sys/dev/bwn/if_bwn.c

   1 /*-
   2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer,
  10  *    without modification.
  11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  13  *    redistribution must be conditioned upon including a substantially
  14  *    similar Disclaimer requirement for further binary redistribution.
  15  *
  16  * NO WARRANTY
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  27  * THE POSSIBILITY OF SUCH DAMAGES.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 /*
  34  * The Broadcom Wireless LAN controller driver.
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/kernel.h>
  40 #include <sys/malloc.h>
  41 #include <sys/module.h>
  42 #include <sys/endian.h>
  43 #include <sys/errno.h>
  44 #include <sys/firmware.h>
  45 #include <sys/lock.h>
  46 #include <sys/mutex.h>
  47 #include <machine/bus.h>
  48 #include <machine/resource.h>
  49 #include <sys/bus.h>
  50 #include <sys/rman.h>
  51 #include <sys/socket.h>
  52 #include <sys/sockio.h>
  53
  54 #include <net/ethernet.h>
  55 #include <net/if.h>
  56 #include <net/if_var.h>
  57 #include <net/if_arp.h>
  58 #include <net/if_dl.h>
  59 #include <net/if_llc.h>
  60 #include <net/if_media.h>
  61 #include <net/if_types.h>
  62
  63 #include <dev/pci/pcivar.h>
  64 #include <dev/pci/pcireg.h>
  65 #include <dev/siba/siba_ids.h>
  66 #include <dev/siba/sibareg.h>
  67 #include <dev/siba/sibavar.h>
  68
  69 #include <net80211/ieee80211_var.h>
  70 #include <net80211/ieee80211_radiotap.h>
  71 #include <net80211/ieee80211_regdomain.h>
  72 #include <net80211/ieee80211_phy.h>
  73 #include <net80211/ieee80211_ratectl.h>
  74
  75 #include <dev/bwn/if_bwnreg.h>
  76 #include <dev/bwn/if_bwnvar.h>
  77
  78 #include <dev/bwn/if_bwn_debug.h>
  79 #include <dev/bwn/if_bwn_misc.h>
  80 #include <dev/bwn/if_bwn_phy_g.h>
  81 #include <dev/bwn/if_bwn_phy_lp.h>
  82
  83 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
  84     "Broadcom driver parameters");
  85
  86 /*
  87  * Tunable & sysctl variables.
  88  */
  89
  90 #ifdef BWN_DEBUG
  91 static  int bwn_debug = 0;
  92 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
  93     "Broadcom debugging printfs");
  94 #endif
  95
  96 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
  97 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
  98     "uses Bad Frames Preemption");
  99 static int      bwn_bluetooth = 1;
 100 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 101     "turns on Bluetooth Coexistence");
 102 static int      bwn_hwpctl = 0;
 103 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 104     "uses H/W power control");
 105 static int      bwn_msi_disable = 0;            /* MSI disabled  */
 106 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
 107 static int      bwn_usedma = 1;
 108 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 109     "uses DMA");
 110 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 111 static int      bwn_wme = 1;
 112 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 113     "uses WME support");
 114
 115 static void     bwn_attach_pre(struct bwn_softc *);
 116 static int      bwn_attach_post(struct bwn_softc *);
 117 static void     bwn_sprom_bugfixes(device_t);
 118 static int      bwn_init(struct bwn_softc *);
 119 static void     bwn_parent(struct ieee80211com *);
 120 static void     bwn_start(struct bwn_softc *);
 121 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 122 static int      bwn_attach_core(struct bwn_mac *);
 123 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 124 static int      bwn_chiptest(struct bwn_mac *);
 125 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 126 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 127                     uint16_t);
 128 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 129                     const struct bwn_channelinfo *, int);
 130 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 131                     const struct ieee80211_bpf_params *);
 132 static void     bwn_updateslot(struct ieee80211com *);
 133 static void     bwn_update_promisc(struct ieee80211com *);
 134 static void     bwn_wme_init(struct bwn_mac *);
 135 static int      bwn_wme_update(struct ieee80211com *);
 136 static void     bwn_wme_clear(struct bwn_softc *);
 137 static void     bwn_wme_load(struct bwn_mac *);
 138 static void     bwn_wme_loadparams(struct bwn_mac *,
 139                     const struct wmeParams *, uint16_t);
 140 static void     bwn_scan_start(struct ieee80211com *);
 141 static void     bwn_scan_end(struct ieee80211com *);
 142 static void     bwn_set_channel(struct ieee80211com *);
 143 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 144                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 145                     const uint8_t [IEEE80211_ADDR_LEN],
 146                     const uint8_t [IEEE80211_ADDR_LEN]);
 147 static void     bwn_vap_delete(struct ieee80211vap *);
 148 static void     bwn_stop(struct bwn_softc *);
 149 static int      bwn_core_init(struct bwn_mac *);
 150 static void     bwn_core_start(struct bwn_mac *);
 151 static void     bwn_core_exit(struct bwn_mac *);
 152 static void     bwn_bt_disable(struct bwn_mac *);
 153 static int      bwn_chip_init(struct bwn_mac *);
 154 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 155 static void     bwn_rate_init(struct bwn_mac *);
 156 static void     bwn_set_phytxctl(struct bwn_mac *);
 157 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 158 static void     bwn_bt_enable(struct bwn_mac *);
 159 static void     bwn_set_macaddr(struct bwn_mac *);
 160 static void     bwn_crypt_init(struct bwn_mac *);
 161 static void     bwn_chip_exit(struct bwn_mac *);
 162 static int      bwn_fw_fillinfo(struct bwn_mac *);
 163 static int      bwn_fw_loaducode(struct bwn_mac *);
 164 static int      bwn_gpio_init(struct bwn_mac *);
 165 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 166 static int      bwn_phy_init(struct bwn_mac *);
 167 static void     bwn_set_txantenna(struct bwn_mac *, int);
 168 static void     bwn_set_opmode(struct bwn_mac *);
 169 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 170 static uint8_t  bwn_plcp_getcck(const uint8_t);
 171 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 172 static void     bwn_pio_init(struct bwn_mac *);
 173 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 174 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 175                     int);
 176 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 177                     struct bwn_pio_rxqueue *, int);
 178 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 179 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 180                     uint16_t);
 181 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 182 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 183 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 184 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 185                     const struct bwn_txstatus *);
 186 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 187 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 188 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 189                     uint16_t);
 190 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 191                     uint32_t);
 192 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 193                     struct mbuf *);
 194 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 195 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 196                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 197 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 198                     uint16_t, uint32_t);
 199 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 200                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 201 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 202                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 203 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 204                     uint16_t, struct bwn_pio_txpkt **);
 205 static void     bwn_dma_init(struct bwn_mac *);
 206 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 207 static int      bwn_dma_mask2type(uint64_t);
 208 static uint64_t bwn_dma_mask(struct bwn_mac *);
 209 static uint16_t bwn_dma_base(int, int);
 210 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 211 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 212                     int, struct bwn_dmadesc_generic **,
 213                     struct bwn_dmadesc_meta **);
 214 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 215                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 216                     int, int);
 217 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 218 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 219 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 220 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 221 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 222 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 223                     int, struct bwn_dmadesc_generic **,
 224                     struct bwn_dmadesc_meta **);
 225 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 226                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 227                     int, int);
 228 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 229 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 230 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 231 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 232 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 233 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 234 static void     bwn_dma_setup(struct bwn_dma_ring *);
 235 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 236 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 237 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 238 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 239 static void     bwn_dma_rx(struct bwn_dma_ring *);
 240 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 241 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 242                     struct bwn_dmadesc_meta *);
 243 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 244 static int      bwn_dma_gettype(struct bwn_mac *);
 245 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 246 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 247 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 248 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 249 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 250                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 251                     int);
 252 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 253                     bus_size_t, int);
 254 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 255 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 256                     const struct bwn_txstatus *);
 257 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 258                     struct mbuf *);
 259 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 260 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 261                     uint8_t);
 262 static int      bwn_dma_attach(struct bwn_mac *);
 263 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 264                     int, int, int);
 265 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 266                     const struct bwn_txstatus *, uint16_t, int *);
 267 static void     bwn_dma_free(struct bwn_mac *);
 268 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 269 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 270                     const char *, struct bwn_fwfile *);
 271 static void     bwn_release_firmware(struct bwn_mac *);
 272 static void     bwn_do_release_fw(struct bwn_fwfile *);
 273 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 274 static int      bwn_fwinitvals_write(struct bwn_mac *,
 275                     const struct bwn_fwinitvals *, size_t, size_t);
 276 static uint16_t bwn_ant2phy(int);
 277 static void     bwn_mac_write_bssid(struct bwn_mac *);
 278 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 279                     const uint8_t *);
 280 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 281                     const uint8_t *, size_t, const uint8_t *);
 282 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 283                     const uint8_t *);
 284 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 285                     const uint8_t *);
 286 static void     bwn_phy_exit(struct bwn_mac *);
 287 static void     bwn_core_stop(struct bwn_mac *);
 288 static int      bwn_switch_band(struct bwn_softc *,
 289                     struct ieee80211_channel *);
 290 static void     bwn_phy_reset(struct bwn_mac *);
 291 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 292 static void     bwn_set_pretbtt(struct bwn_mac *);
 293 static int      bwn_intr(void *);
 294 static void     bwn_intrtask(void *, int);
 295 static void     bwn_restart(struct bwn_mac *, const char *);
 296 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 297 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 298 static void     bwn_intr_atim_end(struct bwn_mac *);
 299 static void     bwn_intr_beacon(struct bwn_mac *);
 300 static void     bwn_intr_pmq(struct bwn_mac *);
 301 static void     bwn_intr_noise(struct bwn_mac *);
 302 static void     bwn_intr_txeof(struct bwn_mac *);
 303 static void     bwn_hwreset(void *, int);
 304 static void     bwn_handle_fwpanic(struct bwn_mac *);
 305 static void     bwn_load_beacon0(struct bwn_mac *);
 306 static void     bwn_load_beacon1(struct bwn_mac *);
 307 static uint32_t bwn_jssi_read(struct bwn_mac *);
 308 static void     bwn_noise_gensample(struct bwn_mac *);
 309 static void     bwn_handle_txeof(struct bwn_mac *,
 310                     const struct bwn_txstatus *);
 311 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 312 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 313 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 314                     struct mbuf *);
 315 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 316 static int      bwn_set_txhdr(struct bwn_mac *,
 317                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 318                     uint16_t);
 319 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 320                     const uint8_t);
 321 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 322 static uint8_t  bwn_get_fbrate(uint8_t);
 323 static void     bwn_txpwr(void *, int);
 324 static void     bwn_tasks(void *);
 325 static void     bwn_task_15s(struct bwn_mac *);
 326 static void     bwn_task_30s(struct bwn_mac *);
 327 static void     bwn_task_60s(struct bwn_mac *);
 328 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 329                     uint8_t);
 330 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 331 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 332                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 333                     int, int);
 334 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 335 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 336 static void     bwn_watchdog(void *);
 337 static void     bwn_dma_stop(struct bwn_mac *);
 338 static void     bwn_pio_stop(struct bwn_mac *);
 339 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 340 static void     bwn_led_attach(struct bwn_mac *);
 341 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 342 static void     bwn_led_event(struct bwn_mac *, int);
 343 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 344 static void     bwn_led_blink_next(void *);
 345 static void     bwn_led_blink_end(void *);
 346 static void     bwn_rfswitch(void *);
 347 static void     bwn_rf_turnon(struct bwn_mac *);
 348 static void     bwn_rf_turnoff(struct bwn_mac *);
 349 static void     bwn_sysctl_node(struct bwn_softc *);
 350
 351 static struct resource_spec bwn_res_spec_legacy[] = {
 352         { SYS_RES_IRQ,          0,              RF_ACTIVE | RF_SHAREABLE },
 353         { -1,                   0,              0 }
 354 };
 355
 356 static struct resource_spec bwn_res_spec_msi[] = {
 357         { SYS_RES_IRQ,          1,              RF_ACTIVE },
 358         { -1,                   0,              0 }
 359 };
 360
 361 static const struct bwn_channelinfo bwn_chantable_bg = {
 362         .channels = {
 363                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 364                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 365                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 366                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 367                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 368         .nchannels = 14
 369 };
 370
 371 static const struct bwn_channelinfo bwn_chantable_a = {
 372         .channels = {
 373                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 374                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 375                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 376                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 377                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 378                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 379                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 380                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 381                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 382                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 383                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 384                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 385                 { 6080, 216, 30 } },
 386         .nchannels = 37
 387 };
 388
 389 static const struct bwn_channelinfo bwn_chantable_n = {
 390         .channels = {
 391                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 392                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 393                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 394                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 395                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 396                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 397                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 398                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 399                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 400                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 401                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 402                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 403                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 404                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 405                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 406                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 407                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 408                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 409                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 410                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 411                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 412                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 413                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 414                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 415                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 416                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 417                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 418                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 419                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 420                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 421                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 422                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 423                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 424                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 425                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 426                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 427                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 428         .nchannels = 110
 429 };
 430
 431 #define VENDOR_LED_ACT(vendor)                          \
 432 {                                                       \
 433         .vid = PCI_VENDOR_##vendor,                     \
 434         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 435 }
 436
 437 static const struct {
 438         uint16_t        vid;
 439         uint8_t         led_act[BWN_LED_MAX];
 440 } bwn_vendor_led_act[] = {
 441         VENDOR_LED_ACT(COMPAQ),
 442         VENDOR_LED_ACT(ASUSTEK)
 443 };
 444
 445 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 446         { BWN_VENDOR_LED_ACT_DEFAULT };
 447
 448 #undef VENDOR_LED_ACT
 449
 450 static const struct {
 451         int             on_dur;
 452         int             off_dur;
 453 } bwn_led_duration[109] = {
 454         [0]     = { 400, 100 },
 455         [2]     = { 150, 75 },
 456         [4]     = { 90, 45 },
 457         [11]    = { 66, 34 },
 458         [12]    = { 53, 26 },
 459         [18]    = { 42, 21 },
 460         [22]    = { 35, 17 },
 461         [24]    = { 32, 16 },
 462         [36]    = { 21, 10 },
 463         [48]    = { 16, 8 },
 464         [72]    = { 11, 5 },
 465         [96]    = { 9, 4 },
 466         [108]   = { 7, 3 }
 467 };
 468
 469 static const uint16_t bwn_wme_shm_offsets[] = {
 470         [0] = BWN_WME_BESTEFFORT,
 471         [1] = BWN_WME_BACKGROUND,
 472         [2] = BWN_WME_VOICE,
 473         [3] = BWN_WME_VIDEO,
 474 };
 475
 476 static const struct siba_devid bwn_devs[] = {
 477         SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
 478         SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
 479         SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
 480         SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
 481         SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
 482         SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
 483         SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
 484         SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
 485         SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
 486 };
 487
 488 static int
 489 bwn_probe(device_t dev)
 490 {
 491         int i;
 492
 493         for (i = 0; i < nitems(bwn_devs); i++) {
 494                 if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
 495                     siba_get_device(dev) == bwn_devs[i].sd_device &&
 496                     siba_get_revid(dev) == bwn_devs[i].sd_rev)
 497                         return (BUS_PROBE_DEFAULT);
 498         }
 499
 500         return (ENXIO);
 501 }
 502
 503 static int
 504 bwn_attach(device_t dev)
 505 {
 506         struct bwn_mac *mac;
 507         struct bwn_softc *sc = device_get_softc(dev);
 508         int error, i, msic, reg;
 509
 510         sc->sc_dev = dev;
 511 #ifdef BWN_DEBUG
 512         sc->sc_debug = bwn_debug;
 513 #endif
 514
 515         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 516                 bwn_attach_pre(sc);
 517                 bwn_sprom_bugfixes(dev);
 518                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 519         }
 520
 521         if (!TAILQ_EMPTY(&sc->sc_maclist)) {
 522                 if (siba_get_pci_device(dev) != 0x4313 &&
 523                     siba_get_pci_device(dev) != 0x431a &&
 524                     siba_get_pci_device(dev) != 0x4321) {
 525                         device_printf(sc->sc_dev,
 526                             "skip 802.11 cores\n");
 527                         return (ENODEV);
 528                 }
 529         }
 530
 531         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 532         mac->mac_sc = sc;
 533         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 534         if (bwn_bfp != 0)
 535                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 536
 537         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 538         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 539         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 540
 541         error = bwn_attach_core(mac);
 542         if (error)
 543                 goto fail0;
 544         bwn_led_attach(mac);
 545
 546         device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
 547             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 548             siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
 549             mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
 550             mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
 551             mac->mac_phy.rf_rev);
 552         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 553                 device_printf(sc->sc_dev, "DMA (%d bits)\n",
 554                     mac->mac_method.dma.dmatype);
 555         else
 556                 device_printf(sc->sc_dev, "PIO\n");
 557
 558         /*
 559          * setup PCI resources and interrupt.
 560          */
 561         if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
 562                 msic = pci_msi_count(dev);
 563                 if (bootverbose)
 564                         device_printf(sc->sc_dev, "MSI count : %d\n", msic);
 565         } else
 566                 msic = 0;
 567
 568         mac->mac_intr_spec = bwn_res_spec_legacy;
 569         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
 570                 if (pci_alloc_msi(dev, &msic) == 0) {
 571                         device_printf(sc->sc_dev,
 572                             "Using %d MSI messages\n", msic);
 573                         mac->mac_intr_spec = bwn_res_spec_msi;
 574                         mac->mac_msi = 1;
 575                 }
 576         }
 577
 578         error = bus_alloc_resources(dev, mac->mac_intr_spec,
 579             mac->mac_res_irq);
 580         if (error) {
 581                 device_printf(sc->sc_dev,
 582                     "couldn't allocate IRQ resources (%d)\n", error);
 583                 goto fail1;
 584         }
 585
 586         if (mac->mac_msi == 0)
 587                 error = bus_setup_intr(dev, mac->mac_res_irq[0],
 588                     INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 589                     &mac->mac_intrhand[0]);
 590         else {
 591                 for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 592                         error = bus_setup_intr(dev, mac->mac_res_irq[i],
 593                             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 594                             &mac->mac_intrhand[i]);
 595                         if (error != 0) {
 596                                 device_printf(sc->sc_dev,
 597                                     "couldn't setup interrupt (%d)\n", error);
 598                                 break;
 599                         }
 600                 }
 601         }
 602
 603         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 604
 605         /*
 606          * calls attach-post routine
 607          */
 608         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 609                 bwn_attach_post(sc);
 610
 611         return (0);
 612 fail1:
 613         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
 614                 pci_release_msi(dev);
 615 fail0:
 616         free(mac, M_DEVBUF);
 617         return (error);
 618 }
 619
 620 static int
 621 bwn_is_valid_ether_addr(uint8_t *addr)
 622 {
 623         char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
 624
 625         if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
 626                 return (FALSE);
 627
 628         return (TRUE);
 629 }
 630
 631 static int
 632 bwn_attach_post(struct bwn_softc *sc)
 633 {
 634         struct ieee80211com *ic = &sc->sc_ic;
 635
 636         ic->ic_softc = sc;
 637         ic->ic_name = device_get_nameunit(sc->sc_dev);
 638         /* XXX not right but it's not used anywhere important */
 639         ic->ic_phytype = IEEE80211_T_OFDM;
 640         ic->ic_opmode = IEEE80211_M_STA;
 641         ic->ic_caps =
 642                   IEEE80211_C_STA               /* station mode supported */
 643                 | IEEE80211_C_MONITOR           /* monitor mode */
 644                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 645                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 646                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 647                 | IEEE80211_C_WME               /* WME/WMM supported */
 648                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 649 #if 0
 650                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 651 #endif
 652                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 653                 ;
 654
 655         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 656
 657         IEEE80211_ADDR_COPY(ic->ic_macaddr,
 658             bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
 659             siba_sprom_get_mac_80211a(sc->sc_dev) :
 660             siba_sprom_get_mac_80211bg(sc->sc_dev));
 661
 662         /* call MI attach routine. */
 663         ieee80211_ifattach(ic);
 664
 665         ic->ic_headroom = sizeof(struct bwn_txhdr);
 666
 667         /* override default methods */
 668         ic->ic_raw_xmit = bwn_raw_xmit;
 669         ic->ic_updateslot = bwn_updateslot;
 670         ic->ic_update_promisc = bwn_update_promisc;
 671         ic->ic_wme.wme_update = bwn_wme_update;
 672         ic->ic_scan_start = bwn_scan_start;
 673         ic->ic_scan_end = bwn_scan_end;
 674         ic->ic_set_channel = bwn_set_channel;
 675         ic->ic_vap_create = bwn_vap_create;
 676         ic->ic_vap_delete = bwn_vap_delete;
 677         ic->ic_transmit = bwn_transmit;
 678         ic->ic_parent = bwn_parent;
 679
 680         ieee80211_radiotap_attach(ic,
 681             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 682             BWN_TX_RADIOTAP_PRESENT,
 683             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 684             BWN_RX_RADIOTAP_PRESENT);
 685
 686         bwn_sysctl_node(sc);
 687
 688         if (bootverbose)
 689                 ieee80211_announce(ic);
 690         return (0);
 691 }
 692
 693 static void
 694 bwn_phy_detach(struct bwn_mac *mac)
 695 {
 696
 697         if (mac->mac_phy.detach != NULL)
 698                 mac->mac_phy.detach(mac);
 699 }
 700
 701 static int
 702 bwn_detach(device_t dev)
 703 {
 704         struct bwn_softc *sc = device_get_softc(dev);
 705         struct bwn_mac *mac = sc->sc_curmac;
 706         struct ieee80211com *ic = &sc->sc_ic;
 707         int i;
 708
 709         sc->sc_flags |= BWN_FLAG_INVALID;
 710
 711         if (device_is_attached(sc->sc_dev)) {
 712                 BWN_LOCK(sc);
 713                 bwn_stop(sc);
 714                 BWN_UNLOCK(sc);
 715                 bwn_dma_free(mac);
 716                 callout_drain(&sc->sc_led_blink_ch);
 717                 callout_drain(&sc->sc_rfswitch_ch);
 718                 callout_drain(&sc->sc_task_ch);
 719                 callout_drain(&sc->sc_watchdog_ch);
 720                 bwn_phy_detach(mac);
 721                 ieee80211_draintask(ic, &mac->mac_hwreset);
 722                 ieee80211_draintask(ic, &mac->mac_txpower);
 723                 ieee80211_ifdetach(ic);
 724         }
 725         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 726         taskqueue_free(sc->sc_tq);
 727
 728         for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 729                 if (mac->mac_intrhand[i] != NULL) {
 730                         bus_teardown_intr(dev, mac->mac_res_irq[i],
 731                             mac->mac_intrhand[i]);
 732                         mac->mac_intrhand[i] = NULL;
 733                 }
 734         }
 735         bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
 736         if (mac->mac_msi != 0)
 737                 pci_release_msi(dev);
 738         mbufq_drain(&sc->sc_snd);
 739         BWN_LOCK_DESTROY(sc);
 740         return (0);
 741 }
 742
 743 static void
 744 bwn_attach_pre(struct bwn_softc *sc)
 745 {
 746
 747         BWN_LOCK_INIT(sc);
 748         TAILQ_INIT(&sc->sc_maclist);
 749         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 750         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 751         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 752         mbufq_init(&sc->sc_snd, ifqmaxlen);
 753         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 754                 taskqueue_thread_enqueue, &sc->sc_tq);
 755         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 756                 "%s taskq", device_get_nameunit(sc->sc_dev));
 757 }
 758
 759 static void
 760 bwn_sprom_bugfixes(device_t dev)
 761 {
 762 #define BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)             \
 763         ((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&          \
 764          (siba_get_pci_device(dev) == _device) &&                       \
 765          (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&    \
 766          (siba_get_pci_subdevice(dev) == _subdevice))
 767
 768         if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
 769             siba_get_pci_subdevice(dev) == 0x4e &&
 770             siba_get_pci_revid(dev) > 0x40)
 771                 siba_sprom_set_bf_lo(dev,
 772                     siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
 773         if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
 774             siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
 775                 siba_sprom_set_bf_lo(dev,
 776                     siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
 777         if (siba_get_type(dev) == SIBA_TYPE_PCI) {
 778                 if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
 779                     BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
 780                     BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
 781                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
 782                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
 783                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
 784                     BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
 785                         siba_sprom_set_bf_lo(dev,
