sys/dev/bwn/if_bwn.c

   1 /*-
   2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer,
  10  *    without modification.
  11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  13  *    redistribution must be conditioned upon including a substantially
  14  *    similar Disclaimer requirement for further binary redistribution.
  15  *
  16  * NO WARRANTY
  17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  27  * THE POSSIBILITY OF SUCH DAMAGES.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 /*
  34  * The Broadcom Wireless LAN controller driver.
  35  */
  36
  37 #include "opt_bwn.h"
  38 #include "opt_wlan.h"
  39
  40 #include <sys/param.h>
  41 #include <sys/systm.h>
  42 #include <sys/kernel.h>
  43 #include <sys/malloc.h>
  44 #include <sys/module.h>
  45 #include <sys/endian.h>
  46 #include <sys/errno.h>
  47 #include <sys/firmware.h>
  48 #include <sys/lock.h>
  49 #include <sys/mutex.h>
  50 #include <machine/bus.h>
  51 #include <machine/resource.h>
  52 #include <sys/bus.h>
  53 #include <sys/rman.h>
  54 #include <sys/socket.h>
  55 #include <sys/sockio.h>
  56
  57 #include <net/ethernet.h>
  58 #include <net/if.h>
  59 #include <net/if_var.h>
  60 #include <net/if_arp.h>
  61 #include <net/if_dl.h>
  62 #include <net/if_llc.h>
  63 #include <net/if_media.h>
  64 #include <net/if_types.h>
  65
  66 #include <dev/pci/pcivar.h>
  67 #include <dev/pci/pcireg.h>
  68 #include <dev/siba/siba_ids.h>
  69 #include <dev/siba/sibareg.h>
  70 #include <dev/siba/sibavar.h>
  71
  72 #include <net80211/ieee80211_var.h>
  73 #include <net80211/ieee80211_radiotap.h>
  74 #include <net80211/ieee80211_regdomain.h>
  75 #include <net80211/ieee80211_phy.h>
  76 #include <net80211/ieee80211_ratectl.h>
  77
  78 #include <dev/bwn/if_bwnreg.h>
  79 #include <dev/bwn/if_bwnvar.h>
  80
  81 #include <dev/bwn/if_bwn_debug.h>
  82 #include <dev/bwn/if_bwn_misc.h>
  83 #include <dev/bwn/if_bwn_util.h>
  84 #include <dev/bwn/if_bwn_phy_common.h>
  85 #include <dev/bwn/if_bwn_phy_g.h>
  86 #include <dev/bwn/if_bwn_phy_lp.h>
  87 #include <dev/bwn/if_bwn_phy_n.h>
  88
  89 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
  90     "Broadcom driver parameters");
  91
  92 /*
  93  * Tunable & sysctl variables.
  94  */
  95
  96 #ifdef BWN_DEBUG
  97 static  int bwn_debug = 0;
  98 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
  99     "Broadcom debugging printfs");
 100 #endif
 101
 102 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
 103 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
 104     "uses Bad Frames Preemption");
 105 static int      bwn_bluetooth = 1;
 106 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 107     "turns on Bluetooth Coexistence");
 108 static int      bwn_hwpctl = 0;
 109 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 110     "uses H/W power control");
 111 static int      bwn_msi_disable = 0;            /* MSI disabled  */
 112 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
 113 static int      bwn_usedma = 1;
 114 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 115     "uses DMA");
 116 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 117 static int      bwn_wme = 1;
 118 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 119     "uses WME support");
 120
 121 static void     bwn_attach_pre(struct bwn_softc *);
 122 static int      bwn_attach_post(struct bwn_softc *);
 123 static void     bwn_sprom_bugfixes(device_t);
 124 static int      bwn_init(struct bwn_softc *);
 125 static void     bwn_parent(struct ieee80211com *);
 126 static void     bwn_start(struct bwn_softc *);
 127 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 128 static int      bwn_attach_core(struct bwn_mac *);
 129 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 130 static int      bwn_chiptest(struct bwn_mac *);
 131 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 132 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 133                     uint16_t);
 134 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 135                     const struct bwn_channelinfo *, const uint8_t []);
 136 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 137                     const struct ieee80211_bpf_params *);
 138 static void     bwn_updateslot(struct ieee80211com *);
 139 static void     bwn_update_promisc(struct ieee80211com *);
 140 static void     bwn_wme_init(struct bwn_mac *);
 141 static int      bwn_wme_update(struct ieee80211com *);
 142 static void     bwn_wme_clear(struct bwn_softc *);
 143 static void     bwn_wme_load(struct bwn_mac *);
 144 static void     bwn_wme_loadparams(struct bwn_mac *,
 145                     const struct wmeParams *, uint16_t);
 146 static void     bwn_scan_start(struct ieee80211com *);
 147 static void     bwn_scan_end(struct ieee80211com *);
 148 static void     bwn_set_channel(struct ieee80211com *);
 149 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 150                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 151                     const uint8_t [IEEE80211_ADDR_LEN],
 152                     const uint8_t [IEEE80211_ADDR_LEN]);
 153 static void     bwn_vap_delete(struct ieee80211vap *);
 154 static void     bwn_stop(struct bwn_softc *);
 155 static int      bwn_core_init(struct bwn_mac *);
 156 static void     bwn_core_start(struct bwn_mac *);
 157 static void     bwn_core_exit(struct bwn_mac *);
 158 static void     bwn_bt_disable(struct bwn_mac *);
 159 static int      bwn_chip_init(struct bwn_mac *);
 160 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 161 static void     bwn_rate_init(struct bwn_mac *);
 162 static void     bwn_set_phytxctl(struct bwn_mac *);
 163 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 164 static void     bwn_bt_enable(struct bwn_mac *);
 165 static void     bwn_set_macaddr(struct bwn_mac *);
 166 static void     bwn_crypt_init(struct bwn_mac *);
 167 static void     bwn_chip_exit(struct bwn_mac *);
 168 static int      bwn_fw_fillinfo(struct bwn_mac *);
 169 static int      bwn_fw_loaducode(struct bwn_mac *);
 170 static int      bwn_gpio_init(struct bwn_mac *);
 171 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 172 static int      bwn_phy_init(struct bwn_mac *);
 173 static void     bwn_set_txantenna(struct bwn_mac *, int);
 174 static void     bwn_set_opmode(struct bwn_mac *);
 175 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 176 static uint8_t  bwn_plcp_getcck(const uint8_t);
 177 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 178 static void     bwn_pio_init(struct bwn_mac *);
 179 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 180 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 181                     int);
 182 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 183                     struct bwn_pio_rxqueue *, int);
 184 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 185 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 186                     uint16_t);
 187 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 188 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 189 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 190 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 191                     const struct bwn_txstatus *);
 192 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 193 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 194 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 195                     uint16_t);
 196 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 197                     uint32_t);
 198 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 199                     struct mbuf *);
 200 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 201 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 202                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 203 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 204                     uint16_t, uint32_t);
 205 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 206                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 207 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 208                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 209 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 210                     uint16_t, struct bwn_pio_txpkt **);
 211 static void     bwn_dma_init(struct bwn_mac *);
 212 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 213 static int      bwn_dma_mask2type(uint64_t);
 214 static uint64_t bwn_dma_mask(struct bwn_mac *);
 215 static uint16_t bwn_dma_base(int, int);
 216 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 217 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 218                     int, struct bwn_dmadesc_generic **,
 219                     struct bwn_dmadesc_meta **);
 220 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 221                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 222                     int, int);
 223 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 224 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 225 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 226 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 227 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 228 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 229                     int, struct bwn_dmadesc_generic **,
 230                     struct bwn_dmadesc_meta **);
 231 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 233                     int, int);
 234 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 235 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 236 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 237 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 238 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 239 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 240 static void     bwn_dma_setup(struct bwn_dma_ring *);
 241 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 242 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 243 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 244 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 245 static void     bwn_dma_rx(struct bwn_dma_ring *);
 246 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 247 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 248                     struct bwn_dmadesc_meta *);
 249 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 250 static int      bwn_dma_gettype(struct bwn_mac *);
 251 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 252 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 253 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 254 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 255 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 256                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 257                     int);
 258 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 259                     bus_size_t, int);
 260 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 261 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 262                     const struct bwn_txstatus *);
 263 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 264                     struct mbuf *);
 265 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 266 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 267                     uint8_t);
 268 static int      bwn_dma_attach(struct bwn_mac *);
 269 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 270                     int, int, int);
 271 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 272                     const struct bwn_txstatus *, uint16_t, int *);
 273 static void     bwn_dma_free(struct bwn_mac *);
 274 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 275 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 276                     const char *, struct bwn_fwfile *);
 277 static void     bwn_release_firmware(struct bwn_mac *);
 278 static void     bwn_do_release_fw(struct bwn_fwfile *);
 279 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 280 static int      bwn_fwinitvals_write(struct bwn_mac *,
 281                     const struct bwn_fwinitvals *, size_t, size_t);
 282 static uint16_t bwn_ant2phy(int);
 283 static void     bwn_mac_write_bssid(struct bwn_mac *);
 284 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 285                     const uint8_t *);
 286 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 287                     const uint8_t *, size_t, const uint8_t *);
 288 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 289                     const uint8_t *);
 290 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 291                     const uint8_t *);
 292 static void     bwn_phy_exit(struct bwn_mac *);
 293 static void     bwn_core_stop(struct bwn_mac *);
 294 static int      bwn_switch_band(struct bwn_softc *,
 295                     struct ieee80211_channel *);
 296 static void     bwn_phy_reset(struct bwn_mac *);
 297 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 298 static void     bwn_set_pretbtt(struct bwn_mac *);
 299 static int      bwn_intr(void *);
 300 static void     bwn_intrtask(void *, int);
 301 static void     bwn_restart(struct bwn_mac *, const char *);
 302 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 303 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 304 static void     bwn_intr_atim_end(struct bwn_mac *);
 305 static void     bwn_intr_beacon(struct bwn_mac *);
 306 static void     bwn_intr_pmq(struct bwn_mac *);
 307 static void     bwn_intr_noise(struct bwn_mac *);
 308 static void     bwn_intr_txeof(struct bwn_mac *);
 309 static void     bwn_hwreset(void *, int);
 310 static void     bwn_handle_fwpanic(struct bwn_mac *);
 311 static void     bwn_load_beacon0(struct bwn_mac *);
 312 static void     bwn_load_beacon1(struct bwn_mac *);
 313 static uint32_t bwn_jssi_read(struct bwn_mac *);
 314 static void     bwn_noise_gensample(struct bwn_mac *);
 315 static void     bwn_handle_txeof(struct bwn_mac *,
 316                     const struct bwn_txstatus *);
 317 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 318 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 319 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 320                     struct mbuf *);
 321 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 322 static int      bwn_set_txhdr(struct bwn_mac *,
 323                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 324                     uint16_t);
 325 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 326                     const uint8_t);
 327 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 328 static uint8_t  bwn_get_fbrate(uint8_t);
 329 static void     bwn_txpwr(void *, int);
 330 static void     bwn_tasks(void *);
 331 static void     bwn_task_15s(struct bwn_mac *);
 332 static void     bwn_task_30s(struct bwn_mac *);
 333 static void     bwn_task_60s(struct bwn_mac *);
 334 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 335                     uint8_t);
 336 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 337 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 338                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 339                     int, int);
 340 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 341 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 342 static void     bwn_watchdog(void *);
 343 static void     bwn_dma_stop(struct bwn_mac *);
 344 static void     bwn_pio_stop(struct bwn_mac *);
 345 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 346 static void     bwn_led_attach(struct bwn_mac *);
 347 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 348 static void     bwn_led_event(struct bwn_mac *, int);
 349 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 350 static void     bwn_led_blink_next(void *);
 351 static void     bwn_led_blink_end(void *);
 352 static void     bwn_rfswitch(void *);
 353 static void     bwn_rf_turnon(struct bwn_mac *);
 354 static void     bwn_rf_turnoff(struct bwn_mac *);
