mac_phy.rf_on = 0;
4709         bwn_mac_enable(mac);
4710 }
4711
4712 /*
4713  * SSB PHY reset.
4714  */
4715 static void
4716 bwn_phy_reset_siba(struct bwn_mac *mac)
4717 {
4718         struct bwn_softc *sc = mac->mac_sc;
4719
4720         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4721             ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4722              BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4723         DELAY(1000);
4724         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4725             (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4726         DELAY(1000);
4727 }
4728
4729 static void
4730 bwn_phy_reset(struct bwn_mac *mac)
4731 {
4732
4733         if (bwn_is_bus_siba(mac)) {
4734                 bwn_phy_reset_siba(mac);
4735         } else {
4736                 BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4737         }
4738 }
4739
4740 static int
4741 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4742 {
4743         struct bwn_vap *bvp = BWN_VAP(vap);
4744         struct ieee80211com *ic= vap->iv_ic;
4745         enum ieee80211_state ostate = vap->iv_state;
4746         struct bwn_softc *sc = ic->ic_softc;
4747         struct bwn_mac *mac = sc->sc_curmac;
4748         int error;
4749
4750         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4751             ieee80211_state_name[vap->iv_state],
4752             ieee80211_state_name[nstate]);
4753
4754         error = bvp->bv_newstate(vap, nstate, arg);
4755         if (error != 0)
4756                 return (error);
4757
4758         BWN_LOCK(sc);
4759
4760         bwn_led_newstate(mac, nstate);
4761
4762         /*
4763          * Clear the BSSID when we stop a STA
4764          */
4765         if (vap->iv_opmode == IEEE80211_M_STA) {
4766                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4767                         /*
4768                          * Clear out the BSSID.  If we reassociate to
4769                          * the same AP, this will reinialize things
4770                          * correctly...
4771                          */
4772                         if (ic->ic_opmode == IEEE80211_M_STA &&
4773                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4774                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4775                                 bwn_set_macaddr(mac);
4776                         }
4777                 }
4778         }
4779
4780         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4781             vap->iv_opmode == IEEE80211_M_AHDEMO) {
4782                 /* XXX nothing to do? */
4783         } else if (nstate == IEEE80211_S_RUN) {
4784                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4785                 bwn_set_opmode(mac);
4786                 bwn_set_pretbtt(mac);
4787                 bwn_spu_setdelay(mac, 0);
4788                 bwn_set_macaddr(mac);
4789         }
4790
4791         BWN_UNLOCK(sc);
4792
4793         return (error);
4794 }
4795
4796 static void
4797 bwn_set_pretbtt(struct bwn_mac *mac)
4798 {
4799         struct bwn_softc *sc = mac->mac_sc;
4800         struct ieee80211com *ic = &sc->sc_ic;
4801         uint16_t pretbtt;
4802
4803         if (ic->ic_opmode == IEEE80211_M_IBSS)
4804                 pretbtt = 2;
4805         else
4806                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4807         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4808         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4809 }
4810
4811 static int
4812 bwn_intr(void *arg)
4813 {
4814         struct bwn_mac *mac = arg;
4815         struct bwn_softc *sc = mac->mac_sc;
4816         uint32_t reason;
4817
4818         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4819             (sc->sc_flags & BWN_FLAG_INVALID))
4820                 return (FILTER_STRAY);
4821
4822         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4823
4824         reason = BWN_READ_4(mac, BWN_INTR_REASON);
4825         if (reason == 0xffffffff)       /* shared IRQ */
4826                 return (FILTER_STRAY);
4827         reason &= mac->mac_intr_mask;
4828         if (reason == 0)
4829                 return (FILTER_HANDLED);
4830         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4831
4832         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4833         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4834         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4835         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4836         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4837         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4838         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4839         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4840         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4841         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4842         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4843
4844         /* Disable interrupts. */
4845         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4846
4847         mac->mac_reason_intr = reason;
4848
4849         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4850         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4851
4852         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4853         return (FILTER_HANDLED);
4854 }
4855
4856 static void
4857 bwn_intrtask(void *arg, int npending)
4858 {
4859         struct bwn_mac *mac = arg;
4860         struct bwn_softc *sc = mac->mac_sc;
4861         uint32_t merged = 0;
4862         int i, tx = 0, rx = 0;
4863
4864         BWN_LOCK(sc);
4865         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4866             (sc->sc_flags & BWN_FLAG_INVALID)) {
4867                 BWN_UNLOCK(sc);
4868                 return;
4869         }
4870
4871         for (i = 0; i < N(mac->mac_reason); i++)
4872                 merged |= mac->mac_reason[i];
4873
4874         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4875                 device_printf(sc->sc_dev, "MAC trans error\n");
4876
4877         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4878                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4879                 mac->mac_phy.txerrors--;
4880                 if (mac->mac_phy.txerrors == 0) {
4881                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4882                         bwn_restart(mac, "PHY TX errors");
4883                 }
4884         }
4885
4886         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4887                 if (merged & BWN_DMAINTR_FATALMASK) {
4888                         device_printf(sc->sc_dev,
4889                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4890                             mac->mac_reason[0], mac->mac_reason[1],
4891                             mac->mac_reason[2], mac->mac_reason[3],
4892                             mac->mac_reason[4], mac->mac_reason[5]);
4893                         bwn_restart(mac, "DMA error");
4894                         BWN_UNLOCK(sc);
4895                         return;
4896                 }
4897                 if (merged & BWN_DMAINTR_NONFATALMASK) {
4898                         device_printf(sc->sc_dev,
4899                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
4900                             mac->mac_reason[0], mac->mac_reason[1],
4901                             mac->mac_reason[2], mac->mac_reason[3],
4902                             mac->mac_reason[4], mac->mac_reason[5]);
4903                 }
4904         }
4905
4906         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4907                 bwn_intr_ucode_debug(mac);
4908         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4909                 bwn_intr_tbtt_indication(mac);
4910         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4911                 bwn_intr_atim_end(mac);
4912         if (mac->mac_reason_intr & BWN_INTR_BEACON)
4913                 bwn_intr_beacon(mac);
4914         if (mac->mac_reason_intr & BWN_INTR_PMQ)
4915                 bwn_intr_pmq(mac);
4916         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4917                 bwn_intr_noise(mac);
4918
4919         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4920                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4921                         bwn_dma_rx(mac->mac_method.dma.rx);
4922                         rx = 1;
4923                 }
4924         } else
4925                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4926
4927         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4928         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4929         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4930         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4931         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4932
4933         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4934                 bwn_intr_txeof(mac);
4935                 tx = 1;
4936         }
4937
4938         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4939
4940         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4941                 int evt = BWN_LED_EVENT_NONE;
4942
4943                 if (tx && rx) {
4944                         if (sc->sc_rx_rate > sc->sc_tx_rate)
4945                                 evt = BWN_LED_EVENT_RX;
4946                         else
4947                                 evt = BWN_LED_EVENT_TX;
4948                 } else if (tx) {
4949                         evt = BWN_LED_EVENT_TX;
4950                 } else if (rx) {
4951                         evt = BWN_LED_EVENT_RX;
4952                 } else if (rx == 0) {
4953                         evt = BWN_LED_EVENT_POLL;
4954                 }
4955
4956                 if (evt != BWN_LED_EVENT_NONE)
4957                         bwn_led_event(mac, evt);
4958        }
4959
4960         if (mbufq_first(&sc->sc_snd) != NULL)
4961                 bwn_start(sc);
4962
4963         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4964         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4965
4966         BWN_UNLOCK(sc);
4967 }
4968
4969 static void
4970 bwn_restart(struct bwn_mac *mac, const char *msg)
4971 {
4972         struct bwn_softc *sc = mac->mac_sc;
4973         struct ieee80211com *ic = &sc->sc_ic;
4974
4975         if (mac->mac_status < BWN_MAC_STATUS_INITED)
4976                 return;
4977
4978         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4979         ieee80211_runtask(ic, &mac->mac_hwreset);
4980 }
4981
4982 static void
4983 bwn_intr_ucode_debug(struct bwn_mac *mac)
4984 {
4985         struct bwn_softc *sc = mac->mac_sc;
4986         uint16_t reason;
4987
4988         if (mac->mac_fw.opensource == 0)
4989                 return;
4990
4991         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4992         switch (reason) {
4993         case BWN_DEBUGINTR_PANIC:
4994                 bwn_handle_fwpanic(mac);
4995                 break;
4996         case BWN_DEBUGINTR_DUMP_SHM:
4997                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4998                 break;
4999         case BWN_DEBUGINTR_DUMP_REGS:
5000                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5001                 break;
5002         case BWN_DEBUGINTR_MARKER:
5003                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5004                 break;
5005         default:
5006                 device_printf(sc->sc_dev,
5007                     "ucode debug unknown reason: %#x\n", reason);
5008         }
5009
5010         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5011             BWN_DEBUGINTR_ACK);
5012 }
5013
5014 static void
5015 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5016 {
5017         struct bwn_softc *sc = mac->mac_sc;
5018         struct ieee80211com *ic = &sc->sc_ic;
5019
5020         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5021                 bwn_psctl(mac, 0);
5022         if (ic->ic_opmode == IEEE80211_M_IBSS)
5023                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5024 }
5025
5026 static void
5027 bwn_intr_atim_end(struct bwn_mac *mac)
5028 {
5029
5030         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5031                 BWN_WRITE_4(mac, BWN_MACCMD,
5032                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5033                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5034         }
5035 }
5036
5037 static void
5038 bwn_intr_beacon(struct bwn_mac *mac)
5039 {
5040         struct bwn_softc *sc = mac->mac_sc;
5041         struct ieee80211com *ic = &sc->sc_ic;
5042         uint32_t cmd, beacon0, beacon1;
5043
5044         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5045             ic->ic_opmode == IEEE80211_M_MBSS)
5046                 return;
5047
5048         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5049
5050         cmd = BWN_READ_4(mac, BWN_MACCMD);
5051         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5052         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5053