 786                             siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
 787         }
 788 #undef  BWN_ISDEV
 789 }
 790
 791 static void
 792 bwn_parent(struct ieee80211com *ic)
 793 {
 794         struct bwn_softc *sc = ic->ic_softc;
 795         int startall = 0;
 796
 797         BWN_LOCK(sc);
 798         if (ic->ic_nrunning > 0) {
 799                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 800                         bwn_init(sc);
 801                         startall = 1;
 802                 } else
 803                         bwn_update_promisc(ic);
 804         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 805                 bwn_stop(sc);
 806         BWN_UNLOCK(sc);
 807
 808         if (startall)
 809                 ieee80211_start_all(ic);
 810 }
 811
 812 static int
 813 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 814 {
 815         struct bwn_softc *sc = ic->ic_softc;
 816         int error;
 817
 818         BWN_LOCK(sc);
 819         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 820                 BWN_UNLOCK(sc);
 821                 return (ENXIO);
 822         }
 823         error = mbufq_enqueue(&sc->sc_snd, m);
 824         if (error) {
 825                 BWN_UNLOCK(sc);
 826                 return (error);
 827         }
 828         bwn_start(sc);
 829         BWN_UNLOCK(sc);
 830         return (0);
 831 }
 832
 833 static void
 834 bwn_start(struct bwn_softc *sc)
 835 {
 836         struct bwn_mac *mac = sc->sc_curmac;
 837         struct ieee80211_frame *wh;
 838         struct ieee80211_node *ni;
 839         struct ieee80211_key *k;
 840         struct mbuf *m;
 841
 842         BWN_ASSERT_LOCKED(sc);
 843
 844         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 845             mac->mac_status < BWN_MAC_STATUS_STARTED)
 846                 return;
 847
 848         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 849                 if (bwn_tx_isfull(sc, m))
 850                         break;
 851                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 852                 if (ni == NULL) {
 853                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
 854                         m_freem(m);
 855                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 856                         continue;
 857                 }
 858                 wh = mtod(m, struct ieee80211_frame *);
 859                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 860                         k = ieee80211_crypto_encap(ni, m);
 861                         if (k == NULL) {
 862                                 if_inc_counter(ni->ni_vap->iv_ifp,
 863                                     IFCOUNTER_OERRORS, 1);
 864                                 ieee80211_free_node(ni);
 865                                 m_freem(m);
 866                                 continue;
 867                         }
 868                 }
 869                 wh = NULL;      /* Catch any invalid use */
 870                 if (bwn_tx_start(sc, ni, m) != 0) {
 871                         if (ni != NULL) {
 872                                 if_inc_counter(ni->ni_vap->iv_ifp,
 873                                     IFCOUNTER_OERRORS, 1);
 874                                 ieee80211_free_node(ni);
 875                         }
 876                         continue;
 877                 }
 878                 sc->sc_watchdog_timer = 5;
 879         }
 880 }
 881
 882 static int
 883 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
 884 {
 885         struct bwn_dma_ring *dr;
 886         struct bwn_mac *mac = sc->sc_curmac;
 887         struct bwn_pio_txqueue *tq;
 888         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 889
 890         BWN_ASSERT_LOCKED(sc);
 891
 892         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 893                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
 894                 if (dr->dr_stop == 1 ||
 895                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
 896                         dr->dr_stop = 1;
 897                         goto full;
 898                 }
 899         } else {
 900                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
 901                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
 902                     pktlen > (tq->tq_size - tq->tq_used))
 903                         goto full;
 904         }
 905         return (0);
 906 full:
 907         mbufq_prepend(&sc->sc_snd, m);
 908         return (1);
 909 }
 910
 911 static int
 912 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
 913 {
 914         struct bwn_mac *mac = sc->sc_curmac;
 915         int error;
 916
 917         BWN_ASSERT_LOCKED(sc);
 918
 919         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
 920                 m_freem(m);
 921                 return (ENXIO);
 922         }
 923
 924         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
 925             bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
 926         if (error) {
 927                 m_freem(m);
 928                 return (error);
 929         }
 930         return (0);
 931 }
 932
 933 static int
 934 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
 935 {
 936         struct bwn_pio_txpkt *tp;
 937         struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
 938         struct bwn_softc *sc = mac->mac_sc;
 939         struct bwn_txhdr txhdr;
 940         struct mbuf *m_new;
 941         uint32_t ctl32;
 942         int error;
 943         uint16_t ctl16;
 944
 945         BWN_ASSERT_LOCKED(sc);
 946
 947         /* XXX TODO send packets after DTIM */
 948
 949         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
 950         tp = TAILQ_FIRST(&tq->tq_pktlist);
 951         tp->tp_ni = ni;
 952         tp->tp_m = m;
 953
 954         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
 955         if (error) {
 956                 device_printf(sc->sc_dev, "tx fail\n");
 957                 return (error);
 958         }
 959
 960         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
 961         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 962         tq->tq_free--;
 963
 964         if (siba_get_revid(sc->sc_dev) >= 8) {
 965                 /*
 966                  * XXX please removes m_defrag(9)
 967                  */
 968                 m_new = m_defrag(m, M_NOWAIT);
 969                 if (m_new == NULL) {
 970                         device_printf(sc->sc_dev,
 971                             "%s: can't defrag TX buffer\n",
 972                             __func__);
 973                         return (ENOBUFS);
 974                 }
 975                 if (m_new->m_next != NULL)
 976                         device_printf(sc->sc_dev,
 977                             "TODO: fragmented packets for PIO\n");
 978                 tp->tp_m = m_new;
 979
 980                 /* send HEADER */
 981                 ctl32 = bwn_pio_write_multi_4(mac, tq,
 982                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
 983                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
 984                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 985                 /* send BODY */
 986                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
 987                     mtod(m_new, const void *), m_new->m_pkthdr.len);
 988                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
 989                     ctl32 | BWN_PIO8_TXCTL_EOF);
 990         } else {
 991                 ctl16 = bwn_pio_write_multi_2(mac, tq,
 992                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
 993                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
 994                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 995                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
 996                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
 997                     ctl16 | BWN_PIO_TXCTL_EOF);
 998         }
 999
1000         return (0);
1001 }
1002
1003 static struct bwn_pio_txqueue *
1004 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1005 {
1006
1007         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1008                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1009
1010         switch (prio) {
1011         case 0:
1012                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1013         case 1:
1014                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1015         case 2:
1016                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1017         case 3:
1018                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1019         }
1020         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1021         return (NULL);
1022 }
1023
1024 static int
1025 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1026 {
1027 #define BWN_GET_TXHDRCACHE(slot)                                        \
1028         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1029         struct bwn_dma *dma = &mac->mac_method.dma;
1030         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1031         struct bwn_dmadesc_generic *desc;
1032         struct bwn_dmadesc_meta *mt;
1033         struct bwn_softc *sc = mac->mac_sc;
1034         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1035         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1036
1037         BWN_ASSERT_LOCKED(sc);
1038         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1039
1040         /* XXX send after DTIM */
1041
1042         slot = bwn_dma_getslot(dr);
1043         dr->getdesc(dr, slot, &desc, &mt);
1044         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1045             ("%s:%d: fail", __func__, __LINE__));
1046
1047         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1048             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1049             BWN_DMA_COOKIE(dr, slot));
1050         if (error)
1051                 goto fail;
1052         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1053             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1054             &mt->mt_paddr, BUS_DMA_NOWAIT);
1055         if (error) {
1056                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1057                     __func__, error);
1058                 goto fail;
1059         }
1060         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1061             BUS_DMASYNC_PREWRITE);
1062         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1063         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1064             BUS_DMASYNC_PREWRITE);
1065
1066         slot = bwn_dma_getslot(dr);
1067         dr->getdesc(dr, slot, &desc, &mt);
1068         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1069             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1070         mt->mt_m = m;
1071         mt->mt_ni = ni;
1072
1073         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1074             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1075         if (error && error != EFBIG) {
1076                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1077                     __func__, error);
1078                 goto fail;
1079         }
1080         if (error) {    /* error == EFBIG */
1081                 struct mbuf *m_new;
1082
1083                 m_new = m_defrag(m, M_NOWAIT);
1084                 if (m_new == NULL) {
1085                         device_printf(sc->sc_dev,
1086                             "%s: can't defrag TX buffer\n",
1087                             __func__);
1088                         error = ENOBUFS;
1089                         goto fail;
1090                 } else {
1091                         m = m_new;
1092                 }
1093
1094                 mt->mt_m = m;
1095                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1096                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1097                 if (error) {
1098                         device_printf(sc->sc_dev,
1099                             "%s: can't load TX buffer (2) %d\n",
1100                             __func__, error);
1101                         goto fail;
1102                 }
1103         }
1104         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1105         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1106         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1107             BUS_DMASYNC_PREWRITE);
1108
1109         /* XXX send after DTIM */
1110
1111         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1112         return (0);
1113 fail:
1114         dr->dr_curslot = backup[0];
1115         dr->dr_usedslot = backup[1];
1116         return (error);
1117 #undef BWN_GET_TXHDRCACHE
1118 }
1119
1120 static void
1121 bwn_watchdog(void *arg)
1122 {
1123         struct bwn_softc *sc = arg;
1124
1125         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1126                 device_printf(sc->sc_dev, "device timeout\n");
1127                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1128         }
1129         callout_schedule(&sc->sc_watchdog_ch, hz);
1130 }
1131
1132 static int
1133 bwn_attach_core(struct bwn_mac *mac)
1134 {
1135         struct bwn_softc *sc = mac->mac_sc;
1136         int error, have_bg = 0, have_a = 0;
1137         uint32_t high;
1138
1139         KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1140             ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1141
1142         siba_powerup(sc->sc_dev, 0);
1143
1144         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1145         bwn_reset_core(mac,
1146             (high & BWN_TGSHIGH_HAVE_2GHZ) ? BWN_TGSLOW_SUPPORT_G : 0);
1147         error = bwn_phy_getinfo(mac, high);
1148         if (error)
1149                 goto fail;
1150
1151         have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1152         have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1153         if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1154             siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1155             siba_get_pci_device(sc->sc_dev) != 0x4324) {
1156                 have_a = have_bg = 0;
1157                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1158                         have_a = 1;
1159                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1160                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1161                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1162                         have_bg = 1;
1163                 else
1164                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1165                             mac->mac_phy.type));
1166         }
1167         /* XXX turns off PHY A because it's not supported */
1168         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1169             mac->mac_phy.type != BWN_PHYTYPE_N) {
1170                 have_a = 0;
1171                 have_bg = 1;
1172         }
1173
1174         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1175                 mac->mac_phy.attach = bwn_phy_g_attach;
1176                 mac->mac_phy.detach = bwn_phy_g_detach;
1177                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1178                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1179                 mac->mac_phy.init = bwn_phy_g_init;
1180                 mac->mac_phy.exit = bwn_phy_g_exit;
1181                 mac->mac_phy.phy_read = bwn_phy_g_read;
1182                 mac->mac_phy.phy_write = bwn_phy_g_write;
1183                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1184                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1185                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1186                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1187                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1188                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1189                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1190                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1191                 mac->mac_phy.set_im = bwn_phy_g_im;
1192                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1193                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1194                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1195                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1196         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1197                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1198                 mac->mac_phy.init = bwn_phy_lp_init;
1199                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1200                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1201                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1202                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1203                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1204                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1205                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1206                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1207                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1208                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1209                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1210         } else {
1211                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1212                     mac->mac_phy.type);
1213                 error = ENXIO;
1214                 goto fail;
1215         }
1216
1217         mac->mac_phy.gmode = have_bg;
1218         if (mac->mac_phy.attach != NULL) {
1219                 error = mac->mac_phy.attach(mac);
1220                 if (error) {
1221                         device_printf(sc->sc_dev, "failed\n");
1222                         goto fail;
1223                 }
1224         }
1225
1226         bwn_reset_core(mac, have_bg ? BWN_TGSLOW_SUPPORT_G : 0);
1227
1228         error = bwn_chiptest(mac);
1229         if (error)
1230                 goto fail;
1231         error = bwn_setup_channels(mac, have_bg, have_a);
1232         if (error) {
1233                 device_printf(sc->sc_dev, "failed to setup channels\n");
1234                 goto fail;
1235         }
1236
1237         if (sc->sc_curmac == NULL)
1238                 sc->sc_curmac = mac;
1239
1240         error = bwn_dma_attach(mac);
1241         if (error != 0) {
1242                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1243                 goto fail;
1244         }
1245
1246         mac->mac_phy.switch_analog(mac, 0);
1247
1248         siba_dev_down(sc->sc_dev, 0);
1249 fail:
1250         siba_powerdown(sc->sc_dev);
1251         return (error);
1252 }
1253
1254 void
1255 bwn_reset_core(struct bwn_mac *mac, uint32_t flags)
1256 {
1257         struct bwn_softc *sc = mac->mac_sc;
1258         uint32_t low, ctl;
1259
1260         flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1261
1262         siba_dev_up(sc->sc_dev, flags);
1263         DELAY(2000);
1264
1265         low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1266             ~BWN_TGSLOW_PHYRESET;
1267         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1268         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1269         DELAY(1000);
1270         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1271         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1272         DELAY(1000);
1273
1274         if (mac->mac_phy.switch_analog != NULL)
1275                 mac->mac_phy.switch_analog(mac, 1);
1276
1277         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1278         if (flags & BWN_TGSLOW_SUPPORT_G)
1279                 ctl |= BWN_MACCTL_GMODE;
1280         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1281 }
1282
1283 static int
1284 bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1285 {
1286         struct bwn_phy *phy = &mac->mac_phy;
1287         struct bwn_softc *sc = mac->mac_sc;
1288         uint32_t tmp;
1289
1290         /* PHY */
1291         tmp = BWN_READ_2(mac, BWN_PHYVER);
1292         phy->gmode = (tgshigh & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1293         phy->rf_on = 1;
1294         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1295         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1296         phy->rev = (tmp & BWN_PHYVER_VERSION);
1297         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1298             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1299                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1300             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1301             (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1302             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1303                 goto unsupphy;
1304
1305         /* RADIO */
1306         if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1307                 if (siba_get_chiprev(sc->sc_dev) == 0)
1308                         tmp = 0x3205017f;
1309                 else if (siba_get_chiprev(sc->sc_dev) == 1)
1310                         tmp = 0x4205017f;
1311                 else
1312                         tmp = 0x5205017f;
1313         } else {
1314                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1315                 tmp = BWN_READ_2(mac, BWN_RFDATALO);
1316                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1317                 tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1318         }
1319         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1320         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1321         phy->rf_manuf = (tmp & 0x00000fff);
1322         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1323                 goto unsupradio;
1324         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1325              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1326             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1327             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1328             (phy->type == BWN_PHYTYPE_N &&
1329              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1330             (phy->type == BWN_PHYTYPE_LP &&
1331              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1332                 goto unsupradio;
1333
1334         return (0);
1335 unsupphy:
1336         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1337             "analog %#x)\n",
1338             phy->type, phy->rev, phy->analog);
1339         return (ENXIO);
1340 unsupradio:
1341         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1342             "rev %#x)\n",
1343             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1344         return (ENXIO);
1345 }
1346
1347 static int
1348 bwn_chiptest(struct bwn_mac *mac)
1349 {
1350 #define TESTVAL0        0x55aaaa55
1351 #define TESTVAL1        0xaa5555aa
1352         struct bwn_softc *sc = mac->mac_sc;
1353         uint32_t v, backup;
1354
1355         BWN_LOCK(sc);
1356
1357         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1358
1359         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1360         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1361                 goto error;
1362         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1363         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1364                 goto error;
1365
1366         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1367
1368         if ((siba_get_revid(sc->sc_dev) >= 3) &&
1369             (siba_get_revid(sc->sc_dev) <= 10)) {
1370                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1371                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1372                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1373                         goto error;
1374                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1375                         goto error;
1376         }
1377         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1378
1379         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1380         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1381                 goto error;
1382
1383         BWN_UNLOCK(sc);
1384         return (0);
1385 error:
1386         BWN_UNLOCK(sc);
1387         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1388         return (ENODEV);
1389 }
1390
1391 #define IEEE80211_CHAN_HTG      (IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1392 #define IEEE80211_CHAN_HTA      (IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1393
1394 static int
1395 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1396 {
1397         struct bwn_softc *sc = mac->mac_sc;
1398         struct ieee80211com *ic = &sc->sc_ic;
1399
1400         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1401         ic->ic_nchans = 0;
1402
1403         if (have_bg)
1404                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1405                     &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1406         if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1407                 if (have_a)
1408                         bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1409                             &ic->ic_nchans, &bwn_chantable_n,
1410                             IEEE80211_CHAN_HTA);
1411         } else {
1412                 if (have_a)
1413                         bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1414                             &ic->ic_nchans, &bwn_chantable_a,
1415                             IEEE80211_CHAN_A);
1416         }
1417
1418         mac->mac_phy.supports_2ghz = have_bg;
1419         mac->mac_phy.supports_5ghz = have_a;
1420
1421         return (ic->ic_nchans == 0 ? ENXIO : 0);
1422 }
1423
1424 uint32_t
1425 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1426 {
1427         uint32_t ret;
1428
1429         BWN_ASSERT_LOCKED(mac->mac_sc);
1430
1431         if (way == BWN_SHARED) {
1432                 KASSERT((offset & 0x0001) == 0,
1433                     ("%s:%d warn", __func__, __LINE__));
1434                 if (offset & 0x0003) {
1435                         bwn_shm_ctlword(mac, way, offset >> 2);
1436                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1437                         ret <<= 16;
1438                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1439                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1440                         goto out;
1441                 }
1442                 offset >>= 2;
1443         }
1444         bwn_shm_ctlword(mac, way, offset);
1445         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1446 out:
1447         return (ret);
1448 }
1449
1450 uint16_t
1451 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1452 {
1453         uint16_t ret;
1454
1455         BWN_ASSERT_LOCKED(mac->mac_sc);
1456
1457         if (way == BWN_SHARED) {
1458                 KASSERT((offset & 0x0001) == 0,
1459                     ("%s:%d warn", __func__, __LINE__));
1460                 if (offset & 0x0003) {
1461                         bwn_shm_ctlword(mac, way, offset >> 2);
1462                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1463                         goto out;
1464                 }
1465                 offset >>= 2;
1466         }
1467         bwn_shm_ctlword(mac, way, offset);
1468         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1469 out:
1470
1471         return (ret);
1472 }
1473
1474 static void
1475 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1476     uint16_t offset)
1477 {
1478         uint32_t control;
1479
1480         control = way;
1481         control <<= 16;
1482         control |= offset;
1483         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1484 }
1485
1486 void
1487 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1488     uint32_t value)
1489 {
1490         BWN_ASSERT_LOCKED(mac->mac_sc);
1491
1492         if (way == BWN_SHARED) {
1493                 KASSERT((offset & 0x0001) == 0,
1494                     ("%s:%d warn", __func__, __LINE__));
1495                 if (offset & 0x0003) {
1496                         bwn_shm_ctlword(mac, way, offset >> 2);
1497                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1498                                     (value >> 16) & 0xffff);
1499                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1500                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1501                         return;
1502                 }
1503                 offset >>= 2;
1504         }
1505         bwn_shm_ctlword(mac, way, offset);
1506         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1507 }
1508
1509 void
1510 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1511     uint16_t value)
1512 {
1513         BWN_ASSERT_LOCKED(mac->mac_sc);
1514
1515         if (way == BWN_SHARED) {
1516                 KASSERT((offset & 0x0001) == 0,
1517                     ("%s:%d warn", __func__, __LINE__));
1518                 if (offset & 0x0003) {
1519                         bwn_shm_ctlword(mac, way, offset >> 2);
1520                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1521                         return;
1522                 }
1523                 offset >>= 2;
1524         }
1525         bwn_shm_ctlword(mac, way, offset);
1526         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1527 }
1528
1529 static void
1530 bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1531     int txpow)
1532 {
1533
1534         c->ic_freq = freq;
1535         c->ic_flags = flags;
1536         c->ic_ieee = ieee;
1537         c->ic_minpower = 0;
1538         c->ic_maxpower = 2 * txpow;
1539         c->ic_maxregpower = txpow;
1540 }
1541
1542 static void
1543 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1544     const struct bwn_channelinfo *ci, int flags)
1545 {
1546         struct ieee80211_channel *c;
1547         int i;
1548
1549         c = &chans[*nchans];
1550
1551         for (i = 0; i < ci->nchannels; i++) {
1552                 const struct bwn_channel *hc;
1553
1554                 hc = &ci->channels[i];
1555                 if (*nchans >= maxchans)
1556                         break;
1557                 bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1558                 c++, (*nchans)++;
1559                 if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1560                         /* g channel have a separate b-only entry */
1561                         if (*nchans >= maxchans)
1562                                 break;
1563                         c[0] = c[-1];
1564                         c[-1].ic_flags = IEEE80211_CHAN_B;
1565                         c++, (*nchans)++;
1566                 }
1567                 if (flags == IEEE80211_CHAN_HTG) {
1568                         /* HT g channel have a separate g-only entry */
1569                         if (*nchans >= maxchans)
1570                                 break;
1571                         c[-1].ic_flags = IEEE80211_CHAN_G;
1572                         c[0] = c[-1];
1573                         c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1574                         c[0].ic_flags |= IEEE80211_CHAN_HT20;   /* HT20 */
1575                         c++, (*nchans)++;
1576                 }
1577                 if (flags == IEEE80211_CHAN_HTA) {
1578                         /* HT a channel have a separate a-only entry */
1579                         if (*nchans >= maxchans)
1580                                 break;
1581                         c[-1].ic_flags = IEEE80211_CHAN_A;
1582                         c[0] = c[-1];
1583                         c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1584                         c[0].ic_flags |= IEEE80211_CHAN_HT20;   /* HT20 */
1585                         c++, (*nchans)++;
1586                 }
1587         }
1588 }
1589
1590 static int
1591 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1592         const struct ieee80211_bpf_params *params)
1593 {
1594         struct ieee80211com *ic = ni->ni_ic;
1595         struct bwn_softc *sc = ic->ic_softc;
1596         struct bwn_mac *mac = sc->sc_curmac;
1597         int error;
1598
1599         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1600             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1601                 m_freem(m);
1602                 return (ENETDOWN);
1603         }
1604
1605         BWN_LOCK(sc);
1606         if (bwn_tx_isfull(sc, m)) {
1607                 m_freem(m);
1608                 BWN_UNLOCK(sc);
1609                 return (ENOBUFS);
1610         }
1611
1612         error = bwn_tx_start(sc, ni, m);
1613         if (error == 0)
1614                 sc->sc_watchdog_timer = 5;
1615         BWN_UNLOCK(sc);
1616         return (error);
1617 }
1618
1619 /*
1620  * Callback from the 802.11 layer to update the slot time
1621  * based on the current setting.  We use it to notify the
1622  * firmware of ERP changes and the f/w takes care of things
1623  * like slot time and preamble.
1624  */
1625 static void
1626 bwn_updateslot(struct ieee80211com *ic)
1627 {
1628         struct bwn_softc *sc = ic->ic_softc;
1629         struct bwn_mac *mac;
1630
1631         BWN_LOCK(sc);
1632         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1633                 mac = (struct bwn_mac *)sc->sc_curmac;
1634                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1635         }
1636         BWN_UNLOCK(sc);
1637 }
1638
1639 /*
1640  * Callback from the 802.11 layer after a promiscuous mode change.
1641  * Note this interface does not check the operating mode as this
1642  * is an internal callback and we are expected to honor the current
1643  * state (e.g. this is used for setting the interface in promiscuous
1644  * mode when operating in hostap mode to do ACS).
1645  */
1646 static void
1647 bwn_update_promisc(struct ieee80211com *ic)
1648 {
1649         struct bwn_softc *sc = ic->ic_softc;
1650         struct bwn_mac *mac = sc->sc_curmac;
1651
1652         BWN_LOCK(sc);
1653         mac = sc->sc_curmac;
1654         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1655                 if (ic->ic_promisc > 0)
1656                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1657                 else
1658                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1659                 bwn_set_opmode(mac);
1660         }
1661         BWN_UNLOCK(sc);
1662 }
1663
1664 /*
1665  * Callback from the 802.11 layer to update WME parameters.