 355 static void     bwn_sysctl_node(struct bwn_softc *);
 356
 357 static struct resource_spec bwn_res_spec_legacy[] = {
 358         { SYS_RES_IRQ,          0,              RF_ACTIVE | RF_SHAREABLE },
 359         { -1,                   0,              0 }
 360 };
 361
 362 static struct resource_spec bwn_res_spec_msi[] = {
 363         { SYS_RES_IRQ,          1,              RF_ACTIVE },
 364         { -1,                   0,              0 }
 365 };
 366
 367 static const struct bwn_channelinfo bwn_chantable_bg = {
 368         .channels = {
 369                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 370                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 371                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 372                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 373                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 374         .nchannels = 14
 375 };
 376
 377 static const struct bwn_channelinfo bwn_chantable_a = {
 378         .channels = {
 379                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 380                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 381                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 382                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 383                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 384                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 385                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 386                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 387                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 388                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 389                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 390                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 391                 { 6080, 216, 30 } },
 392         .nchannels = 37
 393 };
 394
 395 #if 0
 396 static const struct bwn_channelinfo bwn_chantable_n = {
 397         .channels = {
 398                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 399                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 400                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 401                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 402                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 403                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 404                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 405                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 406                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 407                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 408                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 409                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 410                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 411                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 412                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 413                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 414                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 415                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 416                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 417                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 418                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 419                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 420                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 421                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 422                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 423                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 424                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 425                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 426                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 427                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 428                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 429                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 430                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 431                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 432                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 433                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 434                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 435         .nchannels = 110
 436 };
 437 #endif
 438
 439 #define VENDOR_LED_ACT(vendor)                          \
 440 {                                                       \
 441         .vid = PCI_VENDOR_##vendor,                     \
 442         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 443 }
 444
 445 static const struct {
 446         uint16_t        vid;
 447         uint8_t         led_act[BWN_LED_MAX];
 448 } bwn_vendor_led_act[] = {
 449         VENDOR_LED_ACT(COMPAQ),
 450         VENDOR_LED_ACT(ASUSTEK)
 451 };
 452
 453 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 454         { BWN_VENDOR_LED_ACT_DEFAULT };
 455
 456 #undef VENDOR_LED_ACT
 457
 458 static const struct {
 459         int             on_dur;
 460         int             off_dur;
 461 } bwn_led_duration[109] = {
 462         [0]     = { 400, 100 },
 463         [2]     = { 150, 75 },
 464         [4]     = { 90, 45 },
 465         [11]    = { 66, 34 },
 466         [12]    = { 53, 26 },
 467         [18]    = { 42, 21 },
 468         [22]    = { 35, 17 },
 469         [24]    = { 32, 16 },
 470         [36]    = { 21, 10 },
 471         [48]    = { 16, 8 },
 472         [72]    = { 11, 5 },
 473         [96]    = { 9, 4 },
 474         [108]   = { 7, 3 }
 475 };
 476
 477 static const uint16_t bwn_wme_shm_offsets[] = {
 478         [0] = BWN_WME_BESTEFFORT,
 479         [1] = BWN_WME_BACKGROUND,
 480         [2] = BWN_WME_VOICE,
 481         [3] = BWN_WME_VIDEO,
 482 };
 483
 484 static const struct siba_devid bwn_devs[] = {
 485         SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
 486         SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
 487         SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
 488         SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
 489         SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
 490         SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
 491         SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
 492         SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
 493         SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
 494         SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
 495 };
 496
 497 static int
 498 bwn_probe(device_t dev)
 499 {
 500         int i;
 501
 502         for (i = 0; i < nitems(bwn_devs); i++) {
 503                 if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
 504                     siba_get_device(dev) == bwn_devs[i].sd_device &&
 505                     siba_get_revid(dev) == bwn_devs[i].sd_rev)
 506                         return (BUS_PROBE_DEFAULT);
 507         }
 508
 509         return (ENXIO);
 510 }
 511
 512 static int
 513 bwn_attach(device_t dev)
 514 {
 515         struct bwn_mac *mac;
 516         struct bwn_softc *sc = device_get_softc(dev);
 517         int error, i, msic, reg;
 518
 519         sc->sc_dev = dev;
 520 #ifdef BWN_DEBUG
 521         sc->sc_debug = bwn_debug;
 522 #endif
 523
 524         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 525                 bwn_attach_pre(sc);
 526                 bwn_sprom_bugfixes(dev);
 527                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 528         }
 529
 530         if (!TAILQ_EMPTY(&sc->sc_maclist)) {
 531                 if (siba_get_pci_device(dev) != 0x4313 &&
 532                     siba_get_pci_device(dev) != 0x431a &&
 533                     siba_get_pci_device(dev) != 0x4321) {
 534                         device_printf(sc->sc_dev,
 535                             "skip 802.11 cores\n");
 536                         return (ENODEV);
 537                 }
 538         }
 539
 540         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 541         mac->mac_sc = sc;
 542         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 543         if (bwn_bfp != 0)
 544                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 545
 546         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 547         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 548         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 549
 550         error = bwn_attach_core(mac);
 551         if (error)
 552                 goto fail0;
 553         bwn_led_attach(mac);
 554
 555         device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
 556             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 557             siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
 558             mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
 559             mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
 560             mac->mac_phy.rf_rev);
 561         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 562                 device_printf(sc->sc_dev, "DMA (%d bits)\n",
 563                     mac->mac_method.dma.dmatype);
 564         else
 565                 device_printf(sc->sc_dev, "PIO\n");
 566
 567 #ifdef  BWN_GPL_PHY
 568         device_printf(sc->sc_dev,
 569             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
 570 #endif
 571
 572         /*
 573          * setup PCI resources and interrupt.
 574          */
 575         if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
 576                 msic = pci_msi_count(dev);
 577                 if (bootverbose)
 578                         device_printf(sc->sc_dev, "MSI count : %d\n", msic);
 579         } else
 580                 msic = 0;
 581
 582         mac->mac_intr_spec = bwn_res_spec_legacy;
 583         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
 584                 if (pci_alloc_msi(dev, &msic) == 0) {
 585                         device_printf(sc->sc_dev,
 586                             "Using %d MSI messages\n", msic);
 587                         mac->mac_intr_spec = bwn_res_spec_msi;
 588                         mac->mac_msi = 1;
 589                 }
 590         }
 591
 592         error = bus_alloc_resources(dev, mac->mac_intr_spec,
 593             mac->mac_res_irq);
 594         if (error) {
 595                 device_printf(sc->sc_dev,
 596                     "couldn't allocate IRQ resources (%d)\n", error);
 597                 goto fail1;
 598         }
 599
 600         if (mac->mac_msi == 0)
 601                 error = bus_setup_intr(dev, mac->mac_res_irq[0],
 602                     INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 603                     &mac->mac_intrhand[0]);
 604         else {
 605                 for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 606                         error = bus_setup_intr(dev, mac->mac_res_irq[i],
 607                             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 608                             &mac->mac_intrhand[i]);
 609                         if (error != 0) {
 610                                 device_printf(sc->sc_dev,
 611                                     "couldn't setup interrupt (%d)\n", error);
 612                                 break;
 613                         }
 614                 }
 615         }
 616
 617         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 618
 619         /*
 620          * calls attach-post routine
 621          */
 622         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 623                 bwn_attach_post(sc);
 624
 625         return (0);
 626 fail1:
 627         if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
 628                 pci_release_msi(dev);
 629 fail0:
 630         free(mac, M_DEVBUF);
 631         return (error);
 632 }
 633
 634 static int
 635 bwn_is_valid_ether_addr(uint8_t *addr)
 636 {
 637         char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
 638
 639         if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
 640                 return (FALSE);
 641
 642         return (TRUE);
 643 }
 644
 645 static int
 646 bwn_attach_post(struct bwn_softc *sc)
 647 {
 648         struct ieee80211com *ic = &sc->sc_ic;
 649
 650         ic->ic_softc = sc;
 651         ic->ic_name = device_get_nameunit(sc->sc_dev);
 652         /* XXX not right but it's not used anywhere important */
 653         ic->ic_phytype = IEEE80211_T_OFDM;
 654         ic->ic_opmode = IEEE80211_M_STA;
 655         ic->ic_caps =
 656                   IEEE80211_C_STA               /* station mode supported */
 657                 | IEEE80211_C_MONITOR           /* monitor mode */
 658                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 659                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 660                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 661                 | IEEE80211_C_WME               /* WME/WMM supported */
 662                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 663 #if 0
 664                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 665 #endif
 666                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 667                 ;
 668
 669         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 670
 671         IEEE80211_ADDR_COPY(ic->ic_macaddr,
 672             bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
 673             siba_sprom_get_mac_80211a(sc->sc_dev) :
 674             siba_sprom_get_mac_80211bg(sc->sc_dev));
 675
 676         /* call MI attach routine. */
 677         ieee80211_ifattach(ic);
 678
 679         ic->ic_headroom = sizeof(struct bwn_txhdr);
 680
 681         /* override default methods */
 682         ic->ic_raw_xmit = bwn_raw_xmit;
 683         ic->ic_updateslot = bwn_updateslot;
 684         ic->ic_update_promisc = bwn_update_promisc;
 685         ic->ic_wme.wme_update = bwn_wme_update;
 686         ic->ic_scan_start = bwn_scan_start;
 687         ic->ic_scan_end = bwn_scan_end;
 688         ic->ic_set_channel = bwn_set_channel;
 689         ic->ic_vap_create = bwn_vap_create;
 690         ic->ic_vap_delete = bwn_vap_delete;
 691         ic->ic_transmit = bwn_transmit;
 692         ic->ic_parent = bwn_parent;
 693
 694         ieee80211_radiotap_attach(ic,
 695             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 696             BWN_TX_RADIOTAP_PRESENT,
 697             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 698             BWN_RX_RADIOTAP_PRESENT);
 699
 700         bwn_sysctl_node(sc);
 701
 702         if (bootverbose)
 703                 ieee80211_announce(ic);
 704         return (0);
 705 }
 706
 707 static void
 708 bwn_phy_detach(struct bwn_mac *mac)
 709 {
 710
 711         if (mac->mac_phy.detach != NULL)
 712                 mac->mac_phy.detach(mac);
 713 }
 714
 715 static int
 716 bwn_detach(device_t dev)
 717 {
 718         struct bwn_softc *sc = device_get_softc(dev);
 719         struct bwn_mac *mac = sc->sc_curmac;
 720         struct ieee80211com *ic = &sc->sc_ic;
 721         int i;
 722
 723         sc->sc_flags |= BWN_FLAG_INVALID;
 724
 725         if (device_is_attached(sc->sc_dev)) {
 726                 BWN_LOCK(sc);
 727                 bwn_stop(sc);
 728                 BWN_UNLOCK(sc);
 729                 bwn_dma_free(mac);
 730                 callout_drain(&sc->sc_led_blink_ch);
 731                 callout_drain(&sc->sc_rfswitch_ch);
 732                 callout_drain(&sc->sc_task_ch);
 733                 callout_drain(&sc->sc_watchdog_ch);