5054         if (beacon0 && beacon1) {
5055                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5056                 mac->mac_intr_mask |= BWN_INTR_BEACON;
5057                 return;
5058         }
5059
5060         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5061                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5062                 bwn_load_beacon0(mac);
5063                 bwn_load_beacon1(mac);
5064                 cmd = BWN_READ_4(mac, BWN_MACCMD);
5065                 cmd |= BWN_MACCMD_BEACON0_VALID;
5066                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5067         } else {
5068                 if (!beacon0) {
5069                         bwn_load_beacon0(mac);
5070                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5071                         cmd |= BWN_MACCMD_BEACON0_VALID;
5072                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5073                 } else if (!beacon1) {
5074                         bwn_load_beacon1(mac);
5075                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5076                         cmd |= BWN_MACCMD_BEACON1_VALID;
5077                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5078                 }
5079         }
5080 }
5081
5082 static void
5083 bwn_intr_pmq(struct bwn_mac *mac)
5084 {
5085         uint32_t tmp;
5086
5087         while (1) {
5088                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5089                 if (!(tmp & 0x00000008))
5090                         break;
5091         }
5092         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5093 }
5094
5095 static void
5096 bwn_intr_noise(struct bwn_mac *mac)
5097 {
5098         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5099         uint16_t tmp;
5100         uint8_t noise[4];
5101         uint8_t i, j;
5102         int32_t average;
5103
5104         if (mac->mac_phy.type != BWN_PHYTYPE_G)
5105                 return;
5106
5107         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5108         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5109         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5110             noise[3] == 0x7f)
5111                 goto new;
5112
5113         KASSERT(mac->mac_noise.noi_nsamples < 8,
5114             ("%s:%d: fail", __func__, __LINE__));
5115         i = mac->mac_noise.noi_nsamples;
5116         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5117         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5118         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5119         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5120         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5121         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5122         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5123         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5124         mac->mac_noise.noi_nsamples++;
5125         if (mac->mac_noise.noi_nsamples == 8) {
5126                 average = 0;
5127                 for (i = 0; i < 8; i++) {
5128                         for (j = 0; j < 4; j++)
5129                                 average += mac->mac_noise.noi_samples[i][j];
5130                 }
5131                 average = (((average / 32) * 125) + 64) / 128;
5132                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5133                 if (tmp >= 8)
5134                         average += 2;
5135                 else
5136                         average -= 25;
5137                 average -= (tmp == 8) ? 72 : 48;
5138
5139                 mac->mac_stats.link_noise = average;
5140                 mac->mac_noise.noi_running = 0;
5141                 return;
5142         }
5143 new:
5144         bwn_noise_gensample(mac);
5145 }
5146
5147 static int
5148 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5149 {
5150         struct bwn_mac *mac = prq->prq_mac;
5151         struct bwn_softc *sc = mac->mac_sc;
5152         unsigned int i;
5153
5154         BWN_ASSERT_LOCKED(sc);
5155
5156         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5157                 return (0);
5158
5159         for (i = 0; i < 5000; i++) {
5160                 if (bwn_pio_rxeof(prq) == 0)
5161                         break;
5162         }
5163         if (i >= 5000)
5164                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5165         return ((i > 0) ? 1 : 0);
5166 }
5167
5168 static void
5169 bwn_dma_rx(struct bwn_dma_ring *dr)
5170 {
5171         int slot, curslot;
5172
5173         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5174         curslot = dr->get_curslot(dr);
5175         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5176             ("%s:%d: fail", __func__, __LINE__));
5177
5178         slot = dr->dr_curslot;
5179         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5180                 bwn_dma_rxeof(dr, &slot);
5181
5182         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5183             BUS_DMASYNC_PREWRITE);
5184
5185         dr->set_curslot(dr, slot);
5186         dr->dr_curslot = slot;
5187 }
5188
5189 static void
5190 bwn_intr_txeof(struct bwn_mac *mac)
5191 {
5192         struct bwn_txstatus stat;
5193         uint32_t stat0, stat1;
5194         uint16_t tmp;
5195
5196         BWN_ASSERT_LOCKED(mac->mac_sc);
5197
5198         while (1) {
5199                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5200                 if (!(stat0 & 0x00000001))
5201                         break;
5202                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5203
5204                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5205                     "%s: stat0=0x%08x, stat1=0x%08x\n",
5206                     __func__,
5207                     stat0,
5208                     stat1);
5209
5210                 stat.cookie = (stat0 >> 16);
5211                 stat.seq = (stat1 & 0x0000ffff);
5212                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5213                 tmp = (stat0 & 0x0000ffff);
5214                 stat.framecnt = ((tmp & 0xf000) >> 12);
5215                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
5216                 stat.sreason = ((tmp & 0x001c) >> 2);
5217                 stat.pm = (tmp & 0x0080) ? 1 : 0;
5218                 stat.im = (tmp & 0x0040) ? 1 : 0;
5219                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5220                 stat.ack = (tmp & 0x0002) ? 1 : 0;
5221
5222                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5223                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5224                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5225                     __func__,
5226                     stat.cookie,
5227                     stat.seq,
5228                     stat.phy_stat,
5229                     stat.framecnt,
5230                     stat.rtscnt,
5231                     stat.sreason,
5232                     stat.pm,
5233                     stat.im,
5234                     stat.ampdu,
5235                     stat.ack);
5236
5237                 bwn_handle_txeof(mac, &stat);
5238         }
5239 }
5240
5241 static void
5242 bwn_hwreset(void *arg, int npending)
5243 {
5244         struct bwn_mac *mac = arg;
5245         struct bwn_softc *sc = mac->mac_sc;
5246         int error = 0;
5247         int prev_status;
5248
5249         BWN_LOCK(sc);
5250
5251         prev_status = mac->mac_status;
5252         if (prev_status >= BWN_MAC_STATUS_STARTED)
5253                 bwn_core_stop(mac);
5254         if (prev_status >= BWN_MAC_STATUS_INITED)
5255                 bwn_core_exit(mac);
5256
5257         if (prev_status >= BWN_MAC_STATUS_INITED) {
5258                 error = bwn_core_init(mac);
5259                 if (error)
5260                         goto out;
5261         }
5262         if (prev_status >= BWN_MAC_STATUS_STARTED)
5263                 bwn_core_start(mac);
5264 out:
5265         if (error) {
5266                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5267                 sc->sc_curmac = NULL;
5268         }
5269         BWN_UNLOCK(sc);
5270 }
5271
5272 static void
5273 bwn_handle_fwpanic(struct bwn_mac *mac)
5274 {
5275         struct bwn_softc *sc = mac->mac_sc;
5276         uint16_t reason;
5277
5278         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5279         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5280
5281         if (reason == BWN_FWPANIC_RESTART)
5282                 bwn_restart(mac, "ucode panic");
5283 }
5284
5285 static void
5286 bwn_load_beacon0(struct bwn_mac *mac)
5287 {
5288
5289         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5290 }
5291
5292 static void
5293 bwn_load_beacon1(struct bwn_mac *mac)
5294 {
5295
5296         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5297 }
5298
5299 static uint32_t
5300 bwn_jssi_read(struct bwn_mac *mac)
5301 {
5302         uint32_t val = 0;
5303
5304         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5305         val <<= 16;
5306         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5307
5308         return (val);
5309 }
5310
5311 static void
5312 bwn_noise_gensample(struct bwn_mac *mac)
5313 {
5314         uint32_t jssi = 0x7f7f7f7f;
5315
5316         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5317         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5318         BWN_WRITE_4(mac, BWN_MACCMD,
5319             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5320 }
5321
5322 static int
5323 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5324 {
5325         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5326
5327         return (dr->dr_numslots - dr->dr_usedslot);
5328 }
5329
5330 static int
5331 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5332 {
5333         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5334
5335         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5336             ("%s:%d: fail", __func__, __LINE__));
5337         if (slot == dr->dr_numslots - 1)
5338                 return (0);
5339         return (slot + 1);
5340 }
5341
5342 static void
5343 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5344 {
5345         struct bwn_mac *mac = dr->dr_mac;
5346         struct bwn_softc *sc = mac->mac_sc;
5347         struct bwn_dma *dma = &mac->mac_method.dma;
5348         struct bwn_dmadesc_generic *desc;
5349         struct bwn_dmadesc_meta *meta;
5350         struct bwn_rxhdr4 *rxhdr;
5351         struct mbuf *m;
5352         uint32_t macstat;
5353         int32_t tmp;
5354         int cnt = 0;
5355         uint16_t len;
5356
5357         dr->getdesc(dr, *slot, &desc, &meta);
5358
5359         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5360         m = meta->mt_m;
5361
5362         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5363                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5364                 return;
5365         }
5366
5367         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5368         len = le16toh(rxhdr->frame_len);
5369         if (len <= 0) {
5370                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5371                 return;
5372         }
5373         if (bwn_dma_check_redzone(dr, m)) {
5374                 device_printf(sc->sc_dev, "redzone error.\n");
5375                 bwn_dma_set_redzone(dr, m);
5376                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5377                     BUS_DMASYNC_PREWRITE);
5378                 return;
5379         }
5380         if (len > dr->dr_rx_bufsize) {
5381                 tmp = len;
5382                 while (1) {
5383                         dr->getdesc(dr, *slot, &desc, &meta);
5384                         bwn_dma_set_redzone(dr, meta->mt_m);
5385                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5386                             BUS_DMASYNC_PREWRITE);
5387                         *slot = bwn_dma_nextslot(dr, *slot);
5388                         cnt++;
5389                         tmp -= dr->dr_rx_bufsize;
5390                         if (tmp <= 0)
5391                                 break;
5392                 }
5393                 device_printf(sc->sc_dev, "too small buffer "
5394                        "(len %u buffer %u dropped %d)\n",
5395                        len, dr->dr_rx_bufsize, cnt);
5396                 return;
5397         }
5398
5399         switch (mac->mac_fw.fw_hdr_format) {
5400         case BWN_FW_HDR_351:
5401         case BWN_FW_HDR_410:
5402                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5403                 break;
5404         case BWN_FW_HDR_598:
5405                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5406                 break;
5407         }
5408
5409         if (macstat & BWN_RX_MAC_FCSERR) {
5410                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5411                         device_printf(sc->sc_dev, "RX drop\n");
5412                         return;
5413                 }