1666  */
1667 static int
1668 bwn_wme_update(struct ieee80211com *ic)
1669 {
1670         struct bwn_softc *sc = ic->ic_softc;
1671         struct bwn_mac *mac = sc->sc_curmac;
1672         struct wmeParams *wmep;
1673         int i;
1674
1675         BWN_LOCK(sc);
1676         mac = sc->sc_curmac;
1677         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1678                 bwn_mac_suspend(mac);
1679                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1680                         wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1681                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1682                 }
1683                 bwn_mac_enable(mac);
1684         }
1685         BWN_UNLOCK(sc);
1686         return (0);
1687 }
1688
1689 static void
1690 bwn_scan_start(struct ieee80211com *ic)
1691 {
1692         struct bwn_softc *sc = ic->ic_softc;
1693         struct bwn_mac *mac;
1694
1695         BWN_LOCK(sc);
1696         mac = sc->sc_curmac;
1697         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1698                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1699                 bwn_set_opmode(mac);
1700                 /* disable CFP update during scan */
1701                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1702         }
1703         BWN_UNLOCK(sc);
1704 }
1705
1706 static void
1707 bwn_scan_end(struct ieee80211com *ic)
1708 {
1709         struct bwn_softc *sc = ic->ic_softc;
1710         struct bwn_mac *mac;
1711
1712         BWN_LOCK(sc);
1713         mac = sc->sc_curmac;
1714         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1715                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1716                 bwn_set_opmode(mac);
1717                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1718         }
1719         BWN_UNLOCK(sc);
1720 }
1721
1722 static void
1723 bwn_set_channel(struct ieee80211com *ic)
1724 {
1725         struct bwn_softc *sc = ic->ic_softc;
1726         struct bwn_mac *mac = sc->sc_curmac;
1727         struct bwn_phy *phy = &mac->mac_phy;
1728         int chan, error;
1729
1730         BWN_LOCK(sc);
1731
1732         error = bwn_switch_band(sc, ic->ic_curchan);
1733         if (error)
1734                 goto fail;
1735         bwn_mac_suspend(mac);
1736         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1737         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1738         if (chan != phy->chan)
1739                 bwn_switch_channel(mac, chan);
1740
1741         /* TX power level */
1742         if (ic->ic_curchan->ic_maxpower != 0 &&
1743             ic->ic_curchan->ic_maxpower != phy->txpower) {
1744                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1745                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1746                     BWN_TXPWR_IGNORE_TSSI);
1747         }
1748
1749         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1750         if (phy->set_antenna)
1751                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1752
1753         if (sc->sc_rf_enabled != phy->rf_on) {
1754                 if (sc->sc_rf_enabled) {
1755                         bwn_rf_turnon(mac);
1756                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1757                                 device_printf(sc->sc_dev,
1758                                     "please turn on the RF switch\n");
1759                 } else
1760                         bwn_rf_turnoff(mac);
1761         }
1762
1763         bwn_mac_enable(mac);
1764
1765 fail:
1766         /*
1767          * Setup radio tap channel freq and flags
1768          */
1769         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1770                 htole16(ic->ic_curchan->ic_freq);
1771         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1772                 htole16(ic->ic_curchan->ic_flags & 0xffff);
1773
1774         BWN_UNLOCK(sc);
1775 }
1776
1777 static struct ieee80211vap *
1778 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1779     enum ieee80211_opmode opmode, int flags,
1780     const uint8_t bssid[IEEE80211_ADDR_LEN],
1781     const uint8_t mac[IEEE80211_ADDR_LEN])
1782 {
1783         struct ieee80211vap *vap;
1784         struct bwn_vap *bvp;
1785
1786         switch (opmode) {
1787         case IEEE80211_M_HOSTAP:
1788         case IEEE80211_M_MBSS:
1789         case IEEE80211_M_STA:
1790         case IEEE80211_M_WDS:
1791         case IEEE80211_M_MONITOR:
1792         case IEEE80211_M_IBSS:
1793         case IEEE80211_M_AHDEMO:
1794                 break;
1795         default:
1796                 return (NULL);
1797         }
1798
1799         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1800         vap = &bvp->bv_vap;
1801         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1802         /* override with driver methods */
1803         bvp->bv_newstate = vap->iv_newstate;
1804         vap->iv_newstate = bwn_newstate;
1805
1806         /* override max aid so sta's cannot assoc when we're out of sta id's */
1807         vap->iv_max_aid = BWN_STAID_MAX;
1808
1809         ieee80211_ratectl_init(vap);
1810
1811         /* complete setup */
1812         ieee80211_vap_attach(vap, ieee80211_media_change,
1813             ieee80211_media_status, mac);
1814         return (vap);
1815 }
1816
1817 static void
1818 bwn_vap_delete(struct ieee80211vap *vap)
1819 {
1820         struct bwn_vap *bvp = BWN_VAP(vap);
1821
1822         ieee80211_ratectl_deinit(vap);
1823         ieee80211_vap_detach(vap);
1824         free(bvp, M_80211_VAP);
1825 }
1826
1827 static int
1828 bwn_init(struct bwn_softc *sc)
1829 {
1830         struct bwn_mac *mac;
1831         int error;
1832
1833         BWN_ASSERT_LOCKED(sc);
1834
1835         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1836         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1837         sc->sc_filters = 0;
1838         bwn_wme_clear(sc);
1839         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1840         sc->sc_rf_enabled = 1;
1841
1842         mac = sc->sc_curmac;
1843         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1844                 error = bwn_core_init(mac);
1845                 if (error != 0)
1846                         return (error);
1847         }
1848         if (mac->mac_status == BWN_MAC_STATUS_INITED)
1849                 bwn_core_start(mac);
1850
1851         bwn_set_opmode(mac);
1852         bwn_set_pretbtt(mac);
1853         bwn_spu_setdelay(mac, 0);
1854         bwn_set_macaddr(mac);
1855
1856         sc->sc_flags |= BWN_FLAG_RUNNING;
1857         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1858         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1859
1860         return (0);
1861 }
1862
1863 static void
1864 bwn_stop(struct bwn_softc *sc)
1865 {
1866         struct bwn_mac *mac = sc->sc_curmac;
1867
1868         BWN_ASSERT_LOCKED(sc);
1869
1870         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1871                 /* XXX FIXME opmode not based on VAP */
1872                 bwn_set_opmode(mac);
1873                 bwn_set_macaddr(mac);
1874         }
1875
1876         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1877                 bwn_core_stop(mac);
1878
1879         callout_stop(&sc->sc_led_blink_ch);
1880         sc->sc_led_blinking = 0;
1881
1882         bwn_core_exit(mac);
1883         sc->sc_rf_enabled = 0;
1884
1885         sc->sc_flags &= ~BWN_FLAG_RUNNING;
1886 }
1887
1888 static void
1889 bwn_wme_clear(struct bwn_softc *sc)
1890 {
1891 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1892         struct wmeParams *p;
1893         unsigned int i;
1894
1895         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1896             ("%s:%d: fail", __func__, __LINE__));
1897
1898         for (i = 0; i < N(sc->sc_wmeParams); i++) {
1899                 p = &(sc->sc_wmeParams[i]);
1900
1901                 switch (bwn_wme_shm_offsets[i]) {
1902                 case BWN_WME_VOICE:
1903                         p->wmep_txopLimit = 0;
1904                         p->wmep_aifsn = 2;
1905                         /* XXX FIXME: log2(cwmin) */
1906                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1907                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1908                         break;
1909                 case BWN_WME_VIDEO:
1910                         p->wmep_txopLimit = 0;
1911                         p->wmep_aifsn = 2;
1912                         /* XXX FIXME: log2(cwmin) */
1913                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1914                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1915                         break;
1916                 case BWN_WME_BESTEFFORT:
1917                         p->wmep_txopLimit = 0;
1918                         p->wmep_aifsn = 3;
1919                         /* XXX FIXME: log2(cwmin) */
1920                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1921                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1922                         break;
1923                 case BWN_WME_BACKGROUND:
1924                         p->wmep_txopLimit = 0;
1925                         p->wmep_aifsn = 7;
1926                         /* XXX FIXME: log2(cwmin) */
1927                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1928                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1929                         break;
1930                 default:
1931                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1932                 }
1933         }
1934 }
1935
1936 static int
1937 bwn_core_init(struct bwn_mac *mac)
1938 {
1939         struct bwn_softc *sc = mac->mac_sc;
1940         uint64_t hf;
1941         int error;
1942
1943         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
1944             ("%s:%d: fail", __func__, __LINE__));
1945
1946         siba_powerup(sc->sc_dev, 0);
1947         if (!siba_dev_isup(sc->sc_dev))
1948                 bwn_reset_core(mac,
1949                     mac->mac_phy.gmode ? BWN_TGSLOW_SUPPORT_G : 0);
1950
1951         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
1952         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
1953         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
1954         BWN_GETTIME(mac->mac_phy.nexttime);
1955         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
1956         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
1957         mac->mac_stats.link_noise = -95;
1958         mac->mac_reason_intr = 0;
1959         bzero(mac->mac_reason, sizeof(mac->mac_reason));
1960         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
1961 #ifdef BWN_DEBUG
1962         if (sc->sc_debug & BWN_DEBUG_XMIT)
1963                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
1964 #endif
1965         mac->mac_suspended = 1;
1966         mac->mac_task_state = 0;
1967         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
1968
1969         mac->mac_phy.init_pre(mac);
1970
1971         siba_pcicore_intr(sc->sc_dev);
1972
1973         siba_fix_imcfglobug(sc->sc_dev);
1974         bwn_bt_disable(mac);
1975         if (mac->mac_phy.prepare_hw) {
1976                 error = mac->mac_phy.prepare_hw(mac);
1977                 if (error)
1978                         goto fail0;
1979         }
1980         error = bwn_chip_init(mac);
1981         if (error)
1982                 goto fail0;
1983         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
1984             siba_get_revid(sc->sc_dev));
1985         hf = bwn_hf_read(mac);
1986         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1987                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
1988                 if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
1989                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
1990                 if (mac->mac_phy.rev == 1)
1991                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
1992         }
1993         if (mac->mac_phy.rf_ver == 0x2050) {
1994                 if (mac->mac_phy.rf_rev < 6)
1995                         hf |= BWN_HF_FORCE_VCO_RECALC;
1996                 if (mac->mac_phy.rf_rev == 6)
1997                         hf |= BWN_HF_4318_TSSI;
1998         }
1999         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2000                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2001         if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2002             (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2003                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2004         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2005         bwn_hf_write(mac, hf);
2006
2007         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2008         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2009         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2010         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2011
2012         bwn_rate_init(mac);
2013         bwn_set_phytxctl(mac);
2014
2015         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2016             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2017         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2018
2019         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2020                 bwn_pio_init(mac);
2021         else
2022                 bwn_dma_init(mac);
2023         bwn_wme_init(mac);
2024         bwn_spu_setdelay(mac, 1);
2025         bwn_bt_enable(mac);
2026
2027         siba_powerup(sc->sc_dev,
2028             !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2029         bwn_set_macaddr(mac);
2030         bwn_crypt_init(mac);
2031
2032         /* XXX LED initializatin */
2033
2034         mac->mac_status = BWN_MAC_STATUS_INITED;
2035
2036         return (error);
2037
2038 fail0:
2039         siba_powerdown(sc->sc_dev);
2040         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2041             ("%s:%d: fail", __func__, __LINE__));
2042         return (error);
2043 }
2044
2045 static void
2046 bwn_core_start(struct bwn_mac *mac)
2047 {
2048         struct bwn_softc *sc = mac->mac_sc;
2049         uint32_t tmp;
2050
2051         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2052             ("%s:%d: fail", __func__, __LINE__));
2053
2054         if (siba_get_revid(sc->sc_dev) < 5)
2055                 return;
2056
2057         while (1) {
2058                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2059                 if (!(tmp & 0x00000001))
2060                         break;
2061                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2062         }
2063
2064         bwn_mac_enable(mac);
2065         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2066         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2067
2068         mac->mac_status = BWN_MAC_STATUS_STARTED;
2069 }
2070
2071 static void
2072 bwn_core_exit(struct bwn_mac *mac)
2073 {
2074         struct bwn_softc *sc = mac->mac_sc;
2075         uint32_t macctl;
2076
2077         BWN_ASSERT_LOCKED(mac->mac_sc);
2078
2079         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2080             ("%s:%d: fail", __func__, __LINE__));
2081
2082         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2083                 return;
2084         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2085
2086         macctl = BWN_READ_4(mac, BWN_MACCTL);
2087         macctl &= ~BWN_MACCTL_MCODE_RUN;
2088         macctl |= BWN_MACCTL_MCODE_JMP0;
2089         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2090
2091         bwn_dma_stop(mac);
2092         bwn_pio_stop(mac);
2093         bwn_chip_exit(mac);
2094         mac->mac_phy.switch_analog(mac, 0);
2095         siba_dev_down(sc->sc_dev, 0);
2096         siba_powerdown(sc->sc_dev);
2097 }
2098
2099 static void
2100 bwn_bt_disable(struct bwn_mac *mac)
2101 {
2102         struct bwn_softc *sc = mac->mac_sc;
2103
2104         (void)sc;
2105         /* XXX do nothing yet */
2106 }
2107
2108 static int
2109 bwn_chip_init(struct bwn_mac *mac)
2110 {
2111         struct bwn_softc *sc = mac->mac_sc;
2112         struct bwn_phy *phy = &mac->mac_phy;
2113         uint32_t macctl;
2114         int error;
2115
2116         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2117         if (phy->gmode)
2118                 macctl |= BWN_MACCTL_GMODE;
2119         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2120
2121         error = bwn_fw_fillinfo(mac);
2122         if (error)
2123                 return (error);
2124         error = bwn_fw_loaducode(mac);
2125         if (error)
2126                 return (error);
2127
2128         error = bwn_gpio_init(mac);
2129         if (error)
2130                 return (error);
2131
2132         error = bwn_fw_loadinitvals(mac);
2133         if (error) {
2134                 siba_gpio_set(sc->sc_dev, 0);
2135                 return (error);
2136         }
2137         phy->switch_analog(mac, 1);
2138         error = bwn_phy_init(mac);
2139         if (error) {
2140                 siba_gpio_set(sc->sc_dev, 0);
2141                 return (error);
2142         }
2143         if (phy->set_im)
2144                 phy->set_im(mac, BWN_IMMODE_NONE);
2145         if (phy->set_antenna)
2146                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2147         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2148
2149         if (phy->type == BWN_PHYTYPE_B)
2150                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2151         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2152         if (siba_get_revid(sc->sc_dev) < 5)
2153                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2154
2155         BWN_WRITE_4(mac, BWN_MACCTL,
2156             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2157         BWN_WRITE_4(mac, BWN_MACCTL,
2158             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2159         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2160
2161         bwn_set_opmode(mac);
2162         if (siba_get_revid(sc->sc_dev) < 3) {
2163                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2164                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2165                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2166                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2167         } else {
2168                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2169                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2170         }
2171         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2172         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2173         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2174         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2175         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2176         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2177         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2178         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
2179             siba_read_4(sc->sc_dev, SIBA_TGSLOW) | 0x00100000);
2180         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2181         return (error);
2182 }
2183
2184 /* read hostflags */
2185 uint64_t
2186 bwn_hf_read(struct bwn_mac *mac)
2187 {
2188         uint64_t ret;
2189
2190         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2191         ret <<= 16;
2192         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2193         ret <<= 16;
2194         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2195         return (ret);
2196 }
2197
2198 void
2199 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2200 {
2201
2202         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2203             (value & 0x00000000ffffull));
2204         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2205             (value & 0x0000ffff0000ull) >> 16);
2206         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2207             (value & 0xffff00000000ULL) >> 32);
2208 }
2209
2210 static void
2211 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2212 {
2213
2214         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2215         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2216 }
2217
2218 static void
2219 bwn_rate_init(struct bwn_mac *mac)
2220 {
2221
2222         switch (mac->mac_phy.type) {
2223         case BWN_PHYTYPE_A:
2224         case BWN_PHYTYPE_G:
2225         case BWN_PHYTYPE_LP:
2226         case BWN_PHYTYPE_N:
2227                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2228                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2229                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2230                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2231                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2232                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2233                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2234                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2235                         break;
2236                 /* FALLTHROUGH */
2237         case BWN_PHYTYPE_B:
2238                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2239                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2240                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2241                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2242                 break;
2243         default:
2244                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2245         }
2246 }
2247
2248 static void
2249 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2250 {
2251         uint16_t offset;
2252
2253         if (ofdm) {
2254                 offset = 0x480;
2255                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2256         } else {
2257                 offset = 0x4c0;
2258                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2259         }
2260         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2261             bwn_shm_read_2(mac, BWN_SHARED, offset));
2262 }
2263
2264 static uint8_t
2265 bwn_plcp_getcck(const uint8_t bitrate)
2266 {
2267
2268         switch (bitrate) {
2269         case BWN_CCK_RATE_1MB:
2270                 return (0x0a);
2271         case BWN_CCK_RATE_2MB:
2272                 return (0x14);
2273         case BWN_CCK_RATE_5MB:
2274                 return (0x37);
2275         case BWN_CCK_RATE_11MB:
2276                 return (0x6e);
2277         }
2278         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2279         return (0);
2280 }
2281
2282 static uint8_t
2283 bwn_plcp_getofdm(const uint8_t bitrate)
2284 {
2285
2286         switch (bitrate) {
2287         case BWN_OFDM_RATE_6MB:
2288                 return (0xb);
2289         case BWN_OFDM_RATE_9MB:
2290                 return (0xf);
2291         case BWN_OFDM_RATE_12MB:
2292                 return (0xa);
2293         case BWN_OFDM_RATE_18MB:
2294                 return (0xe);
2295         case BWN_OFDM_RATE_24MB:
2296                 return (0x9);
2297         case BWN_OFDM_RATE_36MB:
2298                 return (0xd);
2299         case BWN_OFDM_RATE_48MB:
2300                 return (0x8);
2301         case BWN_OFDM_RATE_54MB:
2302                 return (0xc);
2303         }
2304         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2305         return (0);
2306 }
2307
2308 static void
2309 bwn_set_phytxctl(struct bwn_mac *mac)
2310 {
2311         uint16_t ctl;
2312
2313         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2314             BWN_TX_PHY_TXPWR);
2315         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2316         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2317         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2318 }
2319
2320 static void
2321 bwn_pio_init(struct bwn_mac *mac)
2322 {
2323         struct bwn_pio *pio = &mac->mac_method.pio;
2324
2325         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2326             & ~BWN_MACCTL_BIGENDIAN);
2327         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2328
2329         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2330         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2331         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2332         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2333         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2334         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2335 }
2336
2337 static void
2338 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2339     int index)
2340 {
2341         struct bwn_pio_txpkt *tp;
2342         struct bwn_softc *sc = mac->mac_sc;
2343         unsigned int i;
2344
2345         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2346         tq->tq_index = index;
2347
2348         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2349         if (siba_get_revid(sc->sc_dev) >= 8)
2350                 tq->tq_size = 1920;
2351         else {
2352                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2353                 tq->tq_size -= 80;
2354         }
2355
2356         TAILQ_INIT(&tq->tq_pktlist);
2357         for (i = 0; i < N(tq->tq_pkts); i++) {
2358                 tp = &(tq->tq_pkts[i]);
2359                 tp->tp_index = i;
2360                 tp->tp_queue = tq;
2361                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2362         }
2363 }
2364
2365 static uint16_t
2366 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2367 {
2368         struct bwn_softc *sc = mac->mac_sc;
2369         static const uint16_t bases[] = {
2370                 BWN_PIO_BASE0,
2371                 BWN_PIO_BASE1,
2372                 BWN_PIO_BASE2,
2373                 BWN_PIO_BASE3,
2374                 BWN_PIO_BASE4,
2375                 BWN_PIO_BASE5,
2376                 BWN_PIO_BASE6,
2377                 BWN_PIO_BASE7,
2378         };
2379         static const uint16_t bases_rev11[] = {
2380                 BWN_PIO11_BASE0,
2381                 BWN_PIO11_BASE1,
2382                 BWN_PIO11_BASE2,
2383                 BWN_PIO11_BASE3,
2384                 BWN_PIO11_BASE4,
2385                 BWN_PIO11_BASE5,
2386         };
2387
2388         if (siba_get_revid(sc->sc_dev) >= 11) {
2389                 if (index >= N(bases_rev11))
2390                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2391                 return (bases_rev11[index]);
2392         }
2393         if (index >= N(bases))
2394                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2395         return (bases[index]);
2396 }
2397
2398 static void
2399 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2400     int index)
2401 {
2402         struct bwn_softc *sc = mac->mac_sc;
2403
2404         prq->prq_mac = mac;
2405         prq->prq_rev = siba_get_revid(sc->sc_dev);
2406         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2407         bwn_dma_rxdirectfifo(mac, index, 1);
2408 }
2409
2410 static void
2411 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2412 {
2413         if (tq == NULL)
2414                 return;
2415         bwn_pio_cancel_tx_packets(tq);
2416 }
2417
2418 static void
2419 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2420 {
2421
2422         bwn_destroy_pioqueue_tx(pio);
2423 }
2424
2425 static uint16_t
2426 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2427     uint16_t offset)
2428 {
2429
2430         return (BWN_READ_2(mac, tq->tq_base + offset));
2431 }
2432
2433 static void
2434 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2435 {
2436         uint32_t ctl;
2437         int type;
2438         uint16_t base;
2439
2440         type = bwn_dma_mask2type(bwn_dma_mask(mac));
2441         base = bwn_dma_base(type, idx);
2442         if (type == BWN_DMA_64BIT) {
2443                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2444                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2445                 if (enable)
2446                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2447                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2448         } else {
2449                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2450                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2451                 if (enable)
2452                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2453                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2454         }
2455 }
2456
2457 static uint64_t
2458 bwn_dma_mask(struct bwn_mac *mac)
2459 {
2460         uint32_t tmp;
2461         uint16_t base;
2462
2463         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2464         if (tmp & SIBA_TGSHIGH_DMA64)
2465                 return (BWN_DMA_BIT_MASK(64));
2466         base = bwn_dma_base(0, 0);
2467         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2468         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2469         if (tmp & BWN_DMA32_TXADDREXT_MASK)
2470                 return (BWN_DMA_BIT_MASK(32));
2471
2472         return (BWN_DMA_BIT_MASK(30));
2473 }
2474
2475 static int
2476 bwn_dma_mask2type(uint64_t dmamask)
2477 {
2478
2479         if (dmamask == BWN_DMA_BIT_MASK(30))
2480                 return (BWN_DMA_30BIT);
2481         if (dmamask == BWN_DMA_BIT_MASK(32))
2482                 return (BWN_DMA_32BIT);
2483         if (dmamask == BWN_DMA_BIT_MASK(64))
2484                 return (BWN_DMA_64BIT);
2485         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2486         return (BWN_DMA_30BIT);
2487 }
2488
2489 static void
2490 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2491 {
2492         struct bwn_pio_txpkt *tp;
2493         unsigned int i;
2494
2495         for (i = 0; i < N(tq->tq_pkts); i++) {
2496                 tp = &(tq->tq_pkts[i]);
2497                 if (tp->tp_m) {
2498                         m_freem(tp->tp_m);
2499                         tp->tp_m = NULL;
2500                 }
2501         }
2502 }
2503
2504 static uint16_t
2505 bwn_dma_base(int type, int controller_idx)
2506 {
2507         static const uint16_t map64[] = {
2508                 BWN_DMA64_BASE0,
2509                 BWN_DMA64_BASE1,
2510                 BWN_DMA64_BASE2,
2511                 BWN_DMA64_BASE3,
2512                 BWN_DMA64_BASE4,
2513                 BWN_DMA64_BASE5,
2514         };
2515         static const uint16_t map32[] = {
2516                 BWN_DMA32_BASE0,
2517                 BWN_DMA32_BASE1,
2518                 BWN_DMA32_BASE2,
2519                 BWN_DMA32_BASE3,
2520                 BWN_DMA32_BASE4,
2521                 BWN_DMA32_BASE5,
2522         };
2523
2524         if (type == BWN_DMA_64BIT) {
2525                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2526                     ("%s:%d: fail", __func__, __LINE__));
2527                 return (map64[controller_idx]);
2528         }
2529         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2530             ("%s:%d: fail", __func__, __LINE__));
2531         return (map32[controller_idx]);
2532 }
2533
2534 static void
2535 bwn_dma_init(struct bwn_mac *mac)
2536 {
2537         struct bwn_dma *dma = &mac->mac_method.dma;
2538
2539         /* setup TX DMA channels. */
2540         bwn_dma_setup(dma->wme[WME_AC_BK]);
2541         bwn_dma_setup(dma->wme[WME_AC_BE]);
2542         bwn_dma_setup(dma->wme[WME_AC_VI]);
2543         bwn_dma_setup(dma->wme[WME_AC_VO]);
2544         bwn_dma_setup(dma->mcast);
2545         /* setup RX DMA channel. */
2546         bwn_dma_setup(dma->rx);
2547 }
2548
2549 static struct bwn_dma_ring *
2550 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2551     int for_tx, int type)
2552 {
2553         struct bwn_dma *dma = &mac->mac_method.dma;
2554         struct bwn_dma_ring *dr;
2555         struct bwn_dmadesc_generic *desc;
2556         struct bwn_dmadesc_meta *mt;
2557         struct bwn_softc *sc = mac->mac_sc;
2558         int error, i;
2559
2560         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2561         if (dr == NULL)
2562                 goto out;
2563         dr->dr_numslots = BWN_RXRING_SLOTS;
2564         if (for_tx)
2565                 dr->dr_numslots = BWN_TXRING_SLOTS;
2566
2567         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2568             M_DEVBUF, M_NOWAIT | M_ZERO);
2569         if (dr->dr_meta == NULL)
2570                 goto fail0;
2571
2572         dr->dr_type = type;
2573         dr->dr_mac = mac;
2574         dr->dr_base = bwn_dma_base(type, controller_index);
2575         dr->dr_index = controller_index;
2576         if (type == BWN_DMA_64BIT) {
2577                 dr->getdesc = bwn_dma_64_getdesc;
2578                 dr->setdesc = bwn_dma_64_setdesc;
2579                 dr->start_transfer = bwn_dma_64_start_transfer;
2580                 dr->suspend = bwn_dma_64_suspend;
2581                 dr->resume = bwn_dma_64_resume;
2582                 dr->get_curslot = bwn_dma_64_get_curslot;
2583                 dr->set_curslot = bwn_dma_64_set_curslot;
2584         } else {
2585                 dr->getdesc = bwn_dma_32_getdesc;
2586                 dr->setdesc = bwn_dma_32_setdesc;
2587                 dr->start_transfer = bwn_dma_32_start_transfer;
2588                 dr->suspend = bwn_dma_32_suspend;
2589                 dr->resume = bwn_dma_32_resume;
2590                 dr->get_curslot = bwn_dma_32_get_curslot;
2591                 dr->set_curslot = bwn_dma_32_set_curslot;
2592         }
2593         if (for_tx) {
2594                 dr->dr_tx = 1;
2595                 dr->dr_curslot = -1;
2596         } else {
2597                 if (dr->dr_index == 0) {
2598                         dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2599                         dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2600                 } else
2601                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2602         }
2603
2604         error = bwn_dma_allocringmemory(dr);
2605         if (error)
2606                 goto fail2;
2607
2608         if (for_tx) {
2609                 /*
2610                  * Assumption: BWN_TXRING_SLOTS can be divided by
2611                  * BWN_TX_SLOTS_PER_FRAME
2612                  */
2613                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2614                     ("%s:%d: fail", __func__, __LINE__));
2615
2616                 dr->dr_txhdr_cache =
2617                     malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2618                         BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
2619                 KASSERT(dr->dr_txhdr_cache != NULL,
2620                     ("%s:%d: fail", __func__, __LINE__));
2621
2622                 /*
2623                  * Create TX ring DMA stuffs
2624                  */
2625                 error = bus_dma_tag_create(dma->parent_dtag,
2626                                     BWN_ALIGN, 0,
2627                                     BUS_SPACE_MAXADDR,
2628                                     BUS_SPACE_MAXADDR,
2629                                     NULL, NULL,
2630                                     BWN_HDRSIZE(mac),
2631                                     1,
2632                                     BUS_SPACE_MAXSIZE_32BIT,
2633                                     0,
2634                                     NULL, NULL,
2635                                     &dr->dr_txring_dtag);
2636                 if (error) {
2637                         device_printf(sc->sc_dev,