 734                 bwn_phy_detach(mac);
 735                 ieee80211_draintask(ic, &mac->mac_hwreset);
 736                 ieee80211_draintask(ic, &mac->mac_txpower);
 737                 ieee80211_ifdetach(ic);
 738         }
 739         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 740         taskqueue_free(sc->sc_tq);
 741
 742         for (i = 0; i < BWN_MSI_MESSAGES; i++) {
 743                 if (mac->mac_intrhand[i] != NULL) {
 744                         bus_teardown_intr(dev, mac->mac_res_irq[i],
 745                             mac->mac_intrhand[i]);
 746                         mac->mac_intrhand[i] = NULL;
 747                 }
 748         }
 749         bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
 750         if (mac->mac_msi != 0)
 751                 pci_release_msi(dev);
 752         mbufq_drain(&sc->sc_snd);
 753         BWN_LOCK_DESTROY(sc);
 754         return (0);
 755 }
 756
 757 static void
 758 bwn_attach_pre(struct bwn_softc *sc)
 759 {
 760
 761         BWN_LOCK_INIT(sc);
 762         TAILQ_INIT(&sc->sc_maclist);
 763         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 764         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 765         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 766         mbufq_init(&sc->sc_snd, ifqmaxlen);
 767         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 768                 taskqueue_thread_enqueue, &sc->sc_tq);
 769         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 770                 "%s taskq", device_get_nameunit(sc->sc_dev));
 771 }
 772
 773 static void
 774 bwn_sprom_bugfixes(device_t dev)
 775 {
 776 #define BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)             \
 777         ((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&          \
 778          (siba_get_pci_device(dev) == _device) &&                       \
 779          (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&    \
 780          (siba_get_pci_subdevice(dev) == _subdevice))
 781
 782         if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
 783             siba_get_pci_subdevice(dev) == 0x4e &&
 784             siba_get_pci_revid(dev) > 0x40)
 785                 siba_sprom_set_bf_lo(dev,
 786                     siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
 787         if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
 788             siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
 789                 siba_sprom_set_bf_lo(dev,
 790                     siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
 791         if (siba_get_type(dev) == SIBA_TYPE_PCI) {
 792                 if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
 793                     BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
 794                     BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
 795                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
 796                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
 797                     BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
 798                     BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
 799                         siba_sprom_set_bf_lo(dev,
 800                             siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
 801         }
 802 #undef  BWN_ISDEV
 803 }
 804
 805 static void
 806 bwn_parent(struct ieee80211com *ic)
 807 {
 808         struct bwn_softc *sc = ic->ic_softc;
 809         int startall = 0;
 810
 811         BWN_LOCK(sc);
 812         if (ic->ic_nrunning > 0) {
 813                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 814                         bwn_init(sc);
 815                         startall = 1;
 816                 } else
 817                         bwn_update_promisc(ic);
 818         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 819                 bwn_stop(sc);
 820         BWN_UNLOCK(sc);
 821
 822         if (startall)
 823                 ieee80211_start_all(ic);
 824 }
 825
 826 static int
 827 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 828 {
 829         struct bwn_softc *sc = ic->ic_softc;
 830         int error;
 831
 832         BWN_LOCK(sc);
 833         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 834                 BWN_UNLOCK(sc);
 835                 return (ENXIO);
 836         }
 837         error = mbufq_enqueue(&sc->sc_snd, m);
 838         if (error) {
 839                 BWN_UNLOCK(sc);
 840                 return (error);
 841         }
 842         bwn_start(sc);
 843         BWN_UNLOCK(sc);
 844         return (0);
 845 }
 846
 847 static void
 848 bwn_start(struct bwn_softc *sc)
 849 {
 850         struct bwn_mac *mac = sc->sc_curmac;
 851         struct ieee80211_frame *wh;
 852         struct ieee80211_node *ni;
 853         struct ieee80211_key *k;
 854         struct mbuf *m;
 855
 856         BWN_ASSERT_LOCKED(sc);
 857
 858         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 859             mac->mac_status < BWN_MAC_STATUS_STARTED)
 860                 return;
 861
 862         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 863                 if (bwn_tx_isfull(sc, m))
 864                         break;
 865                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 866                 if (ni == NULL) {
 867                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
 868                         m_freem(m);
 869                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 870                         continue;
 871                 }
 872                 wh = mtod(m, struct ieee80211_frame *);
 873                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 874                         k = ieee80211_crypto_encap(ni, m);
 875                         if (k == NULL) {
 876                                 if_inc_counter(ni->ni_vap->iv_ifp,
 877                                     IFCOUNTER_OERRORS, 1);
 878                                 ieee80211_free_node(ni);
 879                                 m_freem(m);
 880                                 continue;
 881                         }
 882                 }
 883                 wh = NULL;      /* Catch any invalid use */
 884                 if (bwn_tx_start(sc, ni, m) != 0) {
 885                         if (ni != NULL) {
 886                                 if_inc_counter(ni->ni_vap->iv_ifp,
 887                                     IFCOUNTER_OERRORS, 1);
 888                                 ieee80211_free_node(ni);
 889                         }
 890                         continue;
 891                 }
 892                 sc->sc_watchdog_timer = 5;
 893         }
 894 }
 895
 896 static int
 897 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
 898 {
 899         struct bwn_dma_ring *dr;
 900         struct bwn_mac *mac = sc->sc_curmac;
 901         struct bwn_pio_txqueue *tq;
 902         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 903
 904         BWN_ASSERT_LOCKED(sc);
 905
 906         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
 907                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
 908                 if (dr->dr_stop == 1 ||
 909                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
 910                         dr->dr_stop = 1;
 911                         goto full;
 912                 }
 913         } else {
 914                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
 915                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
 916                     pktlen > (tq->tq_size - tq->tq_used))
 917                         goto full;
 918         }
 919         return (0);
 920 full:
 921         mbufq_prepend(&sc->sc_snd, m);
 922         return (1);
 923 }
 924
 925 static int
 926 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
 927 {
 928         struct bwn_mac *mac = sc->sc_curmac;
 929         int error;
 930
 931         BWN_ASSERT_LOCKED(sc);
 932
 933         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
 934                 m_freem(m);
 935                 return (ENXIO);
 936         }
 937
 938         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
 939             bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
 940         if (error) {
 941                 m_freem(m);
 942                 return (error);
 943         }
 944         return (0);
 945 }
 946
 947 static int
 948 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
 949 {
 950         struct bwn_pio_txpkt *tp;
 951         struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
 952         struct bwn_softc *sc = mac->mac_sc;
 953         struct bwn_txhdr txhdr;
 954         struct mbuf *m_new;
 955         uint32_t ctl32;
 956         int error;
 957         uint16_t ctl16;
 958
 959         BWN_ASSERT_LOCKED(sc);
 960
 961         /* XXX TODO send packets after DTIM */
 962
 963         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
 964         tp = TAILQ_FIRST(&tq->tq_pktlist);
 965         tp->tp_ni = ni;
 966         tp->tp_m = m;
 967
 968         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
 969         if (error) {
 970                 device_printf(sc->sc_dev, "tx fail\n");
 971                 return (error);
 972         }
 973
 974         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
 975         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
 976         tq->tq_free--;
 977
 978         if (siba_get_revid(sc->sc_dev) >= 8) {
 979                 /*
 980                  * XXX please removes m_defrag(9)
 981                  */
 982                 m_new = m_defrag(m, M_NOWAIT);
 983                 if (m_new == NULL) {
 984                         device_printf(sc->sc_dev,
 985                             "%s: can't defrag TX buffer\n",
 986                             __func__);
 987                         return (ENOBUFS);
 988                 }
 989                 if (m_new->m_next != NULL)
 990                         device_printf(sc->sc_dev,
 991                             "TODO: fragmented packets for PIO\n");
 992                 tp->tp_m = m_new;
 993
 994                 /* send HEADER */
 995                 ctl32 = bwn_pio_write_multi_4(mac, tq,
 996                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
 997                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
 998                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
 999                 /* send BODY */
1000                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001                     mtod(m_new, const void *), m_new->m_pkthdr.len);
1002                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003                     ctl32 | BWN_PIO8_TXCTL_EOF);
1004         } else {
1005                 ctl16 = bwn_pio_write_multi_2(mac, tq,
1006                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011                     ctl16 | BWN_PIO_TXCTL_EOF);
1012         }
1013
1014         return (0);
1015 }
1016
1017 static struct bwn_pio_txqueue *
1018 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019 {
1020
1021         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023
1024         switch (prio) {
1025         case 0:
1026                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027         case 1:
1028                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029         case 2:
1030                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031         case 3:
1032                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033         }
1034         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035         return (NULL);
1036 }
1037
1038 static int
1039 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040 {
1041 #define BWN_GET_TXHDRCACHE(slot)                                        \
1042         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043         struct bwn_dma *dma = &mac->mac_method.dma;
1044         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045         struct bwn_dmadesc_generic *desc;
1046         struct bwn_dmadesc_meta *mt;
1047         struct bwn_softc *sc = mac->mac_sc;
1048         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050
1051         BWN_ASSERT_LOCKED(sc);
1052         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053
1054         /* XXX send after DTIM */
1055
1056         slot = bwn_dma_getslot(dr);
1057         dr->getdesc(dr, slot, &desc, &mt);
1058         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059             ("%s:%d: fail", __func__, __LINE__));
1060
1061         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063             BWN_DMA_COOKIE(dr, slot));
1064         if (error)
1065                 goto fail;
1066         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068             &mt->mt_paddr, BUS_DMA_NOWAIT);
1069         if (error) {
1070                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071                     __func__, error);
1072                 goto fail;
1073         }
1074         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075             BUS_DMASYNC_PREWRITE);
1076         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078             BUS_DMASYNC_PREWRITE);
1079
1080         slot = bwn_dma_getslot(dr);
1081         dr->getdesc(dr, slot, &desc, &mt);
1082         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084         mt->mt_m = m;
1085         mt->mt_ni = ni;
1086
1087         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089         if (error && error != EFBIG) {
1090                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091                     __func__, error);
1092                 goto fail;
1093         }
1094         if (error) {    /* error == EFBIG */
1095                 struct mbuf *m_new;
1096
1097                 m_new = m_defrag(m, M_NOWAIT);
1098                 if (m_new == NULL) {
1099                         device_printf(sc->sc_dev,
1100                             "%s: can't defrag TX buffer\n",
1101                             __func__);
1102                         error = ENOBUFS;
1103                         goto fail;
1104                 } else {
1105                         m = m_new;
1106                 }
1107
1108                 mt->mt_m = m;
1109                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111                 if (error) {
1112                         device_printf(sc->sc_dev,
1113                             "%s: can't load TX buffer (2) %d\n",
1114                             __func__, error);
1115                         goto fail;
1116                 }
1117         }
1118         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121             BUS_DMASYNC_PREWRITE);
1122
1123         /* XXX send after DTIM */
1124
1125         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126         return (0);
1127 fail:
1128         dr->dr_curslot = backup[0];
1129         dr->dr_usedslot = backup[1];
1130         return (error);
1131 #undef BWN_GET_TXHDRCACHE
1132 }
1133
1134 static void
1135 bwn_watchdog(void *arg)
1136 {
1137         struct bwn_softc *sc = arg;
1138
1139         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140                 device_printf(sc->sc_dev, "device timeout\n");
1141                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142         }
1143         callout_schedule(&sc->sc_watchdog_ch, hz);
1144 }
1145
1146 static int
1147 bwn_attach_core(struct bwn_mac *mac)
1148 {
1149         struct bwn_softc *sc = mac->mac_sc;
1150         int error, have_bg = 0, have_a = 0;
1151         uint32_t high;
1152
1153         KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154             ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155
1156         siba_powerup(sc->sc_dev, 0);
1157
1158         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1159
1160         /*
1161          * Guess at whether it has A-PHY or G-PHY.