5414         }
5415
5416         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5417         m_adj(m, dr->dr_frameoffset);
5418
5419         bwn_rxeof(dr->dr_mac, m, rxhdr);
5420 }
5421
5422 static void
5423 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5424 {
5425         struct bwn_softc *sc = mac->mac_sc;
5426         struct bwn_stats *stats = &mac->mac_stats;
5427
5428         BWN_ASSERT_LOCKED(mac->mac_sc);
5429
5430         if (status->im)
5431                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5432         if (status->ampdu)
5433                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5434         if (status->rtscnt) {
5435                 if (status->rtscnt == 0xf)
5436                         stats->rtsfail++;
5437                 else
5438                         stats->rts++;
5439         }
5440
5441         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5442                 bwn_dma_handle_txeof(mac, status);
5443         } else {
5444                 bwn_pio_handle_txeof(mac, status);
5445         }
5446
5447         bwn_phy_txpower_check(mac, 0);
5448 }
5449
5450 static uint8_t
5451 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5452 {
5453         struct bwn_mac *mac = prq->prq_mac;
5454         struct bwn_softc *sc = mac->mac_sc;
5455         struct bwn_rxhdr4 rxhdr;
5456         struct mbuf *m;
5457         uint32_t ctl32, macstat, v32;
5458         unsigned int i, padding;
5459         uint16_t ctl16, len, totlen, v16;
5460         unsigned char *mp;
5461         char *data;
5462
5463         memset(&rxhdr, 0, sizeof(rxhdr));
5464
5465         if (prq->prq_rev >= 8) {
5466                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5467                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5468                         return (0);
5469                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5470                     BWN_PIO8_RXCTL_FRAMEREADY);
5471                 for (i = 0; i < 10; i++) {
5472                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5473                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5474                                 goto ready;
5475                         DELAY(10);
5476                 }
5477         } else {
5478                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5479                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5480                         return (0);
5481                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5482                     BWN_PIO_RXCTL_FRAMEREADY);
5483                 for (i = 0; i < 10; i++) {
5484                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5485                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5486                                 goto ready;
5487                         DELAY(10);
5488                 }
5489         }
5490         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5491         return (1);
5492 ready:
5493         if (prq->prq_rev >= 8)
5494                 siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5495                     prq->prq_base + BWN_PIO8_RXDATA);
5496         else
5497                 siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5498                     prq->prq_base + BWN_PIO_RXDATA);
5499         len = le16toh(rxhdr.frame_len);
5500         if (len > 0x700) {
5501                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5502                 goto error;
5503         }
5504         if (len == 0) {
5505                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5506                 goto error;
5507         }
5508
5509         switch (mac->mac_fw.fw_hdr_format) {
5510         case BWN_FW_HDR_351:
5511         case BWN_FW_HDR_410:
5512                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
5513                 break;
5514         case BWN_FW_HDR_598:
5515                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
5516                 break;
5517         }
5518
5519         if (macstat & BWN_RX_MAC_FCSERR) {
5520                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5521                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5522                         goto error;
5523                 }
5524         }
5525
5526         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5527         totlen = len + padding;
5528         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5529         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5530         if (m == NULL) {
5531                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5532                 goto error;
5533         }
5534         mp = mtod(m, unsigned char *);
5535         if (prq->prq_rev >= 8) {
5536                 siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5537                     prq->prq_base + BWN_PIO8_RXDATA);
5538                 if (totlen & 3) {
5539                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5540                         data = &(mp[totlen - 1]);
5541                         switch (totlen & 3) {
5542                         case 3:
5543                                 *data = (v32 >> 16);
5544                                 data--;
5545                         case 2:
5546                                 *data = (v32 >> 8);
5547                                 data--;
5548                         case 1:
5549                                 *data = v32;
5550                         }
5551                 }
5552         } else {
5553                 siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5554                     prq->prq_base + BWN_PIO_RXDATA);
5555                 if (totlen & 1) {
5556                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5557                         mp[totlen - 1] = v16;
5558                 }
5559         }
5560
5561         m->m_len = m->m_pkthdr.len = totlen;
5562
5563         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5564
5565         return (1);
5566 error:
5567         if (prq->prq_rev >= 8)
5568                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5569                     BWN_PIO8_RXCTL_DATAREADY);
5570         else
5571                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5572         return (1);
5573 }
5574
5575 static int
5576 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5577     struct bwn_dmadesc_meta *meta, int init)
5578 {
5579         struct bwn_mac *mac = dr->dr_mac;
5580         struct bwn_dma *dma = &mac->mac_method.dma;
5581         struct bwn_rxhdr4 *hdr;
5582         bus_dmamap_t map;
5583         bus_addr_t paddr;
5584         struct mbuf *m;
5585         int error;
5586
5587         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5588         if (m == NULL) {
5589                 error = ENOBUFS;
5590
5591                 /*
5592                  * If the NIC is up and running, we need to:
5593                  * - Clear RX buffer's header.
5594                  * - Restore RX descriptor settings.
5595                  */
5596                 if (init)
5597                         return (error);
5598                 else
5599                         goto back;
5600         }
5601         m->m_len = m->m_pkthdr.len = MCLBYTES;
5602
5603         bwn_dma_set_redzone(dr, m);
5604
5605         /*
5606          * Try to load RX buf into temporary DMA map
5607          */
5608         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5609             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5610         if (error) {
5611                 m_freem(m);
5612
5613                 /*
5614                  * See the comment above
5615                  */
5616                 if (init)
5617                         return (error);
5618                 else
5619                         goto back;
5620         }
5621
5622         if (!init)
5623                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5624         meta->mt_m = m;
5625         meta->mt_paddr = paddr;
5626
5627         /*
5628          * Swap RX buf's DMA map with the loaded temporary one
5629          */
5630         map = meta->mt_dmap;
5631         meta->mt_dmap = dr->dr_spare_dmap;
5632         dr->dr_spare_dmap = map;
5633
5634 back:
5635         /*
5636          * Clear RX buf header
5637          */
5638         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5639         bzero(hdr, sizeof(*hdr));
5640         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5641             BUS_DMASYNC_PREWRITE);
5642
5643         /*
5644          * Setup RX buf descriptor
5645          */
5646         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5647             sizeof(*hdr), 0, 0, 0);
5648         return (error);
5649 }
5650
5651 static void
5652 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5653                  bus_size_t mapsz __unused, int error)
5654 {
5655
5656         if (!error) {
5657                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5658                 *((bus_addr_t *)arg) = seg->ds_addr;
5659         }
5660 }
5661
5662 static int
5663 bwn_hwrate2ieeerate(int rate)
5664 {
5665
5666         switch (rate) {
5667         case BWN_CCK_RATE_1MB:
5668                 return (2);
5669         case BWN_CCK_RATE_2MB:
5670                 return (4);
5671         case BWN_CCK_RATE_5MB:
5672                 return (11);
5673         case BWN_CCK_RATE_11MB:
5674                 return (22);
5675         case BWN_OFDM_RATE_6MB:
5676                 return (12);
5677         case BWN_OFDM_RATE_9MB:
5678                 return (18);
5679         case BWN_OFDM_RATE_12MB:
5680                 return (24);
5681         case BWN_OFDM_RATE_18MB:
5682                 return (36);
5683         case BWN_OFDM_RATE_24MB:
5684                 return (48);
5685         case BWN_OFDM_RATE_36MB:
5686                 return (72);
5687         case BWN_OFDM_RATE_48MB:
5688                 return (96);
5689         case BWN_OFDM_RATE_54MB:
5690                 return (108);
5691         default:
5692                 printf("Ooops\n");
5693                 return (0);
5694         }
5695 }
5696
5697 /*
5698  * Post process the RX provided RSSI.
5699  *
5700  * Valid for A, B, G, LP PHYs.
5701  */
5702 static int8_t
5703 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5704     int ofdm, int adjust_2053, int adjust_2050)
5705 {
5706         struct bwn_phy *phy = &mac->mac_phy;
5707         struct bwn_phy_g *gphy = &phy->phy_g;
5708         int tmp;
5709
5710         switch (phy->rf_ver) {
5711         case 0x2050:
5712                 if (ofdm) {
5713                         tmp = in_rssi;
5714                         if (tmp > 127)
5715                                 tmp -= 256;
5716                         tmp = tmp * 73 / 64;
5717                         if (adjust_2050)
5718                                 tmp += 25;
5719                         else
5720                                 tmp -= 3;
5721                 } else {
5722                         if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5723                             & BWN_BFL_RSSI) {
5724                                 if (in_rssi > 63)
5725                                         in_rssi = 63;
5726                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5727                                 tmp = (31 - tmp) * -131 / 128 - 57;
5728                         } else {
5729                                 tmp = in_rssi;
5730                                 tmp = (31 - tmp) * -149 / 128 - 68;
5731                         }
5732                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5733                                 tmp += 25;
5734                 }
5735                 break;
5736         case 0x2060:
5737                 if (in_rssi > 127)
5738                         tmp = in_rssi - 256;
5739                 else
5740                         tmp = in_rssi;
5741                 break;
5742         default:
5743                 tmp = in_rssi;
5744                 tmp = (tmp - 11) * 103 / 64;
5745                 if (adjust_2053)
5746                         tmp -= 109;
5747                 else
5748                         tmp -= 83;
5749         }
5750
5751         return (tmp);
5752 }
5753
5754 static void
5755 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5756 {
5757         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5758         struct bwn_plcp6 *plcp;
5759         struct bwn_softc *sc = mac->mac_sc;
5760         struct ieee80211_frame_min *wh;
5761         struct ieee80211_node *ni;
5762         struct ieee80211com *ic = &sc->sc_ic;
5763         uint32_t macstat;
5764         int padding, rate, rssi = 0, noise = 0, type;
5765         uint16_t phytype, phystat0, phystat3, chanstat;
5766         unsigned char *mp = mtod(m, unsigned char *);
5767         static int rx_mac_dec_rpt = 0;
5768
5769         BWN_ASSERT_LOCKED(sc);
5770
5771         phystat0 = le16toh(rxhdr->phy_status0);
5772
5773         /*
5774          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5775          * used for LP-PHY.