2638                             "can't create TX ring DMA tag: TODO frees\n");
2639                         goto fail1;
2640                 }
2641
2642                 for (i = 0; i < dr->dr_numslots; i += 2) {
2643                         dr->getdesc(dr, i, &desc, &mt);
2644
2645                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2646                         mt->mt_m = NULL;
2647                         mt->mt_ni = NULL;
2648                         mt->mt_islast = 0;
2649                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2650                             &mt->mt_dmap);
2651                         if (error) {
2652                                 device_printf(sc->sc_dev,
2653                                      "can't create RX buf DMA map\n");
2654                                 goto fail1;
2655                         }
2656
2657                         dr->getdesc(dr, i + 1, &desc, &mt);
2658
2659                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2660                         mt->mt_m = NULL;
2661                         mt->mt_ni = NULL;
2662                         mt->mt_islast = 1;
2663                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2664                             &mt->mt_dmap);
2665                         if (error) {
2666                                 device_printf(sc->sc_dev,
2667                                      "can't create RX buf DMA map\n");
2668                                 goto fail1;
2669                         }
2670                 }
2671         } else {
2672                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2673                     &dr->dr_spare_dmap);
2674                 if (error) {
2675                         device_printf(sc->sc_dev,
2676                             "can't create RX buf DMA map\n");
2677                         goto out;               /* XXX wrong! */
2678                 }
2679
2680                 for (i = 0; i < dr->dr_numslots; i++) {
2681                         dr->getdesc(dr, i, &desc, &mt);
2682
2683                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2684                             &mt->mt_dmap);
2685                         if (error) {
2686                                 device_printf(sc->sc_dev,
2687                                     "can't create RX buf DMA map\n");
2688                                 goto out;       /* XXX wrong! */
2689                         }
2690                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2691                         if (error) {
2692                                 device_printf(sc->sc_dev,
2693                                     "failed to allocate RX buf\n");
2694                                 goto out;       /* XXX wrong! */
2695                         }
2696                 }
2697
2698                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2699                     BUS_DMASYNC_PREWRITE);
2700
2701                 dr->dr_usedslot = dr->dr_numslots;
2702         }
2703
2704       out:
2705         return (dr);
2706
2707 fail2:
2708         free(dr->dr_txhdr_cache, M_DEVBUF);
2709 fail1:
2710         free(dr->dr_meta, M_DEVBUF);
2711 fail0:
2712         free(dr, M_DEVBUF);
2713         return (NULL);
2714 }
2715
2716 static void
2717 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2718 {
2719
2720         if (dr == NULL)
2721                 return;
2722
2723         bwn_dma_free_descbufs(*dr);
2724         bwn_dma_free_ringmemory(*dr);
2725
2726         free((*dr)->dr_txhdr_cache, M_DEVBUF);
2727         free((*dr)->dr_meta, M_DEVBUF);
2728         free(*dr, M_DEVBUF);
2729
2730         *dr = NULL;
2731 }
2732
2733 static void
2734 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2735     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2736 {
2737         struct bwn_dmadesc32 *desc;
2738
2739         *meta = &(dr->dr_meta[slot]);
2740         desc = dr->dr_ring_descbase;
2741         desc = &(desc[slot]);
2742
2743         *gdesc = (struct bwn_dmadesc_generic *)desc;
2744 }
2745
2746 static void
2747 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2748     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2749     int start, int end, int irq)
2750 {
2751         struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2752         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2753         uint32_t addr, addrext, ctl;
2754         int slot;
2755
2756         slot = (int)(&(desc->dma.dma32) - descbase);
2757         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2758             ("%s:%d: fail", __func__, __LINE__));
2759
2760         addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2761         addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2762         addr |= siba_dma_translation(sc->sc_dev);
2763         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2764         if (slot == dr->dr_numslots - 1)
2765                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
2766         if (start)
2767                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
2768         if (end)
2769                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
2770         if (irq)
2771                 ctl |= BWN_DMA32_DCTL_IRQ;
2772         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2773             & BWN_DMA32_DCTL_ADDREXT_MASK;
2774
2775         desc->dma.dma32.control = htole32(ctl);
2776         desc->dma.dma32.address = htole32(addr);
2777 }
2778
2779 static void
2780 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2781 {
2782
2783         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2784             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2785 }
2786
2787 static void
2788 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2789 {
2790
2791         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2792             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2793 }
2794
2795 static void
2796 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2797 {
2798
2799         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2800             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2801 }
2802
2803 static int
2804 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2805 {
2806         uint32_t val;
2807
2808         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2809         val &= BWN_DMA32_RXDPTR;
2810
2811         return (val / sizeof(struct bwn_dmadesc32));
2812 }
2813
2814 static void
2815 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2816 {
2817
2818         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2819             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2820 }
2821
2822 static void
2823 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2824     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2825 {
2826         struct bwn_dmadesc64 *desc;
2827
2828         *meta = &(dr->dr_meta[slot]);
2829         desc = dr->dr_ring_descbase;
2830         desc = &(desc[slot]);
2831
2832         *gdesc = (struct bwn_dmadesc_generic *)desc;
2833 }
2834
2835 static void
2836 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2837     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2838     int start, int end, int irq)
2839 {
2840         struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2841         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2842         int slot;
2843         uint32_t ctl0 = 0, ctl1 = 0;
2844         uint32_t addrlo, addrhi;
2845         uint32_t addrext;
2846
2847         slot = (int)(&(desc->dma.dma64) - descbase);
2848         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2849             ("%s:%d: fail", __func__, __LINE__));
2850
2851         addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2852         addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2853         addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2854             30;
2855         addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2856         if (slot == dr->dr_numslots - 1)
2857                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2858         if (start)
2859                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2860         if (end)
2861                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2862         if (irq)
2863                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
2864         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2865         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2866             & BWN_DMA64_DCTL1_ADDREXT_MASK;
2867
2868         desc->dma.dma64.control0 = htole32(ctl0);
2869         desc->dma.dma64.control1 = htole32(ctl1);
2870         desc->dma.dma64.address_low = htole32(addrlo);
2871         desc->dma.dma64.address_high = htole32(addrhi);
2872 }
2873
2874 static void
2875 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2876 {
2877
2878         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2879             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2880 }
2881
2882 static void
2883 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2884 {
2885
2886         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2887             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2888 }
2889
2890 static void
2891 bwn_dma_64_resume(struct bwn_dma_ring *dr)
2892 {
2893
2894         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2895             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2896 }
2897
2898 static int
2899 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2900 {
2901         uint32_t val;
2902
2903         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2904         val &= BWN_DMA64_RXSTATDPTR;
2905
2906         return (val / sizeof(struct bwn_dmadesc64));
2907 }
2908
2909 static void
2910 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
2911 {
2912
2913         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
2914             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2915 }
2916
2917 static int
2918 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
2919 {
2920         struct bwn_mac *mac = dr->dr_mac;
2921         struct bwn_dma *dma = &mac->mac_method.dma;
2922         struct bwn_softc *sc = mac->mac_sc;
2923         int error;
2924
2925         error = bus_dma_tag_create(dma->parent_dtag,
2926                             BWN_ALIGN, 0,
2927                             BUS_SPACE_MAXADDR,
2928                             BUS_SPACE_MAXADDR,
2929                             NULL, NULL,
2930                             BWN_DMA_RINGMEMSIZE,
2931                             1,
2932                             BUS_SPACE_MAXSIZE_32BIT,
2933                             0,
2934                             NULL, NULL,
2935                             &dr->dr_ring_dtag);
2936         if (error) {
2937                 device_printf(sc->sc_dev,
2938                     "can't create TX ring DMA tag: TODO frees\n");
2939                 return (-1);
2940         }
2941
2942         error = bus_dmamem_alloc(dr->dr_ring_dtag,
2943             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
2944             &dr->dr_ring_dmap);
2945         if (error) {
2946                 device_printf(sc->sc_dev,
2947                     "can't allocate DMA mem: TODO frees\n");
2948                 return (-1);
2949         }
2950         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
2951             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
2952             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
2953         if (error) {
2954                 device_printf(sc->sc_dev,
2955                     "can't load DMA mem: TODO free\n");
2956                 return (-1);
2957         }
2958
2959         return (0);
2960 }
2961
2962 static void
2963 bwn_dma_setup(struct bwn_dma_ring *dr)
2964 {
2965         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2966         uint64_t ring64;
2967         uint32_t addrext, ring32, value;
2968         uint32_t trans = siba_dma_translation(sc->sc_dev);
2969
2970         if (dr->dr_tx) {
2971                 dr->dr_curslot = -1;
2972
2973                 if (dr->dr_type == BWN_DMA_64BIT) {
2974                         ring64 = (uint64_t)(dr->dr_ring_dmabase);
2975                         addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
2976                             >> 30;
2977                         value = BWN_DMA64_TXENABLE;
2978                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
2979                             & BWN_DMA64_TXADDREXT_MASK;
2980                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
2981                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
2982                             (ring64 & 0xffffffff));
2983                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
2984                             ((ring64 >> 32) &
2985                             ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
2986                 } else {
2987                         ring32 = (uint32_t)(dr->dr_ring_dmabase);
2988                         addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
2989                         value = BWN_DMA32_TXENABLE;
2990                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
2991                             & BWN_DMA32_TXADDREXT_MASK;
2992                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
2993                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
2994                             (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
2995                 }
2996                 return;
2997         }
2998
2999         /*
3000          * set for RX
3001          */
3002         dr->dr_usedslot = dr->dr_numslots;
3003
3004         if (dr->dr_type == BWN_DMA_64BIT) {
3005                 ring64 = (uint64_t)(dr->dr_ring_dmabase);
3006                 addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3007                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3008                 value |= BWN_DMA64_RXENABLE;
3009                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3010                     & BWN_DMA64_RXADDREXT_MASK;
3011                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3012                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3013                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3014                     ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3015                     | (trans << 1));
3016                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3017                     sizeof(struct bwn_dmadesc64));
3018         } else {
3019                 ring32 = (uint32_t)(dr->dr_ring_dmabase);
3020                 addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3021                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3022                 value |= BWN_DMA32_RXENABLE;
3023                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3024                     & BWN_DMA32_RXADDREXT_MASK;
3025                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3026                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3027                     (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3028                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3029                     sizeof(struct bwn_dmadesc32));
3030         }
3031 }
3032
3033 static void
3034 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3035 {
3036
3037         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3038         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3039             dr->dr_ring_dmap);
3040 }
3041
3042 static void
3043 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3044 {
3045
3046         if (dr->dr_tx) {
3047                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3048                 if (dr->dr_type == BWN_DMA_64BIT) {
3049                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3050                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3051                 } else
3052                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3053         } else {
3054                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3055                 if (dr->dr_type == BWN_DMA_64BIT) {
3056                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3057                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3058                 } else
3059                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3060         }
3061 }
3062
3063 static void
3064 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3065 {
3066         struct bwn_dmadesc_generic *desc;
3067         struct bwn_dmadesc_meta *meta;
3068         struct bwn_mac *mac = dr->dr_mac;
3069         struct bwn_dma *dma = &mac->mac_method.dma;
3070         struct bwn_softc *sc = mac->mac_sc;
3071         int i;
3072
3073         if (!dr->dr_usedslot)
3074                 return;
3075         for (i = 0; i < dr->dr_numslots; i++) {
3076                 dr->getdesc(dr, i, &desc, &meta);
3077
3078                 if (meta->mt_m == NULL) {
3079                         if (!dr->dr_tx)
3080                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3081                                     __func__);
3082                         continue;
3083                 }
3084                 if (dr->dr_tx) {
3085                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3086                                 bus_dmamap_unload(dr->dr_txring_dtag,
3087                                     meta->mt_dmap);
3088                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3089                                 bus_dmamap_unload(dma->txbuf_dtag,
3090                                     meta->mt_dmap);
3091                 } else
3092                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3093                 bwn_dma_free_descbuf(dr, meta);
3094         }
3095 }
3096
3097 static int
3098 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3099     int type)
3100 {
3101         struct bwn_softc *sc = mac->mac_sc;
3102         uint32_t value;
3103         int i;
3104         uint16_t offset;
3105
3106         for (i = 0; i < 10; i++) {
3107                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3108                     BWN_DMA32_TXSTATUS;
3109                 value = BWN_READ_4(mac, base + offset);
3110                 if (type == BWN_DMA_64BIT) {
3111                         value &= BWN_DMA64_TXSTAT;
3112                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3113                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3114                             value == BWN_DMA64_TXSTAT_STOPPED)
3115                                 break;
3116                 } else {
3117                         value &= BWN_DMA32_TXSTATE;
3118                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3119                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3120                             value == BWN_DMA32_TXSTAT_STOPPED)
3121                                 break;
3122                 }
3123                 DELAY(1000);
3124         }
3125         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3126         BWN_WRITE_4(mac, base + offset, 0);
3127         for (i = 0; i < 10; i++) {
3128                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3129                                                    BWN_DMA32_TXSTATUS;
3130                 value = BWN_READ_4(mac, base + offset);
3131                 if (type == BWN_DMA_64BIT) {
3132                         value &= BWN_DMA64_TXSTAT;
3133                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3134                                 i = -1;
3135                                 break;
3136                         }
3137                 } else {
3138                         value &= BWN_DMA32_TXSTATE;
3139                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3140                                 i = -1;
3141                                 break;
3142                         }
3143                 }
3144                 DELAY(1000);
3145         }
3146         if (i != -1) {
3147                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3148                 return (ENODEV);
3149         }
3150         DELAY(1000);
3151
3152         return (0);
3153 }
3154
3155 static int
3156 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3157     int type)
3158 {
3159         struct bwn_softc *sc = mac->mac_sc;
3160         uint32_t value;
3161         int i;
3162         uint16_t offset;
3163
3164         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3165         BWN_WRITE_4(mac, base + offset, 0);
3166         for (i = 0; i < 10; i++) {
3167                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3168                     BWN_DMA32_RXSTATUS;
3169                 value = BWN_READ_4(mac, base + offset);
3170                 if (type == BWN_DMA_64BIT) {
3171                         value &= BWN_DMA64_RXSTAT;
3172                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3173                                 i = -1;
3174                                 break;
3175                         }
3176                 } else {
3177                         value &= BWN_DMA32_RXSTATE;
3178                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3179                                 i = -1;
3180                                 break;
3181                         }
3182                 }
3183                 DELAY(1000);
3184         }
3185         if (i != -1) {
3186                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3187                 return (ENODEV);
3188         }
3189
3190         return (0);
3191 }
3192
3193 static void
3194 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3195     struct bwn_dmadesc_meta *meta)
3196 {
3197
3198         if (meta->mt_m != NULL) {
3199                 m_freem(meta->mt_m);
3200                 meta->mt_m = NULL;
3201         }
3202         if (meta->mt_ni != NULL) {
3203                 ieee80211_free_node(meta->mt_ni);
3204                 meta->mt_ni = NULL;
3205         }
3206 }
3207
3208 static void
3209 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3210 {
3211         struct bwn_rxhdr4 *rxhdr;
3212         unsigned char *frame;
3213
3214         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3215         rxhdr->frame_len = 0;
3216
3217         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3218             sizeof(struct bwn_plcp6) + 2,
3219             ("%s:%d: fail", __func__, __LINE__));
3220         frame = mtod(m, char *) + dr->dr_frameoffset;
3221         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3222 }
3223
3224 static uint8_t
3225 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3226 {
3227         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3228
3229         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3230             == 0xff);
3231 }
3232
3233 static void
3234 bwn_wme_init(struct bwn_mac *mac)
3235 {
3236
3237         bwn_wme_load(mac);
3238
3239         /* enable WME support. */
3240         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3241         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3242             BWN_IFSCTL_USE_EDCF);
3243 }
3244
3245 static void
3246 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3247 {
3248         struct bwn_softc *sc = mac->mac_sc;
3249         struct ieee80211com *ic = &sc->sc_ic;
3250         uint16_t delay; /* microsec */
3251
3252         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3253         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3254                 delay = 500;
3255         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3256                 delay = max(delay, (uint16_t)2400);
3257
3258         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3259 }
3260
3261 static void
3262 bwn_bt_enable(struct bwn_mac *mac)
3263 {
3264         struct bwn_softc *sc = mac->mac_sc;
3265         uint64_t hf;
3266
3267         if (bwn_bluetooth == 0)
3268                 return;
3269         if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3270                 return;
3271         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3272                 return;
3273
3274         hf = bwn_hf_read(mac);
3275         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3276                 hf |= BWN_HF_BT_COEXISTALT;
3277         else
3278                 hf |= BWN_HF_BT_COEXIST;
3279         bwn_hf_write(mac, hf);
3280 }
3281
3282 static void
3283 bwn_set_macaddr(struct bwn_mac *mac)
3284 {
3285
3286         bwn_mac_write_bssid(mac);
3287         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3288             mac->mac_sc->sc_ic.ic_macaddr);
3289 }
3290
3291 static void
3292 bwn_clear_keys(struct bwn_mac *mac)
3293 {
3294         int i;
3295
3296         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3297                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3298                     ("%s:%d: fail", __func__, __LINE__));
3299
3300                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3301                     NULL, BWN_SEC_KEYSIZE, NULL);
3302                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3303                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3304                             NULL, BWN_SEC_KEYSIZE, NULL);
3305                 }
3306                 mac->mac_key[i].keyconf = NULL;
3307         }
3308 }
3309
3310 static void
3311 bwn_crypt_init(struct bwn_mac *mac)
3312 {
3313         struct bwn_softc *sc = mac->mac_sc;
3314
3315         mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3316         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3317             ("%s:%d: fail", __func__, __LINE__));
3318         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3319         mac->mac_ktp *= 2;
3320         if (siba_get_revid(sc->sc_dev) >= 5)
3321                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3322         bwn_clear_keys(mac);
3323 }
3324
3325 static void
3326 bwn_chip_exit(struct bwn_mac *mac)
3327 {
3328         struct bwn_softc *sc = mac->mac_sc;
3329
3330         bwn_phy_exit(mac);
3331         siba_gpio_set(sc->sc_dev, 0);
3332 }
3333
3334 static int
3335 bwn_fw_fillinfo(struct bwn_mac *mac)
3336 {
3337         int error;
3338
3339         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3340         if (error == 0)
3341                 return (0);
3342         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3343         if (error == 0)
3344                 return (0);
3345         return (error);
3346 }
3347
3348 static int
3349 bwn_gpio_init(struct bwn_mac *mac)
3350 {
3351         struct bwn_softc *sc = mac->mac_sc;
3352         uint32_t mask = 0x1f, set = 0xf, value;
3353
3354         BWN_WRITE_4(mac, BWN_MACCTL,
3355             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3356         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3357             BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3358
3359         if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3360                 mask |= 0x0060;
3361                 set |= 0x0060;
3362         }
3363         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3364                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3365                     BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3366                 mask |= 0x0200;
3367                 set |= 0x0200;
3368         }
3369         if (siba_get_revid(sc->sc_dev) >= 2)
3370                 mask |= 0x0010;
3371
3372         value = siba_gpio_get(sc->sc_dev);
3373         if (value == -1)
3374                 return (0);
3375         siba_gpio_set(sc->sc_dev, (value & mask) | set);
3376
3377         return (0);
3378 }
3379
3380 static int
3381 bwn_fw_loadinitvals(struct bwn_mac *mac)
3382 {
3383 #define GETFWOFFSET(fwp, offset)                                \
3384         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3385         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3386         const struct bwn_fwhdr *hdr;
3387         struct bwn_fw *fw = &mac->mac_fw;
3388         int error;
3389
3390         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3391         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3392             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3393         if (error)
3394                 return (error);
3395         if (fw->initvals_band.fw) {
3396                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3397                 error = bwn_fwinitvals_write(mac,
3398                     GETFWOFFSET(fw->initvals_band, hdr_len),
3399                     be32toh(hdr->size),
3400                     fw->initvals_band.fw->datasize - hdr_len);
3401         }
3402         return (error);
3403 #undef GETFWOFFSET
3404 }
3405
3406 static int
3407 bwn_phy_init(struct bwn_mac *mac)
3408 {
3409         struct bwn_softc *sc = mac->mac_sc;
3410         int error;
3411
3412         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3413         mac->mac_phy.rf_onoff(mac, 1);
3414         error = mac->mac_phy.init(mac);
3415         if (error) {
3416                 device_printf(sc->sc_dev, "PHY init failed\n");
3417                 goto fail0;
3418         }
3419         error = bwn_switch_channel(mac,
3420             mac->mac_phy.get_default_chan(mac));
3421         if (error) {
3422                 device_printf(sc->sc_dev,
3423                     "failed to switch default channel\n");
3424                 goto fail1;
3425         }
3426         return (0);
3427 fail1:
3428         if (mac->mac_phy.exit)
3429                 mac->mac_phy.exit(mac);
3430 fail0:
3431         mac->mac_phy.rf_onoff(mac, 0);
3432
3433         return (error);
3434 }
3435
3436 static void
3437 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3438 {
3439         uint16_t ant;
3440         uint16_t tmp;
3441
3442         ant = bwn_ant2phy(antenna);
3443
3444         /* For ACK/CTS */
3445         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3446         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3447         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3448         /* For Probe Resposes */
3449         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3450         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3451         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3452 }
3453
3454 static void
3455 bwn_set_opmode(struct bwn_mac *mac)
3456 {
3457         struct bwn_softc *sc = mac->mac_sc;
3458         struct ieee80211com *ic = &sc->sc_ic;
3459         uint32_t ctl;
3460         uint16_t cfp_pretbtt;
3461
3462         ctl = BWN_READ_4(mac, BWN_MACCTL);
3463         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3464             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3465             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3466         ctl |= BWN_MACCTL_STA;
3467
3468         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3469             ic->ic_opmode == IEEE80211_M_MBSS)
3470                 ctl |= BWN_MACCTL_HOSTAP;
3471         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3472                 ctl &= ~BWN_MACCTL_STA;
3473         ctl |= sc->sc_filters;
3474
3475         if (siba_get_revid(sc->sc_dev) <= 4)
3476                 ctl |= BWN_MACCTL_PROMISC;
3477
3478         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3479
3480         cfp_pretbtt = 2;
3481         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3482                 if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3483                     siba_get_chiprev(sc->sc_dev) == 3)
3484                         cfp_pretbtt = 100;
3485                 else
3486                         cfp_pretbtt = 50;
3487         }
3488         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3489 }
3490
3491 static int
3492 bwn_dma_gettype(struct bwn_mac *mac)
3493 {
3494         uint32_t tmp;
3495         uint16_t base;
3496
3497         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3498         if (tmp & SIBA_TGSHIGH_DMA64)
3499                 return (BWN_DMA_64BIT);
3500         base = bwn_dma_base(0, 0);
3501         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3502         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3503         if (tmp & BWN_DMA32_TXADDREXT_MASK)
3504                 return (BWN_DMA_32BIT);
3505
3506         return (BWN_DMA_30BIT);
3507 }
3508
3509 static void
3510 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3511 {
3512         if (!error) {
3513                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3514                 *((bus_addr_t *)arg) = seg->ds_addr;
3515         }
3516 }
3517
3518 void
3519 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3520 {
3521         struct bwn_phy *phy = &mac->mac_phy;
3522         struct bwn_softc *sc = mac->mac_sc;
3523         unsigned int i, max_loop;
3524         uint16_t value;
3525         uint32_t buffer[5] = {
3526                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3527         };
3528
3529         if (ofdm) {
3530                 max_loop = 0x1e;
3531                 buffer[0] = 0x000201cc;
3532         } else {
3533                 max_loop = 0xfa;
3534                 buffer[0] = 0x000b846e;
3535         }
3536
3537         BWN_ASSERT_LOCKED(mac->mac_sc);
3538
3539         for (i = 0; i < 5; i++)
3540                 bwn_ram_write(mac, i * 4, buffer[i]);
3541
3542         BWN_WRITE_2(mac, 0x0568, 0x0000);
3543         BWN_WRITE_2(mac, 0x07c0,
3544             (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3545
3546         value = (ofdm ? 0x41 : 0x40);
3547         BWN_WRITE_2(mac, 0x050c, value);
3548
3549         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3550             phy->type == BWN_PHYTYPE_LCN)
3551                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3552         BWN_WRITE_2(mac, 0x0508, 0x0000);
3553         BWN_WRITE_2(mac, 0x050a, 0x0000);
3554         BWN_WRITE_2(mac, 0x054c, 0x0000);
3555         BWN_WRITE_2(mac, 0x056a, 0x0014);
3556         BWN_WRITE_2(mac, 0x0568, 0x0826);
3557         BWN_WRITE_2(mac, 0x0500, 0x0000);
3558
3559         /* XXX TODO: n phy pa override? */
3560
3561         switch (phy->type) {
3562         case BWN_PHYTYPE_N:
3563         case BWN_PHYTYPE_LCN:
3564                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3565                 break;
3566         case BWN_PHYTYPE_LP:
3567                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3568                 break;
3569         default:
3570                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3571                 break;
3572         }
3573
3574         /* flush */
3575         BWN_READ_2(mac, 0x0502);
3576
3577         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3578                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3579         for (i = 0x00; i < max_loop; i++) {
3580                 value = BWN_READ_2(mac, 0x050e);
3581                 if (value & 0x0080)
3582                         break;
3583                 DELAY(10);
3584         }
3585         for (i = 0x00; i < 0x0a; i++) {
3586                 value = BWN_READ_2(mac, 0x050e);
3587                 if (value & 0x0400)
3588                         break;
3589                 DELAY(10);
3590         }
3591         for (i = 0x00; i < 0x19; i++) {
3592                 value = BWN_READ_2(mac, 0x0690);