1162          * This is just used for resetting the core to probe things;
1163          * we will re-guess once it's all up and working.
1164          *
1165          * XXX TODO: there's the TGSHIGH DUALPHY flag based on
1166          * the PHY revision.
1167          */
1168         bwn_reset_core(mac, !!(high & BWN_TGSHIGH_HAVE_2GHZ));
1169
1170         /*
1171          * Get the PHY version.
1172          */
1173         error = bwn_phy_getinfo(mac, high);
1174         if (error)
1175                 goto fail;
1176
1177         /* XXX TODO need bhnd */
1178         if (bwn_is_bus_siba(mac)) {
1179                 have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1180                 have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1181                 if (high & BWN_TGSHIGH_DUALPHY) {
1182                         have_bg = 1;
1183                         have_a = 1;
1184                 }
1185         } else {
1186                 device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1187                 error = ENXIO;
1188                 goto fail;
1189         }
1190
1191 #if 0
1192         device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1193             " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1194             __func__,
1195             high,
1196             have_a,
1197             have_bg,
1198             siba_get_pci_device(sc->sc_dev),
1199             siba_get_chipid(sc->sc_dev));
1200 #endif
1201
1202         if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1203             siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204             siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205             siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206             siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207                 have_a = have_bg = 0;
1208                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209                         have_a = 1;
1210                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1212                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1213                         have_bg = 1;
1214                 else
1215                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216                             mac->mac_phy.type));
1217         }
1218
1219         /*
1220          * XXX The PHY-G support doesn't do 5GHz operation.
1221          */
1222         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223             mac->mac_phy.type != BWN_PHYTYPE_N) {
1224                 device_printf(sc->sc_dev,
1225                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226                     __func__);
1227                 have_a = 0;
1228                 have_bg = 1;
1229         }
1230
1231         mac->mac_phy.phy_n = NULL;
1232
1233         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234                 mac->mac_phy.attach = bwn_phy_g_attach;
1235                 mac->mac_phy.detach = bwn_phy_g_detach;
1236                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238                 mac->mac_phy.init = bwn_phy_g_init;
1239                 mac->mac_phy.exit = bwn_phy_g_exit;
1240                 mac->mac_phy.phy_read = bwn_phy_g_read;
1241                 mac->mac_phy.phy_write = bwn_phy_g_write;
1242                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250                 mac->mac_phy.set_im = bwn_phy_g_im;
1251                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257                 mac->mac_phy.init = bwn_phy_lp_init;
1258                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1259                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1260                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270                 mac->mac_phy.attach = bwn_phy_n_attach;
1271                 mac->mac_phy.detach = bwn_phy_n_detach;
1272                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274                 mac->mac_phy.init = bwn_phy_n_init;
1275                 mac->mac_phy.exit = bwn_phy_n_exit;
1276                 mac->mac_phy.phy_read = bwn_phy_n_read;
1277                 mac->mac_phy.phy_write = bwn_phy_n_write;
1278                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286                 mac->mac_phy.set_im = bwn_phy_n_im;
1287                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291         } else {
1292                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293                     mac->mac_phy.type);
1294                 error = ENXIO;
1295                 goto fail;
1296         }
1297
1298         mac->mac_phy.gmode = have_bg;
1299         if (mac->mac_phy.attach != NULL) {
1300                 error = mac->mac_phy.attach(mac);
1301                 if (error) {
1302                         device_printf(sc->sc_dev, "failed\n");
1303                         goto fail;
1304                 }
1305         }
1306
1307         bwn_reset_core(mac, have_bg);
1308
1309         error = bwn_chiptest(mac);
1310         if (error)
1311                 goto fail;
1312         error = bwn_setup_channels(mac, have_bg, have_a);
1313         if (error) {
1314                 device_printf(sc->sc_dev, "failed to setup channels\n");
1315                 goto fail;
1316         }
1317
1318         if (sc->sc_curmac == NULL)
1319                 sc->sc_curmac = mac;
1320
1321         error = bwn_dma_attach(mac);
1322         if (error != 0) {
1323                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324                 goto fail;
1325         }
1326
1327         mac->mac_phy.switch_analog(mac, 0);
1328
1329         siba_dev_down(sc->sc_dev, 0);
1330 fail:
1331         siba_powerdown(sc->sc_dev);
1332         return (error);
1333 }
1334
1335 /*
1336  * Reset - SIBA.
1337  *
1338  * XXX TODO: implement BCMA version!
1339  */
1340 void
1341 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1342 {
1343         struct bwn_softc *sc = mac->mac_sc;
1344         uint32_t low, ctl;
1345         uint32_t flags = 0;
1346
1347         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1348
1349         flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1350         if (g_mode)
1351                 flags |= BWN_TGSLOW_SUPPORT_G;
1352
1353         /* XXX N-PHY only; and hard-code to 20MHz for now */
1354         if (mac->mac_phy.type == BWN_PHYTYPE_N)
1355                 flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1356
1357         siba_dev_up(sc->sc_dev, flags);
1358         DELAY(2000);
1359
1360         /* Take PHY out of reset */
1361         low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1362             ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1363         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1364         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1365         DELAY(2000);
1366         low &= ~SIBA_TGSLOW_FGC;
1367         low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1368         siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1369         siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1370         DELAY(2000);
1371
1372         if (mac->mac_phy.switch_analog != NULL)
1373                 mac->mac_phy.switch_analog(mac, 1);
1374
1375         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1376         if (g_mode)
1377                 ctl |= BWN_MACCTL_GMODE;
1378         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1379 }
1380
1381 static int
1382 bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1383 {
1384         struct bwn_phy *phy = &mac->mac_phy;
1385         struct bwn_softc *sc = mac->mac_sc;
1386         uint32_t tmp;
1387
1388         /* PHY */
1389         tmp = BWN_READ_2(mac, BWN_PHYVER);
1390         phy->gmode = !! (tgshigh & BWN_TGSHIGH_HAVE_2GHZ);
1391         phy->rf_on = 1;
1392         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1393         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1394         phy->rev = (tmp & BWN_PHYVER_VERSION);
1395         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1396             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1397                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1398             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1399             (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1400             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1401                 goto unsupphy;
1402
1403         /* RADIO */
1404         if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1405                 if (siba_get_chiprev(sc->sc_dev) == 0)
1406                         tmp = 0x3205017f;
1407                 else if (siba_get_chiprev(sc->sc_dev) == 1)
1408                         tmp = 0x4205017f;
1409                 else
1410                         tmp = 0x5205017f;
1411         } else {
1412                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1413                 tmp = BWN_READ_2(mac, BWN_RFDATALO);
1414                 BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1415                 tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1416         }
1417         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1418         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1419         phy->rf_manuf = (tmp & 0x00000fff);
1420
1421         /*
1422          * For now, just always do full init (ie, what bwn has traditionally
1423          * done)
1424          */
1425         phy->phy_do_full_init = 1;
1426
1427         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1428                 goto unsupradio;
1429         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1430              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1431             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1432             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1433             (phy->type == BWN_PHYTYPE_N &&
1434              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1435             (phy->type == BWN_PHYTYPE_LP &&
1436              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1437                 goto unsupradio;
1438
1439         return (0);
1440 unsupphy:
1441         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1442             "analog %#x)\n",
1443             phy->type, phy->rev, phy->analog);
1444         return (ENXIO);
1445 unsupradio:
1446         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1447             "rev %#x)\n",
1448             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1449         return (ENXIO);
1450 }
1451
1452 static int
1453 bwn_chiptest(struct bwn_mac *mac)
1454 {
1455 #define TESTVAL0        0x55aaaa55
1456 #define TESTVAL1        0xaa5555aa
1457         struct bwn_softc *sc = mac->mac_sc;
1458         uint32_t v, backup;
1459
1460         BWN_LOCK(sc);
1461
1462         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1463
1464         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1465         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1466                 goto error;
1467         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1468         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1469                 goto error;
1470
1471         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1472
1473         if ((siba_get_revid(sc->sc_dev) >= 3) &&
1474             (siba_get_revid(sc->sc_dev) <= 10)) {
1475                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1476                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1477                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1478                         goto error;
1479                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1480                         goto error;
1481         }
1482         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1483
1484         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1485         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1486                 goto error;
1487
1488         BWN_UNLOCK(sc);
1489         return (0);
1490 error:
1491         BWN_UNLOCK(sc);
1492         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1493         return (ENODEV);
1494 }
1495
1496 static int
1497 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1498 {
1499         struct bwn_softc *sc = mac->mac_sc;
1500         struct ieee80211com *ic = &sc->sc_ic;
1501         uint8_t bands[IEEE80211_MODE_BYTES];
1502
1503         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1504         ic->ic_nchans = 0;
1505
1506         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1507             __func__,
1508             have_bg,
1509             have_a);
1510
1511         if (have_bg) {
1512                 memset(bands, 0, sizeof(bands));
1513                 setbit(bands, IEEE80211_MODE_11B);
1514                 setbit(bands, IEEE80211_MODE_11G);
1515                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1516                     &ic->ic_nchans, &bwn_chantable_bg, bands);
1517         }
1518
1519         if (have_a) {
1520                 memset(bands, 0, sizeof(bands));
1521                 setbit(bands, IEEE80211_MODE_11A);
1522                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1523                     &ic->ic_nchans, &bwn_chantable_a, bands);
1524         }
1525
1526         mac->mac_phy.supports_2ghz = have_bg;
1527         mac->mac_phy.supports_5ghz = have_a;
1528
1529         return (ic->ic_nchans == 0 ? ENXIO : 0);
1530 }
1531
1532 uint32_t
1533 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1534 {
1535         uint32_t ret;
1536
1537         BWN_ASSERT_LOCKED(mac->mac_sc);
1538
1539         if (way == BWN_SHARED) {
1540                 KASSERT((offset & 0x0001) == 0,
1541                     ("%s:%d warn", __func__, __LINE__));
1542                 if (offset & 0x0003) {
1543                         bwn_shm_ctlword(mac, way, offset >> 2);
1544                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1545                         ret <<= 16;
1546                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1547                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1548                         goto out;
1549                 }
1550                 offset >>= 2;
1551         }
1552         bwn_shm_ctlword(mac, way, offset);
1553         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1554 out:
1555         return (ret);
1556 }
1557
1558 uint16_t
1559 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1560 {
1561         uint16_t ret;
1562
1563         BWN_ASSERT_LOCKED(mac->mac_sc);
1564
1565         if (way == BWN_SHARED) {
1566                 KASSERT((offset & 0x0001) == 0,
1567                     ("%s:%d warn", __func__, __LINE__));
1568                 if (offset & 0x0003) {
1569                         bwn_shm_ctlword(mac, way, offset >> 2);
1570                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1571                         goto out;
1572                 }
1573                 offset >>= 2;
1574         }
1575         bwn_shm_ctlword(mac, way, offset);
1576         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1577 out:
1578
1579         return (ret);
1580 }
1581
1582 static void
1583 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1584     uint16_t offset)
1585 {
1586         uint32_t control;
1587
1588         control = way;
1589         control <<= 16;
1590         control |= offset;
1591         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1592 }
1593
1594 void
1595 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1596     uint32_t value)
1597 {
1598         BWN_ASSERT_LOCKED(mac->mac_sc);
1599
1600         if (way == BWN_SHARED) {
1601                 KASSERT((offset & 0x0001) == 0,
1602                     ("%s:%d warn", __func__, __LINE__));
1603                 if (offset & 0x0003) {
1604                         bwn_shm_ctlword(mac, way, offset >> 2);
1605                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1606                                     (value >> 16) & 0xffff);
1607                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1608                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1609                         return;
1610                 }
1611                 offset >>= 2;
1612         }
1613         bwn_shm_ctlword(mac, way, offset);
1614         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1615 }
1616
1617 void
1618 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1619     uint16_t value)
1620 {
1621         BWN_ASSERT_LOCKED(mac->mac_sc);
1622
1623         if (way == BWN_SHARED) {
1624                 KASSERT((offset & 0x0001) == 0,
1625                     ("%s:%d warn", __func__, __LINE__));
1626                 if (offset & 0x0003) {
1627                         bwn_shm_ctlword(mac, way, offset >> 2);
1628                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1629                         return;
1630                 }
1631                 offset >>= 2;
1632         }
1633         bwn_shm_ctlword(mac, way, offset);
1634         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1635 }
1636
1637 static void
1638 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1639     const struct bwn_channelinfo *ci, const uint8_t bands[])
1640 {
1641         int i, error;
1642
1643         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1644                 const struct bwn_channel *hc = &ci->channels[i];
1645
1646                 error = ieee80211_add_channel(chans, maxchans, nchans,
1647                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1648         }
1649 }
1650
1651 static int
1652 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1653         const struct ieee80211_bpf_params *params)
1654 {
1655         struct ieee80211com *ic = ni->ni_ic;
1656         struct bwn_softc *sc = ic->ic_softc;
1657         struct bwn_mac *mac = sc->sc_curmac;
1658         int error;
1659
1660         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1661             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1662                 m_freem(m);
1663                 return (ENETDOWN);
1664         }
1665
1666         BWN_LOCK(sc);
1667         if (bwn_tx_isfull(sc, m)) {
1668                 m_freem(m);
1669                 BWN_UNLOCK(sc);
1670                 return (ENOBUFS);
1671         }
1672
1673         error = bwn_tx_start(sc, ni, m);
1674         if (error == 0)
1675                 sc->sc_watchdog_timer = 5;
1676         BWN_UNLOCK(sc);
1677         return (error);
1678 }
1679
1680 /*
1681  * Callback from the 802.11 layer to update the slot time
1682  * based on the current setting.  We use it to notify the
1683  * firmware of ERP changes and the f/w takes care of things
1684  * like slot time and preamble.
1685  */
1686 static void
1687 bwn_updateslot(struct ieee80211com *ic)
1688 {
1689         struct bwn_softc *sc = ic->ic_softc;
1690         struct bwn_mac *mac;
1691
1692         BWN_LOCK(sc);
1693         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1694                 mac = (struct bwn_mac *)sc->sc_curmac;
1695                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1696         }
1697         BWN_UNLOCK(sc);
1698 }
1699
1700 /*
1701  * Callback from the 802.11 layer after a promiscuous mode change.
1702  * Note this interface does not check the operating mode as this
1703  * is an internal callback and we are expected to honor the current
1704  * state (e.g. this is used for setting the interface in promiscuous
1705  * mode when operating in hostap mode to do ACS).
1706  */
1707 static void
1708 bwn_update_promisc(struct ieee80211com *ic)
1709 {
1710         struct bwn_softc *sc = ic->ic_softc;
1711         struct bwn_mac *mac = sc->sc_curmac;
1712
1713         BWN_LOCK(sc);
1714         mac = sc->sc_curmac;
1715         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1716                 if (ic->ic_promisc > 0)
1717                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1718                 else
1719                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1720                 bwn_set_opmode(mac);
1721         }
1722         BWN_UNLOCK(sc);
1723 }
1724
1725 /*
1726  * Callback from the 802.11 layer to update WME parameters.
1727  */
1728 static int
1729 bwn_wme_update(struct ieee80211com *ic)
1730 {
1731         struct bwn_softc *sc = ic->ic_softc;
1732         struct bwn_mac *mac = sc->sc_curmac;
1733         struct wmeParams *wmep;
1734         int i;
1735
1736         BWN_LOCK(sc);
1737         mac = sc->sc_curmac;
1738         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1739                 bwn_mac_suspend(mac);
1740                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1741                         wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1742                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1743                 }
1744                 bwn_mac_enable(mac);
1745         }
1746         BWN_UNLOCK(sc);
1747         return (0);
1748 }
1749
1750 static void
1751 bwn_scan_start(struct ieee80211com *ic)
1752 {
1753         struct bwn_softc *sc = ic->ic_softc;
1754         struct bwn_mac *mac;
1755
1756         BWN_LOCK(sc);
1757         mac = sc->sc_curmac;
1758         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1759                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1760                 bwn_set_opmode(mac);
1761                 /* disable CFP update during scan */
1762                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1763         }
1764         BWN_UNLOCK(sc);
1765 }
1766
1767 static void
1768 bwn_scan_end(struct ieee80211com *ic)
1769 {
1770         struct bwn_softc *sc = ic->ic_softc;
1771         struct bwn_mac *mac;
1772
1773         BWN_LOCK(sc);
1774         mac = sc->sc_curmac;
1775         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1776                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1777                 bwn_set_opmode(mac);
1778                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1779         }
1780         BWN_UNLOCK(sc);
1781 }
1782
1783 static void
1784 bwn_set_channel(struct ieee80211com *ic)
1785 {
1786         struct bwn_softc *sc = ic->ic_softc;
1787         struct bwn_mac *mac = sc->sc_curmac;
1788         struct bwn_phy *phy = &mac->mac_phy;
1789         int chan, error;
1790
1791         BWN_LOCK(sc);
1792
1793         error = bwn_switch_band(sc, ic->ic_curchan);
1794         if (error)
1795                 goto fail;
1796         bwn_mac_suspend(mac);
1797         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1798         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1799         if (chan != phy->chan)
1800                 bwn_switch_channel(mac, chan);
1801
1802         /* TX power level */
1803         if (ic->ic_curchan->ic_maxpower != 0 &&
1804             ic->ic_curchan->ic_maxpower != phy->txpower) {
1805                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1806                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1807                     BWN_TXPWR_IGNORE_TSSI);
1808         }
1809
1810         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1811         if (phy->set_antenna)
1812                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1813
1814         if (sc->sc_rf_enabled != phy->rf_on) {
1815                 if (sc->sc_rf_enabled) {
1816                         bwn_rf_turnon(mac);
1817                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1818                                 device_printf(sc->sc_dev,
1819                                     "please turn on the RF switch\n");
1820                 } else
1821                         bwn_rf_turnoff(mac);
1822         }
1823
1824         bwn_mac_enable(mac);
1825
1826 fail:
1827         /*
1828          * Setup radio tap channel freq and flags
1829          */
1830         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1831                 htole16(ic->ic_curchan->ic_freq);
1832         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1833                 htole16(ic->ic_curchan->ic_flags & 0xffff);
1834
1835         BWN_UNLOCK(sc);
1836 }
1837
1838 static struct ieee80211vap *
1839 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1840     enum ieee80211_opmode opmode, int flags,
1841     const uint8_t bssid[IEEE80211_ADDR_LEN],
1842     const uint8_t mac[IEEE80211_ADDR_LEN])
1843 {
1844         struct ieee80211vap *vap;
1845         struct bwn_vap *bvp;
1846
1847         switch (opmode) {
1848         case IEEE80211_M_HOSTAP:
1849         case IEEE80211_M_MBSS:
1850         case IEEE80211_M_STA:
1851         case IEEE80211_M_WDS:
1852         case IEEE80211_M_MONITOR:
1853         case IEEE80211_M_IBSS:
1854         case IEEE80211_M_AHDEMO:
1855                 break;
1856         default:
1857                 return (NULL);
1858         }
1859
1860         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1861         vap = &bvp->bv_vap;
1862         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1863         /* override with driver methods */
1864         bvp->bv_newstate = vap->iv_newstate;
1865         vap->iv_newstate = bwn_newstate;
1866
1867         /* override max aid so sta's cannot assoc when we're out of sta id's */
1868         vap->iv_max_aid = BWN_STAID_MAX;
1869
1870         ieee80211_ratectl_init(vap);
1871
1872         /* complete setup */
1873         ieee80211_vap_attach(vap, ieee80211_media_change,
1874             ieee80211_media_status, mac);
1875         return (vap);
1876 }
1877
1878 static void
1879 bwn_vap_delete(struct ieee80211vap *vap)
1880 {
1881         struct bwn_vap *bvp = BWN_VAP(vap);
1882
1883         ieee80211_ratectl_deinit(vap);
1884         ieee80211_vap_detach(vap);
1885         free(bvp, M_80211_VAP);
1886 }
1887
1888 static int
1889 bwn_init(struct bwn_softc *sc)
1890 {
1891         struct bwn_mac *mac;
1892         int error;
1893
1894         BWN_ASSERT_LOCKED(sc);
1895
1896         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1897
1898         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1899         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1900         sc->sc_filters = 0;
1901         bwn_wme_clear(sc);
1902         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1903         sc->sc_rf_enabled = 1;
1904
1905         mac = sc->sc_curmac;
1906         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1907                 error = bwn_core_init(mac);
1908                 if (error != 0)
1909                         return (error);
1910         }
1911         if (mac->mac_status == BWN_MAC_STATUS_INITED)
1912                 bwn_core_start(mac);
1913
1914         bwn_set_opmode(mac);
1915         bwn_set_pretbtt(mac);
1916         bwn_spu_setdelay(mac, 0);
1917         bwn_set_macaddr(mac);
1918
1919         sc->sc_flags |= BWN_FLAG_RUNNING;
1920         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1921         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1922
1923         return (0);
1924 }
1925
1926 static void
1927 bwn_stop(struct bwn_softc *sc)
1928 {
1929         struct bwn_mac *mac = sc->sc_curmac;
1930
1931         BWN_ASSERT_LOCKED(sc);
1932
1933         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1934
1935         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936                 /* XXX FIXME opmode not based on VAP */
1937                 bwn_set_opmode(mac);
1938                 bwn_set_macaddr(mac);
1939         }
1940
1941         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1942                 bwn_core_stop(mac);
1943
1944         callout_stop(&sc->sc_led_blink_ch);
1945         sc->sc_led_blinking = 0;
1946
1947         bwn_core_exit(mac);
1948         sc->sc_rf_enabled = 0;
1949
1950         sc->sc_flags &= ~BWN_FLAG_RUNNING;
1951 }
1952
1953 static void
1954 bwn_wme_clear(struct bwn_softc *sc)
1955 {
1956 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1957         struct wmeParams *p;
1958         unsigned int i;
1959
1960         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1961             ("%s:%d: fail", __func__, __LINE__));
1962
1963         for (i = 0; i < N(sc->sc_wmeParams); i++) {
1964                 p = &(sc->sc_wmeParams[i]);
1965
1966                 switch (bwn_wme_shm_offsets[i]) {
1967                 case BWN_WME_VOICE:
1968                         p->wmep_txopLimit = 0;
1969                         p->wmep_aifsn = 2;
1970                         /* XXX FIXME: log2(cwmin) */
1971                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1972                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1973                         break;
1974                 case BWN_WME_VIDEO:
1975                         p->wmep_txopLimit = 0;
1976                         p->wmep_aifsn = 2;
