sys/dev/bwn/if_bwn.c

   1 /*-
   2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer,
  10  *    without modification.
  11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  13  *    redistribution must be conditioned upon including a substantially
  14  *    similar Disclaimer requirement for further binary redistribution.
  15  *
  16  * NO WARRANTY
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  27  * THE POSSIBILITY OF SUCH DAMAGES.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 /*
  34  * The Broadcom Wireless LAN controller driver.
  35  */
  36
  37 #include "opt_bwn.h"
  38 #include "opt_wlan.h"
  39
  40 #include <sys/param.h>
  41 #include <sys/systm.h>
  42 #include <sys/kernel.h>
  43 #include <sys/malloc.h>
  44 #include <sys/module.h>
  45 #include <sys/endian.h>
  46 #include <sys/errno.h>
  47 #include <sys/firmware.h>
  48 #include <sys/lock.h>
  49 #include <sys/mutex.h>
  50 #include <machine/bus.h>
  51 #include <machine/resource.h>
  52 #include <sys/bus.h>
  53 #include <sys/rman.h>
  54 #include <sys/socket.h>
  55 #include <sys/sockio.h>
  56
  57 #include <net/ethernet.h>
  58 #include <net/if.h>
  59 #include <net/if_var.h>
  60 #include <net/if_arp.h>
  61 #include <net/if_dl.h>
  62 #include <net/if_llc.h>
  63 #include <net/if_media.h>
  64 #include <net/if_types.h>
  65
  66 #include <dev/pci/pcivar.h>
  67 #include <dev/pci/pcireg.h>
  68 #include <dev/siba/siba_ids.h>
  69 #include <dev/siba/sibareg.h>
  70 #include <dev/siba/sibavar.h>
  71
  72 #include <net80211/ieee80211_var.h>
  73 #include <net80211/ieee80211_radiotap.h>
  74 #include <net80211/ieee80211_regdomain.h>
  75 #include <net80211/ieee80211_phy.h>
  76 #include <net80211/ieee80211_ratectl.h>
  77
  78 #include <dev/bwn/if_bwnreg.h>
  79 #include <dev/bwn/if_bwnvar.h>
  80
  81 #include <dev/bwn/if_bwn_debug.h>
  82 #include <dev/bwn/if_bwn_misc.h>
  83 #include <dev/bwn/if_bwn_util.h>
  84 #include <dev/bwn/if_bwn_phy_common.h>
  85 #include <dev/bwn/if_bwn_phy_g.h>
  86 #include <dev/bwn/if_bwn_phy_lp.h>
  87 #include <dev/bwn/if_bwn_phy_n.h>
  88
  89 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
  90     "Broadcom driver parameters");
  91
  92 /*
  93  * Tunable & sysctl variables.
  94  */
  95
  96 #ifdef BWN_DEBUG
  97 static  int bwn_debug = 0;
  98 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
  99     "Broadcom debugging printfs");
 100 #endif
 101
 102 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
 103 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
 104     "uses Bad Frames Preemption");
 105 static int      bwn_bluetooth = 1;
 106 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 107     "turns on Bluetooth Coexistence");
 108 static int      bwn_hwpctl = 0;
 109 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 110     "uses H/W power control");
 111 static int      bwn_msi_disable = 0;            /* MSI disabled  */
 112 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
 113 static int      bwn_usedma = 1;
 114 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 115     "uses DMA");
 116 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 117 static int      bwn_wme = 1;
 118 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 119     "uses WME support");
 120
 121 static void     bwn_attach_pre(struct bwn_softc *);
 122 static int      bwn_attach_post(struct bwn_softc *);
 123 static void     bwn_sprom_bugfixes(device_t);
 124 static int      bwn_init(struct bwn_softc *);
 125 static void     bwn_parent(struct ieee80211com *);
 126 static void     bwn_start(struct bwn_softc *);
 127 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 128 static int      bwn_attach_core(struct bwn_mac *);
 129 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 130 static int      bwn_chiptest(struct bwn_mac *);
 131 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 132 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 133                     uint16_t);
 134 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 135                     const struct bwn_channelinfo *, const uint8_t []);
 136 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 137                     const struct ieee80211_bpf_params *);
 138 static void     bwn_updateslot(struct ieee80211com *);
 139 static void     bwn_update_promisc(struct ieee80211com *);
 140 static void     bwn_wme_init(struct bwn_mac *);
 141 static int      bwn_wme_update(struct ieee80211com *);
 142 static void     bwn_wme_clear(struct bwn_softc *);
 143 static void     bwn_wme_load(struct bwn_mac *);
 144 static void     bwn_wme_loadparams(struct bwn_mac *,
 145                     const struct wmeParams *, uint16_t);
 146 static void     bwn_scan_start(struct ieee80211com *);
 147 static void     bwn_scan_end(struct ieee80211com *);
 148 static void     bwn_set_channel(struct ieee80211com *);
 149 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 150                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 151                     const uint8_t [IEEE80211_ADDR_LEN],
 152                     const uint8_t [IEEE80211_ADDR_LEN]);
 153 static void     bwn_vap_delete(struct ieee80211vap *);
 154 static void     bwn_stop(struct bwn_softc *);
 155 static int      bwn_core_init(struct bwn_mac *);
 156 static void     bwn_core_start(struct bwn_mac *);
 157 static void     bwn_core_exit(struct bwn_mac *);
 158 static void     bwn_bt_disable(struct bwn_mac *);
 159 static int      bwn_chip_init(struct bwn_mac *);
 160 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 161 static void     bwn_rate_init(struct bwn_mac *);
 162 static void     bwn_set_phytxctl(struct bwn_mac *);
 163 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 164 static void     bwn_bt_enable(struct bwn_mac *);
 165 static void     bwn_set_macaddr(struct bwn_mac *);
 166 static void     bwn_crypt_init(struct bwn_mac *);
 167 static void     bwn_chip_exit(struct bwn_mac *);
 168 static int      bwn_fw_fillinfo(struct bwn_mac *);
 169 static int      bwn_fw_loaducode(struct bwn_mac *);
 170 static int      bwn_gpio_init(struct bwn_mac *);
 171 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 172 static int      bwn_phy_init(struct bwn_mac *);
 173 static void     bwn_set_txantenna(struct bwn_mac *, int);
 174 static void     bwn_set_opmode(struct bwn_mac *);
 175 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 176 static uint8_t  bwn_plcp_getcck(const uint8_t);
 177 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 178 static void     bwn_pio_init(struct bwn_mac *);
 179 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 180 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 181                     int);
 182 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 183                     struct bwn_pio_rxqueue *, int);
 184 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 185 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 186                     uint16_t);
 187 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 188 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 189 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 190 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 191                     const struct bwn_txstatus *);
 192 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 193 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 194 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 195                     uint16_t);
 196 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 197                     uint32_t);
 198 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 199                     struct mbuf *);
 200 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 201 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 202                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 203 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 204                     uint16_t, uint32_t);
 205 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 206                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 207 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 208                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 209 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 210                     uint16_t, struct bwn_pio_txpkt **);
 211 static void     bwn_dma_init(struct bwn_mac *);
 212 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 213 static int      bwn_dma_mask2type(uint64_t);
 214 static uint64_t bwn_dma_mask(struct bwn_mac *);
 215 static uint16_t bwn_dma_base(int, int);
 216 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 217 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 218                     int, struct bwn_dmadesc_generic **,
 219                     struct bwn_dmadesc_meta **);
 220 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 221                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 222                     int, int);
 223 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 224 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 225 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 226 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 227 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 228 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 229                     int, struct bwn_dmadesc_generic **,
 230                     struct bwn_dmadesc_meta **);
 231 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 233                     int, int);
 234 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 235 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 236 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 237 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 238 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 239 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 240 static void     bwn_dma_setup(struct bwn_dma_ring *);
 241 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 242 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 243 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 244 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 245 static void     bwn_dma_rx(struct bwn_dma_ring *);
 246 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 247 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 248                     struct bwn_dmadesc_meta *);
 249 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 250 static int      bwn_dma_gettype(struct bwn_mac *);
 251 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 252 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 253 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 254 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 255 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 256                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 257                     int);
 258 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 259                     bus_size_t, int);
 260 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 261 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 262                     const struct bwn_txstatus *);
 263 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 264                     struct mbuf *);
 265 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 266 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 267                     uint8_t);
 268 static int      bwn_dma_attach(struct bwn_mac *);
 269 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 270                     int, int, int);
 271 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 272                     const struct bwn_txstatus *, uint16_t, int *);
 273 static void     bwn_dma_free(struct bwn_mac *);
 274 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 275 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 276                     const char *, struct bwn_fwfile *);
 277 static void     bwn_release_firmware(struct bwn_mac *);
 278 static void     bwn_do_release_fw(struct bwn_fwfile *);
 279 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 280 static int      bwn_fwinitvals_write(struct bwn_mac *,
 281                     const struct bwn_fwinitvals *, size_t, size_t);
 282 static uint16_t bwn_ant2phy(int);
 283 static void     bwn_mac_write_bssid(struct bwn_mac *);
 284 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 285                     const uint8_t *);
 286 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 287                     const uint8_t *, size_t, const uint8_t *);
 288 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 289                     const uint8_t *);
 290 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 291                     const uint8_t *);
 292 static void     bwn_phy_exit(struct bwn_mac *);
 293 static void     bwn_core_stop(struct bwn_mac *);
 294 static int      bwn_switch_band(struct bwn_softc *,
 295                     struct ieee80211_channel *);
 296 static void     bwn_phy_reset(struct bwn_mac *);
 297 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 298 static void     bwn_set_pretbtt(struct bwn_mac *);
 299 static int      bwn_intr(void *);
 300 static void     bwn_intrtask(void *, int);
 301 static void     bwn_restart(struct bwn_mac *, const char *);
 302 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 303 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 304 static void     bwn_intr_atim_end(struct bwn_mac *);
 305 static void     bwn_intr_beacon(struct bwn_mac *);
 306 static void     bwn_intr_pmq(struct bwn_mac *);
 307 static void     bwn_intr_noise(struct bwn_mac *);
 308 static void     bwn_intr_txeof(struct bwn_mac *);
 309 static void     bwn_hwreset(void *, int);
 310 static void     bwn_handle_fwpanic(struct bwn_mac *);
 311 static void     bwn_load_beacon0(struct bwn_mac *);
 312 static void     bwn_load_beacon1(struct bwn_mac *);
 313 static uint32_t bwn_jssi_read(struct bwn_mac *);
 314 static void     bwn_noise_gensample(struct bwn_mac *);
 315 static void     bwn_handle_txeof(struct bwn_mac *,
 316                     const struct bwn_txstatus *);
 317 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 318 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 319 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 320                     struct mbuf *);
 321 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 322 static int      bwn_set_txhdr(struct bwn_mac *,
 323                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 324                     uint16_t);
 325 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 326                     const uint8_t);
 327 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 328 static uint8_t  bwn_get_fbrate(uint8_t);
 329 static void     bwn_txpwr(void *, int);
 330 static void     bwn_tasks(void *);
 331 static void     bwn_task_15s(struct bwn_mac *);
 332 static void     bwn_task_30s(struct bwn_mac *);
 333 static void     bwn_task_60s(struct bwn_mac *);
 334 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 335                     uint8_t);
 336 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 337 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 338                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 339                     int, int);
 340 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 341 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 342 static void     bwn_watchdog(void *);
 343 static void     bwn_dma_stop(struct bwn_mac *);
 344 static void     bwn_pio_stop(struct bwn_mac *);
 345 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 346 static void     bwn_led_attach(struct bwn_mac *);
 347 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 348 static void     bwn_led_event(struct bwn_mac *, int);
 349 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 350 static void     bwn_led_blink_next(void *);
 351 static void     bwn_led_blink_end(void *);
 352 static void     bwn_rfswitch(void *);
 353 static void     bwn_rf_turnon(struct bwn_mac *);
 354 static void     bwn_rf_turnoff(struct bwn_mac *);
 355 static void     bwn_sysctl_node(struct bwn_softc *);
 356
 357 static struct resource_spec bwn_res_spec_legacy[] = {
 358         { SYS_RES_IRQ,          0,              RF_ACTIVE | RF_SHAREABLE },
 359         { -1,                   0,              0 }
 360 };
 361
 362 static struct resource_spec bwn_res_spec_msi[] = {
 363         { SYS_RES_IRQ,          1,              RF_ACTIVE },
 364         { -1,                   0,              0 }
 365 };
 366
 367 static const struct bwn_channelinfo bwn_chantable_bg = {
 368         .channels = {
 369                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 370                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 371                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 372                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 373                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 374         .nchannels = 14
 375 };
 376
 377 static const struct bwn_channelinfo bwn_chantable_a = {
 378         .channels = {
 379                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 380                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 381                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 382                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 383                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 384                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 385                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 386                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 387                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 388                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 389                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 390                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 391                 { 6080, 216, 30 } },
 392         .nchannels = 37
 393 };
 394
 395 #if 0
 396 static const struct bwn_channelinfo bwn_chantable_n = {
 397         .channels = {
 398                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 399                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 400                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 401                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 402                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 403                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 404                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 405                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 406                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 407                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 408                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 409                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 410                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 411                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 412                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 413                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 414                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 415                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 416                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 417                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 418                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 419                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 420                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 421                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 422                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 423                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 424                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 425                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 426                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 427                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 428                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 429                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 430                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 431                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 432                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 433                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 434                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 435         .nchannels = 110
 436 };
 437 #endif
 438
 439 #define VENDOR_LED_ACT(vendor)                          \
 440 {                                                       \
 441         .vid = PCI_VENDOR_##vendor,                     \
 442         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 443 }
 444
 445 static const struct {
 446         uint16_t        vid;
 447         uint8_t         led_act[BWN_LED_MAX];
 448 } bwn_vendor_led_act[] = {
 449         VENDOR_LED_ACT(COMPAQ),
 450         VENDOR_LED_ACT(ASUSTEK)
 451 };
 452
 453 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 454         { BWN_VENDOR_LED_ACT_DEFAULT };
 455
 456 #undef VENDOR_LED_ACT
 457
 458 static const struct {
 459         int             on_dur;
 460         int             off_dur;
 461 } bwn_led_duration[109] = {
 462         [0]     = { 400, 100 },
 463         [2]     = { 150, 75 },
 464         [4]     = { 90, 45 },
 465         [11]    = { 66, 34 },
 466         [12]    = { 53, 26 },
 467         [18]    = { 42, 21 },
 468         [22]    = { 35, 17 },
 469         [24]    = { 32, 16 },
 470         [36]    = { 21, 10 },
 471         [48]    = { 16, 8 },
 472         [72]    = { 11, 5 },
 473         [96]    = { 9, 4 },
 474         [108]   = { 7, 3 }
 475 };
 476
 477 static const uint16_t bwn_wme_shm_offsets[] = {
 478         [0] = BWN_WME_BESTEFFORT,
 479         [1] = BWN_WME_BACKGROUND,
 480         [2] = BWN_WME_VOICE,
 481         [3] = BWN_WME_VIDEO,
 482 };
 483
 484 static const struct siba_devid bwn_devs[] = {
 485         SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
 486         SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
 487         SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
 488         SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
 489         SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
 490         SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
 491         SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
 492         SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
 493         SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
 494         SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
 495 };
 496
 497 static int
 498 bwn_probe(device_t dev)
 499 {
 500         int i;
 501
 502         for (i = 0; i < nitems(bwn_devs); i++) {
 503                 if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
 504                     siba_get_device(dev) == bwn_devs[i].sd_device &&
 505                     siba_get_revid(dev) == bwn_devs[i].sd_rev)
 506                         return (BUS_PROBE_DEFAULT);
 507         }
 508
 509         return (ENXIO);
 510 }
 511
 512 static int
 513 bwn_attach(device_t dev)
 514 {
 515         struct bwn_mac *mac;
 516         struct bwn_softc *sc = device_get_softc(dev);
 517         int error, i, msic, reg;
 518
 519         sc->sc_dev = dev;
 520 #ifdef BWN_DEBUG
 521         sc->sc_debug = bwn_debug;
 522 #endif
 523
 524         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 525                 bwn_attach_pre(sc);
 526                 bwn_sprom_bugfixes(dev);
 527                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 528         }
 529
 530         if (!TAILQ_EMPTY(&sc->sc_maclist)) {
 531                 if (siba_get_pci_device(dev) != 0x4313 &&
 532                     siba_get_pci_device(dev) != 0x431a &&
 533                     siba_get_pci_device(dev) != 0x4321) {
 534                         device_printf(sc->sc_dev,
 535                             "skip 802.11 cores\n");
 536                         return (ENODEV);
 537                 }
 538         }
 539
 540         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 541         mac->mac_sc = sc;
 542         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 543         if (bwn_bfp != 0)
 544                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 545
 546         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 547         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 548         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 549
 550         error = bwn_attach_core(mac);
 551         if (error)
 552                 goto fail0;
 553         bwn_led_attach(mac);
 554
 555         device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
 556             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 557             siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
 558             mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
 559             mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
 560             mac->mac_phy.rf_rev);
 561         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 562                 device_printf(sc->sc_dev, "DMA (%d bits)\n",
 563                     mac->mac_method.dma.dmatype);
 564         else
 565                 device_printf(sc->sc_dev, "PIO\n");
 566
 567 #ifdef  BWN_GPL_PHY
 568         device_printf(sc->sc_dev,
 569             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
 570 #endif
 571
 572         /*
 573          * setup PCI resources and interrupt.
 574          */
 575         if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
 576                 msic = pci_msi_count(dev);
 577                 if (bootverbose)
 578                         device_printf(sc->sc_dev, "MSI count : %d\n", msic);
 579         } else
 580                 msic = 0;
 581
 582         mac->mac_intr_spec = bwn_res_spec_legacy;
 583         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
 584                 if (pci_alloc_msi(dev, &msic) == 0) {
 585                         device_printf(sc->sc_dev,
 586                             "Using %d MSI messages\n", msic);
 587                         mac->mac_intr_spec = bwn_res_spec_msi;
 588                         mac->mac_msi = 1;
 589                 }
 590         }
 591
 592         error = bus_alloc_resources(dev, mac->mac_intr_spec,
 593             mac->mac_res_irq);
 594         if (error) {
 595                 device_printf(sc->sc_dev,
 596                     "couldn't allocate IRQ resources (%d)\n", error);
 597                 goto fail1;
 598         }
 599
 600         if (mac->mac_msi == 0)
 601                 error = bus_setup_intr(dev, mac->mac_res_irq[0],
 602                     INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 603                     &mac->mac_intrhand[0]);
 604         else {
 605                 for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 606                         error = bus_setup_intr(dev, mac->mac_res_irq[i],
 607                             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 608                             &mac->mac_intrhand[i]);
 609                         if (error != 0) {
 610                                 device_printf(sc->sc_dev,
 611                                     "couldn't setup interrupt (%d)\n", error);
 612                                 break;
 613                         }
 614                 }
 615         }
 616
 617         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 618
 619         /*
 620          * calls attach-post routine
 621          */
 622         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 623                 bwn_attach_post(sc);
 624
 625         return (0);
 626 fail1:
 627         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
 628                 pci_release_msi(dev);
 629 fail0:
 630         free(mac, M_DEVBUF);
 631         return (error);
 632 }
 633
 634 static int
 635 bwn_is_valid_ether_addr(uint8_t *addr)
 636 {
 637         char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
 638
 639         if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
 640                 return (FALSE);
 641
 642         return (TRUE);
 643 }
 644
 645 static int
 646 bwn_attach_post(struct bwn_softc *sc)
 647 {
 648         struct ieee80211com *ic = &sc->sc_ic;
 649
 650         ic->ic_softc = sc;
 651         ic->ic_name = device_get_nameunit(sc->sc_dev);
 652         /* XXX not right but it's not used anywhere important */
 653         ic->ic_phytype = IEEE80211_T_OFDM;
 654         ic->ic_opmode = IEEE80211_M_STA;
 655         ic->ic_caps =
 656                   IEEE80211_C_STA               /* station mode supported */
 657                 | IEEE80211_C_MONITOR           /* monitor mode */
 658                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 659                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 660                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 661                 | IEEE80211_C_WME               /* WME/WMM supported */
 662                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 663 #if 0
 664                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 665 #endif
 666                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 667                 ;
 668
 669         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 670
 671         IEEE80211_ADDR_COPY(ic->ic_macaddr,
 672             bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
 673             siba_sprom_get_mac_80211a(sc->sc_dev) :
 674             siba_sprom_get_mac_80211bg(sc->sc_dev));
 675
 676         /* call MI attach routine. */
 677         ieee80211_ifattach(ic);
 678
 679         ic->ic_headroom = sizeof(struct bwn_txhdr);
 680
 681         /* override default methods */
 682         ic->ic_raw_xmit = bwn_raw_xmit;
 683         ic->ic_updateslot = bwn_updateslot;
 684         ic->ic_update_promisc = bwn_update_promisc;
 685         ic->ic_wme.wme_update = bwn_wme_update;
 686         ic->ic_scan_start = bwn_scan_start;
 687         ic->ic_scan_end = bwn_scan_end;
 688         ic->ic_set_channel = bwn_set_channel;
 689         ic->ic_vap_create = bwn_vap_create;
 690         ic->ic_vap_delete = bwn_vap_delete;
 691         ic->ic_transmit = bwn_transmit;
 692         ic->ic_parent = bwn_parent;
 693
 694         ieee80211_radiotap_attach(ic,
 695             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 696             BWN_TX_RADIOTAP_PRESENT,
 697             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 698             BWN_RX_RADIOTAP_PRESENT);
 699
 700         bwn_sysctl_node(sc);
 701
 702         if (bootverbose)
 703                 ieee80211_announce(ic);
 704         return (0);
 705 }
 706
 707 static void
 708 bwn_phy_detach(struct bwn_mac *mac)
 709 {
 710
 711         if (mac->mac_phy.detach != NULL)
 712                 mac->mac_phy.detach(mac);
 713 }
 714
 715 static int
 716 bwn_detach(device_t dev)
 717 {
 718         struct bwn_softc *sc = device_get_softc(dev);
 719         struct bwn_mac *mac = sc->sc_curmac;
 720         struct ieee80211com *ic = &sc->sc_ic;
 721         int i;
 722
 723         sc->sc_flags |= BWN_FLAG_INVALID;
 724
 725         if (device_is_attached(sc->sc_dev)) {
 726                 BWN_LOCK(sc);
 727                 bwn_stop(sc);
 728                 BWN_UNLOCK(sc);
 729                 bwn_dma_free(mac);
 730                 callout_drain(&sc->sc_led_blink_ch);
 731                 callout_drain(&sc->sc_rfswitch_ch);
 732                 callout_drain(&sc->sc_task_ch);
 733                 callout_drain(&sc->sc_watchdog_ch);
 734                 bwn_phy_detach(mac);
 735                 ieee80211_draintask(ic, &mac->mac_hwreset);
 736                 ieee80211_draintask(ic, &mac->mac_txpower);
 737                 ieee80211_ifdetach(ic);
 738         }
 739         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 740         taskqueue_free(sc->sc_tq);
 741
 742         for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 743                 if (mac->mac_intrhand[i] != NULL) {
 744                         bus_teardown_intr(dev, mac->mac_res_irq[i],
 745                             mac->mac_intrhand[i]);
 746                         mac->mac_intrhand[i] = NULL;
 747                 }
 748         }
 749         bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
 750         if (mac->mac_msi != 0)
 751                 pci_release_msi(dev);
 752         mbufq_drain(&sc->sc_snd);
 753         bwn_release_firmware(mac);
 754         BWN_LOCK_DESTROY(sc);
 755         return (0);
 756 }
 757
 758 static void
 759 bwn_attach_pre(struct bwn_softc *sc)
 760 {
 761
 762         BWN_LOCK_INIT(sc);
 763         TAILQ_INIT(&sc->sc_maclist);
 764         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 765         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 766         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 767         mbufq_init(&sc->sc_snd, ifqmaxlen);
 768         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 769                 taskqueue_thread_enqueue, &sc->sc_tq);
 770         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 771                 "%s taskq", device_get_nameunit(sc->sc_dev));
 772 }
 773
 774 static void
 775 bwn_sprom_bugfixes(device_t dev)
 776 {
 777 #define BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)             \
 778         ((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&          \
 779          (siba_get_pci_device(dev) == _device) &&                       \
 780          (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&    \
 781          (siba_get_pci_subdevice(dev) == _subdevice))
 782
 783         if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
 784             siba_get_pci_subdevice(dev) == 0x4e &&
 785             siba_get_pci_revid(dev) > 0x40)
 786                 siba_sprom_set_bf_lo(dev,
 787                     siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
 788         if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
 789             siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
 790                 siba_sprom_set_bf_lo(dev,
 791                     siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
 792         if (siba_get_type(dev) == SIBA_TYPE_PCI) {
 793                 if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