3593                 if (!(value & 0x0100))
3594                         break;
3595                 DELAY(10);
3596         }
3597         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3598                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3599 }
3600
3601 void
3602 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3603 {
3604         uint32_t macctl;
3605
3606         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3607
3608         macctl = BWN_READ_4(mac, BWN_MACCTL);
3609         if (macctl & BWN_MACCTL_BIGENDIAN)
3610                 printf("TODO: need swap\n");
3611
3612         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3613         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3614         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3615 }
3616
3617 void
3618 bwn_mac_suspend(struct bwn_mac *mac)
3619 {
3620         struct bwn_softc *sc = mac->mac_sc;
3621         int i;
3622         uint32_t tmp;
3623
3624         KASSERT(mac->mac_suspended >= 0,
3625             ("%s:%d: fail", __func__, __LINE__));
3626
3627         if (mac->mac_suspended == 0) {
3628                 bwn_psctl(mac, BWN_PS_AWAKE);
3629                 BWN_WRITE_4(mac, BWN_MACCTL,
3630                             BWN_READ_4(mac, BWN_MACCTL)
3631                             & ~BWN_MACCTL_ON);
3632                 BWN_READ_4(mac, BWN_MACCTL);
3633                 for (i = 35; i; i--) {
3634                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3635                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3636                                 goto out;
3637                         DELAY(10);
3638                 }
3639                 for (i = 40; i; i--) {
3640                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3641                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3642                                 goto out;
3643                         DELAY(1000);
3644                 }
3645                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3646         }
3647 out:
3648         mac->mac_suspended++;
3649 }
3650
3651 void
3652 bwn_mac_enable(struct bwn_mac *mac)
3653 {
3654         struct bwn_softc *sc = mac->mac_sc;
3655         uint16_t state;
3656
3657         state = bwn_shm_read_2(mac, BWN_SHARED,
3658             BWN_SHARED_UCODESTAT);
3659         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3660             state != BWN_SHARED_UCODESTAT_SLEEP)
3661                 device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3662
3663         mac->mac_suspended--;
3664         KASSERT(mac->mac_suspended >= 0,
3665             ("%s:%d: fail", __func__, __LINE__));
3666         if (mac->mac_suspended == 0) {
3667                 BWN_WRITE_4(mac, BWN_MACCTL,
3668                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3669                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3670                 BWN_READ_4(mac, BWN_MACCTL);
3671                 BWN_READ_4(mac, BWN_INTR_REASON);
3672                 bwn_psctl(mac, 0);
3673         }
3674 }
3675
3676 void
3677 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3678 {
3679         struct bwn_softc *sc = mac->mac_sc;
3680         int i;
3681         uint16_t ucstat;
3682
3683         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3684             ("%s:%d: fail", __func__, __LINE__));
3685         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3686             ("%s:%d: fail", __func__, __LINE__));
3687
3688         /* XXX forcibly awake and hwps-off */
3689
3690         BWN_WRITE_4(mac, BWN_MACCTL,
3691             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3692             ~BWN_MACCTL_HWPS);
3693         BWN_READ_4(mac, BWN_MACCTL);
3694         if (siba_get_revid(sc->sc_dev) >= 5) {
3695                 for (i = 0; i < 100; i++) {
3696                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3697                             BWN_SHARED_UCODESTAT);
3698                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3699                                 break;
3700                         DELAY(10);
3701                 }
3702         }
3703 }
3704
3705 static int
3706 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3707 {
3708         struct bwn_softc *sc = mac->mac_sc;
3709         struct bwn_fw *fw = &mac->mac_fw;
3710         const uint8_t rev = siba_get_revid(sc->sc_dev);
3711         const char *filename;
3712         uint32_t high;
3713         int error;
3714
3715         /* microcode */
3716         if (rev >= 5 && rev <= 10)
3717                 filename = "ucode5";
3718         else if (rev >= 11 && rev <= 12)
3719                 filename = "ucode11";
3720         else if (rev == 13)
3721                 filename = "ucode13";
3722         else if (rev == 14)
3723                 filename = "ucode14";
3724         else if (rev >= 15)
3725                 filename = "ucode15";
3726         else {
3727                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3728                 bwn_release_firmware(mac);
3729                 return (EOPNOTSUPP);
3730         }
3731         error = bwn_fw_get(mac, type, filename, &fw->ucode);
3732         if (error) {
3733                 bwn_release_firmware(mac);
3734                 return (error);
3735         }
3736
3737         /* PCM */
3738         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3739         if (rev >= 5 && rev <= 10) {
3740                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3741                 if (error == ENOENT)
3742                         fw->no_pcmfile = 1;
3743                 else if (error) {
3744                         bwn_release_firmware(mac);
3745                         return (error);
3746                 }
3747         } else if (rev < 11) {
3748                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3749                 return (EOPNOTSUPP);
3750         }
3751
3752         /* initvals */
3753         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3754         switch (mac->mac_phy.type) {
3755         case BWN_PHYTYPE_A:
3756                 if (rev < 5 || rev > 10)
3757                         goto fail1;
3758                 if (high & BWN_TGSHIGH_HAVE_2GHZ)
3759                         filename = "a0g1initvals5";
3760                 else
3761                         filename = "a0g0initvals5";
3762                 break;
3763         case BWN_PHYTYPE_G:
3764                 if (rev >= 5 && rev <= 10)
3765                         filename = "b0g0initvals5";
3766                 else if (rev >= 13)
3767                         filename = "b0g0initvals13";
3768                 else
3769                         goto fail1;
3770                 break;
3771         case BWN_PHYTYPE_LP:
3772                 if (rev == 13)
3773                         filename = "lp0initvals13";
3774                 else if (rev == 14)
3775                         filename = "lp0initvals14";
3776                 else if (rev >= 15)
3777                         filename = "lp0initvals15";
3778                 else
3779                         goto fail1;
3780                 break;
3781         case BWN_PHYTYPE_N:
3782                 if (rev >= 11 && rev <= 12)
3783                         filename = "n0initvals11";
3784                 else
3785                         goto fail1;
3786                 break;
3787         default:
3788                 goto fail1;
3789         }
3790         error = bwn_fw_get(mac, type, filename, &fw->initvals);
3791         if (error) {
3792                 bwn_release_firmware(mac);
3793                 return (error);
3794         }
3795
3796         /* bandswitch initvals */
3797         switch (mac->mac_phy.type) {
3798         case BWN_PHYTYPE_A:
3799                 if (rev >= 5 && rev <= 10) {
3800                         if (high & BWN_TGSHIGH_HAVE_2GHZ)
3801                                 filename = "a0g1bsinitvals5";
3802                         else
3803                                 filename = "a0g0bsinitvals5";
3804                 } else if (rev >= 11)
3805                         filename = NULL;
3806                 else
3807                         goto fail1;
3808                 break;
3809         case BWN_PHYTYPE_G:
3810                 if (rev >= 5 && rev <= 10)
3811                         filename = "b0g0bsinitvals5";
3812                 else if (rev >= 11)
3813                         filename = NULL;
3814                 else
3815                         goto fail1;
3816                 break;
3817         case BWN_PHYTYPE_LP:
3818                 if (rev == 13)
3819                         filename = "lp0bsinitvals13";
3820                 else if (rev == 14)
3821                         filename = "lp0bsinitvals14";
3822                 else if (rev >= 15)
3823                         filename = "lp0bsinitvals15";
3824                 else
3825                         goto fail1;
3826                 break;
3827         case BWN_PHYTYPE_N:
3828                 if (rev >= 11 && rev <= 12)
3829                         filename = "n0bsinitvals11";
3830                 else
3831                         goto fail1;
3832                 break;
3833         default:
3834                 goto fail1;
3835         }
3836         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
3837         if (error) {
3838                 bwn_release_firmware(mac);
3839                 return (error);
3840         }
3841         return (0);
3842 fail1:
3843         device_printf(sc->sc_dev, "no INITVALS for rev %d\n", rev);
3844         bwn_release_firmware(mac);
3845         return (EOPNOTSUPP);
3846 }
3847
3848 static int
3849 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
3850     const char *name, struct bwn_fwfile *bfw)
3851 {
3852         const struct bwn_fwhdr *hdr;
3853         struct bwn_softc *sc = mac->mac_sc;
3854         const struct firmware *fw;
3855         char namebuf[64];
3856
3857         if (name == NULL) {
3858                 bwn_do_release_fw(bfw);
3859                 return (0);
3860         }
3861         if (bfw->filename != NULL) {
3862                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
3863                         return (0);
3864                 bwn_do_release_fw(bfw);
3865         }
3866
3867         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
3868             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
3869             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
3870         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
3871         fw = firmware_get(namebuf);
3872         if (fw == NULL) {
3873                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
3874                     namebuf);
3875                 return (ENOENT);
3876         }
3877         if (fw->datasize < sizeof(struct bwn_fwhdr))
3878                 goto fail;
3879         hdr = (const struct bwn_fwhdr *)(fw->data);
3880         switch (hdr->type) {
3881         case BWN_FWTYPE_UCODE:
3882         case BWN_FWTYPE_PCM:
3883                 if (be32toh(hdr->size) !=
3884                     (fw->datasize - sizeof(struct bwn_fwhdr)))
3885                         goto fail;
3886                 /* FALLTHROUGH */
3887         case BWN_FWTYPE_IV:
3888                 if (hdr->ver != 1)
3889                         goto fail;
3890                 break;
3891         default:
3892                 goto fail;
3893         }
3894         bfw->filename = name;
3895         bfw->fw = fw;
3896         bfw->type = type;
3897         return (0);
3898 fail:
3899         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
3900         if (fw != NULL)
3901                 firmware_put(fw, FIRMWARE_UNLOAD);
3902         return (EPROTO);
3903 }
3904
3905 static void
3906 bwn_release_firmware(struct bwn_mac *mac)
3907 {
3908
3909         bwn_do_release_fw(&mac->mac_fw.ucode);
3910         bwn_do_release_fw(&mac->mac_fw.pcm);
3911         bwn_do_release_fw(&mac->mac_fw.initvals);
3912         bwn_do_release_fw(&mac->mac_fw.initvals_band);
3913 }
3914
3915 static void
3916 bwn_do_release_fw(struct bwn_fwfile *bfw)
3917 {
3918
3919         if (bfw->fw != NULL)
3920                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
3921         bfw->fw = NULL;
3922         bfw->filename = NULL;
3923 }
3924
3925 static int
3926 bwn_fw_loaducode(struct bwn_mac *mac)
3927 {
3928 #define GETFWOFFSET(fwp, offset)        \
3929         ((const uint32_t *)((const char *)fwp.fw->data + offset))
3930 #define GETFWSIZE(fwp, offset)  \
3931         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
3932         struct bwn_softc *sc = mac->mac_sc;
3933         const uint32_t *data;
3934         unsigned int i;
3935         uint32_t ctl;
3936         uint16_t date, fwcaps, time;
3937         int error = 0;
3938
3939         ctl = BWN_READ_4(mac, BWN_MACCTL);
3940         ctl |= BWN_MACCTL_MCODE_JMP0;
3941         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
3942             __LINE__));
3943         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3944         for (i = 0; i < 64; i++)
3945                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
3946         for (i = 0; i < 4096; i += 2)
3947                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
3948
3949         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3950         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
3951         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3952              i++) {
3953                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3954                 DELAY(10);
3955         }
3956
3957         if (mac->mac_fw.pcm.fw) {
3958                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
3959                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
3960                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
3961                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
3962                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
3963                     sizeof(struct bwn_fwhdr)); i++) {
3964                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3965                         DELAY(10);
3966                 }
3967         }
3968
3969         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
3970         BWN_WRITE_4(mac, BWN_MACCTL,
3971             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
3972             BWN_MACCTL_MCODE_RUN);
3973
3974         for (i = 0; i < 21; i++) {
3975                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
3976                         break;
3977                 if (i >= 20) {
3978                         device_printf(sc->sc_dev, "ucode timeout\n");
3979                         error = ENXIO;
3980                         goto error;
3981                 }
3982                 DELAY(50000);
3983         }
3984         BWN_READ_4(mac, BWN_INTR_REASON);
3985
3986         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
3987         if (mac->mac_fw.rev <= 0x128) {
3988                 device_printf(sc->sc_dev, "the firmware is too old\n");
3989                 error = EOPNOTSUPP;
3990                 goto error;
3991         }
3992
3993         /*
3994          * Determine firmware header version; needed for TX/RX packet
3995          * handling.
3996          */
3997         if (mac->mac_fw.rev >= 598)
3998                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
3999         else if (mac->mac_fw.rev >= 410)
4000                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4001         else
4002                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4003
4004         /*
4005          * We don't support rev 598 or later; that requires
4006          * another round of changes to the TX/RX descriptor
4007          * and status layout.
4008          *
4009          * So, complain this is the case and exit out, rather
4010          * than attaching and then failing.
4011          */
4012         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4013                 device_printf(sc->sc_dev,
4014                     "firmware is too new (>=598); not supported\n");
4015                 error = EOPNOTSUPP;
4016                 goto error;
4017         }
4018
4019         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4020             BWN_SHARED_UCODE_PATCH);
4021         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4022         mac->mac_fw.opensource = (date == 0xffff);
4023         if (bwn_wme != 0)
4024                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4025         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4026
4027         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4028         if (mac->mac_fw.opensource == 0) {
4029                 device_printf(sc->sc_dev,
4030                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4031                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4032                 if (mac->mac_fw.no_pcmfile)
4033                         device_printf(sc->sc_dev,
4034                             "no HW crypto acceleration due to pcm5\n");
4035         } else {
4036                 mac->mac_fw.patch = time;
4037                 fwcaps = bwn_fwcaps_read(mac);
4038                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4039                         device_printf(sc->sc_dev,
4040                             "disabling HW crypto acceleration\n");
4041                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4042                 }
4043                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4044                         device_printf(sc->sc_dev, "disabling WME support\n");
4045                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4046                 }
4047         }
4048
4049         if (BWN_ISOLDFMT(mac))
4050                 device_printf(sc->sc_dev, "using old firmware image\n");
4051
4052         return (0);
4053
4054 error:
4055         BWN_WRITE_4(mac, BWN_MACCTL,
4056             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4057             BWN_MACCTL_MCODE_JMP0);
4058
4059         return (error);
4060 #undef GETFWSIZE
4061 #undef GETFWOFFSET
4062 }
4063
4064 /* OpenFirmware only */
4065 static uint16_t
4066 bwn_fwcaps_read(struct bwn_mac *mac)
4067 {
4068
4069         KASSERT(mac->mac_fw.opensource == 1,
4070             ("%s:%d: fail", __func__, __LINE__));
4071         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4072 }
4073
4074 static int
4075 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4076     size_t count, size_t array_size)
4077 {
4078 #define GET_NEXTIV16(iv)                                                \
4079         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4080             sizeof(uint16_t) + sizeof(uint16_t)))
4081 #define GET_NEXTIV32(iv)                                                \
4082         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4083             sizeof(uint16_t) + sizeof(uint32_t)))
4084         struct bwn_softc *sc = mac->mac_sc;
4085         const struct bwn_fwinitvals *iv;
4086         uint16_t offset;
4087         size_t i;
4088         uint8_t bit32;
4089
4090         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4091             ("%s:%d: fail", __func__, __LINE__));
4092         iv = ivals;
4093         for (i = 0; i < count; i++) {
4094                 if (array_size < sizeof(iv->offset_size))
4095                         goto fail;
4096                 array_size -= sizeof(iv->offset_size);
4097                 offset = be16toh(iv->offset_size);
4098                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4099                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4100                 if (offset >= 0x1000)
4101                         goto fail;
4102                 if (bit32) {
4103                         if (array_size < sizeof(iv->data.d32))
4104                                 goto fail;
4105                         array_size -= sizeof(iv->data.d32);
4106                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4107                         iv = GET_NEXTIV32(iv);
4108                 } else {
4109
4110                         if (array_size < sizeof(iv->data.d16))
4111                                 goto fail;
4112                         array_size -= sizeof(iv->data.d16);
4113                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4114
4115                         iv = GET_NEXTIV16(iv);
4116                 }
4117         }
4118         if (array_size != 0)
4119                 goto fail;
4120         return (0);
4121 fail:
4122         device_printf(sc->sc_dev, "initvals: invalid format\n");
4123         return (EPROTO);
4124 #undef GET_NEXTIV16
4125 #undef GET_NEXTIV32
4126 }
4127
4128 int
4129 bwn_switch_channel(struct bwn_mac *mac, int chan)
4130 {
4131         struct bwn_phy *phy = &(mac->mac_phy);
4132         struct bwn_softc *sc = mac->mac_sc;
4133         struct ieee80211com *ic = &sc->sc_ic;
4134         uint16_t channelcookie, savedcookie;
4135         int error;
4136
4137         if (chan == 0xffff)
4138                 chan = phy->get_default_chan(mac);
4139
4140         channelcookie = chan;
4141         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4142                 channelcookie |= 0x100;
4143         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4144         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4145         error = phy->switch_channel(mac, chan);
4146         if (error)
4147                 goto fail;
4148
4149         mac->mac_phy.chan = chan;
4150         DELAY(8000);
4151         return (0);
4152 fail:
4153         device_printf(sc->sc_dev, "failed to switch channel\n");
4154         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4155         return (error);
4156 }
4157
4158 static uint16_t
4159 bwn_ant2phy(int antenna)
4160 {
4161
4162         switch (antenna) {
4163         case BWN_ANT0:
4164                 return (BWN_TX_PHY_ANT0);
4165         case BWN_ANT1:
4166                 return (BWN_TX_PHY_ANT1);
4167         case BWN_ANT2:
4168                 return (BWN_TX_PHY_ANT2);
4169         case BWN_ANT3:
4170                 return (BWN_TX_PHY_ANT3);
4171         case BWN_ANTAUTO:
4172                 return (BWN_TX_PHY_ANT01AUTO);
4173         }
4174         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4175         return (0);
4176 }
4177
4178 static void
4179 bwn_wme_load(struct bwn_mac *mac)
4180 {
4181         struct bwn_softc *sc = mac->mac_sc;
4182         int i;
4183
4184         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4185             ("%s:%d: fail", __func__, __LINE__));
4186
4187         bwn_mac_suspend(mac);
4188         for (i = 0; i < N(sc->sc_wmeParams); i++)
4189                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4190                     bwn_wme_shm_offsets[i]);
4191         bwn_mac_enable(mac);
4192 }
4193
4194 static void
4195 bwn_wme_loadparams(struct bwn_mac *mac,
4196     const struct wmeParams *p, uint16_t shm_offset)
4197 {
4198 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4199         struct bwn_softc *sc = mac->mac_sc;
4200         uint16_t params[BWN_NR_WMEPARAMS];
4201         int slot, tmp;
4202         unsigned int i;
4203
4204         slot = BWN_READ_2(mac, BWN_RNG) &
4205             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4206
4207         memset(&params, 0, sizeof(params));
4208
4209         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4210             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4211             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4212
4213         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4214         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4215         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4216         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4217         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4218         params[BWN_WMEPARAM_BSLOTS] = slot;
4219         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4220
4221         for (i = 0; i < N(params); i++) {
4222                 if (i == BWN_WMEPARAM_STATUS) {
4223                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4224                             shm_offset + (i * 2));
4225                         tmp |= 0x100;
4226                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4227                             tmp);
4228                 } else {
4229                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4230                             params[i]);
4231                 }
4232         }
4233 }
4234
4235 static void
4236 bwn_mac_write_bssid(struct bwn_mac *mac)
4237 {
4238         struct bwn_softc *sc = mac->mac_sc;
4239         uint32_t tmp;
4240         int i;
4241         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4242
4243         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4244         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4245         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4246             IEEE80211_ADDR_LEN);
4247
4248         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4249                 tmp = (uint32_t) (mac_bssid[i + 0]);
4250                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4251                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4252                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4253                 bwn_ram_write(mac, 0x20 + i, tmp);
4254         }
4255 }
4256
4257 static void
4258 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4259     const uint8_t *macaddr)
4260 {
4261         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4262         uint16_t data;
4263
4264         if (!mac)
4265                 macaddr = zero;
4266
4267         offset |= 0x0020;
4268         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4269
4270         data = macaddr[0];
4271         data |= macaddr[1] << 8;
4272         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4273         data = macaddr[2];
4274         data |= macaddr[3] << 8;
4275         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4276         data = macaddr[4];
4277         data |= macaddr[5] << 8;
4278         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4279 }
4280
4281 static void
4282 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4283     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4284 {
4285         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4286         uint8_t per_sta_keys_start = 8;
4287
4288         if (BWN_SEC_NEWAPI(mac))
4289                 per_sta_keys_start = 4;
4290
4291         KASSERT(index < mac->mac_max_nr_keys,
4292             ("%s:%d: fail", __func__, __LINE__));
4293         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4294             ("%s:%d: fail", __func__, __LINE__));
4295
4296         if (index >= per_sta_keys_start)
4297                 bwn_key_macwrite(mac, index, NULL);
4298         if (key)
4299                 memcpy(buf, key, key_len);
4300         bwn_key_write(mac, index, algorithm, buf);
4301         if (index >= per_sta_keys_start)
4302                 bwn_key_macwrite(mac, index, mac_addr);
4303
4304         mac->mac_key[index].algorithm = algorithm;
4305 }
4306
4307 static void
4308 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4309 {
4310         struct bwn_softc *sc = mac->mac_sc;
4311         uint32_t addrtmp[2] = { 0, 0 };
4312         uint8_t start = 8;
4313
4314         if (BWN_SEC_NEWAPI(mac))
4315                 start = 4;
4316
4317         KASSERT(index >= start,
4318             ("%s:%d: fail", __func__, __LINE__));
4319         index -= start;
4320
4321         if (addr) {
4322                 addrtmp[0] = addr[0];
4323                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4324                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4325                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4326                 addrtmp[1] = addr[4];
4327                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4328         }
4329
4330         if (siba_get_revid(sc->sc_dev) >= 5) {
4331                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4332                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4333         } else {
4334                 if (index >= 8) {
4335                         bwn_shm_write_4(mac, BWN_SHARED,
4336                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4337                         bwn_shm_write_2(mac, BWN_SHARED,
4338                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4339                 }
4340         }
4341 }
4342
4343 static void
4344 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4345     const uint8_t *key)
4346 {
4347         unsigned int i;
4348         uint32_t offset;
4349         uint16_t kidx, value;
4350
4351         kidx = BWN_SEC_KEY2FW(mac, index);
4352         bwn_shm_write_2(mac, BWN_SHARED,
4353             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4354
4355         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4356         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4357                 value = key[i];
4358                 value |= (uint16_t)(key[i + 1]) << 8;
4359                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4360         }
4361 }
4362
4363 static void
4364 bwn_phy_exit(struct bwn_mac *mac)
4365 {
4366
4367         mac->mac_phy.rf_onoff(mac, 0);
4368         if (mac->mac_phy.exit != NULL)
4369                 mac->mac_phy.exit(mac);
4370 }
4371
4372 static void
4373 bwn_dma_free(struct bwn_mac *mac)
4374 {
4375         struct bwn_dma *dma;
4376
4377         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4378                 return;
4379         dma = &mac->mac_method.dma;
4380
4381         bwn_dma_ringfree(&dma->rx);
4382         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4383         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4384         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4385         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4386         bwn_dma_ringfree(&dma->mcast);
4387 }
4388
4389 static void
4390 bwn_core_stop(struct bwn_mac *mac)
4391 {
4392         struct bwn_softc *sc = mac->mac_sc;
4393
4394         BWN_ASSERT_LOCKED(sc);
4395
4396         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4397                 return;
4398
4399         callout_stop(&sc->sc_rfswitch_ch);
4400         callout_stop(&sc->sc_task_ch);
4401         callout_stop(&sc->sc_watchdog_ch);
4402         sc->sc_watchdog_timer = 0;
4403         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4404         BWN_READ_4(mac, BWN_INTR_MASK);
4405         bwn_mac_suspend(mac);
4406
4407         mac->mac_status = BWN_MAC_STATUS_INITED;
4408 }
4409
4410 static int
4411 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4412 {
4413         struct bwn_mac *up_dev = NULL;
4414         struct bwn_mac *down_dev;
4415         struct bwn_mac *mac;
4416         int err, status;
4417         uint8_t gmode;
4418
4419         BWN_ASSERT_LOCKED(sc);
4420
4421         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4422                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4423                     mac->mac_phy.supports_2ghz) {
4424                         up_dev = mac;
4425                         gmode = 1;
4426                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4427                     mac->mac_phy.supports_5ghz) {
4428                         up_dev = mac;
4429                         gmode = 0;
4430                 } else {
4431                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4432                         return (EINVAL);
4433                 }
4434                 if (up_dev != NULL)
4435                         break;
4436         }
4437         if (up_dev == NULL) {
4438                 device_printf(sc->sc_dev, "Could not find a device\n");
4439                 return (ENODEV);
4440         }
4441         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4442                 return (0);
4443
4444         device_printf(sc->sc_dev, "switching to %s-GHz band\n",
4445             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4446
4447         down_dev = sc->sc_curmac;
4448         status = down_dev->mac_status;
4449         if (status >= BWN_MAC_STATUS_STARTED)
4450                 bwn_core_stop(down_dev);
4451         if (status >= BWN_MAC_STATUS_INITED)
4452                 bwn_core_exit(down_dev);
4453
4454         if (down_dev != up_dev)
4455                 bwn_phy_reset(down_dev);
4456
4457         up_dev->mac_phy.gmode = gmode;
4458         if (status >= BWN_MAC_STATUS_INITED) {
4459                 err = bwn_core_init(up_dev);
4460                 if (err) {
4461                         device_printf(sc->sc_dev,
4462                             "fatal: failed to initialize for %s-GHz\n",
4463                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4464                         goto fail;
4465                 }
4466         }
4467         if (status >= BWN_MAC_STATUS_STARTED)
4468                 bwn_core_start(up_dev);
4469         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4470         sc->sc_curmac = up_dev;
4471
4472         return (0);
4473 fail:
4474         sc->sc_curmac = NULL;
4475         return (err);
4476 }
4477
4478 static void
4479 bwn_rf_turnon(struct bwn_mac *mac)
4480 {
4481
4482         bwn_mac_suspend(mac);
4483         mac->mac_phy.rf_onoff(mac, 1);
4484         mac->mac_phy.rf_on = 1;
4485         bwn_mac_enable(mac);
4486 }
4487
4488 static void
4489 bwn_rf_turnoff(struct bwn_mac *mac)
4490 {
4491
4492         bwn_mac_suspend(mac);
4493         mac->mac_phy.rf_onoff(mac, 0);
4494         mac->mac_phy.rf_on = 0;
4495         bwn_mac_enable(mac);
4496 }
4497
4498 static void
4499 bwn_phy_reset(struct bwn_mac *mac)
4500 {
4501         struct bwn_softc *sc = mac->mac_sc;
4502
4503         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4504             ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4505              BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4506         DELAY(1000);
4507         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4508             (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC) |
4509             BWN_TGSLOW_PHYRESET);
4510         DELAY(1000);
4511 }
4512
4513 static int
4514 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4515 {
4516         struct bwn_vap *bvp = BWN_VAP(vap);
4517         struct ieee80211com *ic= vap->iv_ic;
4518         enum ieee80211_state ostate = vap->iv_state;
4519         struct bwn_softc *sc = ic->ic_softc;
4520         struct bwn_mac *mac = sc->sc_curmac;
4521         int error;
4522
4523         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4524             ieee80211_state_name[vap->iv_state],
4525             ieee80211_state_name[nstate]);
4526
4527         error = bvp->bv_newstate(vap, nstate, arg);
4528         if (error != 0)
4529                 return (error);
4530
4531         BWN_LOCK(sc);
4532
4533         bwn_led_newstate(mac, nstate);
4534
4535         /*
4536          * Clear the BSSID when we stop a STA
4537          */
4538         if (vap->iv_opmode == IEEE80211_M_STA) {
4539                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4540                         /*
4541                          * Clear out the BSSID.  If we reassociate to
4542                          * the same AP, this will reinialize things
4543                          * correctly...