5776          */
5777         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5778
5779         switch (mac->mac_fw.fw_hdr_format) {
5780         case BWN_FW_HDR_351:
5781         case BWN_FW_HDR_410:
5782                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5783                 chanstat = le16toh(rxhdr->ps4.r351.channel);
5784                 break;
5785         case BWN_FW_HDR_598:
5786                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5787                 chanstat = le16toh(rxhdr->ps4.r598.channel);
5788                 break;
5789         }
5790
5791
5792         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5793
5794         if (macstat & BWN_RX_MAC_FCSERR)
5795                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5796         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5797                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5798         if (macstat & BWN_RX_MAC_DECERR)
5799                 goto drop;
5800
5801         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5802         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5803                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5804                     m->m_pkthdr.len);
5805                 goto drop;
5806         }
5807         plcp = (struct bwn_plcp6 *)(mp + padding);
5808         m_adj(m, sizeof(struct bwn_plcp6) + padding);
5809         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5810                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5811                     m->m_pkthdr.len);
5812                 goto drop;
5813         }
5814         wh = mtod(m, struct ieee80211_frame_min *);
5815
5816         if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5817                 device_printf(sc->sc_dev,
5818                     "RX decryption attempted (old %d keyidx %#x)\n",
5819                     BWN_ISOLDFMT(mac),
5820                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5821
5822         if (phystat0 & BWN_RX_PHYST0_OFDM)
5823                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
5824                     phytype == BWN_PHYTYPE_A);
5825         else
5826                 rate = bwn_plcp_get_cckrate(mac, plcp);
5827         if (rate == -1) {
5828                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5829                         goto drop;
5830         }
5831         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5832
5833         /* rssi/noise */
5834         switch (phytype) {
5835         case BWN_PHYTYPE_A:
5836         case BWN_PHYTYPE_B:
5837         case BWN_PHYTYPE_G:
5838         case BWN_PHYTYPE_LP:
5839                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5840                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
5841                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5842                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5843                 break;
5844         case BWN_PHYTYPE_N:
5845                 /* Broadcom has code for min/avg, but always used max */
5846                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5847                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5848                 else
5849                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5850 #if 0
5851                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5852                     "%s: power0=%d, power1=%d, power2=%d\n",
5853                     __func__,
5854                     rxhdr->phy.n.power0,
5855                     rxhdr->phy.n.power1,
5856                     rxhdr->ps2.n.power2);
5857 #endif
5858                 break;
5859         default:
5860                 /* XXX TODO: implement rssi for other PHYs */
5861                 break;
5862         }
5863
5864         /*
5865          * RSSI here is absolute, not relative to the noise floor.
5866          */
5867         noise = mac->mac_stats.link_noise;
5868         rssi = rssi - noise;
5869
5870         /* RX radio tap */
5871         if (ieee80211_radiotap_active(ic))
5872                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5873         m_adj(m, -IEEE80211_CRC_LEN);
5874
5875         BWN_UNLOCK(sc);
5876
5877         ni = ieee80211_find_rxnode(ic, wh);
5878         if (ni != NULL) {
5879                 type = ieee80211_input(ni, m, rssi, noise);
5880                 ieee80211_free_node(ni);
5881         } else
5882                 type = ieee80211_input_all(ic, m, rssi, noise);
5883
5884         BWN_LOCK(sc);
5885         return;
5886 drop:
5887         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5888 }
5889
5890 static void
5891 bwn_dma_handle_txeof(struct bwn_mac *mac,
5892     const struct bwn_txstatus *status)
5893 {
5894         struct bwn_dma *dma = &mac->mac_method.dma;
5895         struct bwn_dma_ring *dr;
5896         struct bwn_dmadesc_generic *desc;
5897         struct bwn_dmadesc_meta *meta;
5898         struct bwn_softc *sc = mac->mac_sc;
5899         int slot;
5900         int retrycnt = 0;
5901
5902         BWN_ASSERT_LOCKED(sc);
5903
5904         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5905         if (dr == NULL) {
5906                 device_printf(sc->sc_dev, "failed to parse cookie\n");
5907                 return;
5908         }
5909         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5910
5911         while (1) {
5912                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
5913                     ("%s:%d: fail", __func__, __LINE__));
5914                 dr->getdesc(dr, slot, &desc, &meta);
5915
5916                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5917                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5918                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5919                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5920
5921                 if (meta->mt_islast) {
5922                         KASSERT(meta->mt_m != NULL,
5923                             ("%s:%d: fail", __func__, __LINE__));
5924
5925                         /*
5926                          * If we don't get an ACK, then we should log the
5927                          * full framecnt.  That may be 0 if it's a PHY
5928                          * failure, so ensure that gets logged as some
5929                          * retry attempt.
5930                          */
5931                         if (status->ack) {
5932                                 retrycnt = status->framecnt - 1;
5933                         } else {
5934                                 retrycnt = status->framecnt;
5935                                 if (retrycnt == 0)
5936                                         retrycnt = 1;
5937                         }
5938                         ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5939                             status->ack ?
5940                               IEEE80211_RATECTL_TX_SUCCESS :
5941                               IEEE80211_RATECTL_TX_FAILURE,
5942                             &retrycnt, 0);
5943                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5944                         meta->mt_ni = NULL;
5945                         meta->mt_m = NULL;
5946                 } else
5947                         KASSERT(meta->mt_m == NULL,
5948                             ("%s:%d: fail", __func__, __LINE__));
5949
5950                 dr->dr_usedslot--;
5951                 if (meta->mt_islast)
5952                         break;
5953                 slot = bwn_dma_nextslot(dr, slot);
5954         }
5955         sc->sc_watchdog_timer = 0;
5956         if (dr->dr_stop) {
5957                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5958                     ("%s:%d: fail", __func__, __LINE__));
5959                 dr->dr_stop = 0;
5960         }
5961 }
5962
5963 static void
5964 bwn_pio_handle_txeof(struct bwn_mac *mac,
5965     const struct bwn_txstatus *status)
5966 {
5967         struct bwn_pio_txqueue *tq;
5968         struct bwn_pio_txpkt *tp = NULL;
5969         struct bwn_softc *sc = mac->mac_sc;
5970         int retrycnt = 0;
5971
5972         BWN_ASSERT_LOCKED(sc);
5973
5974         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5975         if (tq == NULL)
5976                 return;
5977
5978         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5979         tq->tq_free++;
5980
5981         if (tp->tp_ni != NULL) {
5982                 /*
5983                  * Do any tx complete callback.  Note this must
5984                  * be done before releasing the node reference.
5985                  */
5986
5987                 /*
5988                  * If we don't get an ACK, then we should log the
5989                  * full framecnt.  That may be 0 if it's a PHY
5990                  * failure, so ensure that gets logged as some
5991                  * retry attempt.
5992                  */
5993                 if (status->ack) {
5994                         retrycnt = status->framecnt - 1;
5995                 } else {
5996                         retrycnt = status->framecnt;
5997                         if (retrycnt == 0)
5998                                 retrycnt = 1;
5999                 }
6000                 ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6001                     status->ack ?
6002                       IEEE80211_RATECTL_TX_SUCCESS :
6003                       IEEE80211_RATECTL_TX_FAILURE,
6004                     &retrycnt, 0);
6005
6006                 if (tp->tp_m->m_flags & M_TXCB)
6007                         ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6008                 ieee80211_free_node(tp->tp_ni);
6009                 tp->tp_ni = NULL;
6010         }
6011         m_freem(tp->tp_m);
6012         tp->tp_m = NULL;
6013         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6014
6015         sc->sc_watchdog_timer = 0;
6016 }
6017
6018 static void
6019 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6020 {
6021         struct bwn_softc *sc = mac->mac_sc;
6022         struct bwn_phy *phy = &mac->mac_phy;
6023         struct ieee80211com *ic = &sc->sc_ic;
6024         unsigned long now;
6025         bwn_txpwr_result_t result;
6026
6027         BWN_GETTIME(now);
6028
6029         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6030                 return;
6031         phy->nexttime = now + 2 * 1000;
6032
6033         if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6034             siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6035                 return;
6036
6037         if (phy->recalc_txpwr != NULL) {
6038                 result = phy->recalc_txpwr(mac,
6039                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6040                 if (result == BWN_TXPWR_RES_DONE)
6041                         return;
6042                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6043                     ("%s: fail", __func__));
6044                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6045
6046                 ieee80211_runtask(ic, &mac->mac_txpower);
6047         }
6048 }
6049
6050 static uint16_t
6051 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6052 {
6053
6054         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6055 }
6056
6057 static uint32_t
6058 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6059 {
6060
6061         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6062 }
6063
6064 static void
6065 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6066 {
6067
6068         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6069 }
6070
6071 static void
6072 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6073 {
6074
6075         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6076 }
6077
6078 static int
6079 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6080 {
6081
6082         switch (rate) {
6083         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6084         case 12:
6085                 return (BWN_OFDM_RATE_6MB);
6086         case 18:
6087                 return (BWN_OFDM_RATE_9MB);
6088         case 24:
6089                 return (BWN_OFDM_RATE_12MB);
6090         case 36:
6091                 return (BWN_OFDM_RATE_18MB);
6092         case 48:
6093                 return (BWN_OFDM_RATE_24MB);
6094         case 72:
6095                 return (BWN_OFDM_RATE_36MB);
6096         case 96:
6097                 return (BWN_OFDM_RATE_48MB);
6098         case 108:
6099                 return (BWN_OFDM_RATE_54MB);
6100         /* CCK rates (NB: not IEEE std, device-specific) */
6101         case 2:
6102                 return (BWN_CCK_RATE_1MB);
6103         case 4:
6104                 return (BWN_CCK_RATE_2MB);
6105         case 11:
6106                 return (BWN_CCK_RATE_5MB);
6107         case 22:
6108                 return (BWN_CCK_RATE_11MB);
6109         }
6110
6111         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6112         return (BWN_CCK_RATE_1MB);
6113 }
6114
6115 static uint16_t
6116 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6117 {
6118         struct bwn_phy *phy = &mac->mac_phy;
6119         uint16_t control = 0;
6120         uint16_t bw;
6121
6122         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6123         bw = BWN_TXH_PHY1_BW_20;
6124
6125         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6126                 control = bw;
6127         } else {
6128                 control = bw;
6129                 /* Figure out coding rate and modulation */
6130                 /* XXX TODO: table-ize, for MCS transmit */
6131                 /* Note: this is BWN_*_RATE values */
6132                 switch (bitrate) {
6133                 case BWN_CCK_RATE_1MB:
6134                         control |= 0;
6135                         break;
6136                 case BWN_CCK_RATE_2MB:
6137                         control |= 1;
6138                         break;
6139                 case BWN_CCK_RATE_5MB:
6140                         control |= 2;
6141                         break;
6142                 case BWN_CCK_RATE_11MB:
6143                         control |= 3;
6144                         break;
6145                 case BWN_OFDM_RATE_6MB:
6146                         control |= BWN_TXH_PHY1_CRATE_1_2;
6147                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6148                         break;
6149                 case BWN_OFDM_RATE_9MB:
6150                         control |= BWN_TXH_PHY1_CRATE_3_4;
6151                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6152                         break;
6153                 case BWN_OFDM_RATE_12MB:
6154                         control |= BWN_TXH_PHY1_CRATE_1_2;
6155                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6156                         break;
6157                 case BWN_OFDM_RATE_18MB:
6158                         control |= BWN_TXH_PHY1_CRATE_3_4;
6159                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6160                         break;
6161                 case BWN_OFDM_RATE_24MB:
6162                         control |= BWN_TXH_PHY1_CRATE_1_2;
6163                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6164                         break;
6165                 case BWN_OFDM_RATE_36MB:
6166                         control |= BWN_TXH_PHY1_CRATE_3_4;