 794                     BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
 795                     BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
 796                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
 797                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
 798                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
 799                     BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
 800                         siba_sprom_set_bf_lo(dev,
 801                             siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
 802         }
 803 #undef  BWN_ISDEV
 804 }
 805
 806 static void
 807 bwn_parent(struct ieee80211com *ic)
 808 {
 809         struct bwn_softc *sc = ic->ic_softc;
 810         int startall = 0;
 811
 812         BWN_LOCK(sc);
 813         if (ic->ic_nrunning > 0) {
 814                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 815                         bwn_init(sc);
 816                         startall = 1;
 817                 } else
 818                         bwn_update_promisc(ic);
 819         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 820                 bwn_stop(sc);
 821         BWN_UNLOCK(sc);
 822
 823         if (startall)
 824                 ieee80211_start_all(ic);
 825 }
 826
 827 static int
 828 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 829 {
 830         struct bwn_softc *sc = ic->ic_softc;
 831         int error;
 832
 833         BWN_LOCK(sc);
 834         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 835                 BWN_UNLOCK(sc);
 836                 return (ENXIO);
 837         }
 838         error = mbufq_enqueue(&sc->sc_snd, m);
 839         if (error) {
 840                 BWN_UNLOCK(sc);
 841                 return (error);
 842         }
 843         bwn_start(sc);
 844         BWN_UNLOCK(sc);
 845         return (0);
 846 }
 847
 848 static void
 849 bwn_start(struct bwn_softc *sc)
 850 {
 851         struct bwn_mac *mac = sc->sc_curmac;
 852         struct ieee80211_frame *wh;
 853         struct ieee80211_node *ni;
 854         struct ieee80211_key *k;
 855         struct mbuf *m;
 856
 857         BWN_ASSERT_LOCKED(sc);
 858
 859         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 860             mac->mac_status < BWN_MAC_STATUS_STARTED)
 861                 return;
 862
 863         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 864                 if (bwn_tx_isfull(sc, m))
 865                         break;
 866                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 867                 if (ni == NULL) {
 868                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
 869                         m_freem(m);
 870                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 871                         continue;
 872                 }
 873                 wh = mtod(m, struct ieee80211_frame *);
 874                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 875                         k = ieee80211_crypto_encap(ni, m);
 876                         if (k == NULL) {
 877                                 if_inc_counter(ni->ni_vap->iv_ifp,
 878                                     IFCOUNTER_OERRORS, 1);
 879                                 ieee80211_free_node(ni);
 880                                 m_freem(m);
 881                                 continue;
 882                         }
 883                 }
 884                 wh = NULL;      /* Catch any invalid use */
 885                 if (bwn_tx_start(sc, ni, m) != 0) {
 886                         if (ni != NULL) {
 887                                 if_inc_counter(ni->ni_vap->iv_ifp,
 888                                     IFCOUNTER_OERRORS, 1);
 889                                 ieee80211_free_node(ni);
 890                         }
 891                         continue;
 892                 }
 893                 sc->sc_watchdog_timer = 5;
 894         }
 895 }
 896
 897 static int
 898 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
 899 {
 900         struct bwn_dma_ring *dr;
 901         struct bwn_mac *mac = sc->sc_curmac;
 902         struct bwn_pio_txqueue *tq;
 903         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 904
 905         BWN_ASSERT_LOCKED(sc);
 906
 907         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 908                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
 909                 if (dr->dr_stop == 1 ||
 910                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
 911                         dr->dr_stop = 1;
 912                         goto full;
 913                 }
 914         } else {
 915                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
 916                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
 917                     pktlen > (tq->tq_size - tq->tq_used))
 918                         goto full;
 919         }
 920         return (0);
 921 full:
 922         mbufq_prepend(&sc->sc_snd, m);
 923         return (1);
 924 }
 925
 926 static int
 927 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
 928 {
 929         struct bwn_mac *mac = sc->sc_curmac;
 930         int error;
 931
 932         BWN_ASSERT_LOCKED(sc);
 933
 934         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
 935                 m_freem(m);
 936                 return (ENXIO);
 937         }
 938
 939         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
 940             bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
 941         if (error) {
 942                 m_freem(m);
 943                 return (error);
 944         }
 945         return (0);
 946 }
 947
 948 static int
 949 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
 950 {
 951         struct bwn_pio_txpkt *tp;
 952         struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
 953         struct bwn_softc *sc = mac->mac_sc;
 954         struct bwn_txhdr txhdr;
 955         struct mbuf *m_new;
 956         uint32_t ctl32;
 957         int error;
 958         uint16_t ctl16;
 959
 960         BWN_ASSERT_LOCKED(sc);
 961
 962         /* XXX TODO send packets after DTIM */
 963
 964         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
 965         tp = TAILQ_FIRST(&tq->tq_pktlist);
 966         tp->tp_ni = ni;
 967         tp->tp_m = m;
 968
 969         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
 970         if (error) {
 971                 device_printf(sc->sc_dev, "tx fail\n");
 972                 return (error);
 973         }
 974
 975         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
 976         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 977         tq->tq_free--;
 978
 979         if (siba_get_revid(sc->sc_dev) >= 8) {
 980                 /*
 981                  * XXX please removes m_defrag(9)
 982                  */
 983                 m_new = m_defrag(m, M_NOWAIT);
 984                 if (m_new == NULL) {
 985                         device_printf(sc->sc_dev,
 986                             "%s: can't defrag TX buffer\n",
 987                             __func__);
 988                         return (ENOBUFS);
 989                 }
 990                 if (m_new->m_next != NULL)
 991                         device_printf(sc->sc_dev,
 992                             "TODO: fragmented packets for PIO\n");
 993                 tp->tp_m = m_new;
 994
 995                 /* send HEADER */
 996                 ctl32 = bwn_pio_write_multi_4(mac, tq,
 997                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
 998                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
 999                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1000                 /* send BODY */
1001                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1002                     mtod(m_new, const void *), m_new->m_pkthdr.len);
1003                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1004                     ctl32 | BWN_PIO8_TXCTL_EOF);
1005         } else {
1006                 ctl16 = bwn_pio_write_multi_2(mac, tq,
1007                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1008                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1009                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1010                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1011                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1012                     ctl16 | BWN_PIO_TXCTL_EOF);
1013         }
1014
1015         return (0);
1016 }
1017
1018 static struct bwn_pio_txqueue *
1019 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1020 {
1021
1022         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1023                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1024
1025         switch (prio) {
1026         case 0:
1027                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1028         case 1:
1029                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1030         case 2:
1031                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1032         case 3:
1033                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1034         }
1035         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1036         return (NULL);
1037 }
1038
1039 static int
1040 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1041 {
1042 #define BWN_GET_TXHDRCACHE(slot)                                        \
1043         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1044         struct bwn_dma *dma = &mac->mac_method.dma;
1045         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1046         struct bwn_dmadesc_generic *desc;
1047         struct bwn_dmadesc_meta *mt;
1048         struct bwn_softc *sc = mac->mac_sc;
1049         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1050         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1051
1052         BWN_ASSERT_LOCKED(sc);
1053         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1054
1055         /* XXX send after DTIM */
1056
1057         slot = bwn_dma_getslot(dr);
1058         dr->getdesc(dr, slot, &desc, &mt);
1059         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1060             ("%s:%d: fail", __func__, __LINE__));
1061
1062         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1063             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1064             BWN_DMA_COOKIE(dr, slot));
1065         if (error)
1066                 goto fail;
1067         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1068             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1069             &mt->mt_paddr, BUS_DMA_NOWAIT);
1070         if (error) {
1071                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1072                     __func__, error);
1073                 goto fail;
1074         }
1075         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1076             BUS_DMASYNC_PREWRITE);
1077         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1078         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1079             BUS_DMASYNC_PREWRITE);
1080
1081         slot = bwn_dma_getslot(dr);
1082         dr->getdesc(dr, slot, &desc, &mt);
1083         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1084             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1085         mt->mt_m = m;
1086         mt->mt_ni = ni;
1087
1088         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1089             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1090         if (error && error != EFBIG) {
1091                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1092                     __func__, error);
1093                 goto fail;
1094         }
1095         if (error) {    /* error == EFBIG */
1096                 struct mbuf *m_new;
1097
1098                 m_new = m_defrag(m, M_NOWAIT);
1099                 if (m_new == NULL) {
1100                         device_printf(sc->sc_dev,
1101                             "%s: can't defrag TX buffer\n",
1102                             __func__);
1103                         error = ENOBUFS;
1104                         goto fail;
1105                 } else {
1106                         m = m_new;
1107                 }
1108
1109                 mt->mt_m = m;
1110                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1111                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1112                 if (error) {
1113                         device_printf(sc->sc_dev,
1114                             "%s: can't load TX buffer (2) %d\n",
1115                             __func__, error);
1116                         goto fail;
1117                 }
1118         }
1119         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1120         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1121         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1122             BUS_DMASYNC_PREWRITE);
1123
1124         /* XXX send after DTIM */
1125
1126         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1127         return (0);
1128 fail:
1129         dr->dr_curslot = backup[0];
1130         dr->dr_usedslot = backup[1];
1131         return (error);
1132 #undef BWN_GET_TXHDRCACHE
1133 }
1134
1135 static void
1136 bwn_watchdog(void *arg)
1137 {
1138         struct bwn_softc *sc = arg;
1139
1140         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1141                 device_printf(sc->sc_dev, "device timeout\n");
1142                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1143         }
1144         callout_schedule(&sc->sc_watchdog_ch, hz);
1145 }
1146
1147 static int
1148 bwn_attach_core(struct bwn_mac *mac)
1149 {
1150         struct bwn_softc *sc = mac->mac_sc;
1151         int error, have_bg = 0, have_a = 0;
1152
1153         KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154             ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155
1156         if (bwn_is_bus_siba(mac)) {
1157                 uint32_t high;
1158
1159                 siba_powerup(sc->sc_dev, 0);
1160                 high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1161                 have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1162                 have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1163                 if (high & BWN_TGSHIGH_DUALPHY) {
1164                         have_bg = 1;
1165                         have_a = 1;
1166                 }
1167 #if 0
1168                 device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1169                     " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1170                     __func__,
1171                     high,
1172                     have_a,
1173                     have_bg,
1174                     siba_get_pci_device(sc->sc_dev),
1175                     siba_get_chipid(sc->sc_dev));
1176 #endif
1177         } else {
1178                 device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1179                 error = ENXIO;
1180                 goto fail;
1181         }
1182
1183         /*
1184          * Guess at whether it has A-PHY or G-PHY.
1185          * This is just used for resetting the core to probe things;
1186          * we will re-guess once it's all up and working.
1187          */
1188         bwn_reset_core(mac, have_bg);
1189
1190         /*
1191          * Get the PHY version.
1192          */
1193         error = bwn_phy_getinfo(mac, have_bg);
1194         if (error)
1195                 goto fail;
1196
1197         /*
1198          * This is the whitelist of devices which we "believe"
1199          * the SPROM PHY config from.  The rest are "guessed".
1200          */
1201         if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1202             siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1203             siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204             siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205             siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206             siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207                 have_a = have_bg = 0;
1208                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209                         have_a = 1;
1210                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1212                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1213                         have_bg = 1;
1214                 else
1215                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216                             mac->mac_phy.type));
1217         }
1218
1219         /*
1220          * XXX The PHY-G support doesn't do 5GHz operation.
1221          */
1222         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223             mac->mac_phy.type != BWN_PHYTYPE_N) {
1224                 device_printf(sc->sc_dev,
1225                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226                     __func__);
1227                 have_a = 0;
1228                 have_bg = 1;
1229         }
1230
1231         mac->mac_phy.phy_n = NULL;
1232
1233         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234                 mac->mac_phy.attach = bwn_phy_g_attach;
1235                 mac->mac_phy.detach = bwn_phy_g_detach;
1236                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238                 mac->mac_phy.init = bwn_phy_g_init;
1239                 mac->mac_phy.exit = bwn_phy_g_exit;
1240                 mac->mac_phy.phy_read = bwn_phy_g_read;
1241                 mac->mac_phy.phy_write = bwn_phy_g_write;
1242                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250                 mac->mac_phy.set_im = bwn_phy_g_im;
1251                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257                 mac->mac_phy.init = bwn_phy_lp_init;
1258                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1259                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1260                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270                 mac->mac_phy.attach = bwn_phy_n_attach;
1271                 mac->mac_phy.detach = bwn_phy_n_detach;
1272                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274                 mac->mac_phy.init = bwn_phy_n_init;
1275                 mac->mac_phy.exit = bwn_phy_n_exit;
1276                 mac->mac_phy.phy_read = bwn_phy_n_read;
1277                 mac->mac_phy.phy_write = bwn_phy_n_write;
1278                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286                 mac->mac_phy.set_im = bwn_phy_n_im;
1287                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291         } else {
1292                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293                     mac->mac_phy.type);
1294                 error = ENXIO;
1295                 goto fail;
1296         }
1297
1298         mac->mac_phy.gmode = have_bg;
1299         if (mac->mac_phy.attach != NULL) {
1300                 error = mac->mac_phy.attach(mac);
1301                 if (error) {
1302                         device_printf(sc->sc_dev, "failed\n");
1303                         goto fail;
1304                 }
1305         }
1306
1307         bwn_reset_core(mac, have_bg);
1308
1309         error = bwn_chiptest(mac);
1310         if (error)
1311                 goto fail;
1312         error = bwn_setup_channels(mac, have_bg, have_a);
1313         if (error) {
1314                 device_printf(sc->sc_dev, "failed to setup channels\n");
1315                 goto fail;
1316         }
1317
1318         if (sc->sc_curmac == NULL)
1319                 sc->sc_curmac = mac;
1320
1321         error = bwn_dma_attach(mac);
1322         if (error != 0) {
1323                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324                 goto fail;
1325         }
1326
1327         mac->mac_phy.switch_analog(mac, 0);
1328
1329         siba_dev_down(sc->sc_dev, 0);
1330 fail:
1331         siba_powerdown(sc->sc_dev);
1332         bwn_release_firmware(mac);
1333         return (error);
1334 }
1335
1336 /*
1337  * Reset - SIBA.
1338  *
1339  * XXX TODO: implement BCMA version!
1340  */
1341 void
1342 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1343 {
1344         struct bwn_softc *sc = mac->mac_sc;
1345         uint32_t low, ctl;
1346         uint32_t flags = 0;
1347
1348         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1349
1350         flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1351         if (g_mode)
1352                 flags |= BWN_TGSLOW_SUPPORT_G;
1353
1354         /* XXX N-PHY only; and hard-code to 20MHz for now */
1355         if (mac->mac_phy.type == BWN_PHYTYPE_N)
1356                 flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1357
1358         siba_dev_up(sc->sc_dev, flags);
1359         DELAY(2000);
1360
1361         /* Take PHY out of reset */
1362         low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1363             ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1364         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1365         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1366         DELAY(2000);
1367         low &= ~SIBA_TGSLOW_FGC;
1368         low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1369         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1370         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1371         DELAY(2000);
1372
1373         if (mac->mac_phy.switch_analog != NULL)
1374                 mac->mac_phy.switch_analog(mac, 1);
1375
1376         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1377         if (g_mode)
1378                 ctl |= BWN_MACCTL_GMODE;
1379         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1380 }
1381
1382 static int
1383 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1384 {
1385         struct bwn_phy *phy = &mac->mac_phy;
1386         struct bwn_softc *sc = mac->mac_sc;
1387         uint32_t tmp;
1388
1389         /* PHY */
1390         tmp = BWN_READ_2(mac, BWN_PHYVER);
1391         phy->gmode = gmode;
1392         phy->rf_on = 1;
1393         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1394         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1395         phy->rev = (tmp & BWN_PHYVER_VERSION);
1396         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1397             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1398                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1399             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1400             (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1401             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1402                 goto unsupphy;
1403
1404         /* RADIO */
1405         if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1406                 if (siba_get_chiprev(sc->sc_dev) == 0)
1407                         tmp = 0x3205017f;
1408                 else if (siba_get_chiprev(sc->sc_dev) == 1)
1409                         tmp = 0x4205017f;
1410                 else
1411                         tmp = 0x5205017f;
1412         } else {
1413                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1414                 tmp = BWN_READ_2(mac, BWN_RFDATALO);
1415                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1416                 tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1417         }
1418         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1419         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1420         phy->rf_manuf = (tmp & 0x00000fff);
1421
1422         /*
1423          * For now, just always do full init (ie, what bwn has traditionally
1424          * done)
1425          */
1426         phy->phy_do_full_init = 1;
1427
1428         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1429                 goto unsupradio;
1430         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1431              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1432             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1433             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1434             (phy->type == BWN_PHYTYPE_N &&
1435              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1436             (phy->type == BWN_PHYTYPE_LP &&
1437              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1438                 goto unsupradio;
1439
1440         return (0);
1441 unsupphy:
1442         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1443             "analog %#x)\n",
1444             phy->type, phy->rev, phy->analog);
1445         return (ENXIO);
1446 unsupradio:
1447         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1448             "rev %#x)\n",
1449             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1450         return (ENXIO);
1451 }
1452
1453 static int
1454 bwn_chiptest(struct bwn_mac *mac)
1455 {
1456 #define TESTVAL0        0x55aaaa55
1457 #define TESTVAL1        0xaa5555aa
1458         struct bwn_softc *sc = mac->mac_sc;
1459         uint32_t v, backup;
1460
1461         BWN_LOCK(sc);
1462
1463         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1464
1465         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1466         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1467                 goto error;
1468         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1469         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1470                 goto error;
1471
1472         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1473
1474         if ((siba_get_revid(sc->sc_dev) >= 3) &&
1475             (siba_get_revid(sc->sc_dev) <= 10)) {
1476                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1477                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1478                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1479                         goto error;
1480                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1481                         goto error;
1482         }
1483         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1484
1485         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1486         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1487                 goto error;
1488
1489         BWN_UNLOCK(sc);
1490         return (0);
1491 error:
1492         BWN_UNLOCK(sc);
1493         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1494         return (ENODEV);
1495 }
1496
1497 static int
1498 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1499 {
1500         struct bwn_softc *sc = mac->mac_sc;
1501         struct ieee80211com *ic = &sc->sc_ic;
1502         uint8_t bands[IEEE80211_MODE_BYTES];
1503
1504         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1505         ic->ic_nchans = 0;
1506
1507         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1508             __func__,
1509             have_bg,
1510             have_a);
1511
1512         if (have_bg) {
1513                 memset(bands, 0, sizeof(bands));
1514                 setbit(bands, IEEE80211_MODE_11B);
1515                 setbit(bands, IEEE80211_MODE_11G);
1516                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1517                     &ic->ic_nchans, &bwn_chantable_bg, bands);
1518         }
1519
1520         if (have_a) {
1521                 memset(bands, 0, sizeof(bands));
1522                 setbit(bands, IEEE80211_MODE_11A);
1523                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1524                     &ic->ic_nchans, &bwn_chantable_a, bands);
1525         }
1526
1527         mac->mac_phy.supports_2ghz = have_bg;
1528         mac->mac_phy.supports_5ghz = have_a;
1529
1530         return (ic->ic_nchans == 0 ? ENXIO : 0);
1531 }
1532
1533 uint32_t
1534 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1535 {
1536         uint32_t ret;
1537
1538         BWN_ASSERT_LOCKED(mac->mac_sc);
1539
1540         if (way == BWN_SHARED) {
1541                 KASSERT((offset & 0x0001) == 0,
1542                     ("%s:%d warn", __func__, __LINE__));
1543                 if (offset & 0x0003) {
1544                         bwn_shm_ctlword(mac, way, offset >> 2);
1545                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1546                         ret <<= 16;
1547                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1548                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1549                         goto out;
1550                 }
1551                 offset >>= 2;
1552         }
1553         bwn_shm_ctlword(mac, way, offset);
1554         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1555 out:
1556         return (ret);
1557 }
1558
1559 uint16_t
1560 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1561 {
1562         uint16_t ret;
1563
1564         BWN_ASSERT_LOCKED(mac->mac_sc);
1565
1566         if (way == BWN_SHARED) {
1567                 KASSERT((offset & 0x0001) == 0,
1568                     ("%s:%d warn", __func__, __LINE__));
1569                 if (offset & 0x0003) {
1570                         bwn_shm_ctlword(mac, way, offset >> 2);
1571                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1572                         goto out;
1573                 }
1574                 offset >>= 2;
1575         }
1576         bwn_shm_ctlword(mac, way, offset);
1577         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1578 out:
1579
1580         return (ret);
1581 }
1582
1583 static void
1584 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1585     uint16_t offset)
1586 {
1587         uint32_t control;
1588
1589         control = way;
1590         control <<= 16;
1591         control |= offset;
1592         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1593 }
1594
1595 void
1596 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1597     uint32_t value)
1598 {
1599         BWN_ASSERT_LOCKED(mac->mac_sc);
1600
1601         if (way == BWN_SHARED) {
1602                 KASSERT((offset & 0x0001) == 0,
1603                     ("%s:%d warn", __func__, __LINE__));
1604                 if (offset & 0x0003) {
1605                         bwn_shm_ctlword(mac, way, offset >> 2);
1606                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1607                                     (value >> 16) & 0xffff);
1608                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1609                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1610                         return;
1611                 }
1612                 offset >>= 2;
1613         }
1614         bwn_shm_ctlword(mac, way, offset);
1615         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1616 }
1617
1618 void
1619 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1620     uint16_t value)
1621 {
1622         BWN_ASSERT_LOCKED(mac->mac_sc);
1623
1624         if (way == BWN_SHARED) {
1625                 KASSERT((offset & 0x0001) == 0,
1626                     ("%s:%d warn", __func__, __LINE__));
1627                 if (offset & 0x0003) {
1628                         bwn_shm_ctlword(mac, way, offset >> 2);
1629                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1630                         return;
1631                 }
1632                 offset >>= 2;
1633         }
1634         bwn_shm_ctlword(mac, way, offset);
1635         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1636 }
1637
1638 static void
1639 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1640     const struct bwn_channelinfo *ci, const uint8_t bands[])
1641 {
1642         int i, error;
1643
1644         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1645                 const struct bwn_channel *hc = &ci->channels[i];
1646
1647                 error = ieee80211_add_channel(chans, maxchans, nchans,
1648                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1649         }
1650 }
1651
1652 static int
1653 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1654         const struct ieee80211_bpf_params *params)
1655 {
1656         struct ieee80211com *ic = ni->ni_ic;
1657         struct bwn_softc *sc = ic->ic_softc;
1658         struct bwn_mac *mac = sc->sc_curmac;
1659         int error;
1660
1661         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1662             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1663                 m_freem(m);
1664                 return (ENETDOWN);
1665         }
1666
1667         BWN_LOCK(sc);
1668         if (bwn_tx_isfull(sc, m)) {
1669                 m_freem(m);
1670                 BWN_UNLOCK(sc);
1671                 return (ENOBUFS);
1672         }
1673
1674         error = bwn_tx_start(sc, ni, m);
1675         if (error == 0)
1676                 sc->sc_watchdog_timer = 5;
1677         BWN_UNLOCK(sc);
1678         return (error);
1679 }
1680
1681 /*
1682  * Callback from the 802.11 layer to update the slot time
1683  * based on the current setting.  We use it to notify the
1684  * firmware of ERP changes and the f/w takes care of things
1685  * like slot time and preamble.
1686  */
1687 static void
1688 bwn_updateslot(struct ieee80211com *ic)
1689 {
1690         struct bwn_softc *sc = ic->ic_softc;
1691         struct bwn_mac *mac;
1692
1693         BWN_LOCK(sc);
1694         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1695                 mac = (struct bwn_mac *)sc->sc_curmac;
1696                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1697         }
1698         BWN_UNLOCK(sc);
1699 }
1700
1701 /*
1702  * Callback from the 802.11 layer after a promiscuous mode change.
1703  * Note this interface does not check the operating mode as this
1704  * is an internal callback and we are expected to honor the current
1705  * state (e.g. this is used for setting the interface in promiscuous
1706  * mode when operating in hostap mode to do ACS).
1707  */
1708 static void
1709 bwn_update_promisc(struct ieee80211com *ic)
1710 {
1711         struct bwn_softc *sc = ic->ic_softc;
1712         struct bwn_mac *mac = sc->sc_curmac;
1713
1714         BWN_LOCK(sc);
1715         mac = sc->sc_curmac;
1716         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1717                 if (ic->ic_promisc > 0)
1718                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1719                 else
1720                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1721                 bwn_set_opmode(mac);
1722         }
1723         BWN_UNLOCK(sc);
1724 }
1725
1726 /*
1727  * Callback from the 802.11 layer to update WME parameters.