4544                          */
4545                         if (ic->ic_opmode == IEEE80211_M_STA &&
4546                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4547                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4548                                 bwn_set_macaddr(mac);
4549                         }
4550                 }
4551         }
4552
4553         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4554             vap->iv_opmode == IEEE80211_M_AHDEMO) {
4555                 /* XXX nothing to do? */
4556         } else if (nstate == IEEE80211_S_RUN) {
4557                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4558                 bwn_set_opmode(mac);
4559                 bwn_set_pretbtt(mac);
4560                 bwn_spu_setdelay(mac, 0);
4561                 bwn_set_macaddr(mac);
4562         }
4563
4564         BWN_UNLOCK(sc);
4565
4566         return (error);
4567 }
4568
4569 static void
4570 bwn_set_pretbtt(struct bwn_mac *mac)
4571 {
4572         struct bwn_softc *sc = mac->mac_sc;
4573         struct ieee80211com *ic = &sc->sc_ic;
4574         uint16_t pretbtt;
4575
4576         if (ic->ic_opmode == IEEE80211_M_IBSS)
4577                 pretbtt = 2;
4578         else
4579                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4580         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4581         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4582 }
4583
4584 static int
4585 bwn_intr(void *arg)
4586 {
4587         struct bwn_mac *mac = arg;
4588         struct bwn_softc *sc = mac->mac_sc;
4589         uint32_t reason;
4590
4591         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4592             (sc->sc_flags & BWN_FLAG_INVALID))
4593                 return (FILTER_STRAY);
4594
4595         reason = BWN_READ_4(mac, BWN_INTR_REASON);
4596         if (reason == 0xffffffff)       /* shared IRQ */
4597                 return (FILTER_STRAY);
4598         reason &= mac->mac_intr_mask;
4599         if (reason == 0)
4600                 return (FILTER_HANDLED);
4601
4602         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4603         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4604         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4605         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4606         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4607         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4608         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4609         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4610         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4611         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4612         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4613
4614         /* Disable interrupts. */
4615         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4616
4617         mac->mac_reason_intr = reason;
4618
4619         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4620         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4621
4622         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4623         return (FILTER_HANDLED);
4624 }
4625
4626 static void
4627 bwn_intrtask(void *arg, int npending)
4628 {
4629         struct bwn_mac *mac = arg;
4630         struct bwn_softc *sc = mac->mac_sc;
4631         uint32_t merged = 0;
4632         int i, tx = 0, rx = 0;
4633
4634         BWN_LOCK(sc);
4635         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4636             (sc->sc_flags & BWN_FLAG_INVALID)) {
4637                 BWN_UNLOCK(sc);
4638                 return;
4639         }
4640
4641         for (i = 0; i < N(mac->mac_reason); i++)
4642                 merged |= mac->mac_reason[i];
4643
4644         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4645                 device_printf(sc->sc_dev, "MAC trans error\n");
4646
4647         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4648                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4649                 mac->mac_phy.txerrors--;
4650                 if (mac->mac_phy.txerrors == 0) {
4651                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4652                         bwn_restart(mac, "PHY TX errors");
4653                 }
4654         }
4655
4656         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4657                 if (merged & BWN_DMAINTR_FATALMASK) {
4658                         device_printf(sc->sc_dev,
4659                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4660                             mac->mac_reason[0], mac->mac_reason[1],
4661                             mac->mac_reason[2], mac->mac_reason[3],
4662                             mac->mac_reason[4], mac->mac_reason[5]);
4663                         bwn_restart(mac, "DMA error");
4664                         BWN_UNLOCK(sc);
4665                         return;
4666                 }
4667                 if (merged & BWN_DMAINTR_NONFATALMASK) {
4668                         device_printf(sc->sc_dev,
4669                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
4670                             mac->mac_reason[0], mac->mac_reason[1],
4671                             mac->mac_reason[2], mac->mac_reason[3],
4672                             mac->mac_reason[4], mac->mac_reason[5]);
4673                 }
4674         }
4675
4676         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4677                 bwn_intr_ucode_debug(mac);
4678         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4679                 bwn_intr_tbtt_indication(mac);
4680         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4681                 bwn_intr_atim_end(mac);
4682         if (mac->mac_reason_intr & BWN_INTR_BEACON)
4683                 bwn_intr_beacon(mac);
4684         if (mac->mac_reason_intr & BWN_INTR_PMQ)
4685                 bwn_intr_pmq(mac);
4686         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4687                 bwn_intr_noise(mac);
4688
4689         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4690                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4691                         bwn_dma_rx(mac->mac_method.dma.rx);
4692                         rx = 1;
4693                 }
4694         } else
4695                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4696
4697         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4698         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4699         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4700         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4701         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4702
4703         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4704                 bwn_intr_txeof(mac);
4705                 tx = 1;
4706         }
4707
4708         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4709
4710         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4711                 int evt = BWN_LED_EVENT_NONE;
4712
4713                 if (tx && rx) {
4714                         if (sc->sc_rx_rate > sc->sc_tx_rate)
4715                                 evt = BWN_LED_EVENT_RX;
4716                         else
4717                                 evt = BWN_LED_EVENT_TX;
4718                 } else if (tx) {
4719                         evt = BWN_LED_EVENT_TX;
4720                 } else if (rx) {
4721                         evt = BWN_LED_EVENT_RX;
4722                 } else if (rx == 0) {
4723                         evt = BWN_LED_EVENT_POLL;
4724                 }
4725
4726                 if (evt != BWN_LED_EVENT_NONE)
4727                         bwn_led_event(mac, evt);
4728        }
4729
4730         if (mbufq_first(&sc->sc_snd) != NULL)
4731                 bwn_start(sc);
4732
4733         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4734         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4735
4736         BWN_UNLOCK(sc);
4737 }
4738
4739 static void
4740 bwn_restart(struct bwn_mac *mac, const char *msg)
4741 {
4742         struct bwn_softc *sc = mac->mac_sc;
4743         struct ieee80211com *ic = &sc->sc_ic;
4744
4745         if (mac->mac_status < BWN_MAC_STATUS_INITED)
4746                 return;
4747
4748         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4749         ieee80211_runtask(ic, &mac->mac_hwreset);
4750 }
4751
4752 static void
4753 bwn_intr_ucode_debug(struct bwn_mac *mac)
4754 {
4755         struct bwn_softc *sc = mac->mac_sc;
4756         uint16_t reason;
4757
4758         if (mac->mac_fw.opensource == 0)
4759                 return;
4760
4761         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4762         switch (reason) {
4763         case BWN_DEBUGINTR_PANIC:
4764                 bwn_handle_fwpanic(mac);
4765                 break;
4766         case BWN_DEBUGINTR_DUMP_SHM:
4767                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4768                 break;
4769         case BWN_DEBUGINTR_DUMP_REGS:
4770                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4771                 break;
4772         case BWN_DEBUGINTR_MARKER:
4773                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4774                 break;
4775         default:
4776                 device_printf(sc->sc_dev,
4777                     "ucode debug unknown reason: %#x\n", reason);
4778         }
4779
4780         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4781             BWN_DEBUGINTR_ACK);
4782 }
4783
4784 static void
4785 bwn_intr_tbtt_indication(struct bwn_mac *mac)
4786 {
4787         struct bwn_softc *sc = mac->mac_sc;
4788         struct ieee80211com *ic = &sc->sc_ic;
4789
4790         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4791                 bwn_psctl(mac, 0);
4792         if (ic->ic_opmode == IEEE80211_M_IBSS)
4793                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4794 }
4795
4796 static void
4797 bwn_intr_atim_end(struct bwn_mac *mac)
4798 {
4799
4800         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4801                 BWN_WRITE_4(mac, BWN_MACCMD,
4802                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4803                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4804         }
4805 }
4806
4807 static void
4808 bwn_intr_beacon(struct bwn_mac *mac)
4809 {
4810         struct bwn_softc *sc = mac->mac_sc;
4811         struct ieee80211com *ic = &sc->sc_ic;
4812         uint32_t cmd, beacon0, beacon1;
4813
4814         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4815             ic->ic_opmode == IEEE80211_M_MBSS)
4816                 return;
4817
4818         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
4819
4820         cmd = BWN_READ_4(mac, BWN_MACCMD);
4821         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
4822         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
4823
4824         if (beacon0 && beacon1) {
4825                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
4826                 mac->mac_intr_mask |= BWN_INTR_BEACON;
4827                 return;
4828         }
4829
4830         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
4831                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
4832                 bwn_load_beacon0(mac);
4833                 bwn_load_beacon1(mac);
4834                 cmd = BWN_READ_4(mac, BWN_MACCMD);
4835                 cmd |= BWN_MACCMD_BEACON0_VALID;
4836                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4837         } else {
4838                 if (!beacon0) {
4839                         bwn_load_beacon0(mac);
4840                         cmd = BWN_READ_4(mac, BWN_MACCMD);
4841                         cmd |= BWN_MACCMD_BEACON0_VALID;
4842                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4843                 } else if (!beacon1) {
4844                         bwn_load_beacon1(mac);
4845                         cmd = BWN_READ_4(mac, BWN_MACCMD);
4846                         cmd |= BWN_MACCMD_BEACON1_VALID;
4847                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4848                 }
4849         }
4850 }
4851
4852 static void
4853 bwn_intr_pmq(struct bwn_mac *mac)
4854 {
4855         uint32_t tmp;
4856
4857         while (1) {
4858                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
4859                 if (!(tmp & 0x00000008))
4860                         break;
4861         }
4862         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
4863 }
4864
4865 static void
4866 bwn_intr_noise(struct bwn_mac *mac)
4867 {
4868         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
4869         uint16_t tmp;
4870         uint8_t noise[4];
4871         uint8_t i, j;
4872         int32_t average;
4873
4874         if (mac->mac_phy.type != BWN_PHYTYPE_G)
4875                 return;
4876
4877         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
4878         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
4879         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
4880             noise[3] == 0x7f)
4881                 goto new;
4882
4883         KASSERT(mac->mac_noise.noi_nsamples < 8,
4884             ("%s:%d: fail", __func__, __LINE__));
4885         i = mac->mac_noise.noi_nsamples;
4886         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
4887         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
4888         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
4889         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
4890         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
4891         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
4892         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
4893         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
4894         mac->mac_noise.noi_nsamples++;
4895         if (mac->mac_noise.noi_nsamples == 8) {
4896                 average = 0;
4897                 for (i = 0; i < 8; i++) {
4898                         for (j = 0; j < 4; j++)
4899                                 average += mac->mac_noise.noi_samples[i][j];
4900                 }
4901                 average = (((average / 32) * 125) + 64) / 128;
4902                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
4903                 if (tmp >= 8)
4904                         average += 2;
4905                 else
4906                         average -= 25;
4907                 average -= (tmp == 8) ? 72 : 48;
4908
4909                 mac->mac_stats.link_noise = average;
4910                 mac->mac_noise.noi_running = 0;
4911                 return;
4912         }
4913 new:
4914         bwn_noise_gensample(mac);
4915 }
4916
4917 static int
4918 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
4919 {
4920         struct bwn_mac *mac = prq->prq_mac;
4921         struct bwn_softc *sc = mac->mac_sc;
4922         unsigned int i;
4923
4924         BWN_ASSERT_LOCKED(sc);
4925
4926         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4927                 return (0);
4928
4929         for (i = 0; i < 5000; i++) {
4930                 if (bwn_pio_rxeof(prq) == 0)
4931                         break;
4932         }
4933         if (i >= 5000)
4934                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
4935         return ((i > 0) ? 1 : 0);
4936 }
4937
4938 static void
4939 bwn_dma_rx(struct bwn_dma_ring *dr)
4940 {
4941         int slot, curslot;
4942
4943         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
4944         curslot = dr->get_curslot(dr);
4945         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
4946             ("%s:%d: fail", __func__, __LINE__));
4947
4948         slot = dr->dr_curslot;
4949         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
4950                 bwn_dma_rxeof(dr, &slot);
4951
4952         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
4953             BUS_DMASYNC_PREWRITE);
4954
4955         dr->set_curslot(dr, slot);
4956         dr->dr_curslot = slot;
4957 }
4958
4959 static void
4960 bwn_intr_txeof(struct bwn_mac *mac)
4961 {
4962         struct bwn_txstatus stat;
4963         uint32_t stat0, stat1;
4964         uint16_t tmp;
4965
4966         BWN_ASSERT_LOCKED(mac->mac_sc);
4967
4968         while (1) {
4969                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
4970                 if (!(stat0 & 0x00000001))
4971                         break;
4972                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
4973
4974                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
4975                     "%s: stat0=0x%08x, stat1=0x%08x\n",
4976                     __func__,
4977                     stat0,
4978                     stat1);
4979
4980                 stat.cookie = (stat0 >> 16);
4981                 stat.seq = (stat1 & 0x0000ffff);
4982                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
4983                 tmp = (stat0 & 0x0000ffff);
4984                 stat.framecnt = ((tmp & 0xf000) >> 12);
4985                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
4986                 stat.sreason = ((tmp & 0x001c) >> 2);
4987                 stat.pm = (tmp & 0x0080) ? 1 : 0;
4988                 stat.im = (tmp & 0x0040) ? 1 : 0;
4989                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
4990                 stat.ack = (tmp & 0x0002) ? 1 : 0;
4991
4992                 bwn_handle_txeof(mac, &stat);
4993         }
4994 }
4995
4996 static void
4997 bwn_hwreset(void *arg, int npending)
4998 {
4999         struct bwn_mac *mac = arg;
5000         struct bwn_softc *sc = mac->mac_sc;
5001         int error = 0;
5002         int prev_status;
5003
5004         BWN_LOCK(sc);
5005
5006         prev_status = mac->mac_status;
5007         if (prev_status >= BWN_MAC_STATUS_STARTED)
5008                 bwn_core_stop(mac);
5009         if (prev_status >= BWN_MAC_STATUS_INITED)
5010                 bwn_core_exit(mac);
5011
5012         if (prev_status >= BWN_MAC_STATUS_INITED) {
5013                 error = bwn_core_init(mac);
5014                 if (error)
5015                         goto out;
5016         }
5017         if (prev_status >= BWN_MAC_STATUS_STARTED)
5018                 bwn_core_start(mac);
5019 out:
5020         if (error) {
5021                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5022                 sc->sc_curmac = NULL;
5023         }
5024         BWN_UNLOCK(sc);
5025 }
5026
5027 static void
5028 bwn_handle_fwpanic(struct bwn_mac *mac)
5029 {
5030         struct bwn_softc *sc = mac->mac_sc;
5031         uint16_t reason;
5032
5033         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5034         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5035
5036         if (reason == BWN_FWPANIC_RESTART)
5037                 bwn_restart(mac, "ucode panic");
5038 }
5039
5040 static void
5041 bwn_load_beacon0(struct bwn_mac *mac)
5042 {
5043
5044         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5045 }
5046
5047 static void
5048 bwn_load_beacon1(struct bwn_mac *mac)
5049 {
5050
5051         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5052 }
5053
5054 static uint32_t
5055 bwn_jssi_read(struct bwn_mac *mac)
5056 {
5057         uint32_t val = 0;
5058
5059         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5060         val <<= 16;
5061         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5062
5063         return (val);
5064 }
5065
5066 static void
5067 bwn_noise_gensample(struct bwn_mac *mac)
5068 {
5069         uint32_t jssi = 0x7f7f7f7f;
5070
5071         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5072         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5073         BWN_WRITE_4(mac, BWN_MACCMD,
5074             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5075 }
5076
5077 static int
5078 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5079 {
5080         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5081
5082         return (dr->dr_numslots - dr->dr_usedslot);
5083 }
5084
5085 static int
5086 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5087 {
5088         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5089
5090         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5091             ("%s:%d: fail", __func__, __LINE__));
5092         if (slot == dr->dr_numslots - 1)
5093                 return (0);
5094         return (slot + 1);
5095 }
5096
5097 static void
5098 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5099 {
5100         struct bwn_mac *mac = dr->dr_mac;
5101         struct bwn_softc *sc = mac->mac_sc;
5102         struct bwn_dma *dma = &mac->mac_method.dma;
5103         struct bwn_dmadesc_generic *desc;
5104         struct bwn_dmadesc_meta *meta;
5105         struct bwn_rxhdr4 *rxhdr;
5106         struct mbuf *m;
5107         uint32_t macstat;
5108         int32_t tmp;
5109         int cnt = 0;
5110         uint16_t len;
5111
5112         dr->getdesc(dr, *slot, &desc, &meta);
5113
5114         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5115         m = meta->mt_m;
5116
5117         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5118                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5119                 return;
5120         }
5121
5122         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5123         len = le16toh(rxhdr->frame_len);
5124         if (len <= 0) {
5125                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5126                 return;
5127         }
5128         if (bwn_dma_check_redzone(dr, m)) {
5129                 device_printf(sc->sc_dev, "redzone error.\n");
5130                 bwn_dma_set_redzone(dr, m);
5131                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5132                     BUS_DMASYNC_PREWRITE);
5133                 return;
5134         }
5135         if (len > dr->dr_rx_bufsize) {
5136                 tmp = len;
5137                 while (1) {
5138                         dr->getdesc(dr, *slot, &desc, &meta);
5139                         bwn_dma_set_redzone(dr, meta->mt_m);
5140                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5141                             BUS_DMASYNC_PREWRITE);
5142                         *slot = bwn_dma_nextslot(dr, *slot);
5143                         cnt++;
5144                         tmp -= dr->dr_rx_bufsize;
5145                         if (tmp <= 0)
5146                                 break;
5147                 }
5148                 device_printf(sc->sc_dev, "too small buffer "
5149                        "(len %u buffer %u dropped %d)\n",
5150                        len, dr->dr_rx_bufsize, cnt);
5151                 return;
5152         }
5153         macstat = le32toh(rxhdr->mac_status);
5154         if (macstat & BWN_RX_MAC_FCSERR) {
5155                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5156                         device_printf(sc->sc_dev, "RX drop\n");
5157                         return;
5158                 }
5159         }
5160
5161         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5162         m_adj(m, dr->dr_frameoffset);
5163
5164         bwn_rxeof(dr->dr_mac, m, rxhdr);
5165 }
5166
5167 static void
5168 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5169 {
5170         struct bwn_softc *sc = mac->mac_sc;
5171         struct bwn_stats *stats = &mac->mac_stats;
5172
5173         BWN_ASSERT_LOCKED(mac->mac_sc);
5174
5175         if (status->im)
5176                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5177         if (status->ampdu)
5178                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5179         if (status->rtscnt) {
5180                 if (status->rtscnt == 0xf)
5181                         stats->rtsfail++;
5182                 else
5183                         stats->rts++;
5184         }
5185
5186         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5187                 bwn_dma_handle_txeof(mac, status);
5188         } else {
5189                 bwn_pio_handle_txeof(mac, status);
5190         }
5191
5192         bwn_phy_txpower_check(mac, 0);
5193 }
5194
5195 static uint8_t
5196 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5197 {
5198         struct bwn_mac *mac = prq->prq_mac;
5199         struct bwn_softc *sc = mac->mac_sc;
5200         struct bwn_rxhdr4 rxhdr;
5201         struct mbuf *m;
5202         uint32_t ctl32, macstat, v32;
5203         unsigned int i, padding;
5204         uint16_t ctl16, len, totlen, v16;
5205         unsigned char *mp;
5206         char *data;
5207
5208         memset(&rxhdr, 0, sizeof(rxhdr));
5209
5210         if (prq->prq_rev >= 8) {
5211                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5212                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5213                         return (0);
5214                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5215                     BWN_PIO8_RXCTL_FRAMEREADY);
5216                 for (i = 0; i < 10; i++) {
5217                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5218                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5219                                 goto ready;
5220                         DELAY(10);
5221                 }
5222         } else {
5223                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5224                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5225                         return (0);
5226                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5227                     BWN_PIO_RXCTL_FRAMEREADY);
5228                 for (i = 0; i < 10; i++) {
5229                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5230                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5231                                 goto ready;
5232                         DELAY(10);
5233                 }
5234         }
5235         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5236         return (1);
5237 ready:
5238         if (prq->prq_rev >= 8)
5239                 siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5240                     prq->prq_base + BWN_PIO8_RXDATA);
5241         else
5242                 siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5243                     prq->prq_base + BWN_PIO_RXDATA);
5244         len = le16toh(rxhdr.frame_len);
5245         if (len > 0x700) {
5246                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5247                 goto error;
5248         }
5249         if (len == 0) {
5250                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5251                 goto error;
5252         }
5253
5254         macstat = le32toh(rxhdr.mac_status);
5255         if (macstat & BWN_RX_MAC_FCSERR) {
5256                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5257                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5258                         goto error;
5259                 }
5260         }
5261
5262         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5263         totlen = len + padding;
5264         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5265         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5266         if (m == NULL) {
5267                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5268                 goto error;
5269         }
5270         mp = mtod(m, unsigned char *);
5271         if (prq->prq_rev >= 8) {
5272                 siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5273                     prq->prq_base + BWN_PIO8_RXDATA);
5274                 if (totlen & 3) {
5275                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5276                         data = &(mp[totlen - 1]);
5277                         switch (totlen & 3) {
5278                         case 3:
5279                                 *data = (v32 >> 16);
5280                                 data--;
5281                         case 2:
5282                                 *data = (v32 >> 8);
5283                                 data--;
5284                         case 1:
5285                                 *data = v32;
5286                         }
5287                 }
5288         } else {
5289                 siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5290                     prq->prq_base + BWN_PIO_RXDATA);
5291                 if (totlen & 1) {
5292                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5293                         mp[totlen - 1] = v16;
5294                 }
5295         }
5296
5297         m->m_len = m->m_pkthdr.len = totlen;
5298
5299         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5300
5301         return (1);
5302 error:
5303         if (prq->prq_rev >= 8)
5304                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5305                     BWN_PIO8_RXCTL_DATAREADY);
5306         else
5307                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5308         return (1);
5309 }
5310
5311 static int
5312 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5313     struct bwn_dmadesc_meta *meta, int init)
5314 {
5315         struct bwn_mac *mac = dr->dr_mac;
5316         struct bwn_dma *dma = &mac->mac_method.dma;
5317         struct bwn_rxhdr4 *hdr;
5318         bus_dmamap_t map;
5319         bus_addr_t paddr;
5320         struct mbuf *m;
5321         int error;
5322
5323         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5324         if (m == NULL) {
5325                 error = ENOBUFS;
5326
5327                 /*
5328                  * If the NIC is up and running, we need to:
5329                  * - Clear RX buffer's header.