1977                         /* XXX FIXME: log2(cwmin) */
1978                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1979                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1980                         break;
1981                 case BWN_WME_BESTEFFORT:
1982                         p->wmep_txopLimit = 0;
1983                         p->wmep_aifsn = 3;
1984                         /* XXX FIXME: log2(cwmin) */
1985                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1986                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1987                         break;
1988                 case BWN_WME_BACKGROUND:
1989                         p->wmep_txopLimit = 0;
1990                         p->wmep_aifsn = 7;
1991                         /* XXX FIXME: log2(cwmin) */
1992                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1993                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1994                         break;
1995                 default:
1996                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1997                 }
1998         }
1999 }
2000
2001 static int
2002 bwn_core_init(struct bwn_mac *mac)
2003 {
2004         struct bwn_softc *sc = mac->mac_sc;
2005         uint64_t hf;
2006         int error;
2007
2008         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2009             ("%s:%d: fail", __func__, __LINE__));
2010
2011         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2012
2013         siba_powerup(sc->sc_dev, 0);
2014         if (!siba_dev_isup(sc->sc_dev))
2015                 bwn_reset_core(mac, mac->mac_phy.gmode);
2016
2017         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2018         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2019         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2020         BWN_GETTIME(mac->mac_phy.nexttime);
2021         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2022         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2023         mac->mac_stats.link_noise = -95;
2024         mac->mac_reason_intr = 0;
2025         bzero(mac->mac_reason, sizeof(mac->mac_reason));
2026         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2027 #ifdef BWN_DEBUG
2028         if (sc->sc_debug & BWN_DEBUG_XMIT)
2029                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2030 #endif
2031         mac->mac_suspended = 1;
2032         mac->mac_task_state = 0;
2033         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2034
2035         mac->mac_phy.init_pre(mac);
2036
2037         siba_pcicore_intr(sc->sc_dev);
2038
2039         siba_fix_imcfglobug(sc->sc_dev);
2040         bwn_bt_disable(mac);
2041         if (mac->mac_phy.prepare_hw) {
2042                 error = mac->mac_phy.prepare_hw(mac);
2043                 if (error)
2044                         goto fail0;
2045         }
2046         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2047         error = bwn_chip_init(mac);
2048         if (error)
2049                 goto fail0;
2050         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2051             siba_get_revid(sc->sc_dev));
2052         hf = bwn_hf_read(mac);
2053         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2054                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2055                 if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2056                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2057                 if (mac->mac_phy.rev == 1)
2058                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2059         }
2060         if (mac->mac_phy.rf_ver == 0x2050) {
2061                 if (mac->mac_phy.rf_rev < 6)
2062                         hf |= BWN_HF_FORCE_VCO_RECALC;
2063                 if (mac->mac_phy.rf_rev == 6)
2064                         hf |= BWN_HF_4318_TSSI;
2065         }
2066         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2067                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2068         if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2069             (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2070                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2071         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2072         bwn_hf_write(mac, hf);
2073
2074         /* Tell the firmware about the MAC capabilities */
2075         if (siba_get_revid(sc->sc_dev) >= 13) {
2076                 uint32_t cap;
2077                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2078                 DPRINTF(sc, BWN_DEBUG_RESET,
2079                     "%s: hw capabilities: 0x%08x\n",
2080                     __func__, cap);
2081                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2082                     cap & 0xffff);
2083                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2084                     (cap >> 16) & 0xffff);
2085         }
2086
2087         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2088         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2089         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2090         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2091
2092         bwn_rate_init(mac);
2093         bwn_set_phytxctl(mac);
2094
2095         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2096             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2097         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2098
2099         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2100                 bwn_pio_init(mac);
2101         else
2102                 bwn_dma_init(mac);
2103         bwn_wme_init(mac);
2104         bwn_spu_setdelay(mac, 1);
2105         bwn_bt_enable(mac);
2106
2107         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2108         siba_powerup(sc->sc_dev,
2109             !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2110         bwn_set_macaddr(mac);
2111         bwn_crypt_init(mac);
2112
2113         /* XXX LED initializatin */
2114
2115         mac->mac_status = BWN_MAC_STATUS_INITED;
2116
2117         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2118         return (error);
2119
2120 fail0:
2121         siba_powerdown(sc->sc_dev);
2122         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2123             ("%s:%d: fail", __func__, __LINE__));
2124         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2125         return (error);
2126 }
2127
2128 static void
2129 bwn_core_start(struct bwn_mac *mac)
2130 {
2131         struct bwn_softc *sc = mac->mac_sc;
2132         uint32_t tmp;
2133
2134         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2135             ("%s:%d: fail", __func__, __LINE__));
2136
2137         if (siba_get_revid(sc->sc_dev) < 5)
2138                 return;
2139
2140         while (1) {
2141                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2142                 if (!(tmp & 0x00000001))
2143                         break;
2144                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2145         }
2146
2147         bwn_mac_enable(mac);
2148         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2149         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2150
2151         mac->mac_status = BWN_MAC_STATUS_STARTED;
2152 }
2153
2154 static void
2155 bwn_core_exit(struct bwn_mac *mac)
2156 {
2157         struct bwn_softc *sc = mac->mac_sc;
2158         uint32_t macctl;
2159
2160         BWN_ASSERT_LOCKED(mac->mac_sc);
2161
2162         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2163             ("%s:%d: fail", __func__, __LINE__));
2164
2165         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2166                 return;
2167         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2168
2169         macctl = BWN_READ_4(mac, BWN_MACCTL);
2170         macctl &= ~BWN_MACCTL_MCODE_RUN;
2171         macctl |= BWN_MACCTL_MCODE_JMP0;
2172         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2173
2174         bwn_dma_stop(mac);
2175         bwn_pio_stop(mac);
2176         bwn_chip_exit(mac);
2177         mac->mac_phy.switch_analog(mac, 0);
2178         siba_dev_down(sc->sc_dev, 0);
2179         siba_powerdown(sc->sc_dev);
2180 }
2181
2182 static void
2183 bwn_bt_disable(struct bwn_mac *mac)
2184 {
2185         struct bwn_softc *sc = mac->mac_sc;
2186
2187         (void)sc;
2188         /* XXX do nothing yet */
2189 }
2190
2191 static int
2192 bwn_chip_init(struct bwn_mac *mac)
2193 {
2194         struct bwn_softc *sc = mac->mac_sc;
2195         struct bwn_phy *phy = &mac->mac_phy;
2196         uint32_t macctl;
2197         int error;
2198
2199         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2200         if (phy->gmode)
2201                 macctl |= BWN_MACCTL_GMODE;
2202         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2203
2204         error = bwn_fw_fillinfo(mac);
2205         if (error)
2206                 return (error);
2207         error = bwn_fw_loaducode(mac);
2208         if (error)
2209                 return (error);
2210
2211         error = bwn_gpio_init(mac);
2212         if (error)
2213                 return (error);
2214
2215         error = bwn_fw_loadinitvals(mac);
2216         if (error) {
2217                 siba_gpio_set(sc->sc_dev, 0);
2218                 return (error);
2219         }
2220         phy->switch_analog(mac, 1);
2221         error = bwn_phy_init(mac);
2222         if (error) {
2223                 siba_gpio_set(sc->sc_dev, 0);
2224                 return (error);
2225         }
2226         if (phy->set_im)
2227                 phy->set_im(mac, BWN_IMMODE_NONE);
2228         if (phy->set_antenna)
2229                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2230         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2231
2232         if (phy->type == BWN_PHYTYPE_B)
2233                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2234         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2235         if (siba_get_revid(sc->sc_dev) < 5)
2236                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2237
2238         BWN_WRITE_4(mac, BWN_MACCTL,
2239             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2240         BWN_WRITE_4(mac, BWN_MACCTL,
2241             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2242         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2243
2244         bwn_set_opmode(mac);
2245         if (siba_get_revid(sc->sc_dev) < 3) {
2246                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2247                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2248                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2249                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2250         } else {
2251                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2252                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2253         }
2254         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2255         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2256         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2257         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2258         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2259         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2260         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2261
2262         bwn_mac_phy_clock_set(mac, true);
2263
2264         /* SIBA powerup */
2265         /* XXX TODO: BCMA powerup */
2266         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2267         return (error);
2268 }
2269
2270 /* read hostflags */
2271 uint64_t
2272 bwn_hf_read(struct bwn_mac *mac)
2273 {
2274         uint64_t ret;
2275
2276         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2277         ret <<= 16;
2278         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2279         ret <<= 16;
2280         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2281         return (ret);
2282 }
2283
2284 void
2285 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2286 {
2287
2288         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2289             (value & 0x00000000ffffull));
2290         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2291             (value & 0x0000ffff0000ull) >> 16);
2292         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2293             (value & 0xffff00000000ULL) >> 32);
2294 }
2295
2296 static void
2297 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2298 {
2299
2300         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2301         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2302 }
2303
2304 static void
2305 bwn_rate_init(struct bwn_mac *mac)
2306 {
2307
2308         switch (mac->mac_phy.type) {
2309         case BWN_PHYTYPE_A:
2310         case BWN_PHYTYPE_G:
2311         case BWN_PHYTYPE_LP:
2312         case BWN_PHYTYPE_N:
2313                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2314                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2315                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2316                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2317                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2318                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2319                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2320                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2321                         break;
2322                 /* FALLTHROUGH */
2323         case BWN_PHYTYPE_B:
2324                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2325                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2326                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2327                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2328                 break;
2329         default:
2330                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2331         }
2332 }
2333
2334 static void
2335 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2336 {
2337         uint16_t offset;
2338
2339         if (ofdm) {
2340                 offset = 0x480;
2341                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2342         } else {
2343                 offset = 0x4c0;
2344                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2345         }