1728  */
1729 static int
1730 bwn_wme_update(struct ieee80211com *ic)
1731 {
1732         struct bwn_softc *sc = ic->ic_softc;
1733         struct bwn_mac *mac = sc->sc_curmac;
1734         struct wmeParams *wmep;
1735         int i;
1736
1737         BWN_LOCK(sc);
1738         mac = sc->sc_curmac;
1739         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1740                 bwn_mac_suspend(mac);
1741                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1742                         wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1743                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1744                 }
1745                 bwn_mac_enable(mac);
1746         }
1747         BWN_UNLOCK(sc);
1748         return (0);
1749 }
1750
1751 static void
1752 bwn_scan_start(struct ieee80211com *ic)
1753 {
1754         struct bwn_softc *sc = ic->ic_softc;
1755         struct bwn_mac *mac;
1756
1757         BWN_LOCK(sc);
1758         mac = sc->sc_curmac;
1759         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1760                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1761                 bwn_set_opmode(mac);
1762                 /* disable CFP update during scan */
1763                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1764         }
1765         BWN_UNLOCK(sc);
1766 }
1767
1768 static void
1769 bwn_scan_end(struct ieee80211com *ic)
1770 {
1771         struct bwn_softc *sc = ic->ic_softc;
1772         struct bwn_mac *mac;
1773
1774         BWN_LOCK(sc);
1775         mac = sc->sc_curmac;
1776         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1777                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1778                 bwn_set_opmode(mac);
1779                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1780         }
1781         BWN_UNLOCK(sc);
1782 }
1783
1784 static void
1785 bwn_set_channel(struct ieee80211com *ic)
1786 {
1787         struct bwn_softc *sc = ic->ic_softc;
1788         struct bwn_mac *mac = sc->sc_curmac;
1789         struct bwn_phy *phy = &mac->mac_phy;
1790         int chan, error;
1791
1792         BWN_LOCK(sc);
1793
1794         error = bwn_switch_band(sc, ic->ic_curchan);
1795         if (error)
1796                 goto fail;
1797         bwn_mac_suspend(mac);
1798         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1799         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1800         if (chan != phy->chan)
1801                 bwn_switch_channel(mac, chan);
1802
1803         /* TX power level */
1804         if (ic->ic_curchan->ic_maxpower != 0 &&
1805             ic->ic_curchan->ic_maxpower != phy->txpower) {
1806                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1807                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1808                     BWN_TXPWR_IGNORE_TSSI);
1809         }
1810
1811         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1812         if (phy->set_antenna)
1813                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1814
1815         if (sc->sc_rf_enabled != phy->rf_on) {
1816                 if (sc->sc_rf_enabled) {
1817                         bwn_rf_turnon(mac);
1818                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1819                                 device_printf(sc->sc_dev,
1820                                     "please turn on the RF switch\n");
1821                 } else
1822                         bwn_rf_turnoff(mac);
1823         }
1824
1825         bwn_mac_enable(mac);
1826
1827 fail:
1828         /*
1829          * Setup radio tap channel freq and flags
1830          */
1831         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1832                 htole16(ic->ic_curchan->ic_freq);
1833         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1834                 htole16(ic->ic_curchan->ic_flags & 0xffff);
1835
1836         BWN_UNLOCK(sc);
1837 }
1838
1839 static struct ieee80211vap *
1840 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1841     enum ieee80211_opmode opmode, int flags,
1842     const uint8_t bssid[IEEE80211_ADDR_LEN],
1843     const uint8_t mac[IEEE80211_ADDR_LEN])
1844 {
1845         struct ieee80211vap *vap;
1846         struct bwn_vap *bvp;
1847
1848         switch (opmode) {
1849         case IEEE80211_M_HOSTAP:
1850         case IEEE80211_M_MBSS:
1851         case IEEE80211_M_STA:
1852         case IEEE80211_M_WDS:
1853         case IEEE80211_M_MONITOR:
1854         case IEEE80211_M_IBSS:
1855         case IEEE80211_M_AHDEMO:
1856                 break;
1857         default:
1858                 return (NULL);
1859         }
1860
1861         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1862         vap = &bvp->bv_vap;
1863         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1864         /* override with driver methods */
1865         bvp->bv_newstate = vap->iv_newstate;
1866         vap->iv_newstate = bwn_newstate;
1867
1868         /* override max aid so sta's cannot assoc when we're out of sta id's */
1869         vap->iv_max_aid = BWN_STAID_MAX;
1870
1871         ieee80211_ratectl_init(vap);
1872
1873         /* complete setup */
1874         ieee80211_vap_attach(vap, ieee80211_media_change,
1875             ieee80211_media_status, mac);
1876         return (vap);
1877 }
1878
1879 static void
1880 bwn_vap_delete(struct ieee80211vap *vap)
1881 {
1882         struct bwn_vap *bvp = BWN_VAP(vap);
1883
1884         ieee80211_ratectl_deinit(vap);
1885         ieee80211_vap_detach(vap);
1886         free(bvp, M_80211_VAP);
1887 }
1888
1889 static int
1890 bwn_init(struct bwn_softc *sc)
1891 {
1892         struct bwn_mac *mac;
1893         int error;
1894
1895         BWN_ASSERT_LOCKED(sc);
1896
1897         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1898
1899         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1900         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1901         sc->sc_filters = 0;
1902         bwn_wme_clear(sc);
1903         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1904         sc->sc_rf_enabled = 1;
1905
1906         mac = sc->sc_curmac;
1907         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1908                 error = bwn_core_init(mac);
1909                 if (error != 0)
1910                         return (error);
1911         }
1912         if (mac->mac_status == BWN_MAC_STATUS_INITED)
1913                 bwn_core_start(mac);
1914
1915         bwn_set_opmode(mac);
1916         bwn_set_pretbtt(mac);
1917         bwn_spu_setdelay(mac, 0);
1918         bwn_set_macaddr(mac);
1919
1920         sc->sc_flags |= BWN_FLAG_RUNNING;
1921         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1922         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1923
1924         return (0);
1925 }
1926
1927 static void
1928 bwn_stop(struct bwn_softc *sc)
1929 {
1930         struct bwn_mac *mac = sc->sc_curmac;
1931
1932         BWN_ASSERT_LOCKED(sc);
1933
1934         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1935
1936         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1937                 /* XXX FIXME opmode not based on VAP */
1938                 bwn_set_opmode(mac);
1939                 bwn_set_macaddr(mac);
1940         }
1941
1942         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1943                 bwn_core_stop(mac);
1944
1945         callout_stop(&sc->sc_led_blink_ch);
1946         sc->sc_led_blinking = 0;
1947
1948         bwn_core_exit(mac);
1949         sc->sc_rf_enabled = 0;
1950
1951         sc->sc_flags &= ~BWN_FLAG_RUNNING;
1952 }
1953
1954 static void
1955 bwn_wme_clear(struct bwn_softc *sc)
1956 {
1957 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1958         struct wmeParams *p;
1959         unsigned int i;
1960
1961         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1962             ("%s:%d: fail", __func__, __LINE__));
1963
1964         for (i = 0; i < N(sc->sc_wmeParams); i++) {
1965                 p = &(sc->sc_wmeParams[i]);
1966
1967                 switch (bwn_wme_shm_offsets[i]) {
1968                 case BWN_WME_VOICE:
1969                         p->wmep_txopLimit = 0;
1970                         p->wmep_aifsn = 2;
1971                         /* XXX FIXME: log2(cwmin) */
1972                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1973                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1974                         break;
1975                 case BWN_WME_VIDEO:
1976                         p->wmep_txopLimit = 0;
1977                         p->wmep_aifsn = 2;
1978                         /* XXX FIXME: log2(cwmin) */
1979                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1980                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1981                         break;
1982                 case BWN_WME_BESTEFFORT:
1983                         p->wmep_txopLimit = 0;
1984                         p->wmep_aifsn = 3;
1985                         /* XXX FIXME: log2(cwmin) */
1986                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1987                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1988                         break;
1989                 case BWN_WME_BACKGROUND:
1990                         p->wmep_txopLimit = 0;
1991                         p->wmep_aifsn = 7;
1992                         /* XXX FIXME: log2(cwmin) */
1993                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1994                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1995                         break;
1996                 default:
1997                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1998                 }
1999         }
2000 }
2001
2002 static int
2003 bwn_core_init(struct bwn_mac *mac)
2004 {
2005         struct bwn_softc *sc = mac->mac_sc;
2006         uint64_t hf;
2007         int error;
2008
2009         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2010             ("%s:%d: fail", __func__, __LINE__));
2011
2012         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2013
2014         siba_powerup(sc->sc_dev, 0);
2015         if (!siba_dev_isup(sc->sc_dev))
2016                 bwn_reset_core(mac, mac->mac_phy.gmode);
2017
2018         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2019         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2020         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2021         BWN_GETTIME(mac->mac_phy.nexttime);
2022         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2023         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2024         mac->mac_stats.link_noise = -95;
2025         mac->mac_reason_intr = 0;
2026         bzero(mac->mac_reason, sizeof(mac->mac_reason));
2027         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2028 #ifdef BWN_DEBUG
2029         if (sc->sc_debug & BWN_DEBUG_XMIT)
2030                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2031 #endif
2032         mac->mac_suspended = 1;
2033         mac->mac_task_state = 0;
2034         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2035
2036         mac->mac_phy.init_pre(mac);
2037
2038         siba_pcicore_intr(sc->sc_dev);
2039
2040         siba_fix_imcfglobug(sc->sc_dev);
2041         bwn_bt_disable(mac);
2042         if (mac->mac_phy.prepare_hw) {
2043                 error = mac->mac_phy.prepare_hw(mac);
2044                 if (error)
2045                         goto fail0;
2046         }
2047         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2048         error = bwn_chip_init(mac);
2049         if (error)
2050                 goto fail0;
2051         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2052             siba_get_revid(sc->sc_dev));
2053         hf = bwn_hf_read(mac);
2054         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2055                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2056                 if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2057                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2058                 if (mac->mac_phy.rev == 1)
2059                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2060         }
2061         if (mac->mac_phy.rf_ver == 0x2050) {
2062                 if (mac->mac_phy.rf_rev < 6)
2063                         hf |= BWN_HF_FORCE_VCO_RECALC;
2064                 if (mac->mac_phy.rf_rev == 6)
2065                         hf |= BWN_HF_4318_TSSI;
2066         }
2067         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2068                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2069         if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2070             (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2071                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2072         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2073         bwn_hf_write(mac, hf);
2074
2075         /* Tell the firmware about the MAC capabilities */
2076         if (siba_get_revid(sc->sc_dev) >= 13) {
2077                 uint32_t cap;
2078                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2079                 DPRINTF(sc, BWN_DEBUG_RESET,
2080                     "%s: hw capabilities: 0x%08x\n",
2081                     __func__, cap);
2082                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2083                     cap & 0xffff);
2084                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2085                     (cap >> 16) & 0xffff);
2086         }
2087
2088         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2089         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2090         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2091         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2092
2093         bwn_rate_init(mac);
2094         bwn_set_phytxctl(mac);
2095
2096         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2097             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2098         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2099
2100         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2101                 bwn_pio_init(mac);
2102         else
2103                 bwn_dma_init(mac);
2104         bwn_wme_init(mac);
2105         bwn_spu_setdelay(mac, 1);
2106         bwn_bt_enable(mac);
2107
2108         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2109         siba_powerup(sc->sc_dev,
2110             !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2111         bwn_set_macaddr(mac);
2112         bwn_crypt_init(mac);
2113
2114         /* XXX LED initializatin */
2115
2116         mac->mac_status = BWN_MAC_STATUS_INITED;
2117
2118         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2119         return (error);
2120
2121 fail0:
2122         siba_powerdown(sc->sc_dev);
2123         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2124             ("%s:%d: fail", __func__, __LINE__));
2125         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2126         return (error);
2127 }
2128
2129 static void
2130 bwn_core_start(struct bwn_mac *mac)
2131 {
2132         struct bwn_softc *sc = mac->mac_sc;
2133         uint32_t tmp;
2134
2135         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2136             ("%s:%d: fail", __func__, __LINE__));
2137
2138         if (siba_get_revid(sc->sc_dev) < 5)
2139                 return;
2140
2141         while (1) {
2142                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2143                 if (!(tmp & 0x00000001))
2144                         break;
2145                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2146         }
2147
2148         bwn_mac_enable(mac);
2149         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2150         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2151
2152         mac->mac_status = BWN_MAC_STATUS_STARTED;
2153 }
2154
2155 static void
2156 bwn_core_exit(struct bwn_mac *mac)
2157 {
2158         struct bwn_softc *sc = mac->mac_sc;
2159         uint32_t macctl;
2160
2161         BWN_ASSERT_LOCKED(mac->mac_sc);
2162
2163         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2164             ("%s:%d: fail", __func__, __LINE__));
2165
2166         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2167                 return;
2168         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2169
2170         macctl = BWN_READ_4(mac, BWN_MACCTL);
2171         macctl &= ~BWN_MACCTL_MCODE_RUN;
2172         macctl |= BWN_MACCTL_MCODE_JMP0;
2173         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2174
2175         bwn_dma_stop(mac);
2176         bwn_pio_stop(mac);
2177         bwn_chip_exit(mac);
2178         mac->mac_phy.switch_analog(mac, 0);
2179         siba_dev_down(sc->sc_dev, 0);
2180         siba_powerdown(sc->sc_dev);
2181 }
2182
2183 static void
2184 bwn_bt_disable(struct bwn_mac *mac)
2185 {
2186         struct bwn_softc *sc = mac->mac_sc;
2187
2188         (void)sc;
2189         /* XXX do nothing yet */
2190 }
2191
2192 static int
2193 bwn_chip_init(struct bwn_mac *mac)
2194 {
2195         struct bwn_softc *sc = mac->mac_sc;
2196         struct bwn_phy *phy = &mac->mac_phy;
2197         uint32_t macctl;
2198         int error;
2199
2200         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2201         if (phy->gmode)
2202                 macctl |= BWN_MACCTL_GMODE;
2203         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2204
2205         error = bwn_fw_fillinfo(mac);
2206         if (error)
2207                 return (error);
2208         error = bwn_fw_loaducode(mac);
2209         if (error)
2210                 return (error);
2211
2212         error = bwn_gpio_init(mac);
2213         if (error)
2214                 return (error);
2215
2216         error = bwn_fw_loadinitvals(mac);
2217         if (error) {
2218                 siba_gpio_set(sc->sc_dev, 0);
2219                 return (error);
2220         }
2221         phy->switch_analog(mac, 1);
2222         error = bwn_phy_init(mac);
2223         if (error) {
2224                 siba_gpio_set(sc->sc_dev, 0);
2225                 return (error);
2226         }
2227         if (phy->set_im)
2228                 phy->set_im(mac, BWN_IMMODE_NONE);
2229         if (phy->set_antenna)
2230                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2231         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2232
2233         if (phy->type == BWN_PHYTYPE_B)
2234                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2235         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2236         if (siba_get_revid(sc->sc_dev) < 5)
2237                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2238
2239         BWN_WRITE_4(mac, BWN_MACCTL,
2240             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2241         BWN_WRITE_4(mac, BWN_MACCTL,
2242             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2243         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2244
2245         bwn_set_opmode(mac);
2246         if (siba_get_revid(sc->sc_dev) < 3) {
2247                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2248                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2249                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2250                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2251         } else {
2252                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2253                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2254         }
2255         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2256         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2257         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2258         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2259         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2260         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2261         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2262
2263         bwn_mac_phy_clock_set(mac, true);
2264
2265         /* SIBA powerup */
2266         /* XXX TODO: BCMA powerup */
2267         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2268         return (error);
2269 }
2270
2271 /* read hostflags */
2272 uint64_t
2273 bwn_hf_read(struct bwn_mac *mac)
2274 {
2275         uint64_t ret;
2276
2277         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2278         ret <<= 16;
2279         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2280         ret <<= 16;
2281         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2282         return (ret);
2283 }
2284
2285 void
2286 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2287 {
2288
2289         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2290             (value & 0x00000000ffffull));
2291         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2292             (value & 0x0000ffff0000ull) >> 16);
2293         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2294             (value & 0xffff00000000ULL) >> 32);
2295 }
2296
2297 static void
2298 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2299 {
2300
2301         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2302         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2303 }
2304
2305 static void
2306 bwn_rate_init(struct bwn_mac *mac)
2307 {
2308
2309         switch (mac->mac_phy.type) {
2310         case BWN_PHYTYPE_A:
2311         case BWN_PHYTYPE_G:
2312         case BWN_PHYTYPE_LP:
2313         case BWN_PHYTYPE_N:
2314                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2315                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2316                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2317                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2318                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2319                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2320                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2321                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2322                         break;
2323                 /* FALLTHROUGH */
2324         case BWN_PHYTYPE_B:
2325                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2326                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2327                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2328                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2329                 break;
2330         default:
2331                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2332         }
2333 }
2334
2335 static void
2336 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2337 {
2338         uint16_t offset;
2339
2340         if (ofdm) {
2341                 offset = 0x480;
2342                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2343         } else {
2344                 offset = 0x4c0;
2345                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2346         }
2347         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2348             bwn_shm_read_2(mac, BWN_SHARED, offset));
2349 }
2350
2351 static uint8_t
2352 bwn_plcp_getcck(const uint8_t bitrate)
2353 {
2354
2355         switch (bitrate) {
2356         case BWN_CCK_RATE_1MB:
2357                 return (0x0a);
2358         case BWN_CCK_RATE_2MB:
2359                 return (0x14);
2360         case BWN_CCK_RATE_5MB:
2361                 return (0x37);
2362         case BWN_CCK_RATE_11MB:
2363                 return (0x6e);
2364         }
2365         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2366         return (0);
2367 }
2368
2369 static uint8_t
2370 bwn_plcp_getofdm(const uint8_t bitrate)
2371 {
2372
2373         switch (bitrate) {
2374         case BWN_OFDM_RATE_6MB:
2375                 return (0xb);
2376         case BWN_OFDM_RATE_9MB:
2377                 return (0xf);
2378         case BWN_OFDM_RATE_12MB:
2379                 return (0xa);
2380         case BWN_OFDM_RATE_18MB:
2381                 return (0xe);
2382         case BWN_OFDM_RATE_24MB:
2383                 return (0x9);
2384         case BWN_OFDM_RATE_36MB:
2385                 return (0xd);
2386         case BWN_OFDM_RATE_48MB:
2387                 return (0x8);
2388         case BWN_OFDM_RATE_54MB:
2389                 return (0xc);
2390         }
2391         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2392         return (0);
2393 }
2394
2395 static void
2396 bwn_set_phytxctl(struct bwn_mac *mac)
2397 {
2398         uint16_t ctl;
2399
2400         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2401             BWN_TX_PHY_TXPWR);
2402         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2403         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2404         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2405 }
2406
2407 static void
2408 bwn_pio_init(struct bwn_mac *mac)
2409 {
2410         struct bwn_pio *pio = &mac->mac_method.pio;
2411
2412         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2413             & ~BWN_MACCTL_BIGENDIAN);
2414         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2415
2416         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2417         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2418         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2419         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2420         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2421         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2422 }
2423
2424 static void
2425 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2426     int index)
2427 {
2428         struct bwn_pio_txpkt *tp;
2429         struct bwn_softc *sc = mac->mac_sc;
2430         unsigned int i;
2431
2432         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2433         tq->tq_index = index;
2434
2435         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2436         if (siba_get_revid(sc->sc_dev) >= 8)
2437                 tq->tq_size = 1920;
2438         else {
2439                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2440                 tq->tq_size -= 80;
2441         }
2442
2443         TAILQ_INIT(&tq->tq_pktlist);
2444         for (i = 0; i < N(tq->tq_pkts); i++) {
2445                 tp = &(tq->tq_pkts[i]);
2446                 tp->tp_index = i;
2447                 tp->tp_queue = tq;
2448                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2449         }
2450 }
2451
2452 static uint16_t
2453 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2454 {
2455         struct bwn_softc *sc = mac->mac_sc;
2456         static const uint16_t bases[] = {
2457                 BWN_PIO_BASE0,
2458                 BWN_PIO_BASE1,
2459                 BWN_PIO_BASE2,
2460                 BWN_PIO_BASE3,
2461                 BWN_PIO_BASE4,
2462                 BWN_PIO_BASE5,
2463                 BWN_PIO_BASE6,
2464                 BWN_PIO_BASE7,
2465         };
2466         static const uint16_t bases_rev11[] = {
2467                 BWN_PIO11_BASE0,
2468                 BWN_PIO11_BASE1,
2469                 BWN_PIO11_BASE2,
2470                 BWN_PIO11_BASE3,
2471                 BWN_PIO11_BASE4,
2472                 BWN_PIO11_BASE5,
2473         };
2474
2475         if (siba_get_revid(sc->sc_dev) >= 11) {
2476                 if (index >= N(bases_rev11))
2477                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2478                 return (bases_rev11[index]);
2479         }
2480         if (index >= N(bases))
2481                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2482         return (bases[index]);
2483 }
2484
2485 static void
2486 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2487     int index)
2488 {
2489         struct bwn_softc *sc = mac->mac_sc;
2490
2491         prq->prq_mac = mac;
2492         prq->prq_rev = siba_get_revid(sc->sc_dev);
2493         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2494         bwn_dma_rxdirectfifo(mac, index, 1);
2495 }
2496
2497 static void
2498 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2499 {
2500         if (tq == NULL)
2501                 return;
2502         bwn_pio_cancel_tx_packets(tq);
2503 }
2504
2505 static void
2506 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2507 {
2508
2509         bwn_destroy_pioqueue_tx(pio);
2510 }
2511
2512 static uint16_t
2513 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2514     uint16_t offset)
2515 {
2516
2517         return (BWN_READ_2(mac, tq->tq_base + offset));
2518 }
2519
2520 static void
2521 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2522 {
2523         uint32_t ctl;
2524         int type;
2525         uint16_t base;
2526
2527         type = bwn_dma_mask2type(bwn_dma_mask(mac));
2528         base = bwn_dma_base(type, idx);
2529         if (type == BWN_DMA_64BIT) {
2530                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2531                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2532                 if (enable)
2533                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2534                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2535         } else {
2536                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2537                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2538                 if (enable)
2539                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2540                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2541         }
2542 }
2543
2544 static uint64_t
2545 bwn_dma_mask(struct bwn_mac *mac)
2546 {
2547         uint32_t tmp;
2548         uint16_t base;
2549
2550         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2551         if (tmp & SIBA_TGSHIGH_DMA64)
2552                 return (BWN_DMA_BIT_MASK(64));
2553         base = bwn_dma_base(0, 0);
2554         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2555         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2556         if (tmp & BWN_DMA32_TXADDREXT_MASK)
2557                 return (BWN_DMA_BIT_MASK(32));
2558
2559         return (BWN_DMA_BIT_MASK(30));
2560 }
2561
2562 static int
2563 bwn_dma_mask2type(uint64_t dmamask)
2564 {
2565
2566         if (dmamask == BWN_DMA_BIT_MASK(30))
2567                 return (BWN_DMA_30BIT);
2568         if (dmamask == BWN_DMA_BIT_MASK(32))
2569                 return (BWN_DMA_32BIT);
2570         if (dmamask == BWN_DMA_BIT_MASK(64))
2571                 return (BWN_DMA_64BIT);
2572         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2573         return (BWN_DMA_30BIT);
2574 }
2575
2576 static void
2577 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2578 {
2579         struct bwn_pio_txpkt *tp;
2580         unsigned int i;
2581
2582         for (i = 0; i < N(tq->tq_pkts); i++) {
2583                 tp = &(tq->tq_pkts[i]);
2584                 if (tp->tp_m) {
2585                         m_freem(tp->tp_m);
2586                         tp->tp_m = NULL;
2587                 }
2588         }
2589 }
2590
2591 static uint16_t
2592 bwn_dma_base(int type, int controller_idx)
2593 {
2594         static const uint16_t map64[] = {
2595                 BWN_DMA64_BASE0,
2596                 BWN_DMA64_BASE1,
2597                 BWN_DMA64_BASE2,
2598                 BWN_DMA64_BASE3,
2599                 BWN_DMA64_BASE4,
2600                 BWN_DMA64_BASE5,
2601         };
2602         static const uint16_t map32[] = {
2603                 BWN_DMA32_BASE0,
2604                 BWN_DMA32_BASE1,
2605                 BWN_DMA32_BASE2,
2606                 BWN_DMA32_BASE3,
2607                 BWN_DMA32_BASE4,
2608                 BWN_DMA32_BASE5,
2609         };
2610
2611         if (type == BWN_DMA_64BIT) {
2612                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2613                     ("%s:%d: fail", __func__, __LINE__));
2614                 return (map64[controller_idx]);
2615         }
2616         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2617             ("%s:%d: fail", __func__, __LINE__));
2618         return (map32[controller_idx]);
2619 }
2620
2621 static void
2622 bwn_dma_init(struct bwn_mac *mac)
2623 {
2624         struct bwn_dma *dma = &mac->mac_method.dma;
2625
2626         /* setup TX DMA channels. */
2627         bwn_dma_setup(dma->wme[WME_AC_BK]);
2628         bwn_dma_setup(dma->wme[WME_AC_BE]);
2629         bwn_dma_setup(dma->wme[WME_AC_VI]);
2630         bwn_dma_setup(dma->wme[WME_AC_VO]);
2631         bwn_dma_setup(dma->mcast);
2632         /* setup RX DMA channel. */
2633         bwn_dma_setup(dma->rx);
2634 }
2635
2636 static struct bwn_dma_ring *
2637 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2638     int for_tx, int type)
2639 {
2640         struct bwn_dma *dma = &mac->mac_method.dma;
2641         struct bwn_dma_ring *dr;
2642         struct bwn_dmadesc_generic *desc;
2643         struct bwn_dmadesc_meta *mt;
2644         struct bwn_softc *sc = mac->mac_sc;
2645         int error, i;
2646
2647         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2648         if (dr == NULL)
2649                 goto out;
2650         dr->dr_numslots = BWN_RXRING_SLOTS;
2651         if (for_tx)
2652                 dr->dr_numslots = BWN_TXRING_SLOTS;
2653
2654         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2655             M_DEVBUF, M_NOWAIT | M_ZERO);
2656         if (dr->dr_meta == NULL)
2657                 goto fail0;
2658
2659         dr->dr_type = type;
2660         dr->dr_mac = mac;
2661         dr->dr_base = bwn_dma_base(type, controller_index);
2662         dr->dr_index = controller_index;
2663         if (type == BWN_DMA_64BIT) {
2664                 dr->getdesc = bwn_dma_64_getdesc;
2665                 dr->setdesc = bwn_dma_64_setdesc;
2666                 dr->start_transfer = bwn_dma_64_start_transfer;
2667                 dr->suspend = bwn_dma_64_suspend;
2668                 dr->resume = bwn_dma_64_resume;
2669                 dr->get_curslot = bwn_dma_64_get_curslot;
2670                 dr->set_curslot = bwn_dma_64_set_curslot;
2671         } else {
2672                 dr->getdesc = bwn_dma_32_getdesc;
2673                 dr->setdesc = bwn_dma_32_setdesc;
2674                 dr->start_transfer = bwn_dma_32_start_transfer;
2675                 dr->suspend = bwn_dma_32_suspend;
2676                 dr->resume = bwn_dma_32_resume;
2677                 dr->get_curslot = bwn_dma_32_get_curslot;
2678                 dr->set_curslot = bwn_dma_32_set_curslot;
2679         }
2680         if (for_tx) {
2681                 dr->dr_tx = 1;
2682                 dr->dr_curslot = -1;
2683         } else {
2684                 if (dr->dr_index == 0) {
2685                         switch (mac->mac_fw.fw_hdr_format) {
2686                         case BWN_FW_HDR_351:
2687                         case BWN_FW_HDR_410:
2688                                 dr->dr_rx_bufsize =
2689                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
2690                                 dr->dr_frameoffset =
2691                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
2692                                 break;
2693                         case BWN_FW_HDR_598:
2694                                 dr->dr_rx_bufsize =
2695                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
2696                                 dr->dr_frameoffset =
2697                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
2698                                 break;
2699                         }
2700                 } else
2701                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2702         }
2703
2704         error = bwn_dma_allocringmemory(dr);
2705         if (error)
2706                 goto fail2;
2707
2708         if (for_tx) {
2709                 /*
2710                  * Assumption: BWN_TXRING_SLOTS can be divided by
2711                  * BWN_TX_SLOTS_PER_FRAME
2712                  */
2713                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2714                     ("%s:%d: fail", __func__, __LINE__));
2715
2716                 dr->dr_txhdr_cache = contigmalloc(
2717                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2718                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2719                     0, BUS_SPACE_MAXADDR, 8, 0);
2720                 if (dr->dr_txhdr_cache == NULL) {
2721                         device_printf(sc->sc_dev,
2722                             "can't allocate TX header DMA memory\n");
2723                         goto fail1;
2724                 }
2725
2726                 /*
2727                  * Create TX ring DMA stuffs
2728                  */
2729                 error = bus_dma_tag_create(dma->parent_dtag,
2730                                     BWN_ALIGN, 0,
2731                                     BUS_SPACE_MAXADDR,
2732                                     BUS_SPACE_MAXADDR,
2733                                     NULL, NULL,
2734                                     BWN_HDRSIZE(mac),
2735                                     1,
2736                                     BUS_SPACE_MAXSIZE_32BIT,