5330                  * - Restore RX descriptor settings.
5331                  */
5332                 if (init)
5333                         return (error);
5334                 else
5335                         goto back;
5336         }
5337         m->m_len = m->m_pkthdr.len = MCLBYTES;
5338
5339         bwn_dma_set_redzone(dr, m);
5340
5341         /*
5342          * Try to load RX buf into temporary DMA map
5343          */
5344         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5345             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5346         if (error) {
5347                 m_freem(m);
5348
5349                 /*
5350                  * See the comment above
5351                  */
5352                 if (init)
5353                         return (error);
5354                 else
5355                         goto back;
5356         }
5357
5358         if (!init)
5359                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5360         meta->mt_m = m;
5361         meta->mt_paddr = paddr;
5362
5363         /*
5364          * Swap RX buf's DMA map with the loaded temporary one
5365          */
5366         map = meta->mt_dmap;
5367         meta->mt_dmap = dr->dr_spare_dmap;
5368         dr->dr_spare_dmap = map;
5369
5370 back:
5371         /*
5372          * Clear RX buf header
5373          */
5374         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5375         bzero(hdr, sizeof(*hdr));
5376         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5377             BUS_DMASYNC_PREWRITE);
5378
5379         /*
5380          * Setup RX buf descriptor
5381          */
5382         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5383             sizeof(*hdr), 0, 0, 0);
5384         return (error);
5385 }
5386
5387 static void
5388 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5389                  bus_size_t mapsz __unused, int error)
5390 {
5391
5392         if (!error) {
5393                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5394                 *((bus_addr_t *)arg) = seg->ds_addr;
5395         }
5396 }
5397
5398 static int
5399 bwn_hwrate2ieeerate(int rate)
5400 {
5401
5402         switch (rate) {
5403         case BWN_CCK_RATE_1MB:
5404                 return (2);
5405         case BWN_CCK_RATE_2MB:
5406                 return (4);
5407         case BWN_CCK_RATE_5MB:
5408                 return (11);
5409         case BWN_CCK_RATE_11MB:
5410                 return (22);
5411         case BWN_OFDM_RATE_6MB:
5412                 return (12);
5413         case BWN_OFDM_RATE_9MB:
5414                 return (18);
5415         case BWN_OFDM_RATE_12MB:
5416                 return (24);
5417         case BWN_OFDM_RATE_18MB:
5418                 return (36);
5419         case BWN_OFDM_RATE_24MB:
5420                 return (48);
5421         case BWN_OFDM_RATE_36MB:
5422                 return (72);
5423         case BWN_OFDM_RATE_48MB:
5424                 return (96);
5425         case BWN_OFDM_RATE_54MB:
5426                 return (108);
5427         default:
5428                 printf("Ooops\n");
5429                 return (0);
5430         }
5431 }
5432
5433 /*
5434  * Post process the RX provided RSSI.
5435  *
5436  * Valid for A, B, G, LP PHYs.
5437  */
5438 static int8_t
5439 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5440     int ofdm, int adjust_2053, int adjust_2050)
5441 {
5442         struct bwn_phy *phy = &mac->mac_phy;
5443         struct bwn_phy_g *gphy = &phy->phy_g;
5444         int tmp;
5445
5446         switch (phy->rf_ver) {
5447         case 0x2050:
5448                 if (ofdm) {
5449                         tmp = in_rssi;
5450                         if (tmp > 127)
5451                                 tmp -= 256;
5452                         tmp = tmp * 73 / 64;
5453                         if (adjust_2050)
5454                                 tmp += 25;
5455                         else
5456                                 tmp -= 3;
5457                 } else {
5458                         if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5459                             & BWN_BFL_RSSI) {
5460                                 if (in_rssi > 63)
5461                                         in_rssi = 63;
5462                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5463                                 tmp = (31 - tmp) * -131 / 128 - 57;
5464                         } else {
5465                                 tmp = in_rssi;
5466                                 tmp = (31 - tmp) * -149 / 128 - 68;
5467                         }
5468                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5469                                 tmp += 25;
5470                 }
5471                 break;
5472         case 0x2060:
5473                 if (in_rssi > 127)
5474                         tmp = in_rssi - 256;
5475                 else
5476                         tmp = in_rssi;
5477                 break;
5478         default:
5479                 tmp = in_rssi;
5480                 tmp = (tmp - 11) * 103 / 64;
5481                 if (adjust_2053)
5482                         tmp -= 109;
5483                 else
5484                         tmp -= 83;
5485         }
5486
5487         return (tmp);
5488 }
5489
5490 static void
5491 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5492 {
5493         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5494         struct bwn_plcp6 *plcp;
5495         struct bwn_softc *sc = mac->mac_sc;
5496         struct ieee80211_frame_min *wh;
5497         struct ieee80211_node *ni;
5498         struct ieee80211com *ic = &sc->sc_ic;
5499         uint32_t macstat;
5500         int padding, rate, rssi = 0, noise = 0, type;
5501         uint16_t phytype, phystat0, phystat3, chanstat;
5502         unsigned char *mp = mtod(m, unsigned char *);
5503         static int rx_mac_dec_rpt = 0;
5504
5505         BWN_ASSERT_LOCKED(sc);
5506
5507         phystat0 = le16toh(rxhdr->phy_status0);
5508         phystat3 = le16toh(rxhdr->phy_status3);
5509
5510         /* XXX Note: mactime, macstat, chanstat need fixing for fw 598 */
5511         macstat = le32toh(rxhdr->mac_status);
5512         chanstat = le16toh(rxhdr->channel);
5513
5514         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5515
5516         if (macstat & BWN_RX_MAC_FCSERR)
5517                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5518         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5519                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5520         if (macstat & BWN_RX_MAC_DECERR)
5521                 goto drop;
5522
5523         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5524         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5525                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5526                     m->m_pkthdr.len);
5527                 goto drop;
5528         }
5529         plcp = (struct bwn_plcp6 *)(mp + padding);
5530         m_adj(m, sizeof(struct bwn_plcp6) + padding);
5531         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5532                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5533                     m->m_pkthdr.len);
5534                 goto drop;
5535         }
5536         wh = mtod(m, struct ieee80211_frame_min *);
5537
5538         if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5539                 device_printf(sc->sc_dev,
5540                     "RX decryption attempted (old %d keyidx %#x)\n",
5541                     BWN_ISOLDFMT(mac),
5542                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5543
5544         if (phystat0 & BWN_RX_PHYST0_OFDM)
5545                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
5546                     phytype == BWN_PHYTYPE_A);
5547         else
5548                 rate = bwn_plcp_get_cckrate(mac, plcp);
5549         if (rate == -1) {
5550                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5551                         goto drop;
5552         }
5553         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5554
5555         /* rssi/noise */
5556         switch (phytype) {
5557         case BWN_PHYTYPE_A:
5558         case BWN_PHYTYPE_B:
5559         case BWN_PHYTYPE_G:
5560         case BWN_PHYTYPE_LP:
5561                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5562                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
5563                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5564                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5565                 break;
5566         default:
5567                 /* XXX TODO: implement rssi for other PHYs */
5568                 break;
5569         }
5570
5571         noise = mac->mac_stats.link_noise;
5572
5573         /* RX radio tap */
5574         if (ieee80211_radiotap_active(ic))
5575                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5576         m_adj(m, -IEEE80211_CRC_LEN);
5577
5578         BWN_UNLOCK(sc);
5579
5580         ni = ieee80211_find_rxnode(ic, wh);
5581         if (ni != NULL) {
5582                 type = ieee80211_input(ni, m, rssi, noise);
5583                 ieee80211_free_node(ni);
5584         } else
5585                 type = ieee80211_input_all(ic, m, rssi, noise);
5586
5587         BWN_LOCK(sc);
5588         return;
5589 drop:
5590         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5591 }
5592
5593 static void
5594 bwn_dma_handle_txeof(struct bwn_mac *mac,
5595     const struct bwn_txstatus *status)
5596 {
5597         struct bwn_dma *dma = &mac->mac_method.dma;
5598         struct bwn_dma_ring *dr;
5599         struct bwn_dmadesc_generic *desc;
5600         struct bwn_dmadesc_meta *meta;
5601         struct bwn_softc *sc = mac->mac_sc;
5602         int slot;
5603         int retrycnt = 0;
5604
5605         BWN_ASSERT_LOCKED(sc);
5606
5607         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5608         if (dr == NULL) {
5609                 device_printf(sc->sc_dev, "failed to parse cookie\n");
5610                 return;
5611         }
5612         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5613
5614         while (1) {
5615                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
5616                     ("%s:%d: fail", __func__, __LINE__));
5617                 dr->getdesc(dr, slot, &desc, &meta);
5618
5619                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5620                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5621                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5622                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5623
5624                 if (meta->mt_islast) {
5625                         KASSERT(meta->mt_m != NULL,
5626                             ("%s:%d: fail", __func__, __LINE__));
5627
5628                         /* Just count full frame retries for now */
5629                         retrycnt = status->framecnt - 1;
5630                         ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5631                             status->ack ?
5632                               IEEE80211_RATECTL_TX_SUCCESS :
5633                               IEEE80211_RATECTL_TX_FAILURE,
5634                             &retrycnt, 0);
5635                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5636                         meta->mt_ni = NULL;
5637                         meta->mt_m = NULL;
5638                 } else
5639                         KASSERT(meta->mt_m == NULL,
5640                             ("%s:%d: fail", __func__, __LINE__));
5641
5642                 dr->dr_usedslot--;
5643                 if (meta->mt_islast)
5644                         break;
5645                 slot = bwn_dma_nextslot(dr, slot);
5646         }
5647         sc->sc_watchdog_timer = 0;
5648         if (dr->dr_stop) {
5649                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5650                     ("%s:%d: fail", __func__, __LINE__));
5651                 dr->dr_stop = 0;
5652         }
5653 }
5654
5655 static void
5656 bwn_pio_handle_txeof(struct bwn_mac *mac,
5657     const struct bwn_txstatus *status)
5658 {
5659         struct bwn_pio_txqueue *tq;
5660         struct bwn_pio_txpkt *tp = NULL;
5661         struct bwn_softc *sc = mac->mac_sc;
5662         int retrycnt = 0;
5663
5664         BWN_ASSERT_LOCKED(sc);
5665
5666         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5667         if (tq == NULL)
5668                 return;
5669
5670         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5671         tq->tq_free++;
5672
5673         if (tp->tp_ni != NULL) {
5674                 /*
5675                  * Do any tx complete callback.  Note this must
5676                  * be done before releasing the node reference.
5677                  */
5678
5679                 /* Just count full frame retries for now */
5680                 retrycnt = status->framecnt - 1;
5681                 ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5682                     status->ack ?
5683                       IEEE80211_RATECTL_TX_SUCCESS :
5684                       IEEE80211_RATECTL_TX_FAILURE,
5685                     &retrycnt, 0);
5686
5687                 if (tp->tp_m->m_flags & M_TXCB)
5688                         ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5689                 ieee80211_free_node(tp->tp_ni);
5690                 tp->tp_ni = NULL;
5691         }
5692         m_freem(tp->tp_m);
5693         tp->tp_m = NULL;
5694         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5695
5696         sc->sc_watchdog_timer = 0;
5697 }
5698
5699 static void
5700 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5701 {
5702         struct bwn_softc *sc = mac->mac_sc;
5703         struct bwn_phy *phy = &mac->mac_phy;
5704         struct ieee80211com *ic = &sc->sc_ic;
5705         unsigned long now;
5706         int result;
5707
5708         BWN_GETTIME(now);
5709
5710         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5711                 return;
5712         phy->nexttime = now + 2 * 1000;
5713
5714         if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5715             siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5716                 return;
5717
5718         if (phy->recalc_txpwr != NULL) {
5719                 result = phy->recalc_txpwr(mac,
5720                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5721                 if (result == BWN_TXPWR_RES_DONE)
5722                         return;
5723                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
5724                     ("%s: fail", __func__));
5725                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
5726
5727                 ieee80211_runtask(ic, &mac->mac_txpower);
5728         }
5729 }
5730
5731 static uint16_t
5732 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
5733 {
5734
5735         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
5736 }
5737
5738 static uint32_t
5739 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
5740 {
5741
5742         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
5743 }
5744
5745 static void
5746 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
5747 {
5748
5749         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
5750 }
5751
5752 static void
5753 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
5754 {
5755
5756         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
5757 }
5758
5759 static int
5760 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
5761 {
5762
5763         switch (rate) {
5764         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
5765         case 12:
5766                 return (BWN_OFDM_RATE_6MB);
5767         case 18:
5768                 return (BWN_OFDM_RATE_9MB);
5769         case 24:
5770                 return (BWN_OFDM_RATE_12MB);
5771         case 36:
5772                 return (BWN_OFDM_RATE_18MB);
5773         case 48:
5774                 return (BWN_OFDM_RATE_24MB);
5775         case 72:
5776                 return (BWN_OFDM_RATE_36MB);
5777         case 96:
5778                 return (BWN_OFDM_RATE_48MB);
5779         case 108:
5780                 return (BWN_OFDM_RATE_54MB);
5781         /* CCK rates (NB: not IEEE std, device-specific) */
5782         case 2:
5783                 return (BWN_CCK_RATE_1MB);
5784         case 4:
5785                 return (BWN_CCK_RATE_2MB);
5786         case 11:
5787                 return (BWN_CCK_RATE_5MB);
5788         case 22:
5789                 return (BWN_CCK_RATE_11MB);
5790         }
5791
5792         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
5793         return (BWN_CCK_RATE_1MB);
5794 }
5795
5796 static int
5797 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
5798     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
5799 {
5800         const struct bwn_phy *phy = &mac->mac_phy;
5801         struct bwn_softc *sc = mac->mac_sc;
5802         struct ieee80211_frame *wh;
5803         struct ieee80211_frame *protwh;
5804         struct ieee80211_frame_cts *cts;
5805         struct ieee80211_frame_rts *rts;
5806         const struct ieee80211_txparam *tp;
5807         struct ieee80211vap *vap = ni->ni_vap;
5808         struct ieee80211com *ic = &sc->sc_ic;
5809         struct mbuf *mprot;
5810         unsigned int len;
5811         uint32_t macctl = 0;
5812         int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
5813         uint16_t phyctl = 0;
5814         uint8_t rate, rate_fb;
5815
5816         wh = mtod(m, struct ieee80211_frame *);
5817         memset(txhdr, 0, sizeof(*txhdr));
5818
5819         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
5820         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
5821         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
5822
5823         /*
5824          * Find TX rate
5825          */
5826         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
5827         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
5828                 rate = rate_fb = tp->mgmtrate;
5829         else if (ismcast)
5830                 rate = rate_fb = tp->mcastrate;
5831         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
5832                 rate = rate_fb = tp->ucastrate;
5833         else {
5834                 /* XXX TODO: don't fall back to CCK rates for OFDM */
5835                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
5836                 rate = ni->ni_txrate;
5837
5838                 if (rix > 0)
5839                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
5840                             IEEE80211_RATE_VAL;
5841                 else
5842                         rate_fb = rate;
5843         }
5844
5845         sc->sc_tx_rate = rate;
5846
5847         /* Note: this maps the select ieee80211 rate to hardware rate */
5848         rate = bwn_ieeerate2hwrate(sc, rate);
5849         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
5850
5851         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
5852             bwn_plcp_getcck(rate);
5853         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
5854         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
5855
5856         /* XXX rate/rate_fb is the hardware rate */
5857         if ((rate_fb == rate) ||
5858             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
5859             (*(u_int16_t *)wh->i_dur == htole16(0)))
5860                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
5861         else
5862                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
5863                     m->m_pkthdr.len, rate, isshort);
5864
5865         /* XXX TX encryption */
5866         bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
5867             (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
5868             (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
5869             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
5870         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
5871             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
5872
5873         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
5874             BWN_TX_EFT_FB_CCK;
5875         txhdr->chan = phy->chan;
5876         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
5877             BWN_TX_PHY_ENC_CCK;
5878         /* XXX preamble? obey net80211 */
5879         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5880              rate == BWN_CCK_RATE_11MB))
5881                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
5882
5883         /* XXX TX antenna selection */
5884
5885         switch (bwn_antenna_sanitize(mac, 0)) {
5886         case 0:
5887                 phyctl |= BWN_TX_PHY_ANT01AUTO;
5888                 break;
5889         case 1:
5890                 phyctl |= BWN_TX_PHY_ANT0;
5891                 break;
5892         case 2:
5893                 phyctl |= BWN_TX_PHY_ANT1;
5894                 break;
5895         case 3:
5896                 phyctl |= BWN_TX_PHY_ANT2;
5897                 break;
5898         case 4:
5899                 phyctl |= BWN_TX_PHY_ANT3;
5900                 break;
5901         default:
5902                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5903         }
5904
5905         if (!ismcast)
5906                 macctl |= BWN_TX_MAC_ACK;
5907
5908         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
5909         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
5910             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
5911                 macctl |= BWN_TX_MAC_LONGFRAME;
5912
5913         if (ic->ic_flags & IEEE80211_F_USEPROT) {
5914                 /* XXX RTS rate is always 1MB??? */
5915                 /* XXX TODO: don't fall back to CCK rates for OFDM */
5916                 rts_rate = BWN_CCK_RATE_1MB;
5917                 rts_rate_fb = bwn_get_fbrate(rts_rate);
5918
5919                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
5920                 protdur = ieee80211_compute_duration(ic->ic_rt,
5921                     m->m_pkthdr.len, rate, isshort) +
5922                     + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
5923
5924                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
5925                         cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
5926                             (txhdr->body.old.rts_frame) :
5927                             (txhdr->body.new.rts_frame));
5928                         mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
5929                             protdur);
5930                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5931                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
5932                             mprot->m_pkthdr.len);
5933                         m_freem(mprot);
5934                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
5935                         len = sizeof(struct ieee80211_frame_cts);
5936                 } else {
5937                         rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
5938                             (txhdr->body.old.rts_frame) :
5939                             (txhdr->body.new.rts_frame));
5940                         /* XXX rate/rate_fb is the hardware rate */
5941                         protdur += ieee80211_ack_duration(ic->ic_rt, rate,
5942                             isshort);
5943                         mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
5944                             wh->i_addr2, protdur);
5945                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5946                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
5947                             mprot->m_pkthdr.len);
5948                         m_freem(mprot);
5949                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
5950                         len = sizeof(struct ieee80211_frame_rts);
5951                 }
5952                 len += IEEE80211_CRC_LEN;
5953                 bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
5954                     &txhdr->body.old.rts_plcp :
5955                     &txhdr->body.new.rts_plcp), len, rts_rate);
5956                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
5957                     rts_rate_fb);
5958
5959                 protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
5960                     (&txhdr->body.old.rts_frame) :
5961                     (&txhdr->body.new.rts_frame));
5962                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
5963
5964                 if (BWN_ISOFDMRATE(rts_rate)) {
5965                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
5966                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
5967                 } else {
5968                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
5969                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
5970                 }
5971                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
5972                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
5973         }
5974
5975         if (BWN_ISOLDFMT(mac))
5976                 txhdr->body.old.cookie = htole16(cookie);
5977         else
5978                 txhdr->body.new.cookie = htole16(cookie);
5979
5980         txhdr->macctl = htole32(macctl);
5981         txhdr->phyctl = htole16(phyctl);
5982
5983         /*
5984          * TX radio tap
5985          */
5986         if (ieee80211_radiotap_active_vap(vap)) {
5987                 sc->sc_tx_th.wt_flags = 0;
5988                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
5989                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5990                 if (isshort &&
5991                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5992                      rate == BWN_CCK_RATE_11MB))
5993                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
5994                 sc->sc_tx_th.wt_rate = rate;
5995
5996                 ieee80211_radiotap_tx(vap, m);
5997         }
5998
5999         return (0);
6000 }
6001
6002 static void
6003 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6004     const uint8_t rate)
6005 {
6006         uint32_t d, plen;
6007         uint8_t *raw = plcp->o.raw;
6008
6009         if (BWN_ISOFDMRATE(rate)) {
6010                 d = bwn_plcp_getofdm(rate);
6011                 KASSERT(!(octets & 0xf000),
6012                     ("%s:%d: fail", __func__, __LINE__));
6013                 d |= (octets << 5);
6014                 plcp->o.data = htole32(d);
6015         } else {
6016                 plen = octets * 16 / rate;
6017                 if ((octets * 16 % rate) > 0) {
6018                         plen++;
6019                         if ((rate == BWN_CCK_RATE_11MB)
6020                             && ((octets * 8 % 11) < 4)) {
6021                                 raw[1] = 0x84;
6022                         } else
6023                                 raw[1] = 0x04;
6024                 } else
6025                         raw[1] = 0x04;
6026                 plcp->o.data |= htole32(plen << 16);
6027                 raw[0] = bwn_plcp_getcck(rate);
6028         }
6029 }
6030
6031 static uint8_t
6032 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6033 {
6034         struct bwn_softc *sc = mac->mac_sc;
6035         uint8_t mask;
6036
6037         if (n == 0)
6038                 return (0);
6039         if (mac->mac_phy.gmode)
6040                 mask = siba_sprom_get_ant_bg(sc->sc_dev);
6041         else
6042                 mask = siba_sprom_get_ant_a(sc->sc_dev);
6043         if (!(mask & (1 << (n - 1))))
6044                 return (0);
6045         return (n);
6046 }
6047
6048 /*
6049  * Return a fallback rate for the given rate.
6050  *
6051  * Note: Don't fall back from OFDM to CCK.