6167                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6168                         break;
6169                 case BWN_OFDM_RATE_48MB:
6170                         control |= BWN_TXH_PHY1_CRATE_1_2;
6171                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6172                         break;
6173                 case BWN_OFDM_RATE_54MB:
6174                         control |= BWN_TXH_PHY1_CRATE_3_4;
6175                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6176                         break;
6177                 default:
6178                         break;
6179                 }
6180                 control |= BWN_TXH_PHY1_MODE_SISO;
6181         }
6182
6183         return control;
6184 }
6185
6186 static int
6187 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6188     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6189 {
6190         const struct bwn_phy *phy = &mac->mac_phy;
6191         struct bwn_softc *sc = mac->mac_sc;
6192         struct ieee80211_frame *wh;
6193         struct ieee80211_frame *protwh;
6194         struct ieee80211_frame_cts *cts;
6195         struct ieee80211_frame_rts *rts;
6196         const struct ieee80211_txparam *tp;
6197         struct ieee80211vap *vap = ni->ni_vap;
6198         struct ieee80211com *ic = &sc->sc_ic;
6199         struct mbuf *mprot;
6200         unsigned int len;
6201         uint32_t macctl = 0;
6202         int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6203         uint16_t phyctl = 0;
6204         uint8_t rate, rate_fb;
6205         int fill_phy_ctl1 = 0;
6206
6207         wh = mtod(m, struct ieee80211_frame *);
6208         memset(txhdr, 0, sizeof(*txhdr));
6209
6210         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6211         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6212         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6213
6214         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6215             || (phy->type == BWN_PHYTYPE_HT))
6216                 fill_phy_ctl1 = 1;
6217
6218         /*
6219          * Find TX rate
6220          */
6221         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6222         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6223                 rate = rate_fb = tp->mgmtrate;
6224         else if (ismcast)
6225                 rate = rate_fb = tp->mcastrate;
6226         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6227                 rate = rate_fb = tp->ucastrate;
6228         else {
6229                 /* XXX TODO: don't fall back to CCK rates for OFDM */
6230                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
6231                 rate = ni->ni_txrate;
6232
6233                 if (rix > 0)
6234                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6235                             IEEE80211_RATE_VAL;
6236                 else
6237                         rate_fb = rate;
6238         }
6239
6240         sc->sc_tx_rate = rate;
6241
6242         /* Note: this maps the select ieee80211 rate to hardware rate */
6243         rate = bwn_ieeerate2hwrate(sc, rate);
6244         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6245
6246         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6247             bwn_plcp_getcck(rate);
6248         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6249         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6250
6251         /* XXX rate/rate_fb is the hardware rate */
6252         if ((rate_fb == rate) ||
6253             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6254             (*(u_int16_t *)wh->i_dur == htole16(0)))
6255                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6256         else
6257                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6258                     m->m_pkthdr.len, rate, isshort);
6259
6260         /* XXX TX encryption */
6261
6262         switch (mac->mac_fw.fw_hdr_format) {
6263         case BWN_FW_HDR_351:
6264                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6265                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6266                 break;
6267         case BWN_FW_HDR_410:
6268                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6269                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6270                 break;
6271         case BWN_FW_HDR_598:
6272                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6273                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6274                 break;
6275         }
6276
6277         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6278             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6279
6280         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6281             BWN_TX_EFT_FB_CCK;
6282         txhdr->chan = phy->chan;
6283         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6284             BWN_TX_PHY_ENC_CCK;
6285         /* XXX preamble? obey net80211 */
6286         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6287              rate == BWN_CCK_RATE_11MB))
6288                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
6289
6290         if (! phy->gmode)
6291                 macctl |= BWN_TX_MAC_5GHZ;
6292
6293         /* XXX TX antenna selection */
6294
6295         switch (bwn_antenna_sanitize(mac, 0)) {
6296         case 0:
6297                 phyctl |= BWN_TX_PHY_ANT01AUTO;
6298                 break;
6299         case 1:
6300                 phyctl |= BWN_TX_PHY_ANT0;
6301                 break;
6302         case 2:
6303                 phyctl |= BWN_TX_PHY_ANT1;
6304                 break;
6305         case 3:
6306                 phyctl |= BWN_TX_PHY_ANT2;
6307                 break;
6308         case 4:
6309                 phyctl |= BWN_TX_PHY_ANT3;
6310                 break;
6311         default:
6312                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6313         }
6314
6315         if (!ismcast)
6316                 macctl |= BWN_TX_MAC_ACK;
6317
6318         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6319         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6320             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6321                 macctl |= BWN_TX_MAC_LONGFRAME;
6322
6323         if (ic->ic_flags & IEEE80211_F_USEPROT) {
6324                 /* XXX RTS rate is always 1MB??? */
6325                 /* XXX TODO: don't fall back to CCK rates for OFDM */
6326                 rts_rate = BWN_CCK_RATE_1MB;
6327                 rts_rate_fb = bwn_get_fbrate(rts_rate);
6328
6329                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
6330                 protdur = ieee80211_compute_duration(ic->ic_rt,
6331                     m->m_pkthdr.len, rate, isshort) +
6332                     + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6333
6334                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6335
6336                         switch (mac->mac_fw.fw_hdr_format) {
6337                         case BWN_FW_HDR_351:
6338                                 cts = (struct ieee80211_frame_cts *)
6339                                     txhdr->body.r351.rts_frame;
6340                                 break;
6341                         case BWN_FW_HDR_410:
6342                                 cts = (struct ieee80211_frame_cts *)
6343                                     txhdr->body.r410.rts_frame;
6344                                 break;
6345                         case BWN_FW_HDR_598:
6346                                 cts = (struct ieee80211_frame_cts *)
6347                                     txhdr->body.r598.rts_frame;
6348                                 break;
6349                         }
6350
6351                         mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6352                             protdur);
6353                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6354                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6355                             mprot->m_pkthdr.len);
6356                         m_freem(mprot);
6357                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6358                         len = sizeof(struct ieee80211_frame_cts);
6359                 } else {
6360                         switch (mac->mac_fw.fw_hdr_format) {
6361                         case BWN_FW_HDR_351:
6362                                 rts = (struct ieee80211_frame_rts *)
6363                                     txhdr->body.r351.rts_frame;
6364                                 break;
6365                         case BWN_FW_HDR_410:
6366                                 rts = (struct ieee80211_frame_rts *)
6367                                     txhdr->body.r410.rts_frame;
6368                                 break;
6369                         case BWN_FW_HDR_598:
6370                                 rts = (struct ieee80211_frame_rts *)
6371                                     txhdr->body.r598.rts_frame;
6372                                 break;
6373                         }
6374
6375                         /* XXX rate/rate_fb is the hardware rate */
6376                         protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6377                             isshort);
6378                         mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6379                             wh->i_addr2, protdur);
6380                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6381                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6382                             mprot->m_pkthdr.len);
6383                         m_freem(mprot);
6384                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
6385                         len = sizeof(struct ieee80211_frame_rts);
6386                 }
6387                 len += IEEE80211_CRC_LEN;
6388
6389                 switch (mac->mac_fw.fw_hdr_format) {
6390                 case BWN_FW_HDR_351:
6391                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6392                             &txhdr->body.r351.rts_plcp, len, rts_rate);
6393                         break;
6394                 case BWN_FW_HDR_410:
6395                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6396                             &txhdr->body.r410.rts_plcp, len, rts_rate);
6397                         break;
6398                 case BWN_FW_HDR_598:
6399                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6400                             &txhdr->body.r598.rts_plcp, len, rts_rate);
6401                         break;
6402                 }
6403
6404                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6405                     rts_rate_fb);
6406
6407                 switch (mac->mac_fw.fw_hdr_format) {
6408                 case BWN_FW_HDR_351:
6409                         protwh = (struct ieee80211_frame *)
6410                             &txhdr->body.r351.rts_frame;
6411                         break;
6412                 case BWN_FW_HDR_410:
6413                         protwh = (struct ieee80211_frame *)
6414                             &txhdr->body.r410.rts_frame;
6415                         break;
6416                 case BWN_FW_HDR_598:
6417                         protwh = (struct ieee80211_frame *)
6418                             &txhdr->body.r598.rts_frame;
6419                         break;
6420                 }
6421
6422                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6423
6424                 if (BWN_ISOFDMRATE(rts_rate)) {
6425                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6426                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6427                 } else {
6428                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6429                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6430                 }
6431                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6432                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6433
6434                 if (fill_phy_ctl1) {
6435                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6436                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6437                 }
6438         }
6439
6440         if (fill_phy_ctl1) {
6441                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6442                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6443         }
6444
6445         switch (mac->mac_fw.fw_hdr_format) {
6446         case BWN_FW_HDR_351:
6447                 txhdr->body.r351.cookie = htole16(cookie);
6448                 break;
6449         case BWN_FW_HDR_410:
6450                 txhdr->body.r410.cookie = htole16(cookie);
6451                 break;
6452         case BWN_FW_HDR_598:
6453                 txhdr->body.r598.cookie = htole16(cookie);
6454                 break;
6455         }
6456
6457         txhdr->macctl = htole32(macctl);
6458         txhdr->phyctl = htole16(phyctl);
6459
6460         /*
6461          * TX radio tap
6462          */
6463         if (ieee80211_radiotap_active_vap(vap)) {
6464                 sc->sc_tx_th.wt_flags = 0;
6465                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6466                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6467                 if (isshort &&
6468                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6469                      rate == BWN_CCK_RATE_11MB))
6470                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6471                 sc->sc_tx_th.wt_rate = rate;
6472
6473                 ieee80211_radiotap_tx(vap, m);
6474         }
6475
6476         return (0);
6477 }
6478
6479 static void
6480 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6481     const uint8_t rate)
6482 {
6483         uint32_t d, plen;
6484         uint8_t *raw = plcp->o.raw;
6485
6486         if (BWN_ISOFDMRATE(rate)) {
6487                 d = bwn_plcp_getofdm(rate);
6488                 KASSERT(!(octets & 0xf000),
6489                     ("%s:%d: fail", __func__, __LINE__));
6490                 d |= (octets << 5);
6491                 plcp->o.data = htole32(d);
6492         } else {
6493                 plen = octets * 16 / rate;
6494                 if ((octets * 16 % rate) > 0) {
6495                         plen++;
6496                         if ((rate == BWN_CCK_RATE_11MB)
6497                             && ((octets * 8 % 11) < 4)) {
6498                                 raw[1] = 0x84;
6499                         } else
6500                                 raw[1] = 0x04;
6501                 } else
6502                         raw[1] = 0x04;
6503                 plcp->o.data |= htole32(plen << 16);
6504                 raw[0] = bwn_plcp_getcck(rate);
6505         }
6506 }
6507
6508 static uint8_t
6509 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6510 {
6511         struct bwn_softc *sc = mac->mac_sc;
6512         uint8_t mask;
6513
6514         if (n == 0)
6515                 return (0);
6516         if (mac->mac_phy.gmode)
6517                 mask = siba_sprom_get_ant_bg(sc->sc_dev);
6518         else
6519                 mask = siba_sprom_get_ant_a(sc->sc_dev);
6520         if (!(mask & (1 << (n - 1))))
6521                 return (0);
6522         return (n);
6523 }
6524
6525 /*
6526  * Return a fallback rate for the given rate.