2737                                     0,
2738                                     NULL, NULL,
2739                                     &dr->dr_txring_dtag);
2740                 if (error) {
2741                         device_printf(sc->sc_dev,
2742                             "can't create TX ring DMA tag: TODO frees\n");
2743                         goto fail2;
2744                 }
2745
2746                 for (i = 0; i < dr->dr_numslots; i += 2) {
2747                         dr->getdesc(dr, i, &desc, &mt);
2748
2749                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2750                         mt->mt_m = NULL;
2751                         mt->mt_ni = NULL;
2752                         mt->mt_islast = 0;
2753                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2754                             &mt->mt_dmap);
2755                         if (error) {
2756                                 device_printf(sc->sc_dev,
2757                                      "can't create RX buf DMA map\n");
2758                                 goto fail2;
2759                         }
2760
2761                         dr->getdesc(dr, i + 1, &desc, &mt);
2762
2763                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2764                         mt->mt_m = NULL;
2765                         mt->mt_ni = NULL;
2766                         mt->mt_islast = 1;
2767                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2768                             &mt->mt_dmap);
2769                         if (error) {
2770                                 device_printf(sc->sc_dev,
2771                                      "can't create RX buf DMA map\n");
2772                                 goto fail2;
2773                         }
2774                 }
2775         } else {
2776                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2777                     &dr->dr_spare_dmap);
2778                 if (error) {
2779                         device_printf(sc->sc_dev,
2780                             "can't create RX buf DMA map\n");
2781                         goto out;               /* XXX wrong! */
2782                 }
2783
2784                 for (i = 0; i < dr->dr_numslots; i++) {
2785                         dr->getdesc(dr, i, &desc, &mt);
2786
2787                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2788                             &mt->mt_dmap);
2789                         if (error) {
2790                                 device_printf(sc->sc_dev,
2791                                     "can't create RX buf DMA map\n");
2792                                 goto out;       /* XXX wrong! */
2793                         }
2794                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2795                         if (error) {
2796                                 device_printf(sc->sc_dev,
2797                                     "failed to allocate RX buf\n");
2798                                 goto out;       /* XXX wrong! */
2799                         }
2800                 }
2801
2802                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2803                     BUS_DMASYNC_PREWRITE);
2804
2805                 dr->dr_usedslot = dr->dr_numslots;
2806         }
2807
2808       out:
2809         return (dr);
2810
2811 fail2:
2812         if (dr->dr_txhdr_cache != NULL) {
2813                 contigfree(dr->dr_txhdr_cache,
2814                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2815                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2816         }
2817 fail1:
2818         free(dr->dr_meta, M_DEVBUF);
2819 fail0:
2820         free(dr, M_DEVBUF);
2821         return (NULL);
2822 }
2823
2824 static void
2825 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2826 {
2827
2828         if (dr == NULL)
2829                 return;
2830
2831         bwn_dma_free_descbufs(*dr);
2832         bwn_dma_free_ringmemory(*dr);
2833
2834         if ((*dr)->dr_txhdr_cache != NULL) {
2835                 contigfree((*dr)->dr_txhdr_cache,
2836                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2837                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2838         }
2839         free((*dr)->dr_meta, M_DEVBUF);
2840         free(*dr, M_DEVBUF);
2841
2842         *dr = NULL;
2843 }
2844
2845 static void
2846 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2847     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2848 {
2849         struct bwn_dmadesc32 *desc;
2850
2851         *meta = &(dr->dr_meta[slot]);
2852         desc = dr->dr_ring_descbase;
2853         desc = &(desc[slot]);
2854
2855         *gdesc = (struct bwn_dmadesc_generic *)desc;
2856 }
2857
2858 static void
2859 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2860     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2861     int start, int end, int irq)
2862 {
2863         struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2864         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2865         uint32_t addr, addrext, ctl;
2866         int slot;
2867
2868         slot = (int)(&(desc->dma.dma32) - descbase);
2869         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2870             ("%s:%d: fail", __func__, __LINE__));
2871
2872         addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2873         addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2874         addr |= siba_dma_translation(sc->sc_dev);
2875         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2876         if (slot == dr->dr_numslots - 1)
2877                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
2878         if (start)
2879                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
2880         if (end)
2881                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
2882         if (irq)
2883                 ctl |= BWN_DMA32_DCTL_IRQ;
2884         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2885             & BWN_DMA32_DCTL_ADDREXT_MASK;
2886
2887         desc->dma.dma32.control = htole32(ctl);
2888         desc->dma.dma32.address = htole32(addr);
2889 }
2890
2891 static void
2892 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2893 {
2894
2895         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2896             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2897 }
2898
2899 static void
2900 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2901 {
2902
2903         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2904             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2905 }
2906
2907 static void
2908 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2909 {
2910
2911         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2912             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2913 }
2914
2915 static int
2916 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2917 {
2918         uint32_t val;
2919
2920         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2921         val &= BWN_DMA32_RXDPTR;
2922
2923         return (val / sizeof(struct bwn_dmadesc32));
2924 }
2925
2926 static void
2927 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2928 {
2929
2930         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2931             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2932 }
2933
2934 static void
2935 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2936     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2937 {
2938         struct bwn_dmadesc64 *desc;
2939
2940         *meta = &(dr->dr_meta[slot]);
2941         desc = dr->dr_ring_descbase;
2942         desc = &(desc[slot]);
2943
2944         *gdesc = (struct bwn_dmadesc_generic *)desc;
2945 }
2946
2947 static void
2948 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2949     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2950     int start, int end, int irq)
2951 {
2952         struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2953         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2954         int slot;
2955         uint32_t ctl0 = 0, ctl1 = 0;
2956         uint32_t addrlo, addrhi;
2957         uint32_t addrext;
2958
2959         slot = (int)(&(desc->dma.dma64) - descbase);
2960         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2961             ("%s:%d: fail", __func__, __LINE__));
2962
2963         addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2964         addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2965         addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2966             30;
2967         addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2968         if (slot == dr->dr_numslots - 1)
2969                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2970         if (start)
2971                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2972         if (end)
2973                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2974         if (irq)
2975                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
2976         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2977         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2978             & BWN_DMA64_DCTL1_ADDREXT_MASK;
2979
2980         desc->dma.dma64.control0 = htole32(ctl0);
2981         desc->dma.dma64.control1 = htole32(ctl1);
2982         desc->dma.dma64.address_low = htole32(addrlo);
2983         desc->dma.dma64.address_high = htole32(addrhi);
2984 }
2985
2986 static void
2987 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2988 {
2989
2990         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2991             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2992 }
2993
2994 static void
2995 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2996 {
2997
2998         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2999             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3000 }
3001
3002 static void
3003 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3004 {
3005
3006         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3007             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3008 }
3009
3010 static int
3011 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3012 {
3013         uint32_t val;
3014
3015         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3016         val &= BWN_DMA64_RXSTATDPTR;
3017
3018         return (val / sizeof(struct bwn_dmadesc64));
3019 }
3020
3021 static void
3022 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3023 {
3024
3025         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3026             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3027 }
3028
3029 static int
3030 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3031 {
3032         struct bwn_mac *mac = dr->dr_mac;
3033         struct bwn_dma *dma = &mac->mac_method.dma;
3034         struct bwn_softc *sc = mac->mac_sc;
3035         int error;
3036
3037         error = bus_dma_tag_create(dma->parent_dtag,
3038                             BWN_ALIGN, 0,
3039                             BUS_SPACE_MAXADDR,
3040                             BUS_SPACE_MAXADDR,
3041                             NULL, NULL,
3042                             BWN_DMA_RINGMEMSIZE,
3043                             1,
3044                             BUS_SPACE_MAXSIZE_32BIT,
3045                             0,
3046                             NULL, NULL,
3047                             &dr->dr_ring_dtag);
3048         if (error) {
3049                 device_printf(sc->sc_dev,
3050                     "can't create TX ring DMA tag: TODO frees\n");
3051                 return (-1);
3052         }
3053
3054         error = bus_dmamem_alloc(dr->dr_ring_dtag,
3055             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3056             &dr->dr_ring_dmap);
3057         if (error) {
3058                 device_printf(sc->sc_dev,
3059                     "can't allocate DMA mem: TODO frees\n");
3060                 return (-1);
3061         }
3062         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3063             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3064             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3065         if (error) {
3066                 device_printf(sc->sc_dev,
3067                     "can't load DMA mem: TODO free\n");
3068                 return (-1);
3069         }
3070
3071         return (0);
3072 }
3073
3074 static void
3075 bwn_dma_setup(struct bwn_dma_ring *dr)
3076 {
3077         struct bwn_softc *sc = dr->dr_mac->mac_sc;
3078         uint64_t ring64;
3079         uint32_t addrext, ring32, value;
3080         uint32_t trans = siba_dma_translation(sc->sc_dev);
3081
3082         if (dr->dr_tx) {
3083                 dr->dr_curslot = -1;
3084
3085                 if (dr->dr_type == BWN_DMA_64BIT) {
3086                         ring64 = (uint64_t)(dr->dr_ring_dmabase);
3087                         addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3088                             >> 30;
3089                         value = BWN_DMA64_TXENABLE;
3090                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3091                             & BWN_DMA64_TXADDREXT_MASK;
3092                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3093                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3094                             (ring64 & 0xffffffff));
3095                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3096                             ((ring64 >> 32) &
3097                             ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3098                 } else {
3099                         ring32 = (uint32_t)(dr->dr_ring_dmabase);
3100                         addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3101                         value = BWN_DMA32_TXENABLE;
3102                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3103                             & BWN_DMA32_TXADDREXT_MASK;
3104                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3105                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3106                             (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3107                 }
3108                 return;
3109         }
3110
3111         /*
3112          * set for RX
3113          */
3114         dr->dr_usedslot = dr->dr_numslots;
3115
3116         if (dr->dr_type == BWN_DMA_64BIT) {
3117                 ring64 = (uint64_t)(dr->dr_ring_dmabase);
3118                 addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3119                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3120                 value |= BWN_DMA64_RXENABLE;
3121                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3122                     & BWN_DMA64_RXADDREXT_MASK;
3123                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3124                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3125                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3126                     ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3127                     | (trans << 1));
3128                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3129                     sizeof(struct bwn_dmadesc64));
3130         } else {
3131                 ring32 = (uint32_t)(dr->dr_ring_dmabase);
3132                 addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3133                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3134                 value |= BWN_DMA32_RXENABLE;
3135                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3136                     & BWN_DMA32_RXADDREXT_MASK;
3137                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3138                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3139                     (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3140                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3141                     sizeof(struct bwn_dmadesc32));
3142         }
3143 }
3144
3145 static void
3146 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3147 {
3148
3149         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3150         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3151             dr->dr_ring_dmap);
3152 }
3153
3154 static void
3155 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3156 {
3157
3158         if (dr->dr_tx) {
3159                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3160                 if (dr->dr_type == BWN_DMA_64BIT) {
3161                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3162                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3163                 } else
3164                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3165         } else {
3166                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3167                 if (dr->dr_type == BWN_DMA_64BIT) {
3168                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3169                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3170                 } else
3171                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3172         }
3173 }
3174
3175 static void
3176 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3177 {
3178         struct bwn_dmadesc_generic *desc;
3179         struct bwn_dmadesc_meta *meta;
3180         struct bwn_mac *mac = dr->dr_mac;
3181         struct bwn_dma *dma = &mac->mac_method.dma;
3182         struct bwn_softc *sc = mac->mac_sc;
3183         int i;
3184
3185         if (!dr->dr_usedslot)
3186                 return;
3187         for (i = 0; i < dr->dr_numslots; i++) {
3188                 dr->getdesc(dr, i, &desc, &meta);
3189
3190                 if (meta->mt_m == NULL) {
3191                         if (!dr->dr_tx)
3192                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3193                                     __func__);
3194                         continue;
3195                 }
3196                 if (dr->dr_tx) {
3197                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3198                                 bus_dmamap_unload(dr->dr_txring_dtag,
3199                                     meta->mt_dmap);
3200                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3201                                 bus_dmamap_unload(dma->txbuf_dtag,
3202                                     meta->mt_dmap);
3203                 } else
3204                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3205                 bwn_dma_free_descbuf(dr, meta);
3206         }
3207 }
3208
3209 static int
3210 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3211     int type)
3212 {
3213         struct bwn_softc *sc = mac->mac_sc;
3214         uint32_t value;
3215         int i;
3216         uint16_t offset;
3217
3218         for (i = 0; i < 10; i++) {
3219                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3220                     BWN_DMA32_TXSTATUS;
3221                 value = BWN_READ_4(mac, base + offset);
3222                 if (type == BWN_DMA_64BIT) {
3223                         value &= BWN_DMA64_TXSTAT;
3224                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3225                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3226                             value == BWN_DMA64_TXSTAT_STOPPED)
3227                                 break;
3228                 } else {
3229                         value &= BWN_DMA32_TXSTATE;
3230                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3231                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3232                             value == BWN_DMA32_TXSTAT_STOPPED)
3233                                 break;
3234                 }
3235                 DELAY(1000);
3236         }
3237         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3238         BWN_WRITE_4(mac, base + offset, 0);
3239         for (i = 0; i < 10; i++) {
3240                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3241                                                    BWN_DMA32_TXSTATUS;
3242                 value = BWN_READ_4(mac, base + offset);
3243                 if (type == BWN_DMA_64BIT) {
3244                         value &= BWN_DMA64_TXSTAT;
3245                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3246                                 i = -1;
3247                                 break;
3248                         }
3249                 } else {
3250                         value &= BWN_DMA32_TXSTATE;
3251                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3252                                 i = -1;
3253                                 break;
3254                         }
3255                 }
3256                 DELAY(1000);
3257         }
3258         if (i != -1) {
3259                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3260                 return (ENODEV);
3261         }
3262         DELAY(1000);
3263
3264         return (0);
3265 }
3266
3267 static int
3268 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3269     int type)
3270 {
3271         struct bwn_softc *sc = mac->mac_sc;
3272         uint32_t value;
3273         int i;
3274         uint16_t offset;
3275
3276         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3277         BWN_WRITE_4(mac, base + offset, 0);
3278         for (i = 0; i < 10; i++) {
3279                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3280                     BWN_DMA32_RXSTATUS;
3281                 value = BWN_READ_4(mac, base + offset);
3282                 if (type == BWN_DMA_64BIT) {
3283                         value &= BWN_DMA64_RXSTAT;
3284                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3285                                 i = -1;
3286                                 break;
3287                         }
3288                 } else {
3289                         value &= BWN_DMA32_RXSTATE;
3290                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3291                                 i = -1;
3292                                 break;
3293                         }
3294                 }
3295                 DELAY(1000);
3296         }
3297         if (i != -1) {
3298                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3299                 return (ENODEV);
3300         }
3301
3302         return (0);
3303 }
3304
3305 static void
3306 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3307     struct bwn_dmadesc_meta *meta)
3308 {
3309
3310         if (meta->mt_m != NULL) {
3311                 m_freem(meta->mt_m);
3312                 meta->mt_m = NULL;
3313         }
3314         if (meta->mt_ni != NULL) {
3315                 ieee80211_free_node(meta->mt_ni);
3316                 meta->mt_ni = NULL;
3317         }
3318 }
3319
3320 static void
3321 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3322 {
3323         struct bwn_rxhdr4 *rxhdr;
3324         unsigned char *frame;
3325
3326         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3327         rxhdr->frame_len = 0;
3328
3329         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3330             sizeof(struct bwn_plcp6) + 2,
3331             ("%s:%d: fail", __func__, __LINE__));
3332         frame = mtod(m, char *) + dr->dr_frameoffset;
3333         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3334 }
3335
3336 static uint8_t
3337 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3338 {
3339         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3340
3341         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3342             == 0xff);
3343 }
3344
3345 static void
3346 bwn_wme_init(struct bwn_mac *mac)
3347 {
3348
3349         bwn_wme_load(mac);
3350
3351         /* enable WME support. */
3352         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3353         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3354             BWN_IFSCTL_USE_EDCF);
3355 }
3356
3357 static void
3358 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3359 {
3360         struct bwn_softc *sc = mac->mac_sc;
3361         struct ieee80211com *ic = &sc->sc_ic;
3362         uint16_t delay; /* microsec */
3363
3364         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3365         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3366                 delay = 500;
3367         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3368                 delay = max(delay, (uint16_t)2400);
3369
3370         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3371 }
3372
3373 static void
3374 bwn_bt_enable(struct bwn_mac *mac)
3375 {
3376         struct bwn_softc *sc = mac->mac_sc;
3377         uint64_t hf;
3378
3379         if (bwn_bluetooth == 0)
3380                 return;
3381         if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3382                 return;
3383         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3384                 return;
3385
3386         hf = bwn_hf_read(mac);
3387         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3388                 hf |= BWN_HF_BT_COEXISTALT;
3389         else
3390                 hf |= BWN_HF_BT_COEXIST;
3391         bwn_hf_write(mac, hf);
3392 }
3393
3394 static void
3395 bwn_set_macaddr(struct bwn_mac *mac)
3396 {
3397
3398         bwn_mac_write_bssid(mac);
3399         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3400             mac->mac_sc->sc_ic.ic_macaddr);
3401 }
3402
3403 static void
3404 bwn_clear_keys(struct bwn_mac *mac)
3405 {
3406         int i;
3407
3408         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3409                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3410                     ("%s:%d: fail", __func__, __LINE__));
3411
3412                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3413                     NULL, BWN_SEC_KEYSIZE, NULL);
3414                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3415                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3416                             NULL, BWN_SEC_KEYSIZE, NULL);
3417                 }
3418                 mac->mac_key[i].keyconf = NULL;
3419         }
3420 }
3421
3422 static void
3423 bwn_crypt_init(struct bwn_mac *mac)
3424 {
3425         struct bwn_softc *sc = mac->mac_sc;
3426
3427         mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3428         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3429             ("%s:%d: fail", __func__, __LINE__));
3430         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3431         mac->mac_ktp *= 2;
3432         if (siba_get_revid(sc->sc_dev) >= 5)
3433                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3434         bwn_clear_keys(mac);
3435 }
3436
3437 static void
3438 bwn_chip_exit(struct bwn_mac *mac)
3439 {
3440         struct bwn_softc *sc = mac->mac_sc;
3441
3442         bwn_phy_exit(mac);
3443         siba_gpio_set(sc->sc_dev, 0);
3444 }
3445
3446 static int
3447 bwn_fw_fillinfo(struct bwn_mac *mac)
3448 {
3449         int error;
3450
3451         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3452         if (error == 0)
3453                 return (0);
3454         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3455         if (error == 0)
3456                 return (0);
3457         return (error);
3458 }
3459
3460 static int
3461 bwn_gpio_init(struct bwn_mac *mac)
3462 {
3463         struct bwn_softc *sc = mac->mac_sc;
3464         uint32_t mask = 0x1f, set = 0xf, value;
3465
3466         BWN_WRITE_4(mac, BWN_MACCTL,
3467             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3468         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3469             BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3470
3471         if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3472                 mask |= 0x0060;
3473                 set |= 0x0060;
3474         }
3475         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3476                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3477                     BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3478                 mask |= 0x0200;
3479                 set |= 0x0200;
3480         }
3481         if (siba_get_revid(sc->sc_dev) >= 2)
3482                 mask |= 0x0010;
3483
3484         value = siba_gpio_get(sc->sc_dev);
3485         if (value == -1)
3486                 return (0);
3487         siba_gpio_set(sc->sc_dev, (value & mask) | set);
3488
3489         return (0);
3490 }
3491
3492 static int
3493 bwn_fw_loadinitvals(struct bwn_mac *mac)
3494 {
3495 #define GETFWOFFSET(fwp, offset)                                \
3496         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3497         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3498         const struct bwn_fwhdr *hdr;
3499         struct bwn_fw *fw = &mac->mac_fw;
3500         int error;
3501
3502         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3503         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3504             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3505         if (error)
3506                 return (error);
3507         if (fw->initvals_band.fw) {
3508                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3509                 error = bwn_fwinitvals_write(mac,
3510                     GETFWOFFSET(fw->initvals_band, hdr_len),
3511                     be32toh(hdr->size),
3512                     fw->initvals_band.fw->datasize - hdr_len);
3513         }
3514         return (error);
3515 #undef GETFWOFFSET
3516 }
3517
3518 static int
3519 bwn_phy_init(struct bwn_mac *mac)
3520 {
3521         struct bwn_softc *sc = mac->mac_sc;
3522         int error;
3523
3524         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3525         mac->mac_phy.rf_onoff(mac, 1);
3526         error = mac->mac_phy.init(mac);
3527         if (error) {
3528                 device_printf(sc->sc_dev, "PHY init failed\n");
3529                 goto fail0;
3530         }
3531         error = bwn_switch_channel(mac,
3532             mac->mac_phy.get_default_chan(mac));
3533         if (error) {
3534                 device_printf(sc->sc_dev,
3535                     "failed to switch default channel\n");
3536                 goto fail1;
3537         }
3538         return (0);
3539 fail1:
3540         if (mac->mac_phy.exit)
3541                 mac->mac_phy.exit(mac);
3542 fail0:
3543         mac->mac_phy.rf_onoff(mac, 0);
3544
3545         return (error);
3546 }
3547
3548 static void
3549 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3550 {
3551         uint16_t ant;
3552         uint16_t tmp;
3553
3554         ant = bwn_ant2phy(antenna);
3555
3556         /* For ACK/CTS */
3557         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3558         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3559         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3560         /* For Probe Resposes */
3561         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3562         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3563         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3564 }
3565
3566 static void
3567 bwn_set_opmode(struct bwn_mac *mac)
3568 {
3569         struct bwn_softc *sc = mac->mac_sc;
3570         struct ieee80211com *ic = &sc->sc_ic;
3571         uint32_t ctl;
3572         uint16_t cfp_pretbtt;
3573
3574         ctl = BWN_READ_4(mac, BWN_MACCTL);
3575         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3576             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3577             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3578         ctl |= BWN_MACCTL_STA;
3579
3580         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3581             ic->ic_opmode == IEEE80211_M_MBSS)
3582                 ctl |= BWN_MACCTL_HOSTAP;
3583         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3584                 ctl &= ~BWN_MACCTL_STA;
3585         ctl |= sc->sc_filters;
3586
3587         if (siba_get_revid(sc->sc_dev) <= 4)
3588                 ctl |= BWN_MACCTL_PROMISC;
3589
3590         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3591
3592         cfp_pretbtt = 2;
3593         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3594                 if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3595                     siba_get_chiprev(sc->sc_dev) == 3)
3596                         cfp_pretbtt = 100;
3597                 else
3598                         cfp_pretbtt = 50;
3599         }
3600         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3601 }
3602
3603 static int
3604 bwn_dma_gettype(struct bwn_mac *mac)
3605 {
3606         uint32_t tmp;
3607         uint16_t base;
3608
3609         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3610         if (tmp & SIBA_TGSHIGH_DMA64)
3611                 return (BWN_DMA_64BIT);
3612         base = bwn_dma_base(0, 0);
3613         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3614         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3615         if (tmp & BWN_DMA32_TXADDREXT_MASK)
3616                 return (BWN_DMA_32BIT);
3617
3618         return (BWN_DMA_30BIT);
3619 }
3620
3621 static void
3622 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3623 {
3624         if (!error) {
3625                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3626                 *((bus_addr_t *)arg) = seg->ds_addr;
3627         }
3628 }
3629
3630 void
3631 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3632 {
3633         struct bwn_phy *phy = &mac->mac_phy;
3634         struct bwn_softc *sc = mac->mac_sc;
3635         unsigned int i, max_loop;
3636         uint16_t value;
3637         uint32_t buffer[5] = {
3638                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3639         };
3640
3641         if (ofdm) {
3642                 max_loop = 0x1e;
3643                 buffer[0] = 0x000201cc;
3644         } else {
3645                 max_loop = 0xfa;
3646                 buffer[0] = 0x000b846e;
3647         }
3648
3649         BWN_ASSERT_LOCKED(mac->mac_sc);
3650
3651         for (i = 0; i < 5; i++)
3652                 bwn_ram_write(mac, i * 4, buffer[i]);
3653
3654         BWN_WRITE_2(mac, 0x0568, 0x0000);
3655         BWN_WRITE_2(mac, 0x07c0,
3656             (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3657
3658         value = (ofdm ? 0x41 : 0x40);
3659         BWN_WRITE_2(mac, 0x050c, value);
3660
3661         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3662             phy->type == BWN_PHYTYPE_LCN)
3663                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3664         BWN_WRITE_2(mac, 0x0508, 0x0000);
3665         BWN_WRITE_2(mac, 0x050a, 0x0000);
3666         BWN_WRITE_2(mac, 0x054c, 0x0000);
3667         BWN_WRITE_2(mac, 0x056a, 0x0014);
3668         BWN_WRITE_2(mac, 0x0568, 0x0826);
3669         BWN_WRITE_2(mac, 0x0500, 0x0000);
3670
3671         /* XXX TODO: n phy pa override? */
3672
3673         switch (phy->type) {
3674         case BWN_PHYTYPE_N:
3675         case BWN_PHYTYPE_LCN:
3676                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3677                 break;
3678         case BWN_PHYTYPE_LP:
3679                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3680                 break;
3681         default:
3682                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3683                 break;
3684         }
3685
3686         /* flush */
3687         BWN_READ_2(mac, 0x0502);
3688
3689         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3690                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3691         for (i = 0x00; i < max_loop; i++) {
3692                 value = BWN_READ_2(mac, 0x050e);
3693                 if (value & 0x0080)
3694                         break;
3695                 DELAY(10);
3696         }
3697         for (i = 0x00; i < 0x0a; i++) {
3698                 value = BWN_READ_2(mac, 0x050e);
3699                 if (value & 0x0400)
3700                         break;
3701                 DELAY(10);
3702         }
3703         for (i = 0x00; i < 0x19; i++) {
3704                 value = BWN_READ_2(mac, 0x0690);
3705                 if (!(value & 0x0100))
3706                         break;
3707                 DELAY(10);
3708         }
3709         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3710                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3711 }
3712
3713 void
3714 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3715 {
3716         uint32_t macctl;
3717
3718         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3719
3720         macctl = BWN_READ_4(mac, BWN_MACCTL);
3721         if (macctl & BWN_MACCTL_BIGENDIAN)
3722                 printf("TODO: need swap\n");
3723
3724         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3725         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3726         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3727 }
3728
3729 void
3730 bwn_mac_suspend(struct bwn_mac *mac)
3731 {
3732         struct bwn_softc *sc = mac->mac_sc;