6052  */
6053 static uint8_t
6054 bwn_get_fbrate(uint8_t bitrate)
6055 {
6056         switch (bitrate) {
6057         /* CCK */
6058         case BWN_CCK_RATE_1MB:
6059                 return (BWN_CCK_RATE_1MB);
6060         case BWN_CCK_RATE_2MB:
6061                 return (BWN_CCK_RATE_1MB);
6062         case BWN_CCK_RATE_5MB:
6063                 return (BWN_CCK_RATE_2MB);
6064         case BWN_CCK_RATE_11MB:
6065                 return (BWN_CCK_RATE_5MB);
6066
6067         /* OFDM */
6068         case BWN_OFDM_RATE_6MB:
6069                 return (BWN_OFDM_RATE_6MB);
6070         case BWN_OFDM_RATE_9MB:
6071                 return (BWN_OFDM_RATE_6MB);
6072         case BWN_OFDM_RATE_12MB:
6073                 return (BWN_OFDM_RATE_9MB);
6074         case BWN_OFDM_RATE_18MB:
6075                 return (BWN_OFDM_RATE_12MB);
6076         case BWN_OFDM_RATE_24MB:
6077                 return (BWN_OFDM_RATE_18MB);
6078         case BWN_OFDM_RATE_36MB:
6079                 return (BWN_OFDM_RATE_24MB);
6080         case BWN_OFDM_RATE_48MB:
6081                 return (BWN_OFDM_RATE_36MB);
6082         case BWN_OFDM_RATE_54MB:
6083                 return (BWN_OFDM_RATE_48MB);
6084         }
6085         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6086         return (0);
6087 }
6088
6089 static uint32_t
6090 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6091     uint32_t ctl, const void *_data, int len)
6092 {
6093         struct bwn_softc *sc = mac->mac_sc;
6094         uint32_t value = 0;
6095         const uint8_t *data = _data;
6096
6097         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6098             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6099         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6100
6101         siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6102             tq->tq_base + BWN_PIO8_TXDATA);
6103         if (len & 3) {
6104                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6105                     BWN_PIO8_TXCTL_24_31);
6106                 data = &(data[len - 1]);
6107                 switch (len & 3) {
6108                 case 3:
6109                         ctl |= BWN_PIO8_TXCTL_16_23;
6110                         value |= (uint32_t)(*data) << 16;
6111                         data--;
6112                 case 2:
6113                         ctl |= BWN_PIO8_TXCTL_8_15;
6114                         value |= (uint32_t)(*data) << 8;
6115                         data--;
6116                 case 1:
6117                         value |= (uint32_t)(*data);
6118                 }
6119                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6120                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6121         }
6122
6123         return (ctl);
6124 }
6125
6126 static void
6127 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6128     uint16_t offset, uint32_t value)
6129 {
6130
6131         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6132 }
6133
6134 static uint16_t
6135 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6136     uint16_t ctl, const void *_data, int len)
6137 {
6138         struct bwn_softc *sc = mac->mac_sc;
6139         const uint8_t *data = _data;
6140
6141         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6142         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6143
6144         siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6145             tq->tq_base + BWN_PIO_TXDATA);
6146         if (len & 1) {
6147                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6148                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6149                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6150         }
6151
6152         return (ctl);
6153 }
6154
6155 static uint16_t
6156 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6157     uint16_t ctl, struct mbuf *m0)
6158 {
6159         int i, j = 0;
6160         uint16_t data = 0;
6161         const uint8_t *buf;
6162         struct mbuf *m = m0;
6163
6164         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6165         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6166
6167         for (; m != NULL; m = m->m_next) {
6168                 buf = mtod(m, const uint8_t *);
6169                 for (i = 0; i < m->m_len; i++) {
6170                         if (!((j++) % 2))
6171                                 data |= buf[i];
6172                         else {
6173                                 data |= (buf[i] << 8);
6174                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6175                                 data = 0;
6176                         }
6177                 }
6178         }
6179         if (m0->m_pkthdr.len % 2) {
6180                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6181                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6182                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6183         }
6184
6185         return (ctl);
6186 }
6187
6188 static void
6189 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6190 {
6191
6192         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6193                 return;
6194         BWN_WRITE_2(mac, 0x684, 510 + time);
6195         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6196 }
6197
6198 static struct bwn_dma_ring *
6199 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6200 {
6201
6202         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6203                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6204
6205         switch (prio) {
6206         case 3:
6207                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6208         case 2:
6209                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6210         case 0:
6211                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6212         case 1:
6213                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6214         }
6215         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6216         return (NULL);
6217 }
6218
6219 static int
6220 bwn_dma_getslot(struct bwn_dma_ring *dr)
6221 {
6222         int slot;
6223
6224         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6225
6226         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6227         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6228         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6229
6230         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6231         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6232         dr->dr_curslot = slot;
6233         dr->dr_usedslot++;
6234
6235         return (slot);
6236 }
6237
6238 static struct bwn_pio_txqueue *
6239 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6240     struct bwn_pio_txpkt **pack)
6241 {
6242         struct bwn_pio *pio = &mac->mac_method.pio;
6243         struct bwn_pio_txqueue *tq = NULL;
6244         unsigned int index;
6245
6246         switch (cookie & 0xf000) {
6247         case 0x1000:
6248                 tq = &pio->wme[WME_AC_BK];
6249                 break;
6250         case 0x2000:
6251                 tq = &pio->wme[WME_AC_BE];
6252                 break;
6253         case 0x3000:
6254                 tq = &pio->wme[WME_AC_VI];
6255                 break;
6256         case 0x4000:
6257                 tq = &pio->wme[WME_AC_VO];
6258                 break;
6259         case 0x5000:
6260                 tq = &pio->mcast;
6261                 break;
6262         }
6263         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6264         if (tq == NULL)
6265                 return (NULL);
6266         index = (cookie & 0x0fff);
6267         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6268         if (index >= N(tq->tq_pkts))
6269                 return (NULL);
6270         *pack = &tq->tq_pkts[index];
6271         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6272         return (tq);
6273 }
6274
6275 static void
6276 bwn_txpwr(void *arg, int npending)
6277 {
6278         struct bwn_mac *mac = arg;
6279         struct bwn_softc *sc = mac->mac_sc;
6280
6281         BWN_LOCK(sc);
6282         if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6283             mac->mac_phy.set_txpwr != NULL)
6284                 mac->mac_phy.set_txpwr(mac);
6285         BWN_UNLOCK(sc);
6286 }
6287
6288 static void
6289 bwn_task_15s(struct bwn_mac *mac)
6290 {
6291         uint16_t reg;
6292
6293         if (mac->mac_fw.opensource) {
6294                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6295                 if (reg) {
6296                         bwn_restart(mac, "fw watchdog");
6297                         return;
6298                 }
6299                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6300         }
6301         if (mac->mac_phy.task_15s)
6302                 mac->mac_phy.task_15s(mac);
6303
6304         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6305 }
6306
6307 static void
6308 bwn_task_30s(struct bwn_mac *mac)
6309 {
6310
6311         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6312                 return;
6313         mac->mac_noise.noi_running = 1;
6314         mac->mac_noise.noi_nsamples = 0;
6315
6316         bwn_noise_gensample(mac);
6317 }
6318
6319 static void
6320 bwn_task_60s(struct bwn_mac *mac)
6321 {
6322
6323         if (mac->mac_phy.task_60s)
6324                 mac->mac_phy.task_60s(mac);
6325         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6326 }
6327
6328 static void
6329 bwn_tasks(void *arg)
6330 {
6331         struct bwn_mac *mac = arg;
6332         struct bwn_softc *sc = mac->mac_sc;
6333
6334         BWN_ASSERT_LOCKED(sc);
6335         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6336                 return;
6337
6338         if (mac->mac_task_state % 4 == 0)
6339                 bwn_task_60s(mac);
6340         if (mac->mac_task_state % 2 == 0)
6341                 bwn_task_30s(mac);
6342         bwn_task_15s(mac);
6343
6344         mac->mac_task_state++;
6345         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6346 }
6347
6348 static int
6349 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6350 {
6351         struct bwn_softc *sc = mac->mac_sc;
6352
6353         KASSERT(a == 0, ("not support APHY\n"));
6354
6355         switch (plcp->o.raw[0] & 0xf) {
6356         case 0xb:
6357                 return (BWN_OFDM_RATE_6MB);
6358         case 0xf:
6359                 return (BWN_OFDM_RATE_9MB);
6360         case 0xa:
6361                 return (BWN_OFDM_RATE_12MB);
6362         case 0xe:
6363                 return (BWN_OFDM_RATE_18MB);
6364         case 0x9:
6365                 return (BWN_OFDM_RATE_24MB);
6366         case 0xd:
6367                 return (BWN_OFDM_RATE_36MB);
6368         case 0x8:
6369                 return (BWN_OFDM_RATE_48MB);
6370         case 0xc:
6371                 return (BWN_OFDM_RATE_54MB);
6372         }
6373         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6374             plcp->o.raw[0] & 0xf);
6375         return (-1);
6376 }
6377
6378 static int
6379 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6380 {
6381         struct bwn_softc *sc = mac->mac_sc;
6382
6383         switch (plcp->o.raw[0]) {
6384         case 0x0a:
6385                 return (BWN_CCK_RATE_1MB);
6386         case 0x14:
6387                 return (BWN_CCK_RATE_2MB);
6388         case 0x37:
6389                 return (BWN_CCK_RATE_5MB);
6390         case 0x6e:
6391                 return (BWN_CCK_RATE_11MB);
6392         }
6393         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6394         return (-1);
6395 }
6396
6397 static void
6398 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6399     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6400     int rssi, int noise)
6401 {
6402         struct bwn_softc *sc = mac->mac_sc;
6403         const struct ieee80211_frame_min *wh;
6404         uint64_t tsf;
6405         uint16_t low_mactime_now;
6406
6407         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6408                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6409
6410         wh = mtod(m, const struct ieee80211_frame_min *);
6411         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6412                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6413
6414         bwn_tsf_read(mac, &tsf);
6415         low_mactime_now = tsf;
6416         tsf = tsf & ~0xffffULL;
6417         tsf += le16toh(rxhdr->mac_time);
6418         if (low_mactime_now < le16toh(rxhdr->mac_time))
6419                 tsf -= 0x10000;
6420
6421         sc->sc_rx_th.wr_tsf = tsf;
6422         sc->sc_rx_th.wr_rate = rate;
6423         sc->sc_rx_th.wr_antsignal = rssi;
6424         sc->sc_rx_th.wr_antnoise = noise;
6425 }
6426
6427 static void
6428 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6429 {
6430         uint32_t low, high;
6431
6432         KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6433             ("%s:%d: fail", __func__, __LINE__));
6434
6435         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6436         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6437         *tsf = high;
6438         *tsf <<= 32;
6439         *tsf |= low;
6440 }
6441
6442 static int
6443 bwn_dma_attach(struct bwn_mac *mac)
6444 {
6445         struct bwn_dma *dma = &mac->mac_method.dma;
6446         struct bwn_softc *sc = mac->mac_sc;
6447         bus_addr_t lowaddr = 0;
6448         int error;
6449
6450         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6451                 return (0);
6452
6453         KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6454
6455         mac->mac_flags |= BWN_MAC_FLAG_DMA;
6456
6457         dma->dmatype = bwn_dma_gettype(mac);
6458         if (dma->dmatype == BWN_DMA_30BIT)
6459                 lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6460         else if (dma->dmatype == BWN_DMA_32BIT)
6461                 lowaddr = BUS_SPACE_MAXADDR_32BIT;
6462         else
6463                 lowaddr = BUS_SPACE_MAXADDR;
6464
6465         /*
6466          * Create top level DMA tag
6467          */
6468         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), /* parent */
6469                                BWN_ALIGN, 0,            /* alignment, bounds */
6470                                lowaddr,                 /* lowaddr */
6471                                BUS_SPACE_MAXADDR,       /* highaddr */
6472                                NULL, NULL,              /* filter, filterarg */
6473                                BUS_SPACE_MAXSIZE,       /* maxsize */
6474                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
6475                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
6476                                0,                       /* flags */
6477                                NULL, NULL,              /* lockfunc, lockarg */
6478                                &dma->parent_dtag);
6479         if (error) {
6480                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6481                 return (error);
6482         }
6483
6484         /*
6485          * Create TX/RX mbuf DMA tag
6486          */
6487         error = bus_dma_tag_create(dma->parent_dtag,
6488                                 1,
6489                                 0,
6490                                 BUS_SPACE_MAXADDR,
6491                                 BUS_SPACE_MAXADDR,
6492                                 NULL, NULL,
6493                                 MCLBYTES,
6494                                 1,
6495                                 BUS_SPACE_MAXSIZE_32BIT,
6496                                 0,
6497                                 NULL, NULL,
6498                                 &dma->rxbuf_dtag);
6499         if (error) {
6500                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6501                 goto fail0;
6502         }
6503         error = bus_dma_tag_create(dma->parent_dtag,
6504                                 1,
6505                                 0,
6506                                 BUS_SPACE_MAXADDR,
6507                                 BUS_SPACE_MAXADDR,
6508                                 NULL, NULL,
6509                                 MCLBYTES,
6510                                 1,
6511                                 BUS_SPACE_MAXSIZE_32BIT,
6512                                 0,
6513                                 NULL, NULL,
6514                                 &dma->txbuf_dtag);
6515         if (error) {
6516                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6517                 goto fail1;
6518         }
6519
6520         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6521         if (!dma->wme[WME_AC_BK])
6522                 goto fail2;
6523
6524         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6525         if (!dma->wme[WME_AC_BE])
6526                 goto fail3;
6527
6528         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6529         if (!dma->wme[WME_AC_VI])
6530                 goto fail4;
6531
6532         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6533         if (!dma->wme[WME_AC_VO])
6534                 goto fail5;
6535
6536         dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6537         if (!dma->mcast)
6538                 goto fail6;
6539         dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6540         if (!dma->rx)
6541                 goto fail7;
6542
6543         return (error);
6544
6545 fail7:  bwn_dma_ringfree(&dma->mcast);
6546 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
6547 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
6548 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
6549 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
6550 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
6551 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
6552 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
6553         return (error);
6554 }
6555
6556 static struct bwn_dma_ring *
6557 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
6558     uint16_t cookie, int *slot)
6559 {
6560         struct bwn_dma *dma = &mac->mac_method.dma;
6561         struct bwn_dma_ring *dr;
6562         struct bwn_softc *sc = mac->mac_sc;
6563
6564         BWN_ASSERT_LOCKED(mac->mac_sc);
6565
6566         switch (cookie & 0xf000) {
6567         case 0x1000:
6568                 dr = dma->wme[WME_AC_BK];
6569                 break;
6570         case 0x2000:
6571                 dr = dma->wme[WME_AC_BE];
6572                 break;
6573         case 0x3000:
6574                 dr = dma->wme[WME_AC_VI];
6575                 break;
6576         case 0x4000:
6577                 dr = dma->wme[WME_AC_VO];
6578                 break;
6579         case 0x5000:
6580                 dr = dma->mcast;
6581                 break;
6582         default:
6583                 dr = NULL;
6584                 KASSERT(0 == 1,
6585                     ("invalid cookie value %d", cookie & 0xf000));
6586         }
6587         *slot = (cookie & 0x0fff);
6588         if (*slot < 0 || *slot >= dr->dr_numslots) {
6589                 /*
6590                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
6591                  * that it occurs events which have same H/W sequence numbers.
6592                  * When it's occurred just prints a WARNING msgs and ignores.
6593                  */
6594                 KASSERT(status->seq == dma->lastseq,
6595                     ("%s:%d: fail", __func__, __LINE__));
6596                 device_printf(sc->sc_dev,
6597                     "out of slot ranges (0 < %d < %d)\n", *slot,
6598                     dr->dr_numslots);
6599                 return (NULL);
6600         }
6601         dma->lastseq = status->seq;
6602         return (dr);
6603 }
6604
6605 static void
6606 bwn_dma_stop(struct bwn_mac *mac)
6607 {
6608         struct bwn_dma *dma;
6609
6610         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
6611                 return;
6612         dma = &mac->mac_method.dma;
6613
6614         bwn_dma_ringstop(&dma->rx);
6615         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
6616         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
6617         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
6618         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
6619         bwn_dma_ringstop(&dma->mcast);
6620 }
6621
6622 static void
6623 bwn_dma_ringstop(struct bwn_dma_ring **dr)
6624 {
6625
6626         if (dr == NULL)
6627                 return;
6628
6629         bwn_dma_cleanup(*dr);
6630 }
6631
6632 static void
6633 bwn_pio_stop(struct bwn_mac *mac)
6634 {
6635         struct bwn_pio *pio;
6636
6637         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
6638                 return;
6639         pio = &mac->mac_method.pio;
6640
6641         bwn_destroy_queue_tx(&pio->mcast);
6642         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
6643         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
6644         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
6645         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
6646 }
6647
6648 static void
6649 bwn_led_attach(struct bwn_mac *mac)
6650 {
6651         struct bwn_softc *sc = mac->mac_sc;
6652         const uint8_t *led_act = NULL;
6653         uint16_t val[BWN_LED_MAX];
6654         int i;
6655
6656         sc->sc_led_idle = (2350 * hz) / 1000;
6657         sc->sc_led_blink = 1;
6658
6659         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
6660                 if (siba_get_pci_subvendor(sc->sc_dev) ==
6661                     bwn_vendor_led_act[i].vid) {
6662                         led_act = bwn_vendor_led_act[i].led_act;
6663                         break;
6664                 }
6665         }
6666         if (led_act == NULL)
6667                 led_act = bwn_default_led_act;
6668
6669         val[0] = siba_sprom_get_gpio0(sc->sc_dev);
6670         val[1] = siba_sprom_get_gpio1(sc->sc_dev);
6671         val[2] = siba_sprom_get_gpio2(sc->sc_dev);
6672         val[3] = siba_sprom_get_gpio3(sc->sc_dev);
6673
6674         for (i = 0; i < BWN_LED_MAX; ++i) {
6675                 struct bwn_led *led = &sc->sc_leds[i];
6676
6677                 if (val[i] == 0xff) {
6678                         led->led_act = led_act[i];
6679                 } else {
6680                         if (val[i] & BWN_LED_ACT_LOW)
6681                                 led->led_flags |= BWN_LED_F_ACTLOW;
6682                         led->led_act = val[i] & BWN_LED_ACT_MASK;
6683                 }
6684                 led->led_mask = (1 << i);
6685
6686                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
6687                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
6688                     led->led_act == BWN_LED_ACT_BLINK) {
6689                         led->led_flags |= BWN_LED_F_BLINK;
6690                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
6691                                 led->led_flags |= BWN_LED_F_POLLABLE;
6692                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
6693                                 led->led_flags |= BWN_LED_F_SLOW;
6694
6695                         if (sc->sc_blink_led == NULL) {
6696                                 sc->sc_blink_led = led;
6697                                 if (led->led_flags & BWN_LED_F_SLOW)
6698                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
6699                         }
6700                 }
6701
6702                 DPRINTF(sc, BWN_DEBUG_LED,
6703                     "%dth led, act %d, lowact %d\n", i,
6704                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
6705         }
6706         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
6707 }
6708
6709 static __inline uint16_t
6710 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
6711 {
6712
6713         if (led->led_flags & BWN_LED_F_ACTLOW)
6714                 on = !on;
6715         if (on)
6716                 val |= led->led_mask;
6717         else
6718                 val &= ~led->led_mask;
6719         return val;
6720 }
6721
6722 static void
6723 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
6724 {
6725         struct bwn_softc *sc = mac->mac_sc;
6726         struct ieee80211com *ic = &sc->sc_ic;
6727         uint16_t val;
6728         int i;
6729
6730         if (nstate == IEEE80211_S_INIT) {
6731                 callout_stop(&sc->sc_led_blink_ch);
6732                 sc->sc_led_blinking = 0;
6733         }
6734
6735         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
6736                 return;
6737
6738         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6739         for (i = 0; i < BWN_LED_MAX; ++i) {
6740                 struct bwn_led *led = &sc->sc_leds[i];
6741                 int on;
6742
6743                 if (led->led_act == BWN_LED_ACT_UNKN ||
6744                     led->led_act == BWN_LED_ACT_NULL)
6745                         continue;
6746
6747                 if ((led->led_flags & BWN_LED_F_BLINK) &&
6748                     nstate != IEEE80211_S_INIT)
6749                         continue;
6750
6751                 switch (led->led_act) {
6752                 case BWN_LED_ACT_ON:    /* Always on */
6753                         on = 1;
6754                         break;
6755                 case BWN_LED_ACT_OFF:   /* Always off */
6756                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
6757                         on = 0;
6758                         break;
6759                 default:
6760                         on = 1;
6761                         switch (nstate) {
6762                         case IEEE80211_S_INIT:
6763                                 on = 0;
6764                                 break;
6765                         case IEEE80211_S_RUN:
6766                                 if (led->led_act == BWN_LED_ACT_11G &&
6767                                     ic->ic_curmode != IEEE80211_MODE_11G)
6768                                         on = 0;
6769                                 break;
6770                         default:
6771                                 if (led->led_act == BWN_LED_ACT_ASSOC)
6772                                         on = 0;
6773                                 break;
6774                         }
6775                         break;
6776                 }
6777
6778                 val = bwn_led_onoff(led, val, on);
6779         }
6780         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6781 }
6782
6783 static void
6784 bwn_led_event(struct bwn_mac *mac, int event)
6785 {
6786         struct bwn_softc *sc = mac->mac_sc;
6787         struct bwn_led *led = sc->sc_blink_led;
6788         int rate;
6789
6790         if (event == BWN_LED_EVENT_POLL) {
6791                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
6792                         return;
6793                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6794                         return;
6795         }
6796
6797         sc->sc_led_ticks = ticks;
6798         if (sc->sc_led_blinking)
6799                 return;
6800
6801         switch (event) {
6802         case BWN_LED_EVENT_RX:
6803                 rate = sc->sc_rx_rate;
6804                 break;
6805         case BWN_LED_EVENT_TX:
6806                 rate = sc->sc_tx_rate;
6807                 break;
6808         case BWN_LED_EVENT_POLL:
6809                 rate = 0;
6810                 break;
6811         default:
6812                 panic("unknown LED event %d\n", event);
6813                 break;
6814         }
6815         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
6816             bwn_led_duration[rate].off_dur);
6817 }
6818
6819 static void
6820 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
6821 {
6822         struct bwn_softc *sc = mac->mac_sc;
6823         struct bwn_led *led = sc->sc_blink_led;
6824         uint16_t val;
6825
6826         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6827         val = bwn_led_onoff(led, val, 1);
6828         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6829
6830         if (led->led_flags & BWN_LED_F_SLOW) {
6831                 BWN_LED_SLOWDOWN(on_dur);
6832                 BWN_LED_SLOWDOWN(off_dur);
6833         }
6834
6835         sc->sc_led_blinking = 1;
6836         sc->sc_led_blink_offdur = off_dur;
6837
6838         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
6839 }
6840
6841 static void
6842 bwn_led_blink_next(void *arg)
6843 {
6844         struct bwn_mac *mac = arg;
6845         struct bwn_softc *sc = mac->mac_sc;
6846         uint16_t val;
6847
6848         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6849         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
6850         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6851
6852         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
6853             bwn_led_blink_end, mac);
6854 }
6855
6856 static void
6857 bwn_led_blink_end(void *arg)
6858 {
6859         struct bwn_mac *mac = arg;
6860         struct bwn_softc *sc = mac->mac_sc;
6861
6862         sc->sc_led_blinking = 0;
6863 }
6864
6865 static int
6866 bwn_suspend(device_t dev)
6867 {
6868         struct bwn_softc *sc = device_get_softc(dev);
6869
6870         BWN_LOCK(sc);
6871         bwn_stop(sc);
6872         BWN_UNLOCK(sc);
6873         return (0);
6874 }
6875
6876 static int
6877 bwn_resume(device_t dev)
6878 {
6879         struct bwn_softc *sc = device_get_softc(dev);
6880         int error = EDOOFUS;
6881
6882         BWN_LOCK(sc);
6883         if (sc->sc_ic.ic_nrunning > 0)
6884                 error = bwn_init(sc);
6885         BWN_UNLOCK(sc);
6886         if (error == 0)
6887                 ieee80211_start_all(&sc->sc_ic);
6888         return (0);
6889 }
6890
6891 static void
6892 bwn_rfswitch(void *arg)
6893 {
6894         struct bwn_softc *sc = arg;
6895         struct bwn_mac *mac = sc->sc_curmac;
6896         int cur = 0, prev = 0;
6897
6898         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
6899             ("%s: invalid MAC status %d", __func__, mac->mac_status));
6900
6901         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
6902                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
6903                         & BWN_RF_HWENABLED_HI_MASK))
6904                         cur = 1;
6905         } else {
6906                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
6907                     & BWN_RF_HWENABLED_LO_MASK)
6908                         cur = 1;
6909         }
6910
6911         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
6912                 prev = 1;
6913
6914         if (cur != prev) {
6915                 if (cur)
6916                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
6917                 else
6918                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
6919
6920                 device_printf(sc->sc_dev,
6921                     "status of RF switch is changed to %s\n",
6922                     cur ? "ON" : "OFF");
6923                 if (cur != mac->mac_phy.rf_on) {
6924                         if (cur)
6925                                 bwn_rf_turnon(mac);
6926                         else
6927                                 bwn_rf_turnoff(mac);
6928                 }
6929         }
6930
6931         callout_schedule(&sc->sc_rfswitch_ch, hz);
6932 }
6933
6934 static void
6935 bwn_sysctl_node(struct bwn_softc *sc)
6936 {
6937         device_t dev = sc->sc_dev;
6938         struct bwn_mac *mac;
6939         struct bwn_stats *stats;
6940
6941         /* XXX assume that count of MAC is only 1. */
6942
6943         if ((mac = sc->sc_curmac) == NULL)
6944                 return;
6945         stats = &mac->mac_stats;
6946
6947         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6948             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6949             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
6950         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6951             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6952             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
6953         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6954             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6955             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
6956
6957 #ifdef BWN_DEBUG
6958         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
6959             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6960             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
6961 #endif
6962 }
6963
6964 static device_method_t bwn_methods[] = {
6965         /* Device interface */
6966         DEVMETHOD(device_probe,         bwn_probe),
6967         DEVMETHOD(device_attach,        bwn_attach),
6968         DEVMETHOD(device_detach,        bwn_detach),
6969         DEVMETHOD(device_suspend,       bwn_suspend),
6970         DEVMETHOD(device_resume,        bwn_resume),
6971         DEVMETHOD_END
6972 };
6973 static driver_t bwn_driver = {
6974         "bwn",
6975         bwn_methods,
6976         sizeof(struct bwn_softc)
6977 };
6978 static devclass_t bwn_devclass;
6979 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
6980 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
6981 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
6982 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
6983 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
6984 MODULE_VERSION(bwn, 1);