2346         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2347             bwn_shm_read_2(mac, BWN_SHARED, offset));
2348 }
2349
2350 static uint8_t
2351 bwn_plcp_getcck(const uint8_t bitrate)
2352 {
2353
2354         switch (bitrate) {
2355         case BWN_CCK_RATE_1MB:
2356                 return (0x0a);
2357         case BWN_CCK_RATE_2MB:
2358                 return (0x14);
2359         case BWN_CCK_RATE_5MB:
2360                 return (0x37);
2361         case BWN_CCK_RATE_11MB:
2362                 return (0x6e);
2363         }
2364         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2365         return (0);
2366 }
2367
2368 static uint8_t
2369 bwn_plcp_getofdm(const uint8_t bitrate)
2370 {
2371
2372         switch (bitrate) {
2373         case BWN_OFDM_RATE_6MB:
2374                 return (0xb);
2375         case BWN_OFDM_RATE_9MB:
2376                 return (0xf);
2377         case BWN_OFDM_RATE_12MB:
2378                 return (0xa);
2379         case BWN_OFDM_RATE_18MB:
2380                 return (0xe);
2381         case BWN_OFDM_RATE_24MB:
2382                 return (0x9);
2383         case BWN_OFDM_RATE_36MB:
2384                 return (0xd);
2385         case BWN_OFDM_RATE_48MB:
2386                 return (0x8);
2387         case BWN_OFDM_RATE_54MB:
2388                 return (0xc);
2389         }
2390         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2391         return (0);
2392 }
2393
2394 static void
2395 bwn_set_phytxctl(struct bwn_mac *mac)
2396 {
2397         uint16_t ctl;
2398
2399         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2400             BWN_TX_PHY_TXPWR);
2401         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2402         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2403         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2404 }
2405
2406 static void
2407 bwn_pio_init(struct bwn_mac *mac)
2408 {
2409         struct bwn_pio *pio = &mac->mac_method.pio;
2410
2411         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2412             & ~BWN_MACCTL_BIGENDIAN);
2413         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2414
2415         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2416         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2417         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2418         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2419         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2420         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2421 }
2422
2423 static void
2424 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2425     int index)
2426 {
2427         struct bwn_pio_txpkt *tp;
2428         struct bwn_softc *sc = mac->mac_sc;
2429         unsigned int i;
2430
2431         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2432         tq->tq_index = index;
2433
2434         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2435         if (siba_get_revid(sc->sc_dev) >= 8)
2436                 tq->tq_size = 1920;
2437         else {
2438                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2439                 tq->tq_size -= 80;
2440         }
2441
2442         TAILQ_INIT(&tq->tq_pktlist);
2443         for (i = 0; i < N(tq->tq_pkts); i++) {
2444                 tp = &(tq->tq_pkts[i]);
2445                 tp->tp_index = i;
2446                 tp->tp_queue = tq;
2447                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2448         }
2449 }
2450
2451 static uint16_t
2452 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2453 {
2454         struct bwn_softc *sc = mac->mac_sc;
2455         static const uint16_t bases[] = {
2456                 BWN_PIO_BASE0,
2457                 BWN_PIO_BASE1,
2458                 BWN_PIO_BASE2,
2459                 BWN_PIO_BASE3,
2460                 BWN_PIO_BASE4,
2461                 BWN_PIO_BASE5,
2462                 BWN_PIO_BASE6,
2463                 BWN_PIO_BASE7,
2464         };
2465         static const uint16_t bases_rev11[] = {
2466                 BWN_PIO11_BASE0,
2467                 BWN_PIO11_BASE1,
2468                 BWN_PIO11_BASE2,
2469                 BWN_PIO11_BASE3,
2470                 BWN_PIO11_BASE4,
2471                 BWN_PIO11_BASE5,
2472         };
2473
2474         if (siba_get_revid(sc->sc_dev) >= 11) {
2475                 if (index >= N(bases_rev11))
2476                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2477                 return (bases_rev11[index]);
2478         }
2479         if (index >= N(bases))
2480                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2481         return (bases[index]);
2482 }
2483
2484 static void
2485 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2486     int index)
2487 {
2488         struct bwn_softc *sc = mac->mac_sc;
2489
2490         prq->prq_mac = mac;
2491         prq->prq_rev = siba_get_revid(sc->sc_dev);
2492         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2493         bwn_dma_rxdirectfifo(mac, index, 1);
2494 }
2495
2496 static void
2497 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2498 {
2499         if (tq == NULL)
2500                 return;
2501         bwn_pio_cancel_tx_packets(tq);
2502 }
2503
2504 static void
2505 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2506 {
2507
2508         bwn_destroy_pioqueue_tx(pio);
2509 }
2510
2511 static uint16_t
2512 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2513     uint16_t offset)
2514 {
2515
2516         return (BWN_READ_2(mac, tq->tq_base + offset));
2517 }
2518
2519 static void
2520 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2521 {
2522         uint32_t ctl;
2523         int type;
2524         uint16_t base;
2525
2526         type = bwn_dma_mask2type(bwn_dma_mask(mac));
2527         base = bwn_dma_base(type, idx);
2528         if (type == BWN_DMA_64BIT) {
2529                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2530                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2531                 if (enable)
2532                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2533                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2534         } else {
2535                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2536                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2537                 if (enable)
2538                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2539                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2540         }
2541 }
2542
2543 static uint64_t
2544 bwn_dma_mask(struct bwn_mac *mac)
2545 {
2546         uint32_t tmp;
2547         uint16_t base;
2548
2549         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2550         if (tmp & SIBA_TGSHIGH_DMA64)
2551                 return (BWN_DMA_BIT_MASK(64));
2552         base = bwn_dma_base(0, 0);
2553         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2554         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2555         if (tmp & BWN_DMA32_TXADDREXT_MASK)
2556                 return (BWN_DMA_BIT_MASK(32));
2557
2558         return (BWN_DMA_BIT_MASK(30));
2559 }
2560
2561 static int
2562 bwn_dma_mask2type(uint64_t dmamask)
2563 {
2564
2565         if (dmamask == BWN_DMA_BIT_MASK(30))
2566                 return (BWN_DMA_30BIT);
2567         if (dmamask == BWN_DMA_BIT_MASK(32))
2568                 return (BWN_DMA_32BIT);
2569         if (dmamask == BWN_DMA_BIT_MASK(64))
2570                 return (BWN_DMA_64BIT);
2571         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2572         return (BWN_DMA_30BIT);
2573 }
2574
2575 static void
2576 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2577 {
2578         struct bwn_pio_txpkt *tp;
2579         unsigned int i;
2580
2581         for (i = 0; i < N(tq->tq_pkts); i++) {
2582                 tp = &(tq->tq_pkts[i]);
2583                 if (tp->tp_m) {
2584                         m_freem(tp->tp_m);
2585                         tp->tp_m = NULL;
2586                 }
2587         }
2588 }
2589
2590 static uint16_t
2591 bwn_dma_base(int type, int controller_idx)
2592 {
2593         static const uint16_t map64[] = {
2594                 BWN_DMA64_BASE0,
2595                 BWN_DMA64_BASE1,
2596                 BWN_DMA64_BASE2,
2597                 BWN_DMA64_BASE3,
2598                 BWN_DMA64_BASE4,
2599                 BWN_DMA64_BASE5,
2600         };
2601         static const uint16_t map32[] = {
2602                 BWN_DMA32_BASE0,
2603                 BWN_DMA32_BASE1,
2604                 BWN_DMA32_BASE2,
2605                 BWN_DMA32_BASE3,
2606                 BWN_DMA32_BASE4,
2607                 BWN_DMA32_BASE5,
2608         };
2609
2610         if (type == BWN_DMA_64BIT) {
2611                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2612                     ("%s:%d: fail", __func__, __LINE__));
2613                 return (map64[controller_idx]);
2614         }
2615         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2616             ("%s:%d: fail", __func__, __LINE__));
2617         return (map32[controller_idx]);
2618 }
2619
2620 static void
2621 bwn_dma_init(struct bwn_mac *mac)
2622 {
2623         struct bwn_dma *dma = &mac->mac_method.dma;
2624
2625         /* setup TX DMA channels. */
2626         bwn_dma_setup(dma->wme[WME_AC_BK]);
2627         bwn_dma_setup(dma->wme[WME_AC_BE]);
2628         bwn_dma_setup(dma->wme[WME_AC_VI]);
2629         bwn_dma_setup(dma->wme[WME_AC_VO]);
2630         bwn_dma_setup(dma->mcast);
2631         /* setup RX DMA channel. */
2632         bwn_dma_setup(dma->rx);
2633 }
2634
2635 static struct bwn_dma_ring *
2636 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2637     int for_tx, int type)
2638 {
2639         struct bwn_dma *dma = &mac->mac_method.dma;
2640         struct bwn_dma_ring *dr;
2641         struct bwn_dmadesc_generic *desc;
2642         struct bwn_dmadesc_meta *mt;
2643         struct bwn_softc *sc = mac->mac_sc;
2644         int error, i;
2645
2646         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2647         if (dr == NULL)
2648                 goto out;
2649         dr->dr_numslots = BWN_RXRING_SLOTS;
2650         if (for_tx)
2651                 dr->dr_numslots = BWN_TXRING_SLOTS;
2652
2653         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2654             M_DEVBUF, M_NOWAIT | M_ZERO);
2655         if (dr->dr_meta == NULL)
2656                 goto fail0;
2657
2658         dr->dr_type = type;
2659         dr->dr_mac = mac;
2660         dr->dr_base = bwn_dma_base(type, controller_index);
2661         dr->dr_index = controller_index;
2662         if (type == BWN_DMA_64BIT) {
2663                 dr->getdesc = bwn_dma_64_getdesc;
2664                 dr->setdesc = bwn_dma_64_setdesc;
2665                 dr->start_transfer = bwn_dma_64_start_transfer;
2666                 dr->suspend = bwn_dma_64_suspend;
2667                 dr->resume = bwn_dma_64_resume;
2668                 dr->get_curslot = bwn_dma_64_get_curslot;
2669                 dr->set_curslot = bwn_dma_64_set_curslot;
2670         } else {
2671                 dr->getdesc = bwn_dma_32_getdesc;
2672                 dr->setdesc = bwn_dma_32_setdesc;
2673                 dr->start_transfer = bwn_dma_32_start_transfer;
2674                 dr->suspend = bwn_dma_32_suspend;
2675                 dr->resume = bwn_dma_32_resume;
2676                 dr->get_curslot = bwn_dma_32_get_curslot;
2677                 dr->set_curslot = bwn_dma_32_set_curslot;
2678         }
2679         if (for_tx) {
2680                 dr->dr_tx = 1;
2681                 dr->dr_curslot = -1;
2682         } else {
2683                 if (dr->dr_index == 0) {
2684                         switch (mac->mac_fw.fw_hdr_format) {
2685                         case BWN_FW_HDR_351:
2686                         case BWN_FW_HDR_410:
2687                                 dr->dr_rx_bufsize =
2688                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
2689                                 dr->dr_frameoffset =
2690                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
2691                                 break;
2692                         case BWN_FW_HDR_598:
2693                                 dr->dr_rx_bufsize =
2694                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
2695                                 dr->dr_frameoffset =
2696                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
2697                                 break;
2698                         }
2699                 } else
2700                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2701         }
2702
2703         error = bwn_dma_allocringmemory(dr);
2704         if (error)
2705                 goto fail2;
2706
2707         if (for_tx) {
2708                 /*
2709                  * Assumption: BWN_TXRING_SLOTS can be divided by
2710                  * BWN_TX_SLOTS_PER_FRAME
2711                  */
2712                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2713                     ("%s:%d: fail", __func__, __LINE__));
2714
2715                 dr->dr_txhdr_cache = contigmalloc(
2716                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2717                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2718                     0, BUS_SPACE_MAXADDR, 8, 0);
2719                 if (dr->dr_txhdr_cache == NULL) {
2720                         device_printf(sc->sc_dev,
2721                             "can't allocate TX header DMA memory\n");
2722                         goto fail1;
2723                 }
2724
2725                 /*
2726                  * Create TX ring DMA stuffs
2727                  */
2728                 error = bus_dma_tag_create(dma->parent_dtag,
2729                                     BWN_ALIGN, 0,
2730                                     BUS_SPACE_MAXADDR,
2731                                     BUS_SPACE_MAXADDR,
2732                                     NULL, NULL,
2733                                     BWN_HDRSIZE(mac),
2734                                     1,
2735                                     BUS_SPACE_MAXSIZE_32BIT,
2736                                     0,
2737                                     NULL, NULL,
2738                                     &dr->dr_txring_dtag);
2739                 if (error) {
2740                         device_printf(sc->sc_dev,
2741                             "can't create TX ring DMA tag: TODO frees\n");
2742                         goto fail2;