3733         int i;
3734         uint32_t tmp;
3735
3736         KASSERT(mac->mac_suspended >= 0,
3737             ("%s:%d: fail", __func__, __LINE__));
3738
3739         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3740             __func__, mac->mac_suspended);
3741
3742         if (mac->mac_suspended == 0) {
3743                 bwn_psctl(mac, BWN_PS_AWAKE);
3744                 BWN_WRITE_4(mac, BWN_MACCTL,
3745                             BWN_READ_4(mac, BWN_MACCTL)
3746                             & ~BWN_MACCTL_ON);
3747                 BWN_READ_4(mac, BWN_MACCTL);
3748                 for (i = 35; i; i--) {
3749                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3750                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3751                                 goto out;
3752                         DELAY(10);
3753                 }
3754                 for (i = 40; i; i--) {
3755                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3756                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3757                                 goto out;
3758                         DELAY(1000);
3759                 }
3760                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3761         }
3762 out:
3763         mac->mac_suspended++;
3764 }
3765
3766 void
3767 bwn_mac_enable(struct bwn_mac *mac)
3768 {
3769         struct bwn_softc *sc = mac->mac_sc;
3770         uint16_t state;
3771
3772         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3773             __func__, mac->mac_suspended);
3774
3775         state = bwn_shm_read_2(mac, BWN_SHARED,
3776             BWN_SHARED_UCODESTAT);
3777         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3778             state != BWN_SHARED_UCODESTAT_SLEEP) {
3779                 DPRINTF(sc, BWN_DEBUG_FW,
3780                     "%s: warn: firmware state (%d)\n",
3781                     __func__, state);
3782         }
3783
3784         mac->mac_suspended--;
3785         KASSERT(mac->mac_suspended >= 0,
3786             ("%s:%d: fail", __func__, __LINE__));
3787         if (mac->mac_suspended == 0) {
3788                 BWN_WRITE_4(mac, BWN_MACCTL,
3789                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3790                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3791                 BWN_READ_4(mac, BWN_MACCTL);
3792                 BWN_READ_4(mac, BWN_INTR_REASON);
3793                 bwn_psctl(mac, 0);
3794         }
3795 }
3796
3797 void
3798 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3799 {
3800         struct bwn_softc *sc = mac->mac_sc;
3801         int i;
3802         uint16_t ucstat;
3803
3804         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3805             ("%s:%d: fail", __func__, __LINE__));
3806         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3807             ("%s:%d: fail", __func__, __LINE__));
3808
3809         /* XXX forcibly awake and hwps-off */
3810
3811         BWN_WRITE_4(mac, BWN_MACCTL,
3812             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3813             ~BWN_MACCTL_HWPS);
3814         BWN_READ_4(mac, BWN_MACCTL);
3815         if (siba_get_revid(sc->sc_dev) >= 5) {
3816                 for (i = 0; i < 100; i++) {
3817                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3818                             BWN_SHARED_UCODESTAT);
3819                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3820                                 break;
3821                         DELAY(10);
3822                 }
3823         }
3824         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3825             ucstat);
3826 }
3827
3828 static int
3829 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3830 {
3831         struct bwn_softc *sc = mac->mac_sc;
3832         struct bwn_fw *fw = &mac->mac_fw;
3833         const uint8_t rev = siba_get_revid(sc->sc_dev);
3834         const char *filename;
3835         uint32_t high;
3836         int error;
3837
3838         /* microcode */
3839         filename = NULL;
3840         switch (rev) {
3841         case 42:
3842                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3843                         filename = "ucode42";
3844                 break;
3845         case 40:
3846                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3847                         filename = "ucode40";
3848                 break;
3849         case 33:
3850                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3851                         filename = "ucode33_lcn40";
3852                 break;
3853         case 30:
3854                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3855                         filename = "ucode30_mimo";
3856                 break;
3857         case 29:
3858                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3859                         filename = "ucode29_mimo";
3860                 break;
3861         case 26:
3862                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3863                         filename = "ucode26_mimo";
3864                 break;
3865         case 28:
3866         case 25:
3867                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3868                         filename = "ucode25_mimo";
3869                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3870                         filename = "ucode25_lcn";
3871                 break;
3872         case 24:
3873                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3874                         filename = "ucode24_lcn";
3875                 break;
3876         case 23:
3877                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3878                         filename = "ucode16_mimo";
3879                 break;
3880         case 16:
3881         case 17:
3882         case 18:
3883         case 19:
3884                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3885                         filename = "ucode16_mimo";
3886                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3887                         filename = "ucode16_lp";
3888                 break;
3889         case 15:
3890                 filename = "ucode15";
3891                 break;
3892         case 14:
3893                 filename = "ucode14";
3894                 break;
3895         case 13:
3896                 filename = "ucode13";
3897                 break;
3898         case 12:
3899         case 11:
3900                 filename = "ucode11";
3901                 break;
3902         case 10:
3903         case 9:
3904         case 8:
3905         case 7:
3906         case 6:
3907         case 5:
3908                 filename = "ucode5";
3909                 break;
3910         default:
3911                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3912                 bwn_release_firmware(mac);
3913                 return (EOPNOTSUPP);
3914         }
3915
3916         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3917         error = bwn_fw_get(mac, type, filename, &fw->ucode);
3918         if (error) {
3919                 bwn_release_firmware(mac);
3920                 return (error);
3921         }
3922
3923         /* PCM */
3924         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3925         if (rev >= 5 && rev <= 10) {
3926                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3927                 if (error == ENOENT)
3928                         fw->no_pcmfile = 1;
3929                 else if (error) {
3930                         bwn_release_firmware(mac);
3931                         return (error);
3932                 }
3933         } else if (rev < 11) {
3934                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3935                 bwn_release_firmware(mac);
3936                 return (EOPNOTSUPP);
3937         }
3938
3939         /* initvals */
3940         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3941         switch (mac->mac_phy.type) {
3942         case BWN_PHYTYPE_A:
3943                 if (rev < 5 || rev > 10)
3944                         goto fail1;
3945                 if (high & BWN_TGSHIGH_HAVE_2GHZ)
3946                         filename = "a0g1initvals5";
3947                 else
3948                         filename = "a0g0initvals5";
3949                 break;
3950         case BWN_PHYTYPE_G:
3951                 if (rev >= 5 && rev <= 10)
3952                         filename = "b0g0initvals5";
3953                 else if (rev >= 13)
3954                         filename = "b0g0initvals13";
3955                 else
3956                         goto fail1;
3957                 break;
3958         case BWN_PHYTYPE_LP:
3959                 if (rev == 13)
3960                         filename = "lp0initvals13";
3961                 else if (rev == 14)
3962                         filename = "lp0initvals14";
3963                 else if (rev >= 15)
3964                         filename = "lp0initvals15";
3965                 else
3966                         goto fail1;
3967                 break;
3968         case BWN_PHYTYPE_N:
3969                 if (rev == 30)
3970                         filename = "n16initvals30";
3971                 else if (rev == 28 || rev == 25)
3972                         filename = "n0initvals25";
3973                 else if (rev == 24)
3974                         filename = "n0initvals24";
3975                 else if (rev == 23)
3976                         filename = "n0initvals16";
3977                 else if (rev >= 16 && rev <= 18)
3978                         filename = "n0initvals16";
3979                 else if (rev >= 11 && rev <= 12)
3980                         filename = "n0initvals11";
3981                 else
3982                         goto fail1;
3983                 break;
3984         default:
3985                 goto fail1;
3986         }
3987         error = bwn_fw_get(mac, type, filename, &fw->initvals);
3988         if (error) {
3989                 bwn_release_firmware(mac);
3990                 return (error);
3991         }
3992
3993         /* bandswitch initvals */
3994         switch (mac->mac_phy.type) {
3995         case BWN_PHYTYPE_A:
3996                 if (rev >= 5 && rev <= 10) {
3997                         if (high & BWN_TGSHIGH_HAVE_2GHZ)
3998                                 filename = "a0g1bsinitvals5";
3999                         else
4000                                 filename = "a0g0bsinitvals5";
4001                 } else if (rev >= 11)
4002                         filename = NULL;
4003                 else
4004                         goto fail1;
4005                 break;
4006         case BWN_PHYTYPE_G:
4007                 if (rev >= 5 && rev <= 10)
4008                         filename = "b0g0bsinitvals5";
4009                 else if (rev >= 11)
4010                         filename = NULL;
4011                 else
4012                         goto fail1;
4013                 break;
4014         case BWN_PHYTYPE_LP:
4015                 if (rev == 13)
4016                         filename = "lp0bsinitvals13";
4017                 else if (rev == 14)
4018                         filename = "lp0bsinitvals14";
4019                 else if (rev >= 15)
4020                         filename = "lp0bsinitvals15";
4021                 else
4022                         goto fail1;
4023                 break;
4024         case BWN_PHYTYPE_N:
4025                 if (rev == 30)
4026                         filename = "n16bsinitvals30";
4027                 else if (rev == 28 || rev == 25)
4028                         filename = "n0bsinitvals25";
4029                 else if (rev == 24)
4030                         filename = "n0bsinitvals24";
4031                 else if (rev == 23)
4032                         filename = "n0bsinitvals16";
4033                 else if (rev >= 16 && rev <= 18)
4034                         filename = "n0bsinitvals16";
4035                 else if (rev >= 11 && rev <= 12)
4036                         filename = "n0bsinitvals11";
4037                 else
4038                         goto fail1;
4039                 break;
4040         default:
4041                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
4042                     mac->mac_phy.type);
4043                 goto fail1;
4044         }
4045         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4046         if (error) {
4047                 bwn_release_firmware(mac);
4048                 return (error);
4049         }
4050         return (0);
4051 fail1:
4052         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4053             rev, mac->mac_phy.type);
4054         bwn_release_firmware(mac);
4055         return (EOPNOTSUPP);
4056 }
4057
4058 static int
4059 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4060     const char *name, struct bwn_fwfile *bfw)
4061 {
4062         const struct bwn_fwhdr *hdr;
4063         struct bwn_softc *sc = mac->mac_sc;
4064         const struct firmware *fw;
4065         char namebuf[64];
4066
4067         if (name == NULL) {
4068                 bwn_do_release_fw(bfw);
4069                 return (0);
4070         }
4071         if (bfw->filename != NULL) {
4072                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4073                         return (0);
4074                 bwn_do_release_fw(bfw);
4075         }
4076
4077         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4078             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4079             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4080         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
4081         fw = firmware_get(namebuf);
4082         if (fw == NULL) {
4083                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4084                     namebuf);
4085                 return (ENOENT);
4086         }
4087         if (fw->datasize < sizeof(struct bwn_fwhdr))
4088                 goto fail;
4089         hdr = (const struct bwn_fwhdr *)(fw->data);
4090         switch (hdr->type) {
4091         case BWN_FWTYPE_UCODE:
4092         case BWN_FWTYPE_PCM:
4093                 if (be32toh(hdr->size) !=
4094                     (fw->datasize - sizeof(struct bwn_fwhdr)))
4095                         goto fail;
4096                 /* FALLTHROUGH */
4097         case BWN_FWTYPE_IV:
4098                 if (hdr->ver != 1)
4099                         goto fail;
4100                 break;
4101         default:
4102                 goto fail;
4103         }
4104         bfw->filename = name;
4105         bfw->fw = fw;
4106         bfw->type = type;
4107         return (0);
4108 fail:
4109         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4110         if (fw != NULL)
4111                 firmware_put(fw, FIRMWARE_UNLOAD);
4112         return (EPROTO);
4113 }
4114
4115 static void
4116 bwn_release_firmware(struct bwn_mac *mac)
4117 {
4118
4119         bwn_do_release_fw(&mac->mac_fw.ucode);
4120         bwn_do_release_fw(&mac->mac_fw.pcm);
4121         bwn_do_release_fw(&mac->mac_fw.initvals);
4122         bwn_do_release_fw(&mac->mac_fw.initvals_band);
4123 }
4124
4125 static void
4126 bwn_do_release_fw(struct bwn_fwfile *bfw)
4127 {
4128
4129         if (bfw->fw != NULL)
4130                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4131         bfw->fw = NULL;
4132         bfw->filename = NULL;
4133 }
4134
4135 static int
4136 bwn_fw_loaducode(struct bwn_mac *mac)
4137 {
4138 #define GETFWOFFSET(fwp, offset)        \
4139         ((const uint32_t *)((const char *)fwp.fw->data + offset))
4140 #define GETFWSIZE(fwp, offset)  \
4141         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
4142         struct bwn_softc *sc = mac->mac_sc;
4143         const uint32_t *data;
4144         unsigned int i;
4145         uint32_t ctl;
4146         uint16_t date, fwcaps, time;
4147         int error = 0;
4148
4149         ctl = BWN_READ_4(mac, BWN_MACCTL);
4150         ctl |= BWN_MACCTL_MCODE_JMP0;
4151         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4152             __LINE__));
4153         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4154         for (i = 0; i < 64; i++)
4155                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4156         for (i = 0; i < 4096; i += 2)
4157                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4158
4159         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4160         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4161         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4162              i++) {
4163                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4164                 DELAY(10);
4165         }
4166
4167         if (mac->mac_fw.pcm.fw) {
4168                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4169                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4170                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4171                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4172                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4173                     sizeof(struct bwn_fwhdr)); i++) {
4174                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4175                         DELAY(10);
4176                 }
4177         }
4178
4179         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4180         BWN_WRITE_4(mac, BWN_MACCTL,
4181             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4182             BWN_MACCTL_MCODE_RUN);
4183
4184         for (i = 0; i < 21; i++) {
4185                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4186                         break;
4187                 if (i >= 20) {
4188                         device_printf(sc->sc_dev, "ucode timeout\n");
4189                         error = ENXIO;
4190                         goto error;
4191                 }
4192                 DELAY(50000);
4193         }
4194         BWN_READ_4(mac, BWN_INTR_REASON);
4195
4196         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4197         if (mac->mac_fw.rev <= 0x128) {
4198                 device_printf(sc->sc_dev, "the firmware is too old\n");
4199                 error = EOPNOTSUPP;
4200                 goto error;
4201         }
4202
4203         /*
4204          * Determine firmware header version; needed for TX/RX packet
4205          * handling.
4206          */
4207         if (mac->mac_fw.rev >= 598)
4208                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4209         else if (mac->mac_fw.rev >= 410)
4210                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4211         else
4212                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4213
4214         /*
4215          * We don't support rev 598 or later; that requires
4216          * another round of changes to the TX/RX descriptor
4217          * and status layout.
4218          *
4219          * So, complain this is the case and exit out, rather
4220          * than attaching and then failing.
4221          */
4222 #if 0
4223         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4224                 device_printf(sc->sc_dev,
4225                     "firmware is too new (>=598); not supported\n");
4226                 error = EOPNOTSUPP;
4227                 goto error;
4228         }
4229 #endif
4230
4231         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4232             BWN_SHARED_UCODE_PATCH);
4233         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4234         mac->mac_fw.opensource = (date == 0xffff);
4235         if (bwn_wme != 0)
4236                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4237         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4238
4239         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4240         if (mac->mac_fw.opensource == 0) {
4241                 device_printf(sc->sc_dev,
4242                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4243                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4244                 if (mac->mac_fw.no_pcmfile)
4245                         device_printf(sc->sc_dev,
4246                             "no HW crypto acceleration due to pcm5\n");
4247         } else {
4248                 mac->mac_fw.patch = time;
4249                 fwcaps = bwn_fwcaps_read(mac);
4250                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4251                         device_printf(sc->sc_dev,
4252                             "disabling HW crypto acceleration\n");
4253                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4254                 }
4255                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4256                         device_printf(sc->sc_dev, "disabling WME support\n");
4257                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4258                 }
4259         }
4260
4261         if (BWN_ISOLDFMT(mac))
4262                 device_printf(sc->sc_dev, "using old firmware image\n");
4263
4264         return (0);
4265
4266 error:
4267         BWN_WRITE_4(mac, BWN_MACCTL,
4268             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4269             BWN_MACCTL_MCODE_JMP0);
4270
4271         return (error);
4272 #undef GETFWSIZE
4273 #undef GETFWOFFSET
4274 }
4275
4276 /* OpenFirmware only */
4277 static uint16_t
4278 bwn_fwcaps_read(struct bwn_mac *mac)
4279 {
4280
4281         KASSERT(mac->mac_fw.opensource == 1,
4282             ("%s:%d: fail", __func__, __LINE__));
4283         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4284 }
4285
4286 static int
4287 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4288     size_t count, size_t array_size)
4289 {
4290 #define GET_NEXTIV16(iv)                                                \
4291         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4292             sizeof(uint16_t) + sizeof(uint16_t)))
4293 #define GET_NEXTIV32(iv)                                                \
4294         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4295             sizeof(uint16_t) + sizeof(uint32_t)))
4296         struct bwn_softc *sc = mac->mac_sc;
4297         const struct bwn_fwinitvals *iv;
4298         uint16_t offset;
4299         size_t i;
4300         uint8_t bit32;
4301
4302         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4303             ("%s:%d: fail", __func__, __LINE__));
4304         iv = ivals;
4305         for (i = 0; i < count; i++) {
4306                 if (array_size < sizeof(iv->offset_size))
4307                         goto fail;
4308                 array_size -= sizeof(iv->offset_size);
4309                 offset = be16toh(iv->offset_size);
4310                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4311                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4312                 if (offset >= 0x1000)
4313                         goto fail;
4314                 if (bit32) {
4315                         if (array_size < sizeof(iv->data.d32))
4316                                 goto fail;
4317                         array_size -= sizeof(iv->data.d32);
4318                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4319                         iv = GET_NEXTIV32(iv);
4320                 } else {
4321
4322                         if (array_size < sizeof(iv->data.d16))
4323                                 goto fail;
4324                         array_size -= sizeof(iv->data.d16);
4325                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4326
4327                         iv = GET_NEXTIV16(iv);
4328                 }
4329         }
4330         if (array_size != 0)
4331                 goto fail;
4332         return (0);
4333 fail:
4334         device_printf(sc->sc_dev, "initvals: invalid format\n");
4335         return (EPROTO);
4336 #undef GET_NEXTIV16
4337 #undef GET_NEXTIV32
4338 }
4339
4340 int
4341 bwn_switch_channel(struct bwn_mac *mac, int chan)
4342 {
4343         struct bwn_phy *phy = &(mac->mac_phy);
4344         struct bwn_softc *sc = mac->mac_sc;
4345         struct ieee80211com *ic = &sc->sc_ic;
4346         uint16_t channelcookie, savedcookie;
4347         int error;
4348
4349         if (chan == 0xffff)
4350                 chan = phy->get_default_chan(mac);
4351
4352         channelcookie = chan;
4353         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4354                 channelcookie |= 0x100;
4355         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4356         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4357         error = phy->switch_channel(mac, chan);
4358         if (error)
4359                 goto fail;
4360
4361         mac->mac_phy.chan = chan;
4362         DELAY(8000);
4363         return (0);
4364 fail:
4365         device_printf(sc->sc_dev, "failed to switch channel\n");
4366         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4367         return (error);
4368 }
4369
4370 static uint16_t
4371 bwn_ant2phy(int antenna)
4372 {
4373
4374         switch (antenna) {
4375         case BWN_ANT0:
4376                 return (BWN_TX_PHY_ANT0);
4377         case BWN_ANT1:
4378                 return (BWN_TX_PHY_ANT1);
4379         case BWN_ANT2:
4380                 return (BWN_TX_PHY_ANT2);
4381         case BWN_ANT3:
4382                 return (BWN_TX_PHY_ANT3);
4383         case BWN_ANTAUTO:
4384                 return (BWN_TX_PHY_ANT01AUTO);
4385         }
4386         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4387         return (0);
4388 }
4389
4390 static void
4391 bwn_wme_load(struct bwn_mac *mac)
4392 {
4393         struct bwn_softc *sc = mac->mac_sc;
4394         int i;
4395
4396         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4397             ("%s:%d: fail", __func__, __LINE__));
4398
4399         bwn_mac_suspend(mac);
4400         for (i = 0; i < N(sc->sc_wmeParams); i++)
4401                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4402                     bwn_wme_shm_offsets[i]);
4403         bwn_mac_enable(mac);
4404 }
4405
4406 static void
4407 bwn_wme_loadparams(struct bwn_mac *mac,
4408     const struct wmeParams *p, uint16_t shm_offset)
4409 {
4410 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4411         struct bwn_softc *sc = mac->mac_sc;
4412         uint16_t params[BWN_NR_WMEPARAMS];
4413         int slot, tmp;
4414         unsigned int i;
4415
4416         slot = BWN_READ_2(mac, BWN_RNG) &
4417             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4418
4419         memset(&params, 0, sizeof(params));
4420
4421         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4422             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4423             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4424
4425         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4426         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4427         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4428         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4429         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4430         params[BWN_WMEPARAM_BSLOTS] = slot;
4431         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4432
4433         for (i = 0; i < N(params); i++) {
4434                 if (i == BWN_WMEPARAM_STATUS) {
4435                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4436                             shm_offset + (i * 2));
4437                         tmp |= 0x100;
4438                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4439                             tmp);
4440                 } else {
4441                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4442                             params[i]);
4443                 }
4444         }
4445 }
4446
4447 static void
4448 bwn_mac_write_bssid(struct bwn_mac *mac)
4449 {
4450         struct bwn_softc *sc = mac->mac_sc;
4451         uint32_t tmp;
4452         int i;
4453         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4454
4455         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4456         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4457         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4458             IEEE80211_ADDR_LEN);
4459
4460         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4461                 tmp = (uint32_t) (mac_bssid[i + 0]);
4462                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4463                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4464                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4465                 bwn_ram_write(mac, 0x20 + i, tmp);
4466         }
4467 }
4468
4469 static void
4470 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4471     const uint8_t *macaddr)
4472 {
4473         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4474         uint16_t data;
4475
4476         if (!mac)
4477                 macaddr = zero;
4478
4479         offset |= 0x0020;
4480         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4481
4482         data = macaddr[0];
4483         data |= macaddr[1] << 8;
4484         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4485         data = macaddr[2];
4486         data |= macaddr[3] << 8;
4487         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4488         data = macaddr[4];
4489         data |= macaddr[5] << 8;
4490         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4491 }
4492
4493 static void
4494 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4495     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4496 {
4497         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4498         uint8_t per_sta_keys_start = 8;
4499
4500         if (BWN_SEC_NEWAPI(mac))
4501                 per_sta_keys_start = 4;
4502
4503         KASSERT(index < mac->mac_max_nr_keys,
4504             ("%s:%d: fail", __func__, __LINE__));
4505         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4506             ("%s:%d: fail", __func__, __LINE__));
4507
4508         if (index >= per_sta_keys_start)
4509                 bwn_key_macwrite(mac, index, NULL);
4510         if (key)
4511                 memcpy(buf, key, key_len);
4512         bwn_key_write(mac, index, algorithm, buf);
4513         if (index >= per_sta_keys_start)
4514                 bwn_key_macwrite(mac, index, mac_addr);
4515
4516         mac->mac_key[index].algorithm = algorithm;
4517 }
4518
4519 static void
4520 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4521 {
4522         struct bwn_softc *sc = mac->mac_sc;
4523         uint32_t addrtmp[2] = { 0, 0 };
4524         uint8_t start = 8;
4525
4526         if (BWN_SEC_NEWAPI(mac))
4527                 start = 4;
4528
4529         KASSERT(index >= start,
4530             ("%s:%d: fail", __func__, __LINE__));
4531         index -= start;
4532
4533         if (addr) {
4534                 addrtmp[0] = addr[0];
4535                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4536                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4537                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4538                 addrtmp[1] = addr[4];
4539                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4540         }
4541
4542         if (siba_get_revid(sc->sc_dev) >= 5) {
4543                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4544                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4545         } else {
4546                 if (index >= 8) {
4547                         bwn_shm_write_4(mac, BWN_SHARED,
4548                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4549                         bwn_shm_write_2(mac, BWN_SHARED,
4550                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4551                 }
4552         }
4553 }
4554
4555 static void
4556 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4557     const uint8_t *key)
4558 {
4559         unsigned int i;
4560         uint32_t offset;
4561         uint16_t kidx, value;
4562
4563         kidx = BWN_SEC_KEY2FW(mac, index);
4564         bwn_shm_write_2(mac, BWN_SHARED,
4565             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4566
4567         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4568         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4569                 value = key[i];
4570                 value |= (uint16_t)(key[i + 1]) << 8;
4571                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4572         }
4573 }
4574
4575 static void
4576 bwn_phy_exit(struct bwn_mac *mac)
4577 {
4578
4579         mac->mac_phy.rf_onoff(mac, 0);
4580         if (mac->mac_phy.exit != NULL)
4581                 mac->mac_phy.exit(mac);
4582 }
4583
4584 static void
4585 bwn_dma_free(struct bwn_mac *mac)
4586 {
4587         struct bwn_dma *dma;
4588
4589         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4590                 return;
4591         dma = &mac->mac_method.dma;
4592
4593         bwn_dma_ringfree(&dma->rx);
4594         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4595         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4596         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4597         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4598         bwn_dma_ringfree(&dma->mcast);
4599 }
4600
4601 static void
4602 bwn_core_stop(struct bwn_mac *mac)
4603 {
4604         struct bwn_softc *sc = mac->mac_sc;
4605
4606         BWN_ASSERT_LOCKED(sc);
4607
4608         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4609                 return;
4610
4611         callout_stop(&sc->sc_rfswitch_ch);
4612         callout_stop(&sc->sc_task_ch);
4613         callout_stop(&sc->sc_watchdog_ch);
4614         sc->sc_watchdog_timer = 0;
4615         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4616         BWN_READ_4(mac, BWN_INTR_MASK);
4617         bwn_mac_suspend(mac);
4618
4619         mac->mac_status = BWN_MAC_STATUS_INITED;
4620 }
4621
4622 static int
4623 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4624 {
4625         struct bwn_mac *up_dev = NULL;
4626         struct bwn_mac *down_dev;
4627         struct bwn_mac *mac;
4628         int err, status;
4629         uint8_t gmode;
4630
4631         BWN_ASSERT_LOCKED(sc);
4632
4633         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4634                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4635                     mac->mac_phy.supports_2ghz) {
4636                         up_dev = mac;
4637                         gmode = 1;
4638                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4639                     mac->mac_phy.supports_5ghz) {
4640                         up_dev = mac;
4641                         gmode = 0;
4642                 } else {
4643                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4644                         return (EINVAL);
4645                 }
4646                 if (up_dev != NULL)
4647                         break;
4648         }
4649         if (up_dev == NULL) {
4650                 device_printf(sc->sc_dev, "Could not find a device\n");
4651                 return (ENODEV);
4652         }
4653         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4654                 return (0);
4655
4656         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4657             "switching to %s-GHz band\n",
4658             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4659
4660         down_dev = sc->sc_curmac;
4661         status = down_dev->mac_status;
4662         if (status >= BWN_MAC_STATUS_STARTED)
4663                 bwn_core_stop(down_dev);
4664         if (status >= BWN_MAC_STATUS_INITED)
4665                 bwn_core_exit(down_dev);
4666
4667         if (down_dev != up_dev)
4668                 bwn_phy_reset(down_dev);
4669
4670         up_dev->mac_phy.gmode = gmode;
4671         if (status >= BWN_MAC_STATUS_INITED) {
4672                 err = bwn_core_init(up_dev);
4673                 if (err) {
4674                         device_printf(sc->sc_dev,
4675                             "fatal: failed to initialize for %s-GHz\n",
4676                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4677                         goto fail;
4678                 }
4679         }
4680         if (status >= BWN_MAC_STATUS_STARTED)
4681                 bwn_core_start(up_dev);
4682         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4683         sc->sc_curmac = up_dev;
4684
4685         return (0);
4686 fail:
4687         sc->sc_curmac = NULL;
4688         return (err);
4689 }
4690
4691 static void
4692 bwn_rf_turnon(struct bwn_mac *mac)
4693 {
4694
4695         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4696
4697         bwn_mac_suspend(mac);
4698         mac->mac_phy.rf_onoff(mac, 1);
4699         mac->mac_phy.rf_on = 1;
4700         bwn_mac_enable(mac);
4701 }
4702
4703 static void
4704 bwn_rf_turnoff(struct bwn_mac *mac)
4705 {
4706
4707         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4708
4709         bwn_mac_suspend(mac);
4710         mac->mac_phy.rf_onoff(mac, 0);
4711         mac->mac_phy.rf_on = 0;
4712         bwn_mac_enable(mac);
4713 }
4714
4715 /*
4716  * SSB PHY reset.