6527  *
6528  * Note: Don't fall back from OFDM to CCK.
6529  */
6530 static uint8_t
6531 bwn_get_fbrate(uint8_t bitrate)
6532 {
6533         switch (bitrate) {
6534         /* CCK */
6535         case BWN_CCK_RATE_1MB:
6536                 return (BWN_CCK_RATE_1MB);
6537         case BWN_CCK_RATE_2MB:
6538                 return (BWN_CCK_RATE_1MB);
6539         case BWN_CCK_RATE_5MB:
6540                 return (BWN_CCK_RATE_2MB);
6541         case BWN_CCK_RATE_11MB:
6542                 return (BWN_CCK_RATE_5MB);
6543
6544         /* OFDM */
6545         case BWN_OFDM_RATE_6MB:
6546                 return (BWN_OFDM_RATE_6MB);
6547         case BWN_OFDM_RATE_9MB:
6548                 return (BWN_OFDM_RATE_6MB);
6549         case BWN_OFDM_RATE_12MB:
6550                 return (BWN_OFDM_RATE_9MB);
6551         case BWN_OFDM_RATE_18MB:
6552                 return (BWN_OFDM_RATE_12MB);
6553         case BWN_OFDM_RATE_24MB:
6554                 return (BWN_OFDM_RATE_18MB);
6555         case BWN_OFDM_RATE_36MB:
6556                 return (BWN_OFDM_RATE_24MB);
6557         case BWN_OFDM_RATE_48MB:
6558                 return (BWN_OFDM_RATE_36MB);
6559         case BWN_OFDM_RATE_54MB:
6560                 return (BWN_OFDM_RATE_48MB);
6561         }
6562         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6563         return (0);
6564 }
6565
6566 static uint32_t
6567 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6568     uint32_t ctl, const void *_data, int len)
6569 {
6570         struct bwn_softc *sc = mac->mac_sc;
6571         uint32_t value = 0;
6572         const uint8_t *data = _data;
6573
6574         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6575             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6576         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6577
6578         siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6579             tq->tq_base + BWN_PIO8_TXDATA);
6580         if (len & 3) {
6581                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6582                     BWN_PIO8_TXCTL_24_31);
6583                 data = &(data[len - 1]);
6584                 switch (len & 3) {
6585                 case 3:
6586                         ctl |= BWN_PIO8_TXCTL_16_23;
6587                         value |= (uint32_t)(*data) << 16;
6588                         data--;
6589                 case 2:
6590                         ctl |= BWN_PIO8_TXCTL_8_15;
6591                         value |= (uint32_t)(*data) << 8;
6592                         data--;
6593                 case 1:
6594                         value |= (uint32_t)(*data);
6595                 }
6596                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6597                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6598         }
6599
6600         return (ctl);
6601 }
6602
6603 static void
6604 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6605     uint16_t offset, uint32_t value)
6606 {
6607
6608         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6609 }
6610
6611 static uint16_t
6612 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6613     uint16_t ctl, const void *_data, int len)
6614 {
6615         struct bwn_softc *sc = mac->mac_sc;
6616         const uint8_t *data = _data;
6617
6618         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6619         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6620
6621         siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6622             tq->tq_base + BWN_PIO_TXDATA);
6623         if (len & 1) {
6624                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6625                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6626                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6627         }
6628
6629         return (ctl);
6630 }
6631
6632 static uint16_t
6633 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6634     uint16_t ctl, struct mbuf *m0)
6635 {
6636         int i, j = 0;
6637         uint16_t data = 0;
6638         const uint8_t *buf;
6639         struct mbuf *m = m0;
6640
6641         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6642         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6643
6644         for (; m != NULL; m = m->m_next) {
6645                 buf = mtod(m, const uint8_t *);
6646                 for (i = 0; i < m->m_len; i++) {
6647                         if (!((j++) % 2))
6648                                 data |= buf[i];
6649                         else {
6650                                 data |= (buf[i] << 8);
6651                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6652                                 data = 0;
6653                         }
6654                 }
6655         }
6656         if (m0->m_pkthdr.len % 2) {
6657                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6658                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6659                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6660         }
6661
6662         return (ctl);
6663 }
6664
6665 static void
6666 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6667 {
6668
6669         /* XXX should exit if 5GHz band .. */
6670         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6671                 return;
6672
6673         BWN_WRITE_2(mac, 0x684, 510 + time);
6674         /* Disabled in Linux b43, can adversely effect performance */
6675 #if 0
6676         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6677 #endif
6678 }
6679
6680 static struct bwn_dma_ring *
6681 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6682 {
6683
6684         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6685                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6686
6687         switch (prio) {
6688         case 3:
6689                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6690         case 2:
6691                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6692         case 0:
6693                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6694         case 1:
6695                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6696         }
6697         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6698         return (NULL);
6699 }
6700
6701 static int
6702 bwn_dma_getslot(struct bwn_dma_ring *dr)
6703 {
6704         int slot;
6705
6706         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6707
6708         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6709         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6710         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6711
6712         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6713         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6714         dr->dr_curslot = slot;
6715         dr->dr_usedslot++;
6716
6717         return (slot);
6718 }
6719
6720 static struct bwn_pio_txqueue *
6721 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6722     struct bwn_pio_txpkt **pack)
6723 {
6724         struct bwn_pio *pio = &mac->mac_method.pio;
6725         struct bwn_pio_txqueue *tq = NULL;
6726         unsigned int index;
6727
6728         switch (cookie & 0xf000) {
6729         case 0x1000:
6730                 tq = &pio->wme[WME_AC_BK];
6731                 break;
6732         case 0x2000:
6733                 tq = &pio->wme[WME_AC_BE];
6734                 break;
6735         case 0x3000:
6736                 tq = &pio->wme[WME_AC_VI];
6737                 break;
6738         case 0x4000:
6739                 tq = &pio->wme[WME_AC_VO];
6740                 break;
6741         case 0x5000:
6742                 tq = &pio->mcast;
6743                 break;
6744         }
6745         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6746         if (tq == NULL)
6747                 return (NULL);
6748         index = (cookie & 0x0fff);
6749         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6750         if (index >= N(tq->tq_pkts))
6751                 return (NULL);
6752         *pack = &tq->tq_pkts[index];
6753         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6754         return (tq);
6755 }
6756
6757 static void
6758 bwn_txpwr(void *arg, int npending)
6759 {
6760         struct bwn_mac *mac = arg;
6761         struct bwn_softc *sc = mac->mac_sc;
6762
6763         BWN_LOCK(sc);
6764         if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6765             mac->mac_phy.set_txpwr != NULL)
6766                 mac->mac_phy.set_txpwr(mac);
6767         BWN_UNLOCK(sc);
6768 }
6769
6770 static void
6771 bwn_task_15s(struct bwn_mac *mac)
6772 {
6773         uint16_t reg;
6774
6775         if (mac->mac_fw.opensource) {
6776                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6777                 if (reg) {
6778                         bwn_restart(mac, "fw watchdog");
6779                         return;
6780                 }
6781                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6782         }
6783         if (mac->mac_phy.task_15s)
6784                 mac->mac_phy.task_15s(mac);
6785
6786         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6787 }
6788
6789 static void
6790 bwn_task_30s(struct bwn_mac *mac)
6791 {
6792
6793         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6794                 return;
6795         mac->mac_noise.noi_running = 1;
6796         mac->mac_noise.noi_nsamples = 0;
6797
6798         bwn_noise_gensample(mac);
6799 }
6800
6801 static void
6802 bwn_task_60s(struct bwn_mac *mac)
6803 {
6804
6805         if (mac->mac_phy.task_60s)
6806                 mac->mac_phy.task_60s(mac);
6807         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6808 }
6809
6810 static void
6811 bwn_tasks(void *arg)
6812 {
6813         struct bwn_mac *mac = arg;
6814         struct bwn_softc *sc = mac->mac_sc;
6815
6816         BWN_ASSERT_LOCKED(sc);
6817         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6818                 return;