4717  */
4718 static void
4719 bwn_phy_reset_siba(struct bwn_mac *mac)
4720 {
4721         struct bwn_softc *sc = mac->mac_sc;
4722
4723         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4724             ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4725              BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4726         DELAY(1000);
4727         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4728             (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4729         DELAY(1000);
4730 }
4731
4732 static void
4733 bwn_phy_reset(struct bwn_mac *mac)
4734 {
4735
4736         if (bwn_is_bus_siba(mac)) {
4737                 bwn_phy_reset_siba(mac);
4738         } else {
4739                 BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4740         }
4741 }
4742
4743 static int
4744 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4745 {
4746         struct bwn_vap *bvp = BWN_VAP(vap);
4747         struct ieee80211com *ic= vap->iv_ic;
4748         enum ieee80211_state ostate = vap->iv_state;
4749         struct bwn_softc *sc = ic->ic_softc;
4750         struct bwn_mac *mac = sc->sc_curmac;
4751         int error;
4752
4753         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4754             ieee80211_state_name[vap->iv_state],
4755             ieee80211_state_name[nstate]);
4756
4757         error = bvp->bv_newstate(vap, nstate, arg);
4758         if (error != 0)
4759                 return (error);
4760
4761         BWN_LOCK(sc);
4762
4763         bwn_led_newstate(mac, nstate);
4764
4765         /*
4766          * Clear the BSSID when we stop a STA
4767          */
4768         if (vap->iv_opmode == IEEE80211_M_STA) {
4769                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4770                         /*
4771                          * Clear out the BSSID.  If we reassociate to
4772                          * the same AP, this will reinialize things
4773                          * correctly...
4774                          */
4775                         if (ic->ic_opmode == IEEE80211_M_STA &&
4776                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4777                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4778                                 bwn_set_macaddr(mac);
4779                         }
4780                 }
4781         }
4782
4783         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4784             vap->iv_opmode == IEEE80211_M_AHDEMO) {
4785                 /* XXX nothing to do? */
4786         } else if (nstate == IEEE80211_S_RUN) {
4787                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4788                 bwn_set_opmode(mac);
4789                 bwn_set_pretbtt(mac);
4790                 bwn_spu_setdelay(mac, 0);
4791                 bwn_set_macaddr(mac);
4792         }
4793
4794         BWN_UNLOCK(sc);
4795
4796         return (error);
4797 }
4798
4799 static void
4800 bwn_set_pretbtt(struct bwn_mac *mac)
4801 {
4802         struct bwn_softc *sc = mac->mac_sc;
4803         struct ieee80211com *ic = &sc->sc_ic;
4804         uint16_t pretbtt;
4805
4806         if (ic->ic_opmode == IEEE80211_M_IBSS)
4807                 pretbtt = 2;
4808         else
4809                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4810         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4811         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4812 }
4813
4814 static int
4815 bwn_intr(void *arg)
4816 {
4817         struct bwn_mac *mac = arg;
4818         struct bwn_softc *sc = mac->mac_sc;
4819         uint32_t reason;
4820
4821         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4822             (sc->sc_flags & BWN_FLAG_INVALID))
4823                 return (FILTER_STRAY);
4824
4825         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4826
4827         reason = BWN_READ_4(mac, BWN_INTR_REASON);
4828         if (reason == 0xffffffff)       /* shared IRQ */
4829                 return (FILTER_STRAY);
4830         reason &= mac->mac_intr_mask;
4831         if (reason == 0)
4832                 return (FILTER_HANDLED);
4833         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4834
4835         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4836         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4837         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4838         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4839         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4840         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4841         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4842         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4843         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4844         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4845         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4846
4847         /* Disable interrupts. */
4848         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4849
4850         mac->mac_reason_intr = reason;
4851
4852         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4853         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4854
4855         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4856         return (FILTER_HANDLED);
4857 }
4858
4859 static void
4860 bwn_intrtask(void *arg, int npending)
4861 {
4862         struct bwn_mac *mac = arg;
4863         struct bwn_softc *sc = mac->mac_sc;
4864         uint32_t merged = 0;
4865         int i, tx = 0, rx = 0;
4866
4867         BWN_LOCK(sc);
4868         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4869             (sc->sc_flags & BWN_FLAG_INVALID)) {
4870                 BWN_UNLOCK(sc);
4871                 return;
4872         }
4873
4874         for (i = 0; i < N(mac->mac_reason); i++)
4875                 merged |= mac->mac_reason[i];
4876
4877         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4878                 device_printf(sc->sc_dev, "MAC trans error\n");
4879
4880         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4881                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4882                 mac->mac_phy.txerrors--;
4883                 if (mac->mac_phy.txerrors == 0) {
4884                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4885                         bwn_restart(mac, "PHY TX errors");
4886                 }
4887         }
4888
4889         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4890                 if (merged & BWN_DMAINTR_FATALMASK) {
4891                         device_printf(sc->sc_dev,
4892                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4893                             mac->mac_reason[0], mac->mac_reason[1],
4894                             mac->mac_reason[2], mac->mac_reason[3],
4895                             mac->mac_reason[4], mac->mac_reason[5]);
4896                         bwn_restart(mac, "DMA error");
4897                         BWN_UNLOCK(sc);
4898                         return;
4899                 }
4900                 if (merged & BWN_DMAINTR_NONFATALMASK) {
4901                         device_printf(sc->sc_dev,
4902                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
4903                             mac->mac_reason[0], mac->mac_reason[1],
4904                             mac->mac_reason[2], mac->mac_reason[3],
4905                             mac->mac_reason[4], mac->mac_reason[5]);
4906                 }
4907         }
4908
4909         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4910                 bwn_intr_ucode_debug(mac);
4911         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4912                 bwn_intr_tbtt_indication(mac);
4913         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4914                 bwn_intr_atim_end(mac);
4915         if (mac->mac_reason_intr & BWN_INTR_BEACON)
4916                 bwn_intr_beacon(mac);
4917         if (mac->mac_reason_intr & BWN_INTR_PMQ)
4918                 bwn_intr_pmq(mac);
4919         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4920                 bwn_intr_noise(mac);
4921
4922         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4923                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4924                         bwn_dma_rx(mac->mac_method.dma.rx);
4925                         rx = 1;
4926                 }
4927         } else
4928                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4929
4930         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4931         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4932         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4933         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4934         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4935
4936         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4937                 bwn_intr_txeof(mac);
4938                 tx = 1;
4939         }
4940
4941         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4942
4943         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4944                 int evt = BWN_LED_EVENT_NONE;
4945
4946                 if (tx && rx) {
4947                         if (sc->sc_rx_rate > sc->sc_tx_rate)
4948                                 evt = BWN_LED_EVENT_RX;
4949                         else
4950                                 evt = BWN_LED_EVENT_TX;
4951                 } else if (tx) {
4952                         evt = BWN_LED_EVENT_TX;
4953                 } else if (rx) {
4954                         evt = BWN_LED_EVENT_RX;
4955                 } else if (rx == 0) {
4956                         evt = BWN_LED_EVENT_POLL;
4957                 }
4958
4959                 if (evt != BWN_LED_EVENT_NONE)
4960                         bwn_led_event(mac, evt);
4961        }
4962
4963         if (mbufq_first(&sc->sc_snd) != NULL)
4964                 bwn_start(sc);
4965
4966         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4967         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4968
4969         BWN_UNLOCK(sc);
4970 }
4971
4972 static void
4973 bwn_restart(struct bwn_mac *mac, const char *msg)
4974 {
4975         struct bwn_softc *sc = mac->mac_sc;
4976         struct ieee80211com *ic = &sc->sc_ic;
4977
4978         if (mac->mac_status < BWN_MAC_STATUS_INITED)
4979                 return;
4980
4981         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4982         ieee80211_runtask(ic, &mac->mac_hwreset);
4983 }
4984
4985 static void
4986 bwn_intr_ucode_debug(struct bwn_mac *mac)
4987 {
4988         struct bwn_softc *sc = mac->mac_sc;
4989         uint16_t reason;
4990
4991         if (mac->mac_fw.opensource == 0)
4992                 return;
4993
4994         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4995         switch (reason) {
4996         case BWN_DEBUGINTR_PANIC:
4997                 bwn_handle_fwpanic(mac);
4998                 break;
4999         case BWN_DEBUGINTR_DUMP_SHM:
5000                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5001                 break;
5002         case BWN_DEBUGINTR_DUMP_REGS:
5003                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5004                 break;
5005         case BWN_DEBUGINTR_MARKER:
5006                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5007                 break;
5008         default:
5009                 device_printf(sc->sc_dev,
5010                     "ucode debug unknown reason: %#x\n", reason);
5011         }
5012
5013         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5014             BWN_DEBUGINTR_ACK);
5015 }
5016
5017 static void
5018 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5019 {
5020         struct bwn_softc *sc = mac->mac_sc;
5021         struct ieee80211com *ic = &sc->sc_ic;
5022
5023         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5024                 bwn_psctl(mac, 0);
5025         if (ic->ic_opmode == IEEE80211_M_IBSS)
5026                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5027 }
5028
5029 static void
5030 bwn_intr_atim_end(struct bwn_mac *mac)
5031 {
5032
5033         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5034                 BWN_WRITE_4(mac, BWN_MACCMD,
5035                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5036                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5037         }
5038 }
5039
5040 static void
5041 bwn_intr_beacon(struct bwn_mac *mac)
5042 {
5043         struct bwn_softc *sc = mac->mac_sc;
5044         struct ieee80211com *ic = &sc->sc_ic;
5045         uint32_t cmd, beacon0, beacon1;
5046
5047         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5048             ic->ic_opmode == IEEE80211_M_MBSS)
5049                 return;
5050
5051         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5052
5053         cmd = BWN_READ_4(mac, BWN_MACCMD);
5054         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5055         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5056
5057         if (beacon0 && beacon1) {
5058                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5059                 mac->mac_intr_mask |= BWN_INTR_BEACON;
5060                 return;
5061         }
5062
5063         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5064                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5065                 bwn_load_beacon0(mac);
5066                 bwn_load_beacon1(mac);
5067                 cmd = BWN_READ_4(mac, BWN_MACCMD);
5068                 cmd |= BWN_MACCMD_BEACON0_VALID;
5069                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5070         } else {
5071                 if (!beacon0) {
5072                         bwn_load_beacon0(mac);
5073                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5074                         cmd |= BWN_MACCMD_BEACON0_VALID;
5075                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5076                 } else if (!beacon1) {
5077                         bwn_load_beacon1(mac);
5078                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5079                         cmd |= BWN_MACCMD_BEACON1_VALID;
5080                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5081                 }
5082         }
5083 }
5084
5085 static void
5086 bwn_intr_pmq(struct bwn_mac *mac)
5087 {
5088         uint32_t tmp;
5089
5090         while (1) {
5091                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5092                 if (!(tmp & 0x00000008))
5093                         break;
5094         }
5095         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5096 }
5097
5098 static void
5099 bwn_intr_noise(struct bwn_mac *mac)
5100 {
5101         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5102         uint16_t tmp;
5103         uint8_t noise[4];
5104         uint8_t i, j;
5105         int32_t average;
5106
5107         if (mac->mac_phy.type != BWN_PHYTYPE_G)
5108                 return;
5109
5110         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5111         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5112         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5113             noise[3] == 0x7f)
5114                 goto new;
5115
5116         KASSERT(mac->mac_noise.noi_nsamples < 8,
5117             ("%s:%d: fail", __func__, __LINE__));
5118         i = mac->mac_noise.noi_nsamples;
5119         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5120         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5121         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5122         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5123         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5124         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5125         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5126         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5127         mac->mac_noise.noi_nsamples++;
5128         if (mac->mac_noise.noi_nsamples == 8) {
5129                 average = 0;
5130                 for (i = 0; i < 8; i++) {
5131                         for (j = 0; j < 4; j++)
5132                                 average += mac->mac_noise.noi_samples[i][j];
5133                 }
5134                 average = (((average / 32) * 125) + 64) / 128;
5135                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5136                 if (tmp >= 8)
5137                         average += 2;
5138                 else
5139                         average -= 25;
5140                 average -= (tmp == 8) ? 72 : 48;
5141
5142                 mac->mac_stats.link_noise = average;
5143                 mac->mac_noise.noi_running = 0;
5144                 return;
5145         }
5146 new:
5147         bwn_noise_gensample(mac);
5148 }
5149
5150 static int
5151 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5152 {
5153         struct bwn_mac *mac = prq->prq_mac;
5154         struct bwn_softc *sc = mac->mac_sc;
5155         unsigned int i;
5156
5157         BWN_ASSERT_LOCKED(sc);
5158
5159         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5160                 return (0);
5161
5162         for (i = 0; i < 5000; i++) {
5163                 if (bwn_pio_rxeof(prq) == 0)
5164                         break;
5165         }
5166         if (i >= 5000)
5167                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5168         return ((i > 0) ? 1 : 0);
5169 }
5170
5171 static void
5172 bwn_dma_rx(struct bwn_dma_ring *dr)
5173 {
5174         int slot, curslot;
5175
5176         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5177         curslot = dr->get_curslot(dr);
5178         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5179             ("%s:%d: fail", __func__, __LINE__));
5180
5181         slot = dr->dr_curslot;
5182         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5183                 bwn_dma_rxeof(dr, &slot);
5184
5185         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5186             BUS_DMASYNC_PREWRITE);
5187
5188         dr->set_curslot(dr, slot);
5189         dr->dr_curslot = slot;
5190 }
5191
5192 static void
5193 bwn_intr_txeof(struct bwn_mac *mac)
5194 {
5195         struct bwn_txstatus stat;
5196         uint32_t stat0, stat1;
5197         uint16_t tmp;
5198
5199         BWN_ASSERT_LOCKED(mac->mac_sc);
5200
5201         while (1) {
5202                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5203                 if (!(stat0 & 0x00000001))
5204                         break;
5205                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5206
5207                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5208                     "%s: stat0=0x%08x, stat1=0x%08x\n",
5209                     __func__,
5210                     stat0,
5211                     stat1);
5212
5213                 stat.cookie = (stat0 >> 16);
5214                 stat.seq = (stat1 & 0x0000ffff);
5215                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5216                 tmp = (stat0 & 0x0000ffff);
5217                 stat.framecnt = ((tmp & 0xf000) >> 12);
5218                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
5219                 stat.sreason = ((tmp & 0x001c) >> 2);
5220                 stat.pm = (tmp & 0x0080) ? 1 : 0;
5221                 stat.im = (tmp & 0x0040) ? 1 : 0;
5222                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5223                 stat.ack = (tmp & 0x0002) ? 1 : 0;
5224
5225                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5226                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5227                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5228                     __func__,
5229                     stat.cookie,
5230                     stat.seq,
5231                     stat.phy_stat,
5232                     stat.framecnt,
5233                     stat.rtscnt,
5234                     stat.sreason,
5235                     stat.pm,
5236                     stat.im,
5237                     stat.ampdu,
5238                     stat.ack);
5239
5240                 bwn_handle_txeof(mac, &stat);
5241         }
5242 }
5243
5244 static void
5245 bwn_hwreset(void *arg, int npending)
5246 {
5247         struct bwn_mac *mac = arg;
5248         struct bwn_softc *sc = mac->mac_sc;
5249         int error = 0;
5250         int prev_status;
5251
5252         BWN_LOCK(sc);
5253
5254         prev_status = mac->mac_status;
5255         if (prev_status >= BWN_MAC_STATUS_STARTED)
5256                 bwn_core_stop(mac);
5257         if (prev_status >= BWN_MAC_STATUS_INITED)
5258                 bwn_core_exit(mac);
5259
5260         if (prev_status >= BWN_MAC_STATUS_INITED) {
5261                 error = bwn_core_init(mac);
5262                 if (error)
5263                         goto out;
5264         }
5265         if (prev_status >= BWN_MAC_STATUS_STARTED)
5266                 bwn_core_start(mac);
5267 out:
5268         if (error) {
5269                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5270                 sc->sc_curmac = NULL;
5271         }
5272         BWN_UNLOCK(sc);
5273 }
5274
5275 static void
5276 bwn_handle_fwpanic(struct bwn_mac *mac)
5277 {
5278         struct bwn_softc *sc = mac->mac_sc;
5279         uint16_t reason;
5280
5281         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5282         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5283
5284         if (reason == BWN_FWPANIC_RESTART)
5285                 bwn_restart(mac, "ucode panic");
5286 }
5287
5288 static void
5289 bwn_load_beacon0(struct bwn_mac *mac)
5290 {
5291
5292         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5293 }
5294
5295 static void
5296 bwn_load_beacon1(struct bwn_mac *mac)
5297 {
5298
5299         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5300 }
5301
5302 static uint32_t
5303 bwn_jssi_read(struct bwn_mac *mac)
5304 {
5305         uint32_t val = 0;
5306
5307         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5308         val <<= 16;
5309         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5310
5311         return (val);
5312 }
5313
5314 static void
5315 bwn_noise_gensample(struct bwn_mac *mac)
5316 {
5317         uint32_t jssi = 0x7f7f7f7f;
5318
5319         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5320         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5321         BWN_WRITE_4(mac, BWN_MACCMD,
5322             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5323 }
5324
5325 static int
5326 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5327 {
5328         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5329
5330         return (dr->dr_numslots - dr->dr_usedslot);
5331 }
5332
5333 static int
5334 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5335 {
5336         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5337
5338         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5339             ("%s:%d: fail", __func__, __LINE__));
5340         if (slot == dr->dr_numslots - 1)
5341                 return (0);
5342         return (slot + 1);
5343 }
5344
5345 static void
5346 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5347 {
5348         struct bwn_mac *mac = dr->dr_mac;
5349         struct bwn_softc *sc = mac->mac_sc;
5350         struct bwn_dma *dma = &mac->mac_method.dma;
5351         struct bwn_dmadesc_generic *desc;
5352         struct bwn_dmadesc_meta *meta;
5353         struct bwn_rxhdr4 *rxhdr;
5354         struct mbuf *m;
5355         uint32_t macstat;
5356         int32_t tmp;
5357         int cnt = 0;
5358         uint16_t len;
5359
5360         dr->getdesc(dr, *slot, &desc, &meta);
5361
5362         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5363         m = meta->mt_m;
5364
5365         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5366                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5367                 return;
5368         }
5369
5370         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5371         len = le16toh(rxhdr->frame_len);
5372         if (len <= 0) {
5373                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5374                 return;
5375         }
5376         if (bwn_dma_check_redzone(dr, m)) {
5377                 device_printf(sc->sc_dev, "redzone error.\n");
5378                 bwn_dma_set_redzone(dr, m);
5379                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5380                     BUS_DMASYNC_PREWRITE);
5381                 return;
5382         }
5383         if (len > dr->dr_rx_bufsize) {
5384                 tmp = len;
5385                 while (1) {
5386                         dr->getdesc(dr, *slot, &desc, &meta);
5387                         bwn_dma_set_redzone(dr, meta->mt_m);
5388                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5389                             BUS_DMASYNC_PREWRITE);
5390                         *slot = bwn_dma_nextslot(dr, *slot);
5391                         cnt++;
5392                         tmp -= dr->dr_rx_bufsize;
5393                         if (tmp <= 0)
5394                                 break;
5395                 }
5396                 device_printf(sc->sc_dev, "too small buffer "
5397                        "(len %u buffer %u dropped %d)\n",
5398                        len, dr->dr_rx_bufsize, cnt);
5399                 return;
5400         }
5401
5402         switch (mac->mac_fw.fw_hdr_format) {
5403         case BWN_FW_HDR_351:
5404         case BWN_FW_HDR_410:
5405                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5406                 break;
5407         case BWN_FW_HDR_598:
5408                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5409                 break;
5410         }
5411
5412         if (macstat & BWN_RX_MAC_FCSERR) {
5413                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5414                         device_printf(sc->sc_dev, "RX drop\n");
5415                         return;
5416                 }
5417         }
5418
5419         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5420         m_adj(m, dr->dr_frameoffset);
5421
5422         bwn_rxeof(dr->dr_mac, m, rxhdr);
5423 }
5424
5425 static void
5426 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5427 {
5428         struct bwn_softc *sc = mac->mac_sc;
5429         struct bwn_stats *stats = &mac->mac_stats;
5430
5431         BWN_ASSERT_LOCKED(mac->mac_sc);
5432
5433         if (status->im)
5434                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5435         if (status->ampdu)
5436                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5437         if (status->rtscnt) {
5438                 if (status->rtscnt == 0xf)
5439                         stats->rtsfail++;
5440                 else
5441                         stats->rts++;
5442         }
5443
5444         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5445                 bwn_dma_handle_txeof(mac, status);
5446         } else {
5447                 bwn_pio_handle_txeof(mac, status);
5448         }
5449
5450         bwn_phy_txpower_check(mac, 0);
5451 }
5452
5453 static uint8_t
5454 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5455 {
5456         struct bwn_mac *mac = prq->prq_mac;
5457         struct bwn_softc *sc = mac->mac_sc;
5458         struct bwn_rxhdr4 rxhdr;
5459         struct mbuf *m;
5460         uint32_t ctl32, macstat, v32;
5461         unsigned int i, padding;
5462         uint16_t ctl16, len, totlen, v16;
5463         unsigned char *mp;
5464         char *data;
5465
5466         memset(&rxhdr, 0, sizeof(rxhdr));
5467
5468         if (prq->prq_rev >= 8) {
5469                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5470                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5471                         return (0);
5472                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5473                     BWN_PIO8_RXCTL_FRAMEREADY);
5474                 for (i = 0; i < 10; i++) {
5475                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5476                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5477                                 goto ready;
5478                         DELAY(10);
5479                 }
5480         } else {
5481                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5482                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5483                         return (0);
5484                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5485                     BWN_PIO_RXCTL_FRAMEREADY);
5486                 for (i = 0; i < 10; i++) {
5487                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5488                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5489                                 goto ready;
5490                         DELAY(10);
5491                 }
5492         }
5493         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5494         return (1);
5495 ready:
5496         if (prq->prq_rev >= 8)
5497                 siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5498                     prq->prq_base + BWN_PIO8_RXDATA);
5499         else
5500                 siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5501                     prq->prq_base + BWN_PIO_RXDATA);
5502         len = le16toh(rxhdr.frame_len);
5503         if (len > 0x700) {
5504                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5505                 goto error;
5506         }
5507         if (len == 0) {
5508                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5509                 goto error;
5510         }
5511
5512         switch (mac->mac_fw.fw_hdr_format) {
5513         case BWN_FW_HDR_351:
5514         case BWN_FW_HDR_410:
5515                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
5516                 break;
5517         case BWN_FW_HDR_598:
5518                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
5519                 break;
5520         }
5521
5522         if (macstat & BWN_RX_MAC_FCSERR) {
5523                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5524                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5525                         goto error;
5526                 }
5527         }
5528
5529         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5530         totlen = len + padding;
5531         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5532         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5533         if (m == NULL) {
5534                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5535                 goto error;
5536         }
5537         mp = mtod(m, unsigned char *);
5538         if (prq->prq_rev >= 8) {
5539                 siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5540                     prq->prq_base + BWN_PIO8_RXDATA);
5541                 if (totlen & 3) {
5542                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5543                         data = &(mp[totlen - 1]);
5544                         switch (totlen & 3) {
5545                         case 3:
5546                                 *data = (v32 >> 16);
5547                                 data--;
5548                         case 2:
5549                                 *data = (v32 >> 8);
5550                                 data--;
5551                         case 1:
5552                                 *data = v32;
5553                         }
5554                 }
5555         } else {
5556                 siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5557                     prq->prq_base + BWN_PIO_RXDATA);
5558                 if (totlen & 1) {
5559                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5560                         mp[totlen - 1] = v16;
5561                 }
5562         }
5563
5564         m->m_len = m->m_pkthdr.len = totlen;
5565
5566         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5567
5568         return (1);
5569 error:
5570         if (prq->prq_rev >= 8)
5571                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5572                     BWN_PIO8_RXCTL_DATAREADY);
5573         else
5574                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5575         return (1);
5576 }
5577
5578 static int
5579 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5580     struct bwn_dmadesc_meta *meta, int init)
5581 {
5582         struct bwn_mac *mac = dr->dr_mac;
5583         struct bwn_dma *dma = &mac->mac_method.dma;
5584         struct bwn_rxhdr4 *hdr;
5585         bus_dmamap_t map;
5586         bus_addr_t paddr;
5587         struct mbuf *m;
5588         int error;
5589
5590         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5591         if (m == NULL) {
5592                 error = ENOBUFS;
5593
5594                 /*
5595                  * If the NIC is up and running, we need to:
5596                  * - Clear RX buffer's header.
5597                  * - Restore RX descriptor settings.
5598                  */
5599                 if (init)
5600                         return (error);
5601                 else
5602                         goto back;
5603         }
5604         m->m_len = m->m_pkthdr.len = MCLBYTES;
5605
5606         bwn_dma_set_redzone(dr, m);
5607
5608         /*
5609          * Try to load RX buf into temporary DMA map
5610          */
5611         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5612             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5613         if (error) {
5614                 m_freem(m);
5615
5616                 /*
5617                  * See the comment above
5618                  */
5619                 if (init)
5620                         return (error);
5621                 else
5622                         goto back;
5623         }
5624
5625         if (!init)
5626                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5627         meta->mt_m = m;
5628         meta->mt_paddr = paddr;
5629
5630         /*
5631          * Swap RX buf's DMA map with the loaded temporary one
5632          */
5633         map = meta->mt_dmap;
5634         meta->mt_dmap = dr->dr_spare_dmap;
5635         dr->dr_spare_dmap = map;
5636
5637 back:
5638         /*
5639          * Clear RX buf header
5640          */
5641         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5642         bzero(hdr, sizeof(*hdr));
5643         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5644             BUS_DMASYNC_PREWRITE);
5645
5646         /*
5647          * Setup RX buf descriptor
5648          */
5649         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5650             sizeof(*hdr), 0, 0, 0);
5651         return (error);
5652 }
5653
5654 static void
5655 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5656                  bus_size_t mapsz __unused, int error)
5657 {
5658
5659         if (!error) {
5660                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5661                 *((bus_addr_t *)arg) = seg->ds_addr;
5662         }
5663 }
5664
5665 static int
5666 bwn_hwrate2ieeerate(int rate)
5667 {
5668
5669         switch (rate) {
5670         case BWN_CCK_RATE_1MB:
5671                 return (2);
5672         case BWN_CCK_RATE_2MB:
5673                 return (4);
5674         case BWN_CCK_RATE_5MB:
5675                 return (11);
5676         case BWN_CCK_RATE_11MB:
5677                 return (22);
5678         case BWN_OFDM_RATE_6MB:
5679                 return (12);
5680         case BWN_OFDM_RATE_9MB:
5681                 return (18);
5682         case BWN_OFDM_RATE_12MB:
5683                 return (24);
5684         case BWN_OFDM_RATE_18MB:
5685                 return (36);
5686         case BWN_OFDM_RATE_24MB:
5687                 return (48);
5688         case BWN_OFDM_RATE_36MB:
5689                 return (72);
5690         case BWN_OFDM_RATE_48MB:
5691                 return (96);
5692         case BWN_OFDM_RATE_54MB:
5693                 return (108);
5694         default:
5695                 printf("Ooops\n");
5696                 return (0);
5697         }
5698 }
5699
5700 /*
5701  * Post process the RX provided RSSI.