6819
6820         if (mac->mac_task_state % 4 == 0)
6821                 bwn_task_60s(mac);
6822         if (mac->mac_task_state % 2 == 0)
6823                 bwn_task_30s(mac);
6824         bwn_task_15s(mac);
6825
6826         mac->mac_task_state++;
6827         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6828 }
6829
6830 static int
6831 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6832 {
6833         struct bwn_softc *sc = mac->mac_sc;
6834
6835         KASSERT(a == 0, ("not support APHY\n"));
6836
6837         switch (plcp->o.raw[0] & 0xf) {
6838         case 0xb:
6839                 return (BWN_OFDM_RATE_6MB);
6840         case 0xf:
6841                 return (BWN_OFDM_RATE_9MB);
6842         case 0xa:
6843                 return (BWN_OFDM_RATE_12MB);
6844         case 0xe:
6845                 return (BWN_OFDM_RATE_18MB);
6846         case 0x9:
6847                 return (BWN_OFDM_RATE_24MB);
6848         case 0xd:
6849                 return (BWN_OFDM_RATE_36MB);
6850         case 0x8:
6851                 return (BWN_OFDM_RATE_48MB);
6852         case 0xc:
6853                 return (BWN_OFDM_RATE_54MB);
6854         }
6855         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6856             plcp->o.raw[0] & 0xf);
6857         return (-1);
6858 }
6859
6860 static int
6861 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6862 {
6863         struct bwn_softc *sc = mac->mac_sc;
6864
6865         switch (plcp->o.raw[0]) {
6866         case 0x0a:
6867                 return (BWN_CCK_RATE_1MB);
6868         case 0x14:
6869                 return (BWN_CCK_RATE_2MB);
6870         case 0x37:
6871                 return (BWN_CCK_RATE_5MB);
6872         case 0x6e:
6873                 return (BWN_CCK_RATE_11MB);
6874         }
6875         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6876         return (-1);
6877 }
6878
6879 static void
6880 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6881     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6882     int rssi, int noise)
6883 {
6884         struct bwn_softc *sc = mac->mac_sc;
6885         const struct ieee80211_frame_min *wh;
6886         uint64_t tsf;
6887         uint16_t low_mactime_now;
6888         uint16_t mt;
6889
6890         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6891                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6892
6893         wh = mtod(m, const struct ieee80211_frame_min *);
6894         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6895                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6896
6897         bwn_tsf_read(mac, &tsf);
6898         low_mactime_now = tsf;
6899         tsf = tsf & ~0xffffULL;
6900
6901         switch (mac->mac_fw.fw_hdr_format) {
6902         case BWN_FW_HDR_351:
6903         case BWN_FW_HDR_410:
6904                 mt = le16toh(rxhdr->ps4.r351.mac_time);
6905                 break;
6906         case BWN_FW_HDR_598:
6907                 mt = le16toh(rxhdr->ps4.r598.mac_time);
6908                 break;
6909         }
6910
6911         tsf += mt;
6912         if (low_mactime_now < mt)
6913                 tsf -= 0x10000;
6914
6915         sc->sc_rx_th.wr_tsf = tsf;
6916         sc->sc_rx_th.wr_rate = rate;
6917         sc->sc_rx_th.wr_antsignal = rssi;
6918         sc->sc_rx_th.wr_antnoise = noise;
6919 }
6920
6921 static void
6922 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6923 {
6924         uint32_t low, high;
6925
6926         KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6927             ("%s:%d: fail", __func__, __LINE__));
6928
6929         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6930         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6931         *tsf = high;
6932         *tsf <<= 32;
6933         *tsf |= low;
6934 }
6935
6936 static int
6937 bwn_dma_attach(struct bwn_mac *mac)
6938 {
6939         struct bwn_dma *dma = &mac->mac_method.dma;
6940         struct bwn_softc *sc = mac->mac_sc;
6941         bus_addr_t lowaddr = 0;
6942         int error;
6943
6944         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6945                 return (0);
6946
6947         KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6948
6949         mac->mac_flags |= BWN_MAC_FLAG_DMA;
6950
6951         dma->dmatype = bwn_dma_gettype(mac);
6952         if (dma->dmatype == BWN_DMA_30BIT)
6953                 lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6954         else if (dma->dmatype == BWN_DMA_32BIT)
6955                 lowaddr = BUS_SPACE_MAXADDR_32BIT;
6956         else
6957                 lowaddr = BUS_SPACE_MAXADDR;
6958
6959         /*
6960          * Create top level DMA tag
6961          */
6962         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), /* parent */
6963                                BWN_ALIGN, 0,            /* alignment, bounds */
6964                                lowaddr,                 /* lowaddr */
6965                                BUS_SPACE_MAXADDR,       /* highaddr */
6966                                NULL, NULL,              /* filter, filterarg */
6967                                BUS_SPACE_MAXSIZE,       /* maxsize */
6968                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
6969                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
6970                                0,                       /* flags */
6971                                NULL, NULL,              /* lockfunc, lockarg */
6972                                &dma->parent_dtag);
6973         if (error) {
6974                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6975                 return (error);
6976         }
6977
6978         /*
6979          * Create TX/RX mbuf DMA tag
6980          */
6981         error = bus_dma_tag_create(dma->parent_dtag,
6982                                 1,
6983                                 0,
6984                                 BUS_SPACE_MAXADDR,
6985                                 BUS_SPACE_MAXADDR,
6986                                 NULL, NULL,
6987                                 MCLBYTES,
6988                                 1,
6989                                 BUS_SPACE_MAXSIZE_32BIT,
6990                                 0,
6991                                 NULL, NULL,
6992                                 &dma->rxbuf_dtag);
6993         if (error) {
6994                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6995                 goto fail0;
6996         }
6997         error = bus_dma_tag_create(dma->parent_dtag,
6998                                 1,
6999                                 0,
7000                                 BUS_SPACE_MAXADDR,
7001                                 BUS_SPACE_MAXADDR,
7002                                 NULL, NULL,
7003                                 MCLBYTES,
7004                                 1,
7005                                 BUS_SPACE_MAXSIZE_32BIT,
7006                                 0,
7007                                 NULL, NULL,
7008                                 &dma->txbuf_dtag);
7009         if (error) {
7010                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7011                 goto fail1;
7012         }
7013
7014         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7015         if (!dma->wme[WME_AC_BK])
7016                 goto fail2;
7017
7018         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7019         if (!dma->wme[WME_AC_BE])
7020                 goto fail3;
7021
7022         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7023         if (!dma->wme[WME_AC_VI])
7024                 goto fail4;
7025
7026         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7027         if (!dma->wme[WME_AC_VO])
7028                 goto fail5;
7029
7030         dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7031         if (!dma->mcast)
7032                 goto fail6;
7033         dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7034         if (!dma->rx)
7035                 goto fail7;
7036
7037         return (error);
7038
7039 fail7:  bwn_dma_ringfree(&dma->mcast);
7040 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7041 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7042 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7043 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7044 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
7045 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
7046 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
7047         return (error);
7048 }
7049
7050 static struct bwn_dma_ring *
7051 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7052     uint16_t cookie, int *slot)
7053 {
7054         struct bwn_dma *dma = &mac->mac_method.dma;
7055         struct bwn_dma_ring *dr;
7056         struct bwn_softc *sc = mac->mac_sc;
7057
7058         BWN_ASSERT_LOCKED(mac->mac_sc);
7059
7060         switch (cookie & 0xf000) {
7061         case 0x1000:
7062                 dr = dma->wme[WME_AC_BK];
7063                 break;
7064         case 0x2000:
7065                 dr = dma->wme[WME_AC_BE];
7066                 break;
7067         case 0x3000:
7068                 dr = dma->wme[WME_AC_VI];
7069                 break;
7070         case 0x4000:
7071                 dr = dma->wme[WME_AC_VO];
7072                 break;
7073         case 0x5000:
7074                 dr = dma->mcast;
7075                 break;
7076         default:
7077                 dr = NULL;
7078                 KASSERT(0 == 1,
7079                     ("invalid cookie value %d", cookie & 0xf000));
7080         }
7081         *slot = (cookie & 0x0fff);
7082         if (*slot < 0 || *slot >= dr->dr_numslots) {
7083                 /*
7084                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7085                  * that it occurs events which have same H/W sequence numbers.
7086                  * When it's occurred just prints a WARNING msgs and ignores.