5702  *
5703  * Valid for A, B, G, LP PHYs.
5704  */
5705 static int8_t
5706 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5707     int ofdm, int adjust_2053, int adjust_2050)
5708 {
5709         struct bwn_phy *phy = &mac->mac_phy;
5710         struct bwn_phy_g *gphy = &phy->phy_g;
5711         int tmp;
5712
5713         switch (phy->rf_ver) {
5714         case 0x2050:
5715                 if (ofdm) {
5716                         tmp = in_rssi;
5717                         if (tmp > 127)
5718                                 tmp -= 256;
5719                         tmp = tmp * 73 / 64;
5720                         if (adjust_2050)
5721                                 tmp += 25;
5722                         else
5723                                 tmp -= 3;
5724                 } else {
5725                         if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5726                             & BWN_BFL_RSSI) {
5727                                 if (in_rssi > 63)
5728                                         in_rssi = 63;
5729                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5730                                 tmp = (31 - tmp) * -131 / 128 - 57;
5731                         } else {
5732                                 tmp = in_rssi;
5733                                 tmp = (31 - tmp) * -149 / 128 - 68;
5734                         }
5735                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5736                                 tmp += 25;
5737                 }
5738                 break;
5739         case 0x2060:
5740                 if (in_rssi > 127)
5741                         tmp = in_rssi - 256;
5742                 else
5743                         tmp = in_rssi;
5744                 break;
5745         default:
5746                 tmp = in_rssi;
5747                 tmp = (tmp - 11) * 103 / 64;
5748                 if (adjust_2053)
5749                         tmp -= 109;
5750                 else
5751                         tmp -= 83;
5752         }
5753
5754         return (tmp);
5755 }
5756
5757 static void
5758 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5759 {
5760         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5761         struct bwn_plcp6 *plcp;
5762         struct bwn_softc *sc = mac->mac_sc;
5763         struct ieee80211_frame_min *wh;
5764         struct ieee80211_node *ni;
5765         struct ieee80211com *ic = &sc->sc_ic;
5766         uint32_t macstat;
5767         int padding, rate, rssi = 0, noise = 0, type;
5768         uint16_t phytype, phystat0, phystat3, chanstat;
5769         unsigned char *mp = mtod(m, unsigned char *);
5770         static int rx_mac_dec_rpt = 0;
5771
5772         BWN_ASSERT_LOCKED(sc);
5773
5774         phystat0 = le16toh(rxhdr->phy_status0);
5775
5776         /*
5777          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5778          * used for LP-PHY.
5779          */
5780         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5781
5782         switch (mac->mac_fw.fw_hdr_format) {
5783         case BWN_FW_HDR_351:
5784         case BWN_FW_HDR_410:
5785                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5786                 chanstat = le16toh(rxhdr->ps4.r351.channel);
5787                 break;
5788         case BWN_FW_HDR_598:
5789                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5790                 chanstat = le16toh(rxhdr->ps4.r598.channel);
5791                 break;
5792         }
5793
5794
5795         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5796
5797         if (macstat & BWN_RX_MAC_FCSERR)
5798                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5799         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5800                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5801         if (macstat & BWN_RX_MAC_DECERR)
5802                 goto drop;
5803
5804         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5805         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5806                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5807                     m->m_pkthdr.len);
5808                 goto drop;
5809         }
5810         plcp = (struct bwn_plcp6 *)(mp + padding);
5811         m_adj(m, sizeof(struct bwn_plcp6) + padding);
5812         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5813                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5814                     m->m_pkthdr.len);
5815                 goto drop;
5816         }
5817         wh = mtod(m, struct ieee80211_frame_min *);
5818
5819         if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5820                 device_printf(sc->sc_dev,
5821                     "RX decryption attempted (old %d keyidx %#x)\n",
5822                     BWN_ISOLDFMT(mac),
5823                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5824
5825         if (phystat0 & BWN_RX_PHYST0_OFDM)
5826                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
5827                     phytype == BWN_PHYTYPE_A);
5828         else
5829                 rate = bwn_plcp_get_cckrate(mac, plcp);
5830         if (rate == -1) {
5831                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5832                         goto drop;
5833         }
5834         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5835
5836         /* rssi/noise */
5837         switch (phytype) {
5838         case BWN_PHYTYPE_A:
5839         case BWN_PHYTYPE_B:
5840         case BWN_PHYTYPE_G:
5841         case BWN_PHYTYPE_LP:
5842                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5843                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
5844                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5845                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5846                 break;
5847         case BWN_PHYTYPE_N:
5848                 /* Broadcom has code for min/avg, but always used max */
5849                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5850                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5851                 else
5852                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5853 #if 0
5854                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5855                     "%s: power0=%d, power1=%d, power2=%d\n",
5856                     __func__,
5857                     rxhdr->phy.n.power0,
5858                     rxhdr->phy.n.power1,
5859                     rxhdr->ps2.n.power2);
5860 #endif
5861                 break;
5862         default:
5863                 /* XXX TODO: implement rssi for other PHYs */
5864                 break;
5865         }
5866
5867         /*
5868          * RSSI here is absolute, not relative to the noise floor.
5869          */
5870         noise = mac->mac_stats.link_noise;
5871         rssi = rssi - noise;
5872
5873         /* RX radio tap */
5874         if (ieee80211_radiotap_active(ic))
5875                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5876         m_adj(m, -IEEE80211_CRC_LEN);
5877
5878         BWN_UNLOCK(sc);
5879
5880         ni = ieee80211_find_rxnode(ic, wh);
5881         if (ni != NULL) {
5882                 type = ieee80211_input(ni, m, rssi, noise);
5883                 ieee80211_free_node(ni);
5884         } else
5885                 type = ieee80211_input_all(ic, m, rssi, noise);
5886
5887         BWN_LOCK(sc);
5888         return;
5889 drop:
5890         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5891 }
5892
5893 static void
5894 bwn_dma_handle_txeof(struct bwn_mac *mac,
5895     const struct bwn_txstatus *status)
5896 {
5897         struct bwn_dma *dma = &mac->mac_method.dma;
5898         struct bwn_dma_ring *dr;
5899         struct bwn_dmadesc_generic *desc;
5900         struct bwn_dmadesc_meta *meta;
5901         struct bwn_softc *sc = mac->mac_sc;
5902         int slot;
5903         int retrycnt = 0;
5904
5905         BWN_ASSERT_LOCKED(sc);
5906
5907         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5908         if (dr == NULL) {
5909                 device_printf(sc->sc_dev, "failed to parse cookie\n");
5910                 return;
5911         }
5912         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5913
5914         while (1) {
5915                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
5916                     ("%s:%d: fail", __func__, __LINE__));
5917                 dr->getdesc(dr, slot, &desc, &meta);
5918
5919                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5920                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5921                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5922                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5923
5924                 if (meta->mt_islast) {
5925                         KASSERT(meta->mt_m != NULL,
5926                             ("%s:%d: fail", __func__, __LINE__));
5927
5928                         /*
5929                          * If we don't get an ACK, then we should log the
5930                          * full framecnt.  That may be 0 if it's a PHY
5931                          * failure, so ensure that gets logged as some
5932                          * retry attempt.
5933                          */
5934                         if (status->ack) {
5935                                 retrycnt = status->framecnt - 1;
5936                         } else {
5937                                 retrycnt = status->framecnt;
5938                                 if (retrycnt == 0)
5939                                         retrycnt = 1;
5940                         }
5941                         ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5942                             status->ack ?
5943                               IEEE80211_RATECTL_TX_SUCCESS :
5944                               IEEE80211_RATECTL_TX_FAILURE,
5945                             &retrycnt, 0);
5946                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5947                         meta->mt_ni = NULL;
5948                         meta->mt_m = NULL;
5949                 } else
5950                         KASSERT(meta->mt_m == NULL,
5951                             ("%s:%d: fail", __func__, __LINE__));
5952
5953                 dr->dr_usedslot--;
5954                 if (meta->mt_islast)
5955                         break;
5956                 slot = bwn_dma_nextslot(dr, slot);
5957         }
5958         sc->sc_watchdog_timer = 0;
5959         if (dr->dr_stop) {
5960                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5961                     ("%s:%d: fail", __func__, __LINE__));
5962                 dr->dr_stop = 0;
5963         }
5964 }
5965
5966 static void
5967 bwn_pio_handle_txeof(struct bwn_mac *mac,
5968     const struct bwn_txstatus *status)
5969 {
5970         struct bwn_pio_txqueue *tq;
5971         struct bwn_pio_txpkt *tp = NULL;
5972         struct bwn_softc *sc = mac->mac_sc;
5973         int retrycnt = 0;
5974
5975         BWN_ASSERT_LOCKED(sc);
5976
5977         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5978         if (tq == NULL)
5979                 return;
5980
5981         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5982         tq->tq_free++;
5983
5984         if (tp->tp_ni != NULL) {
5985                 /*
5986                  * Do any tx complete callback.  Note this must
5987                  * be done before releasing the node reference.
5988                  */
5989
5990                 /*
5991                  * If we don't get an ACK, then we should log the
5992                  * full framecnt.  That may be 0 if it's a PHY
5993                  * failure, so ensure that gets logged as some
5994                  * retry attempt.
5995                  */
5996                 if (status->ack) {
5997                         retrycnt = status->framecnt - 1;
5998                 } else {
5999                         retrycnt = status->framecnt;
6000                         if (retrycnt == 0)
6001                                 retrycnt = 1;
6002                 }
6003                 ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6004                     status->ack ?
6005                       IEEE80211_RATECTL_TX_SUCCESS :
6006                       IEEE80211_RATECTL_TX_FAILURE,
6007                     &retrycnt, 0);
6008
6009                 if (tp->tp_m->m_flags & M_TXCB)
6010                         ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6011                 ieee80211_free_node(tp->tp_ni);
6012                 tp->tp_ni = NULL;
6013         }
6014         m_freem(tp->tp_m);
6015         tp->tp_m = NULL;
6016         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6017
6018         sc->sc_watchdog_timer = 0;
6019 }
6020
6021 static void
6022 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6023 {
6024         struct bwn_softc *sc = mac->mac_sc;
6025         struct bwn_phy *phy = &mac->mac_phy;
6026         struct ieee80211com *ic = &sc->sc_ic;
6027         unsigned long now;
6028         bwn_txpwr_result_t result;
6029
6030         BWN_GETTIME(now);
6031
6032         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6033                 return;
6034         phy->nexttime = now + 2 * 1000;
6035
6036         if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6037             siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6038                 return;
6039
6040         if (phy->recalc_txpwr != NULL) {
6041                 result = phy->recalc_txpwr(mac,
6042                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6043                 if (result == BWN_TXPWR_RES_DONE)
6044                         return;
6045                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6046                     ("%s: fail", __func__));
6047                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6048
6049                 ieee80211_runtask(ic, &mac->mac_txpower);
6050         }
6051 }
6052
6053 static uint16_t
6054 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6055 {
6056
6057         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6058 }
6059
6060 static uint32_t
6061 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6062 {
6063
6064         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6065 }
6066
6067 static void
6068 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6069 {
6070
6071         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6072 }
6073
6074 static void
6075 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6076 {
6077
6078         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6079 }
6080
6081 static int
6082 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6083 {
6084
6085         switch (rate) {
6086         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6087         case 12:
6088                 return (BWN_OFDM_RATE_6MB);
6089         case 18:
6090                 return (BWN_OFDM_RATE_9MB);
6091         case 24:
6092                 return (BWN_OFDM_RATE_12MB);
6093         case 36:
6094                 return (BWN_OFDM_RATE_18MB);
6095         case 48:
6096                 return (BWN_OFDM_RATE_24MB);
6097         case 72:
6098                 return (BWN_OFDM_RATE_36MB);
6099         case 96:
6100                 return (BWN_OFDM_RATE_48MB);
6101         case 108:
6102                 return (BWN_OFDM_RATE_54MB);
6103         /* CCK rates (NB: not IEEE std, device-specific) */
6104         case 2:
6105                 return (BWN_CCK_RATE_1MB);
6106         case 4:
6107                 return (BWN_CCK_RATE_2MB);
6108         case 11:
6109                 return (BWN_CCK_RATE_5MB);
6110         case 22:
6111                 return (BWN_CCK_RATE_11MB);
6112         }
6113
6114         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6115         return (BWN_CCK_RATE_1MB);
6116 }
6117
6118 static uint16_t
6119 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6120 {
6121         struct bwn_phy *phy = &mac->mac_phy;
6122         uint16_t control = 0;
6123         uint16_t bw;
6124
6125         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6126         bw = BWN_TXH_PHY1_BW_20;
6127
6128         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6129                 control = bw;
6130         } else {
6131                 control = bw;
6132                 /* Figure out coding rate and modulation */
6133                 /* XXX TODO: table-ize, for MCS transmit */
6134                 /* Note: this is BWN_*_RATE values */
6135                 switch (bitrate) {
6136                 case BWN_CCK_RATE_1MB:
6137                         control |= 0;
6138                         break;
6139                 case BWN_CCK_RATE_2MB:
6140                         control |= 1;
6141                         break;
6142                 case BWN_CCK_RATE_5MB:
6143                         control |= 2;
6144                         break;
6145                 case BWN_CCK_RATE_11MB:
6146                         control |= 3;
6147                         break;
6148                 case BWN_OFDM_RATE_6MB:
6149                         control |= BWN_TXH_PHY1_CRATE_1_2;
6150                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6151                         break;
6152                 case BWN_OFDM_RATE_9MB:
6153                         control |= BWN_TXH_PHY1_CRATE_3_4;
6154                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6155                         break;
6156                 case BWN_OFDM_RATE_12MB:
6157                         control |= BWN_TXH_PHY1_CRATE_1_2;
6158                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6159                         break;
6160                 case BWN_OFDM_RATE_18MB:
6161                         control |= BWN_TXH_PHY1_CRATE_3_4;
6162                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6163                         break;
6164                 case BWN_OFDM_RATE_24MB:
6165                         control |= BWN_TXH_PHY1_CRATE_1_2;
6166                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6167                         break;
6168                 case BWN_OFDM_RATE_36MB:
6169                         control |= BWN_TXH_PHY1_CRATE_3_4;
6170                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6171                         break;
6172                 case BWN_OFDM_RATE_48MB:
6173                         control |= BWN_TXH_PHY1_CRATE_1_2;
6174                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6175                         break;
6176                 case BWN_OFDM_RATE_54MB:
6177                         control |= BWN_TXH_PHY1_CRATE_3_4;
6178                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6179                         break;
6180                 default:
6181                         break;
6182                 }
6183                 control |= BWN_TXH_PHY1_MODE_SISO;
6184         }
6185
6186         return control;
6187 }
6188
6189 static int
6190 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6191     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6192 {
6193         const struct bwn_phy *phy = &mac->mac_phy;
6194         struct bwn_softc *sc = mac->mac_sc;
6195         struct ieee80211_frame *wh;
6196         struct ieee80211_frame *protwh;
6197         struct ieee80211_frame_cts *cts;
6198         struct ieee80211_frame_rts *rts;
6199         const struct ieee80211_txparam *tp;
6200         struct ieee80211vap *vap = ni->ni_vap;
6201         struct ieee80211com *ic = &sc->sc_ic;
6202         struct mbuf *mprot;
6203         unsigned int len;
6204         uint32_t macctl = 0;
6205         int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6206         uint16_t phyctl = 0;
6207         uint8_t rate, rate_fb;
6208         int fill_phy_ctl1 = 0;
6209
6210         wh = mtod(m, struct ieee80211_frame *);
6211         memset(txhdr, 0, sizeof(*txhdr));
6212
6213         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6214         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6215         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6216
6217         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6218             || (phy->type == BWN_PHYTYPE_HT))
6219                 fill_phy_ctl1 = 1;
6220
6221         /*
6222          * Find TX rate
6223          */
6224         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6225         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6226                 rate = rate_fb = tp->mgmtrate;
6227         else if (ismcast)
6228                 rate = rate_fb = tp->mcastrate;
6229         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6230                 rate = rate_fb = tp->ucastrate;
6231         else {
6232                 /* XXX TODO: don't fall back to CCK rates for OFDM */
6233                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
6234                 rate = ni->ni_txrate;
6235
6236                 if (rix > 0)
6237                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6238                             IEEE80211_RATE_VAL;
6239                 else
6240                         rate_fb = rate;
6241         }
6242
6243         sc->sc_tx_rate = rate;
6244
6245         /* Note: this maps the select ieee80211 rate to hardware rate */
6246         rate = bwn_ieeerate2hwrate(sc, rate);
6247         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6248
6249         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6250             bwn_plcp_getcck(rate);
6251         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6252         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6253
6254         /* XXX rate/rate_fb is the hardware rate */
6255         if ((rate_fb == rate) ||
6256             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6257             (*(u_int16_t *)wh->i_dur == htole16(0)))
6258                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6259         else
6260                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6261                     m->m_pkthdr.len, rate, isshort);
6262
6263         /* XXX TX encryption */
6264
6265         switch (mac->mac_fw.fw_hdr_format) {
6266         case BWN_FW_HDR_351:
6267                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6268                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6269                 break;
6270         case BWN_FW_HDR_410:
6271                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6272                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6273                 break;
6274         case BWN_FW_HDR_598:
6275                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6276                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6277                 break;
6278         }
6279
6280         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6281             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6282
6283         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6284             BWN_TX_EFT_FB_CCK;
6285         txhdr->chan = phy->chan;
6286         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6287             BWN_TX_PHY_ENC_CCK;
6288         /* XXX preamble? obey net80211 */
6289         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6290              rate == BWN_CCK_RATE_11MB))
6291                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
6292
6293         if (! phy->gmode)
6294                 macctl |= BWN_TX_MAC_5GHZ;
6295
6296         /* XXX TX antenna selection */
6297
6298         switch (bwn_antenna_sanitize(mac, 0)) {
6299         case 0:
6300                 phyctl |= BWN_TX_PHY_ANT01AUTO;
6301                 break;
6302         case 1:
6303                 phyctl |= BWN_TX_PHY_ANT0;
6304                 break;
6305         case 2:
6306                 phyctl |= BWN_TX_PHY_ANT1;
6307                 break;
6308         case 3:
6309                 phyctl |= BWN_TX_PHY_ANT2;
6310                 break;
6311         case 4:
6312                 phyctl |= BWN_TX_PHY_ANT3;
6313                 break;
6314         default:
6315                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6316         }
6317
6318         if (!ismcast)
6319                 macctl |= BWN_TX_MAC_ACK;
6320
6321         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6322         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6323             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6324                 macctl |= BWN_TX_MAC_LONGFRAME;
6325
6326         if (ic->ic_flags & IEEE80211_F_USEPROT) {
6327                 /* XXX RTS rate is always 1MB??? */
6328                 /* XXX TODO: don't fall back to CCK rates for OFDM */
6329                 rts_rate = BWN_CCK_RATE_1MB;
6330                 rts_rate_fb = bwn_get_fbrate(rts_rate);
6331
6332                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
6333                 protdur = ieee80211_compute_duration(ic->ic_rt,
6334                     m->m_pkthdr.len, rate, isshort) +
6335                     + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6336
6337                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6338
6339                         switch (mac->mac_fw.fw_hdr_format) {
6340                         case BWN_FW_HDR_351:
6341                                 cts = (struct ieee80211_frame_cts *)
6342                                     txhdr->body.r351.rts_frame;
6343                                 break;
6344                         case BWN_FW_HDR_410:
6345                                 cts = (struct ieee80211_frame_cts *)
6346                                     txhdr->body.r410.rts_frame;
6347                                 break;
6348                         case BWN_FW_HDR_598:
6349                                 cts = (struct ieee80211_frame_cts *)
6350                                     txhdr->body.r598.rts_frame;
6351                                 break;
6352                         }
6353
6354                         mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6355                             protdur);
6356                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6357                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6358                             mprot->m_pkthdr.len);
6359                         m_freem(mprot);
6360                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6361                         len = sizeof(struct ieee80211_frame_cts);
6362                 } else {
6363                         switch (mac->mac_fw.fw_hdr_format) {
6364                         case BWN_FW_HDR_351:
6365                                 rts = (struct ieee80211_frame_rts *)
6366                                     txhdr->body.r351.rts_frame;
6367                                 break;
6368                         case BWN_FW_HDR_410:
6369                                 rts = (struct ieee80211_frame_rts *)
6370                                     txhdr->body.r410.rts_frame;
6371                                 break;
6372                         case BWN_FW_HDR_598:
6373                                 rts = (struct ieee80211_frame_rts *)
6374                                     txhdr->body.r598.rts_frame;
6375                                 break;
6376                         }
6377
6378                         /* XXX rate/rate_fb is the hardware rate */
6379                         protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6380                             isshort);
6381                         mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6382                             wh->i_addr2, protdur);
6383                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6384                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6385                             mprot->m_pkthdr.len);
6386                         m_freem(mprot);
6387                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
6388                         len = sizeof(struct ieee80211_frame_rts);
6389                 }
6390                 len += IEEE80211_CRC_LEN;
6391
6392                 switch (mac->mac_fw.fw_hdr_format) {
6393                 case BWN_FW_HDR_351:
6394                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6395                             &txhdr->body.r351.rts_plcp, len, rts_rate);
6396                         break;
6397                 case BWN_FW_HDR_410:
6398                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6399                             &txhdr->body.r410.rts_plcp, len, rts_rate);
6400                         break;
6401                 case BWN_FW_HDR_598:
6402                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6403                             &txhdr->body.r598.rts_plcp, len, rts_rate);
6404                         break;
6405                 }
6406
6407                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6408                     rts_rate_fb);
6409
6410                 switch (mac->mac_fw.fw_hdr_format) {
6411                 case BWN_FW_HDR_351:
6412                         protwh = (struct ieee80211_frame *)
6413                             &txhdr->body.r351.rts_frame;
6414                         break;
6415                 case BWN_FW_HDR_410:
6416                         protwh = (struct ieee80211_frame *)
6417                             &txhdr->body.r410.rts_frame;
6418                         break;
6419                 case BWN_FW_HDR_598:
6420                         protwh = (struct ieee80211_frame *)
6421                             &txhdr->body.r598.rts_frame;
6422                         break;
6423                 }
6424
6425                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6426
6427                 if (BWN_ISOFDMRATE(rts_rate)) {
6428                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6429                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6430                 } else {
6431                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6432                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6433                 }
6434                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6435                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6436
6437                 if (fill_phy_ctl1) {
6438                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6439                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6440                 }
6441         }
6442
6443         if (fill_phy_ctl1) {
6444                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6445                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6446         }
6447
6448         switch (mac->mac_fw.fw_hdr_format) {
6449         case BWN_FW_HDR_351:
6450                 txhdr->body.r351.cookie = htole16(cookie);
6451                 break;
6452         case BWN_FW_HDR_410:
6453                 txhdr->body.r410.cookie = htole16(cookie);
6454                 break;
6455         case BWN_FW_HDR_598:
6456                 txhdr->body.r598.cookie = htole16(cookie);
6457                 break;
6458         }
6459
6460         txhdr->macctl = htole32(macctl);
6461         txhdr->phyctl = htole16(phyctl);
6462
6463         /*
6464          * TX radio tap
6465          */
6466         if (ieee80211_radiotap_active_vap(vap)) {
6467                 sc->sc_tx_th.wt_flags = 0;
6468                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6469                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6470                 if (isshort &&
6471                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6472                      rate == BWN_CCK_RATE_11MB))
6473                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6474                 sc->sc_tx_th.wt_rate = rate;
6475
6476                 ieee80211_radiotap_tx(vap, m);
6477         }
6478
6479         return (0);
6480 }
6481
6482 static void
6483 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6484     const uint8_t rate)
6485 {
6486         uint32_t d, plen;
6487         uint8_t *raw = plcp->o.raw;
6488
6489         if (BWN_ISOFDMRATE(rate)) {
6490                 d = bwn_plcp_getofdm(rate);
6491                 KASSERT(!(octets & 0xf000),
6492                     ("%s:%d: fail", __func__, __LINE__));
6493                 d |= (octets << 5);
6494                 plcp->o.data = htole32(d);
6495         } else {
6496                 plen = octets * 16 / rate;
6497                 if ((octets * 16 % rate) > 0) {
6498                         plen++;
6499                         if ((rate == BWN_CCK_RATE_11MB)
6500                             && ((octets * 8 % 11) < 4)) {
6501                                 raw[1] = 0x84;
6502                         } else
6503                                 raw[1] = 0x04;
6504                 } else
6505                         raw[1] = 0x04;
6506                 plcp->o.data |= htole32(plen << 16);
6507                 raw[0] = bwn_plcp_getcck(rate);
6508         }
6509 }
6510
6511 static uint8_t
6512 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6513 {
6514         struct bwn_softc *sc = mac->mac_sc;
6515         uint8_t mask;
6516
6517         if (n == 0)
6518                 return (0);
6519         if (mac->mac_phy.gmode)
6520                 mask = siba_sprom_get_ant_bg(sc->sc_dev);
6521         else
6522                 mask = siba_sprom_get_ant_a(sc->sc_dev);
6523         if (!(mask & (1 << (n - 1))))
6524                 return (0);
6525         return (n);
6526 }
6527
6528 /*
6529  * Return a fallback rate for the given rate.
6530  *
6531  * Note: Don't fall back from OFDM to CCK.