7087                  */
7088                 KASSERT(status->seq == dma->lastseq,
7089                     ("%s:%d: fail", __func__, __LINE__));
7090                 device_printf(sc->sc_dev,
7091                     "out of slot ranges (0 < %d < %d)\n", *slot,
7092                     dr->dr_numslots);
7093                 return (NULL);
7094         }
7095         dma->lastseq = status->seq;
7096         return (dr);
7097 }
7098
7099 static void
7100 bwn_dma_stop(struct bwn_mac *mac)
7101 {
7102         struct bwn_dma *dma;
7103
7104         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7105                 return;
7106         dma = &mac->mac_method.dma;
7107
7108         bwn_dma_ringstop(&dma->rx);
7109         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7110         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7111         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7112         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7113         bwn_dma_ringstop(&dma->mcast);
7114 }
7115
7116 static void
7117 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7118 {
7119
7120         if (dr == NULL)
7121                 return;
7122
7123         bwn_dma_cleanup(*dr);
7124 }
7125
7126 static void
7127 bwn_pio_stop(struct bwn_mac *mac)
7128 {
7129         struct bwn_pio *pio;
7130
7131         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7132                 return;
7133         pio = &mac->mac_method.pio;
7134
7135         bwn_destroy_queue_tx(&pio->mcast);
7136         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7137         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7138         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7139         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7140 }
7141
7142 static void
7143 bwn_led_attach(struct bwn_mac *mac)
7144 {
7145         struct bwn_softc *sc = mac->mac_sc;
7146         const uint8_t *led_act = NULL;
7147         uint16_t val[BWN_LED_MAX];
7148         int i;
7149
7150         sc->sc_led_idle = (2350 * hz) / 1000;
7151         sc->sc_led_blink = 1;
7152
7153         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7154                 if (siba_get_pci_subvendor(sc->sc_dev) ==
7155                     bwn_vendor_led_act[i].vid) {
7156                         led_act = bwn_vendor_led_act[i].led_act;
7157                         break;
7158                 }
7159         }
7160         if (led_act == NULL)
7161                 led_act = bwn_default_led_act;
7162
7163         val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7164         val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7165         val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7166         val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7167
7168         for (i = 0; i < BWN_LED_MAX; ++i) {
7169                 struct bwn_led *led = &sc->sc_leds[i];
7170
7171                 if (val[i] == 0xff) {
7172                         led->led_act = led_act[i];
7173                 } else {
7174                         if (val[i] & BWN_LED_ACT_LOW)
7175                                 led->led_flags |= BWN_LED_F_ACTLOW;
7176                         led->led_act = val[i] & BWN_LED_ACT_MASK;
7177                 }
7178                 led->led_mask = (1 << i);
7179
7180                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7181                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
7182                     led->led_act == BWN_LED_ACT_BLINK) {
7183                         led->led_flags |= BWN_LED_F_BLINK;
7184                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7185                                 led->led_flags |= BWN_LED_F_POLLABLE;
7186                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7187                                 led->led_flags |= BWN_LED_F_SLOW;
7188
7189                         if (sc->sc_blink_led == NULL) {
7190                                 sc->sc_blink_led = led;
7191                                 if (led->led_flags & BWN_LED_F_SLOW)
7192                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
7193                         }
7194                 }
7195
7196                 DPRINTF(sc, BWN_DEBUG_LED,
7197                     "%dth led, act %d, lowact %d\n", i,
7198                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7199         }
7200         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7201 }
7202
7203 static __inline uint16_t
7204 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7205 {
7206
7207         if (led->led_flags & BWN_LED_F_ACTLOW)
7208                 on = !on;
7209         if (on)
7210                 val |= led->led_mask;
7211         else
7212                 val &= ~led->led_mask;
7213         return val;
7214 }
7215
7216 static void
7217 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7218 {
7219         struct bwn_softc *sc = mac->mac_sc;
7220         struct ieee80211com *ic = &sc->sc_ic;
7221         uint16_t val;
7222         int i;
7223
7224         if (nstate == IEEE80211_S_INIT) {
7225                 callout_stop(&sc->sc_led_blink_ch);
7226                 sc->sc_led_blinking = 0;
7227         }
7228
7229         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7230                 return;
7231
7232         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7233         for (i = 0; i < BWN_LED_MAX; ++i) {
7234                 struct bwn_led *led = &sc->sc_leds[i];
7235                 int on;
7236
7237                 if (led->led_act == BWN_LED_ACT_UNKN ||
7238                     led->led_act == BWN_LED_ACT_NULL)
7239                         continue;
7240
7241                 if ((led->led_flags & BWN_LED_F_BLINK) &&
7242                     nstate != IEEE80211_S_INIT)
7243                         continue;
7244
7245                 switch (led->led_act) {
7246                 case BWN_LED_ACT_ON:    /* Always on */
7247                         on = 1;
7248                         break;
7249                 case BWN_LED_ACT_OFF:   /* Always off */
7250                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7251                         on = 0;
7252                         break;
7253                 default:
7254                         on = 1;
7255                         switch (nstate) {
7256                         case IEEE80211_S_INIT:
7257                                 on = 0;
7258                                 break;
7259                         case IEEE80211_S_RUN:
7260                                 if (led->led_act == BWN_LED_ACT_11G &&
7261                                     ic->ic_curmode != IEEE80211_MODE_11G)
7262                                         on = 0;
7263                                 break;
7264                         default:
7265                                 if (led->led_act == BWN_LED_ACT_ASSOC)
7266                                         on = 0;
7267                                 break;
7268                         }
7269                         break;
7270                 }
7271
7272                 val = bwn_led_onoff(led, val, on);
7273         }
7274         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7275 }
7276
7277 static void
7278 bwn_led_event(struct bwn_mac *mac, int event)
7279 {
7280         struct bwn_softc *sc = mac->mac_sc;
7281         struct bwn_led *led = sc->sc_blink_led;
7282         int rate;
7283
7284         if (event == BWN_LED_EVENT_POLL) {
7285                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7286                         return;
7287                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7288                         return;
7289         }
7290
7291         sc->sc_led_ticks = ticks;
7292         if (sc->sc_led_blinking)
7293                 return;
7294
7295         switch (event) {
7296         case BWN_LED_EVENT_RX:
7297                 rate = sc->sc_rx_rate;
7298                 break;
7299         case BWN_LED_EVENT_TX:
7300                 rate = sc->sc_tx_rate;
7301                 break;
7302         case BWN_LED_EVENT_POLL:
7303                 rate = 0;
7304                 break;
7305         default:
7306                 panic("unknown LED event %d\n", event);
7307                 break;
7308         }
7309         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7310             bwn_led_duration[rate].off_dur);
7311 }
7312
7313 static void
7314 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7315 {
7316         struct bwn_softc *sc = mac->mac_sc;
7317         struct bwn_led *led = sc->sc_blink_led;
7318         uint16_t val;
7319
7320         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7321         val = bwn_led_onoff(led, val, 1);
7322         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7323
7324         if (led->led_flags & BWN_LED_F_SLOW) {
7325                 BWN_LED_SLOWDOWN(on_dur);
7326                 BWN_LED_SLOWDOWN(off_dur);
7327         }
7328
7329         sc->sc_led_blinking = 1;
7330         sc->sc_led_blink_offdur = off_dur;
7331
7332         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7333 }
7334
7335 static void
7336 bwn_led_blink_next(void *arg)
7337 {
7338         struct bwn_mac *mac = arg;
7339         struct bwn_softc *sc = mac->mac_sc;
7340         uint16_t val;
7341
7342         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7343         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7344         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7345
7346         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7347             bwn_led_blink_end, mac);
7348 }
7349
7350 static void
7351 bwn_led_blink_end(void *arg)
7352 {
7353         struct bwn_mac *mac = arg;
7354         struct bwn_softc *sc = mac->mac_sc;
7355
7356         sc->sc_led_blinking = 0;
7357 }
7358
7359 static int
7360 bwn_suspend(device_t dev)
7361 {
7362         struct bwn_softc *sc = device_get_softc(dev);
7363
7364         BWN_LOCK(sc);
7365         bwn_stop(sc);
7366         BWN_UNLOCK(sc);
7367         return (0);
7368 }
7369
7370 static int
7371 bwn_resume(device_t dev)
7372 {
7373         struct bwn_softc *sc = device_get_softc(dev);
7374         int error = EDOOFUS;
7375
7376         BWN_LOCK(sc);
7377         if (sc->sc_ic.ic_nrunning > 0)
7378                 error = bwn_init(sc);
7379         BWN_UNLOCK(sc);
7380         if (error == 0)
7381                 ieee80211_start_all(&sc->sc_ic);
7382         return (0);
7383 }
7384
7385 static void
7386 bwn_rfswitch(void *arg)
7387 {
7388         struct bwn_softc *sc = arg;
7389         struct bwn_mac *mac = sc->sc_curmac;
7390         int cur = 0, prev = 0;
7391
7392         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7393             ("%s: invalid MAC status %d", __func__, mac->mac_status));
7394
7395         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7396             || mac->mac_phy.type == BWN_PHYTYPE_N) {
7397                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7398                         & BWN_RF_HWENABLED_HI_MASK))
7399                         cur = 1;
7400         } else {
7401                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7402                     & BWN_RF_HWENABLED_LO_MASK)
7403                         cur = 1;
7404         }
7405
7406         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7407                 prev = 1;
7408
7409         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7410             __func__, cur, prev);
7411
7412         if (cur != prev) {
7413                 if (cur)
7414                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7415                 else
7416                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7417
7418                 device_printf(sc->sc_dev,
7419                     "status of RF switch is changed to %s\n",
7420                     cur ? "ON" : "OFF");
7421                 if (cur != mac->mac_phy.rf_on) {
7422                         if (cur)
7423                                 bwn_rf_turnon(mac);
7424                         else
7425                                 bwn_rf_turnoff(mac);
7426                 }
7427         }
7428
7429         callout_schedule(&sc->sc_rfswitch_ch, hz);
7430 }
7431
7432 static void
7433 bwn_sysctl_node(struct bwn_softc *sc)
7434 {
7435         device_t dev = sc->sc_dev;
7436         struct bwn_mac *mac;
7437         struct bwn_stats *stats;
7438
7439         /* XXX assume that count of MAC is only 1. */
7440
7441         if ((mac = sc->sc_curmac) == NULL)
7442                 return;
7443         stats = &mac->mac_stats;
7444
7445         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7446             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7447             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7448         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7449             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7450             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7451         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7452             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7453             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7454
7455 #ifdef BWN_DEBUG
7456         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7457             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7458             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7459 #endif
7460 }
7461
7462 static device_method_t bwn_methods[] = {
7463         /* Device interface */
7464         DEVMETHOD(device_probe,         bwn_probe),
7465         DEVMETHOD(device_attach,        bwn_attach),
7466         DEVMETHOD(device_detach,        bwn_detach),
7467         DEVMETHOD(device_suspend,       bwn_suspend),
7468         DEVMETHOD(device_resume,        bwn_resume),
7469         DEVMETHOD_END
7470 };
7471 static driver_t bwn_driver = {
7472         "bwn",
7473         bwn_methods,
7474         sizeof(struct bwn_softc)
7475 };
7476 static devclass_t bwn_devclass;
7477 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7478 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7479 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
7480 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
7481 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7482 MODULE_VERSION(bwn, 1);