6532  */
6533 static uint8_t
6534 bwn_get_fbrate(uint8_t bitrate)
6535 {
6536         switch (bitrate) {
6537         /* CCK */
6538         case BWN_CCK_RATE_1MB:
6539                 return (BWN_CCK_RATE_1MB);
6540         case BWN_CCK_RATE_2MB:
6541                 return (BWN_CCK_RATE_1MB);
6542         case BWN_CCK_RATE_5MB:
6543                 return (BWN_CCK_RATE_2MB);
6544         case BWN_CCK_RATE_11MB:
6545                 return (BWN_CCK_RATE_5MB);
6546
6547         /* OFDM */
6548         case BWN_OFDM_RATE_6MB:
6549                 return (BWN_OFDM_RATE_6MB);
6550         case BWN_OFDM_RATE_9MB:
6551                 return (BWN_OFDM_RATE_6MB);
6552         case BWN_OFDM_RATE_12MB:
6553                 return (BWN_OFDM_RATE_9MB);
6554         case BWN_OFDM_RATE_18MB:
6555                 return (BWN_OFDM_RATE_12MB);
6556         case BWN_OFDM_RATE_24MB:
6557                 return (BWN_OFDM_RATE_18MB);
6558         case BWN_OFDM_RATE_36MB:
6559                 return (BWN_OFDM_RATE_24MB);
6560         case BWN_OFDM_RATE_48MB:
6561                 return (BWN_OFDM_RATE_36MB);
6562         case BWN_OFDM_RATE_54MB:
6563                 return (BWN_OFDM_RATE_48MB);
6564         }
6565         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6566         return (0);
6567 }
6568
6569 static uint32_t
6570 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6571     uint32_t ctl, const void *_data, int len)
6572 {
6573         struct bwn_softc *sc = mac->mac_sc;
6574         uint32_t value = 0;
6575         const uint8_t *data = _data;
6576
6577         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6578             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6579         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6580
6581         siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6582             tq->tq_base + BWN_PIO8_TXDATA);
6583         if (len & 3) {
6584                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6585                     BWN_PIO8_TXCTL_24_31);
6586                 data = &(data[len - 1]);
6587                 switch (len & 3) {
6588                 case 3:
6589                         ctl |= BWN_PIO8_TXCTL_16_23;
6590                         value |= (uint32_t)(*data) << 16;
6591                         data--;
6592                 case 2:
6593                         ctl |= BWN_PIO8_TXCTL_8_15;
6594                         value |= (uint32_t)(*data) << 8;
6595                         data--;
6596                 case 1:
6597                         value |= (uint32_t)(*data);
6598                 }
6599                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6600                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6601         }
6602
6603         return (ctl);
6604 }
6605
6606 static void
6607 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6608     uint16_t offset, uint32_t value)
6609 {
6610
6611         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6612 }
6613
6614 static uint16_t
6615 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6616     uint16_t ctl, const void *_data, int len)
6617 {
6618         struct bwn_softc *sc = mac->mac_sc;
6619         const uint8_t *data = _data;
6620
6621         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6622         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6623
6624         siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6625             tq->tq_base + BWN_PIO_TXDATA);
6626         if (len & 1) {
6627                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6628                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6629                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6630         }
6631
6632         return (ctl);
6633 }
6634
6635 static uint16_t
6636 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6637     uint16_t ctl, struct mbuf *m0)
6638 {
6639         int i, j = 0;
6640         uint16_t data = 0;
6641         const uint8_t *buf;
6642         struct mbuf *m = m0;
6643
6644         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6645         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6646
6647         for (; m != NULL; m = m->m_next) {
6648                 buf = mtod(m, const uint8_t *);
6649                 for (i = 0; i < m->m_len; i++) {
6650                         if (!((j++) % 2))
6651                                 data |= buf[i];
6652                         else {
6653                                 data |= (buf[i] << 8);
6654                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6655                                 data = 0;
6656                         }
6657                 }
6658         }
6659         if (m0->m_pkthdr.len % 2) {
6660                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6661                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6662                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6663         }
6664
6665         return (ctl);
6666 }
6667
6668 static void
6669 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6670 {
6671
6672         /* XXX should exit if 5GHz band .. */
6673         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6674                 return;
6675
6676         BWN_WRITE_2(mac, 0x684, 510 + time);
6677         /* Disabled in Linux b43, can adversely effect performance */
6678 #if 0
6679         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6680 #endif
6681 }
6682
6683 static struct bwn_dma_ring *
6684 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6685 {
6686
6687         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6688                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6689
6690         switch (prio) {
6691         case 3:
6692                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6693         case 2:
6694                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6695         case 0:
6696                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6697         case 1:
6698                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6699         }
6700         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6701         return (NULL);
6702 }
6703
6704 static int
6705 bwn_dma_getslot(struct bwn_dma_ring *dr)
6706 {
6707         int slot;
6708
6709         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6710
6711         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6712         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6713         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6714
6715         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6716         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6717         dr->dr_curslot = slot;
6718         dr->dr_usedslot++;
6719
6720         return (slot);
6721 }
6722
6723 static struct bwn_pio_txqueue *
6724 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6725     struct bwn_pio_txpkt **pack)
6726 {
6727         struct bwn_pio *pio = &mac->mac_method.pio;
6728         struct bwn_pio_txqueue *tq = NULL;
6729         unsigned int index;
6730
6731         switch (cookie & 0xf000) {
6732         case 0x1000:
6733                 tq = &pio->wme[WME_AC_BK];
6734                 break;
6735         case 0x2000:
6736                 tq = &pio->wme[WME_AC_BE];
6737                 break;
6738         case 0x3000:
6739                 tq = &pio->wme[WME_AC_VI];
6740                 break;
6741         case 0x4000:
6742                 tq = &pio->wme[WME_AC_VO];
6743                 break;
6744         case 0x5000:
6745                 tq = &pio->mcast;
6746                 break;
6747         }
6748         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6749         if (tq == NULL)
6750                 return (NULL);
6751         index = (cookie & 0x0fff);
6752         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6753         if (index >= N(tq->tq_pkts))
6754                 return (NULL);
6755         *pack = &tq->tq_pkts[index];
6756         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6757         return (tq);
6758 }
6759
6760 static void
6761 bwn_txpwr(void *arg, int npending)
6762 {
6763         struct bwn_mac *mac = arg;
6764         struct bwn_softc *sc = mac->mac_sc;
6765
6766         BWN_LOCK(sc);
6767         if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6768             mac->mac_phy.set_txpwr != NULL)
6769                 mac->mac_phy.set_txpwr(mac);
6770         BWN_UNLOCK(sc);
6771 }
6772
6773 static void
6774 bwn_task_15s(struct bwn_mac *mac)
6775 {
6776         uint16_t reg;
6777
6778         if (mac->mac_fw.opensource) {
6779                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6780                 if (reg) {
6781                         bwn_restart(mac, "fw watchdog");
6782                         return;
6783                 }
6784                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6785         }
6786         if (mac->mac_phy.task_15s)
6787                 mac->mac_phy.task_15s(mac);
6788
6789         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6790 }
6791
6792 static void
6793 bwn_task_30s(struct bwn_mac *mac)
6794 {
6795
6796         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6797                 return;
6798         mac->mac_noise.noi_running = 1;
6799         mac->mac_noise.noi_nsamples = 0;
6800
6801         bwn_noise_gensample(mac);
6802 }
6803
6804 static void
6805 bwn_task_60s(struct bwn_mac *mac)
6806 {
6807
6808         if (mac->mac_phy.task_60s)
6809                 mac->mac_phy.task_60s(mac);
6810         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6811 }
6812
6813 static void
6814 bwn_tasks(void *arg)
6815 {
6816         struct bwn_mac *mac = arg;
6817         struct bwn_softc *sc = mac->mac_sc;
6818
6819         BWN_ASSERT_LOCKED(sc);
6820         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6821                 return;
6822
6823         if (mac->mac_task_state % 4 == 0)
6824                 bwn_task_60s(mac);
6825         if (mac->mac_task_state % 2 == 0)
6826                 bwn_task_30s(mac);
6827         bwn_task_15s(mac);
6828
6829         mac->mac_task_state++;
6830         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6831 }
6832
6833 static int
6834 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6835 {
6836         struct bwn_softc *sc = mac->mac_sc;
6837
6838         KASSERT(a == 0, ("not support APHY\n"));
6839
6840         switch (plcp->o.raw[0] & 0xf) {
6841         case 0xb:
6842                 return (BWN_OFDM_RATE_6MB);
6843         case 0xf:
6844                 return (BWN_OFDM_RATE_9MB);
6845         case 0xa:
6846                 return (BWN_OFDM_RATE_12MB);
6847         case 0xe:
6848                 return (BWN_OFDM_RATE_18MB);
6849         case 0x9:
6850                 return (BWN_OFDM_RATE_24MB);
6851         case 0xd:
6852                 return (BWN_OFDM_RATE_36MB);
6853         case 0x8:
6854                 return (BWN_OFDM_RATE_48MB);
6855         case 0xc:
6856                 return (BWN_OFDM_RATE_54MB);
6857         }
6858         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6859             plcp->o.raw[0] & 0xf);
6860         return (-1);
6861 }
6862
6863 static int
6864 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6865 {
6866         struct bwn_softc *sc = mac->mac_sc;
6867
6868         switch (plcp->o.raw[0]) {
6869         case 0x0a:
6870                 return (BWN_CCK_RATE_1MB);
6871         case 0x14:
6872                 return (BWN_CCK_RATE_2MB);
6873         case 0x37:
6874                 return (BWN_CCK_RATE_5MB);
6875         case 0x6e:
6876                 return (BWN_CCK_RATE_11MB);
6877         }
6878         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6879         return (-1);
6880 }
6881
6882 static void
6883 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6884     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6885     int rssi, int noise)
6886 {
6887         struct bwn_softc *sc = mac->mac_sc;
6888         const struct ieee80211_frame_min *wh;
6889         uint64_t tsf;
6890         uint16_t low_mactime_now;
6891         uint16_t mt;
6892
6893         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6894                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6895
6896         wh = mtod(m, const struct ieee80211_frame_min *);
6897         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6898                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6899
6900         bwn_tsf_read(mac, &tsf);
6901         low_mactime_now = tsf;
6902         tsf = tsf & ~0xffffULL;
6903
6904         switch (mac->mac_fw.fw_hdr_format) {
6905         case BWN_FW_HDR_351:
6906         case BWN_FW_HDR_410:
6907                 mt = le16toh(rxhdr->ps4.r351.mac_time);
6908                 break;
6909         case BWN_FW_HDR_598:
6910                 mt = le16toh(rxhdr->ps4.r598.mac_time);
6911                 break;
6912         }
6913
6914         tsf += mt;
6915         if (low_mactime_now < mt)
6916                 tsf -= 0x10000;
6917
6918         sc->sc_rx_th.wr_tsf = tsf;
6919         sc->sc_rx_th.wr_rate = rate;
6920         sc->sc_rx_th.wr_antsignal = rssi;
6921         sc->sc_rx_th.wr_antnoise = noise;
6922 }
6923
6924 static void
6925 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6926 {
6927         uint32_t low, high;
6928
6929         KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6930             ("%s:%d: fail", __func__, __LINE__));
6931
6932         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6933         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6934         *tsf = high;
6935         *tsf <<= 32;
6936         *tsf |= low;
6937 }
6938
6939 static int
6940 bwn_dma_attach(struct bwn_mac *mac)
6941 {
6942         struct bwn_dma *dma = &mac->mac_method.dma;
6943         struct bwn_softc *sc = mac->mac_sc;
6944         bus_addr_t lowaddr = 0;
6945         int error;
6946
6947         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6948                 return (0);
6949
6950         KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6951
6952         mac->mac_flags |= BWN_MAC_FLAG_DMA;
6953
6954         dma->dmatype = bwn_dma_gettype(mac);
6955         if (dma->dmatype == BWN_DMA_30BIT)
6956                 lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6957         else if (dma->dmatype == BWN_DMA_32BIT)
6958                 lowaddr = BUS_SPACE_MAXADDR_32BIT;
6959         else
6960                 lowaddr = BUS_SPACE_MAXADDR;
6961
6962         /*
6963          * Create top level DMA tag
6964          */
6965         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), /* parent */
6966                                BWN_ALIGN, 0,            /* alignment, bounds */
6967                                lowaddr,                 /* lowaddr */
6968                                BUS_SPACE_MAXADDR,       /* highaddr */
6969                                NULL, NULL,              /* filter, filterarg */
6970                                BUS_SPACE_MAXSIZE,       /* maxsize */
6971                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
6972                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
6973                                0,                       /* flags */
6974                                NULL, NULL,              /* lockfunc, lockarg */
6975                                &dma->parent_dtag);
6976         if (error) {
6977                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6978                 return (error);
6979         }
6980
6981         /*
6982          * Create TX/RX mbuf DMA tag
6983          */
6984         error = bus_dma_tag_create(dma->parent_dtag,
6985                                 1,
6986                                 0,
6987                                 BUS_SPACE_MAXADDR,
6988                                 BUS_SPACE_MAXADDR,
6989                                 NULL, NULL,
6990                                 MCLBYTES,
6991                                 1,
6992                                 BUS_SPACE_MAXSIZE_32BIT,
6993                                 0,
6994                                 NULL, NULL,
6995                                 &dma->rxbuf_dtag);
6996         if (error) {
6997                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6998                 goto fail0;
6999         }
7000         error = bus_dma_tag_create(dma->parent_dtag,
7001                                 1,
7002                                 0,
7003                                 BUS_SPACE_MAXADDR,
7004                                 BUS_SPACE_MAXADDR,
7005                                 NULL, NULL,
7006                                 MCLBYTES,
7007                                 1,
7008                                 BUS_SPACE_MAXSIZE_32BIT,
7009                                 0,
7010                                 NULL, NULL,
7011                                 &dma->txbuf_dtag);
7012         if (error) {
7013                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7014                 goto fail1;
7015         }
7016
7017         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7018         if (!dma->wme[WME_AC_BK])
7019                 goto fail2;
7020
7021         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7022         if (!dma->wme[WME_AC_BE])
7023                 goto fail3;
7024
7025         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7026         if (!dma->wme[WME_AC_VI])
7027                 goto fail4;
7028
7029         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7030         if (!dma->wme[WME_AC_VO])
7031                 goto fail5;
7032
7033         dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7034         if (!dma->mcast)
7035                 goto fail6;
7036         dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7037         if (!dma->rx)
7038                 goto fail7;
7039
7040         return (error);
7041
7042 fail7:  bwn_dma_ringfree(&dma->mcast);
7043 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7044 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7045 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7046 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7047 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
7048 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
7049 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
7050         return (error);
7051 }
7052
7053 static struct bwn_dma_ring *
7054 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7055     uint16_t cookie, int *slot)
7056 {
7057         struct bwn_dma *dma = &mac->mac_method.dma;
7058         struct bwn_dma_ring *dr;
7059         struct bwn_softc *sc = mac->mac_sc;
7060
7061         BWN_ASSERT_LOCKED(mac->mac_sc);
7062
7063         switch (cookie & 0xf000) {
7064         case 0x1000:
7065                 dr = dma->wme[WME_AC_BK];
7066                 break;
7067         case 0x2000:
7068                 dr = dma->wme[WME_AC_BE];
7069                 break;
7070         case 0x3000:
7071                 dr = dma->wme[WME_AC_VI];
7072                 break;
7073         case 0x4000:
7074                 dr = dma->wme[WME_AC_VO];
7075                 break;
7076         case 0x5000:
7077                 dr = dma->mcast;
7078                 break;
7079         default:
7080                 dr = NULL;
7081                 KASSERT(0 == 1,
7082                     ("invalid cookie value %d", cookie & 0xf000));
7083         }
7084         *slot = (cookie & 0x0fff);
7085         if (*slot < 0 || *slot >= dr->dr_numslots) {
7086                 /*
7087                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7088                  * that it occurs events which have same H/W sequence numbers.
7089                  * When it's occurred just prints a WARNING msgs and ignores.
7090                  */
7091                 KASSERT(status->seq == dma->lastseq,
7092                     ("%s:%d: fail", __func__, __LINE__));
7093                 device_printf(sc->sc_dev,
7094                     "out of slot ranges (0 < %d < %d)\n", *slot,
7095                     dr->dr_numslots);
7096                 return (NULL);
7097         }
7098         dma->lastseq = status->seq;
7099         return (dr);
7100 }
7101
7102 static void
7103 bwn_dma_stop(struct bwn_mac *mac)
7104 {
7105         struct bwn_dma *dma;
7106
7107         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7108                 return;
7109         dma = &mac->mac_method.dma;
7110
7111         bwn_dma_ringstop(&dma->rx);
7112         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7113         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7114         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7115         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7116         bwn_dma_ringstop(&dma->mcast);
7117 }
7118
7119 static void
7120 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7121 {
7122
7123         if (dr == NULL)
7124                 return;
7125
7126         bwn_dma_cleanup(*dr);
7127 }
7128
7129 static void
7130 bwn_pio_stop(struct bwn_mac *mac)
7131 {
7132         struct bwn_pio *pio;
7133
7134         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7135                 return;
7136         pio = &mac->mac_method.pio;
7137
7138         bwn_destroy_queue_tx(&pio->mcast);
7139         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7140         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7141         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7142         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7143 }
7144
7145 static void
7146 bwn_led_attach(struct bwn_mac *mac)
7147 {
7148         struct bwn_softc *sc = mac->mac_sc;
7149         const uint8_t *led_act = NULL;
7150         uint16_t val[BWN_LED_MAX];
7151         int i;
7152
7153         sc->sc_led_idle = (2350 * hz) / 1000;
7154         sc->sc_led_blink = 1;
7155
7156         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7157                 if (siba_get_pci_subvendor(sc->sc_dev) ==
7158                     bwn_vendor_led_act[i].vid) {
7159                         led_act = bwn_vendor_led_act[i].led_act;
7160                         break;
7161                 }
7162         }
7163         if (led_act == NULL)
7164                 led_act = bwn_default_led_act;
7165
7166         val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7167         val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7168         val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7169         val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7170
7171         for (i = 0; i < BWN_LED_MAX; ++i) {
7172                 struct bwn_led *led = &sc->sc_leds[i];
7173
7174                 if (val[i] == 0xff) {
7175                         led->led_act = led_act[i];
7176                 } else {
7177                         if (val[i] & BWN_LED_ACT_LOW)
7178                                 led->led_flags |= BWN_LED_F_ACTLOW;
7179                         led->led_act = val[i] & BWN_LED_ACT_MASK;
7180                 }
7181                 led->led_mask = (1 << i);
7182
7183                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7184                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
7185                     led->led_act == BWN_LED_ACT_BLINK) {
7186                         led->led_flags |= BWN_LED_F_BLINK;
7187                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7188                                 led->led_flags |= BWN_LED_F_POLLABLE;
7189                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7190                                 led->led_flags |= BWN_LED_F_SLOW;
7191
7192                         if (sc->sc_blink_led == NULL) {
7193                                 sc->sc_blink_led = led;
7194                                 if (led->led_flags & BWN_LED_F_SLOW)
7195                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
7196                         }
7197                 }
7198
7199                 DPRINTF(sc, BWN_DEBUG_LED,
7200                     "%dth led, act %d, lowact %d\n", i,
7201                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7202         }
7203         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7204 }
7205
7206 static __inline uint16_t
7207 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7208 {
7209
7210         if (led->led_flags & BWN_LED_F_ACTLOW)
7211                 on = !on;
7212         if (on)
7213                 val |= led->led_mask;
7214         else
7215                 val &= ~led->led_mask;
7216         return val;
7217 }
7218
7219 static void
7220 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7221 {
7222         struct bwn_softc *sc = mac->mac_sc;
7223         struct ieee80211com *ic = &sc->sc_ic;
7224         uint16_t val;
7225         int i;
7226
7227         if (nstate == IEEE80211_S_INIT) {
7228                 callout_stop(&sc->sc_led_blink_ch);
7229                 sc->sc_led_blinking = 0;
7230         }
7231
7232         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7233                 return;
7234
7235         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7236         for (i = 0; i < BWN_LED_MAX; ++i) {
7237                 struct bwn_led *led = &sc->sc_leds[i];
7238                 int on;
7239
7240                 if (led->led_act == BWN_LED_ACT_UNKN ||
7241                     led->led_act == BWN_LED_ACT_NULL)
7242                         continue;
7243
7244                 if ((led->led_flags & BWN_LED_F_BLINK) &&
7245                     nstate != IEEE80211_S_INIT)
7246                         continue;
7247
7248                 switch (led->led_act) {
7249                 case BWN_LED_ACT_ON:    /* Always on */
7250                         on = 1;
7251                         break;
7252                 case BWN_LED_ACT_OFF:   /* Always off */
7253                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7254                         on = 0;
7255                         break;
7256                 default:
7257                         on = 1;
7258                         switch (nstate) {
7259                         case IEEE80211_S_INIT:
7260                                 on = 0;
7261                                 break;
7262                         case IEEE80211_S_RUN:
7263                                 if (led->led_act == BWN_LED_ACT_11G &&
7264                                     ic->ic_curmode != IEEE80211_MODE_11G)
7265                                         on = 0;
7266                                 break;
7267                         default:
7268                                 if (led->led_act == BWN_LED_ACT_ASSOC)
7269                                         on = 0;
7270                                 break;
7271                         }
7272                         break;
7273                 }
7274
7275                 val = bwn_led_onoff(led, val, on);
7276         }
7277         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7278 }
7279
7280 static void
7281 bwn_led_event(struct bwn_mac *mac, int event)
7282 {
7283         struct bwn_softc *sc = mac->mac_sc;
7284         struct bwn_led *led = sc->sc_blink_led;
7285         int rate;
7286
7287         if (event == BWN_LED_EVENT_POLL) {
7288                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7289                         return;
7290                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7291                         return;
7292         }
7293
7294         sc->sc_led_ticks = ticks;
7295         if (sc->sc_led_blinking)
7296                 return;
7297
7298         switch (event) {
7299         case BWN_LED_EVENT_RX:
7300                 rate = sc->sc_rx_rate;
7301                 break;
7302         case BWN_LED_EVENT_TX:
7303                 rate = sc->sc_tx_rate;
7304                 break;
7305         case BWN_LED_EVENT_POLL:
7306                 rate = 0;
7307                 break;
7308         default:
7309                 panic("unknown LED event %d\n", event);
7310                 break;
7311         }
7312         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7313             bwn_led_duration[rate].off_dur);
7314 }
7315
7316 static void
7317 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7318 {
7319         struct bwn_softc *sc = mac->mac_sc;
7320         struct bwn_led *led = sc->sc_blink_led;
7321         uint16_t val;
7322
7323         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7324         val = bwn_led_onoff(led, val, 1);
7325         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7326
7327         if (led->led_flags & BWN_LED_F_SLOW) {
7328                 BWN_LED_SLOWDOWN(on_dur);
7329                 BWN_LED_SLOWDOWN(off_dur);
7330         }
7331
7332         sc->sc_led_blinking = 1;
7333         sc->sc_led_blink_offdur = off_dur;
7334
7335         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7336 }
7337
7338 static void
7339 bwn_led_blink_next(void *arg)
7340 {
7341         struct bwn_mac *mac = arg;
7342         struct bwn_softc *sc = mac->mac_sc;
7343         uint16_t val;
7344
7345         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7346         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7347         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7348
7349         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7350             bwn_led_blink_end, mac);
7351 }
7352
7353 static void
7354 bwn_led_blink_end(void *arg)
7355 {
7356         struct bwn_mac *mac = arg;
7357         struct bwn_softc *sc = mac->mac_sc;
7358
7359         sc->sc_led_blinking = 0;
7360 }
7361
7362 static int
7363 bwn_suspend(device_t dev)
7364 {
7365         struct bwn_softc *sc = device_get_softc(dev);
7366
7367         BWN_LOCK(sc);
7368         bwn_stop(sc);
7369         BWN_UNLOCK(sc);
7370         return (0);
7371 }
7372
7373 static int
7374 bwn_resume(device_t dev)
7375 {
7376         struct bwn_softc *sc = device_get_softc(dev);
7377         int error = EDOOFUS;
7378
7379         BWN_LOCK(sc);
7380         if (sc->sc_ic.ic_nrunning > 0)
7381                 error = bwn_init(sc);
7382         BWN_UNLOCK(sc);
7383         if (error == 0)
7384                 ieee80211_start_all(&sc->sc_ic);
7385         return (0);
7386 }
7387
7388 static void
7389 bwn_rfswitch(void *arg)
7390 {
7391         struct bwn_softc *sc = arg;
7392         struct bwn_mac *mac = sc->sc_curmac;
7393         int cur = 0, prev = 0;
7394
7395         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7396             ("%s: invalid MAC status %d", __func__, mac->mac_status));
7397
7398         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7399             || mac->mac_phy.type == BWN_PHYTYPE_N) {
7400                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7401                         & BWN_RF_HWENABLED_HI_MASK))
7402                         cur = 1;
7403         } else {
7404                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7405                     & BWN_RF_HWENABLED_LO_MASK)
7406                         cur = 1;
7407         }
7408
7409         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7410                 prev = 1;
7411
7412         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7413             __func__, cur, prev);
7414
7415         if (cur != prev) {
7416                 if (cur)
7417                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7418                 else
7419                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7420
7421                 device_printf(sc->sc_dev,
7422                     "status of RF switch is changed to %s\n",
7423                     cur ? "ON" : "OFF");
7424                 if (cur != mac->mac_phy.rf_on) {
7425                         if (cur)
7426                                 bwn_rf_turnon(mac);
7427                         else
7428                                 bwn_rf_turnoff(mac);
7429                 }
7430         }
7431
7432         callout_schedule(&sc->sc_rfswitch_ch, hz);
7433 }
7434
7435 static void
7436 bwn_sysctl_node(struct bwn_softc *sc)
7437 {
7438         device_t dev = sc->sc_dev;
7439         struct bwn_mac *mac;
7440         struct bwn_stats *stats;
7441
7442         /* XXX assume that count of MAC is only 1. */
7443
7444         if ((mac = sc->sc_curmac) == NULL)
7445                 return;
7446         stats = &mac->mac_stats;
7447
7448         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7449             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7450             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7451         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7452             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7453             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7454         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7455             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7456             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7457
7458 #ifdef BWN_DEBUG
7459         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7460             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7461             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7462 #endif
7463 }
7464
7465 static device_method_t bwn_methods[] = {
7466         /* Device interface */
7467         DEVMETHOD(device_probe,         bwn_probe),
7468         DEVMETHOD(device_attach,        bwn_attach),
7469         DEVMETHOD(device_detach,        bwn_detach),
7470         DEVMETHOD(device_suspend,       bwn_suspend),
7471         DEVMETHOD(device_resume,        bwn_resume),
7472         DEVMETHOD_END
7473 };
7474 static driver_t bwn_driver = {
7475         "bwn",
7476         bwn_methods,
7477         sizeof(struct bwn_softc)
7478 };
7479 static devclass_t bwn_devclass;
7480 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7481 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7482 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
7483 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
7484 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7485 MODULE_VERSION(bwn, 1);