2743                 }
2744
2745                 for (i = 0; i < dr->dr_numslots; i += 2) {
2746                         dr->getdesc(dr, i, &desc, &mt);
2747
2748                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2749                         mt->mt_m = NULL;
2750                         mt->mt_ni = NULL;
2751                         mt->mt_islast = 0;
2752                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2753                             &mt->mt_dmap);
2754                         if (error) {
2755                                 device_printf(sc->sc_dev,
2756                                      "can't create RX buf DMA map\n");
2757                                 goto fail2;
2758                         }
2759
2760                         dr->getdesc(dr, i + 1, &desc, &mt);
2761
2762                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2763                         mt->mt_m = NULL;
2764                         mt->mt_ni = NULL;
2765                         mt->mt_islast = 1;
2766                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2767                             &mt->mt_dmap);
2768                         if (error) {
2769                                 device_printf(sc->sc_dev,
2770                                      "can't create RX buf DMA map\n");
2771                                 goto fail2;
2772                         }
2773                 }
2774         } else {
2775                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2776                     &dr->dr_spare_dmap);
2777                 if (error) {
2778                         device_printf(sc->sc_dev,
2779                             "can't create RX buf DMA map\n");
2780                         goto out;               /* XXX wrong! */
2781                 }
2782
2783                 for (i = 0; i < dr->dr_numslots; i++) {
2784                         dr->getdesc(dr, i, &desc, &mt);
2785
2786                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2787                             &mt->mt_dmap);
2788                         if (error) {
2789                                 device_printf(sc->sc_dev,
2790                                     "can't create RX buf DMA map\n");
2791                                 goto out;       /* XXX wrong! */
2792                         }
2793                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2794                         if (error) {
2795                                 device_printf(sc->sc_dev,
2796                                     "failed to allocate RX buf\n");
2797                                 goto out;       /* XXX wrong! */
2798                         }
2799                 }
2800
2801                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2802                     BUS_DMASYNC_PREWRITE);
2803
2804                 dr->dr_usedslot = dr->dr_numslots;
2805         }
2806
2807       out:
2808         return (dr);
2809
2810 fail2:
2811         if (dr->dr_txhdr_cache != NULL) {
2812                 contigfree(dr->dr_txhdr_cache,
2813                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2814                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2815         }
2816 fail1:
2817         free(dr->dr_meta, M_DEVBUF);
2818 fail0:
2819         free(dr, M_DEVBUF);
2820         return (NULL);
2821 }
2822
2823 static void
2824 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2825 {
2826
2827         if (dr == NULL)
2828                 return;
2829
2830         bwn_dma_free_descbufs(*dr);
2831         bwn_dma_free_ringmemory(*dr);
2832
2833         if ((*dr)->dr_txhdr_cache != NULL) {
2834                 contigfree((*dr)->dr_txhdr_cache,
2835                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2836                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2837         }
2838         free((*dr)->dr_meta, M_DEVBUF);
2839         free(*dr, M_DEVBUF);
2840
2841         *dr = NULL;
2842 }
2843
2844 static void
2845 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2846     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2847 {
2848         struct bwn_dmadesc32 *desc;
2849
2850         *meta = &(dr->dr_meta[slot]);
2851         desc = dr->dr_ring_descbase;
2852         desc = &(desc[slot]);
2853
2854         *gdesc = (struct bwn_dmadesc_generic *)desc;
2855 }
2856
2857 static void
2858 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2859     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2860     int start, int end, int irq)
2861 {
2862         struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2863         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2864         uint32_t addr, addrext, ctl;
2865         int slot;
2866
2867         slot = (int)(&(desc->dma.dma32) - descbase);
2868         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2869             ("%s:%d: fail", __func__, __LINE__));
2870
2871         addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2872         addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2873         addr |= siba_dma_translation(sc->sc_dev);
2874         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2875         if (slot == dr->dr_numslots - 1)
2876                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
2877         if (start)
2878                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
2879         if (end)
2880                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
2881         if (irq)
2882                 ctl |= BWN_DMA32_DCTL_IRQ;
2883         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2884             & BWN_DMA32_DCTL_ADDREXT_MASK;
2885
2886         desc->dma.dma32.control = htole32(ctl);
2887         desc->dma.dma32.address = htole32(addr);
2888 }
2889
2890 static void
2891 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2892 {
2893
2894         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2895             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2896 }
2897
2898 static void
2899 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2900 {
2901
2902         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2903             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2904 }
2905
2906 static void
2907 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2908 {
2909
2910         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2911             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2912 }
2913
2914 static int
2915 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2916 {
2917         uint32_t val;
2918
2919         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2920         val &= BWN_DMA32_RXDPTR;
2921
2922         return (val / sizeof(struct bwn_dmadesc32));
2923 }
2924
2925 static void
2926 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2927 {
2928
2929         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2930             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2931 }
2932
2933 static void
2934 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2935     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2936 {
2937         struct bwn_dmadesc64 *desc;
2938
2939         *meta = &(dr->dr_meta[slot]);
2940         desc = dr->dr_ring_descbase;
2941         desc = &(desc[slot]);
2942
2943         *gdesc = (struct bwn_dmadesc_generic *)desc;
2944 }
2945
2946 static void
2947 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2948     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2949     int start, int end, int irq)
2950 {
2951         struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2952         struct bwn_softc *sc = dr->dr_mac->mac_sc;
2953         int slot;
2954         uint32_t ctl0 = 0, ctl1 = 0;
2955         uint32_t addrlo, addrhi;
2956         uint32_t addrext;
2957
2958         slot = (int)(&(desc->dma.dma64) - descbase);
2959         KASSERT(slot >= 0 && slot < dr->dr_numslots,
2960             ("%s:%d: fail", __func__, __LINE__));
2961
2962         addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2963         addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2964         addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2965             30;
2966         addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2967         if (slot == dr->dr_numslots - 1)
2968                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2969         if (start)
2970                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2971         if (end)
2972                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2973         if (irq)
2974                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
2975         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2976         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2977             & BWN_DMA64_DCTL1_ADDREXT_MASK;
2978
2979         desc->dma.dma64.control0 = htole32(ctl0);
2980         desc->dma.dma64.control1 = htole32(ctl1);
2981         desc->dma.dma64.address_low = htole32(addrlo);
2982         desc->dma.dma64.address_high = htole32(addrhi);
2983 }
2984
2985 static void
2986 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2987 {
2988
2989         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2990             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2991 }
2992
2993 static void
2994 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2995 {
2996
2997         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2998             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2999 }
3000
3001 static void
3002 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3003 {
3004
3005         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3006             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3007 }
3008
3009 static int
3010 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3011 {
3012         uint32_t val;
3013
3014         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3015         val &= BWN_DMA64_RXSTATDPTR;
3016
3017         return (val / sizeof(struct bwn_dmadesc64));
3018 }
3019
3020 static void
3021 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3022 {
3023
3024         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3025             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3026 }
3027
3028 static int
3029 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3030 {
3031         struct bwn_mac *mac = dr->dr_mac;
3032         struct bwn_dma *dma = &mac->mac_method.dma;
3033         struct bwn_softc *sc = mac->mac_sc;
3034         int error;
3035
3036         error = bus_dma_tag_create(dma->parent_dtag,
3037                             BWN_ALIGN, 0,
3038                             BUS_SPACE_MAXADDR,
3039                             BUS_SPACE_MAXADDR,
3040                             NULL, NULL,
3041                             BWN_DMA_RINGMEMSIZE,
3042                             1,
3043                             BUS_SPACE_MAXSIZE_32BIT,
3044                             0,
3045                             NULL, NULL,
3046                             &dr->dr_ring_dtag);
3047         if (error) {
3048                 device_printf(sc->sc_dev,
3049                     "can't create TX ring DMA tag: TODO frees\n");
3050                 return (-1);
3051         }
3052
3053         error = bus_dmamem_alloc(dr->dr_ring_dtag,
3054             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3055             &dr->dr_ring_dmap);
3056         if (error) {
3057                 device_printf(sc->sc_dev,
3058                     "can't allocate DMA mem: TODO frees\n");
3059                 return (-1);
3060         }
3061         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3062             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3063             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3064         if (error) {
3065                 device_printf(sc->sc_dev,
3066                     "can't load DMA mem: TODO free\n");
3067                 return (-1);
3068         }
3069
3070         return (0);
3071 }
3072
3073 static void
3074 bwn_dma_setup(struct bwn_dma_ring *dr)
3075 {
3076         struct bwn_softc *sc = dr->dr_mac->mac_sc;
3077         uint64_t ring64;
3078         uint32_t addrext, ring32, value;
3079         uint32_t trans = siba_dma_translation(sc->sc_dev);
3080
3081         if (dr->dr_tx) {
3082                 dr->dr_curslot = -1;
3083
3084                 if (dr->dr_type == BWN_DMA_64BIT) {
3085                         ring64 = (uint64_t)(dr->dr_ring_dmabase);
3086                         addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3087                             >> 30;
3088                         value = BWN_DMA64_TXENABLE;
3089                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3090                             & BWN_DMA64_TXADDREXT_MASK;
3091                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3092                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3093                             (ring64 & 0xffffffff));
3094                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3095                             ((ring64 >> 32) &
3096                             ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3097                 } else {
3098                         ring32 = (uint32_t)(dr->dr_ring_dmabase);
3099                         addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3100                         value = BWN_DMA32_TXENABLE;
3101                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3102                             & BWN_DMA32_TXADDREXT_MASK;
3103                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3104                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3105                             (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3106                 }
3107                 return;
3108         }
3109
3110         /*
3111          * set for RX
3112          */
3113         dr->dr_usedslot = dr->dr_numslots;
3114
3115         if (dr->dr_type == BWN_DMA_64BIT) {
3116                 ring64 = (uint64_t)(dr->dr_ring_dmabase);
3117                 addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3118                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3119                 value |= BWN_DMA64_RXENABLE;
3120                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3121                     & BWN_DMA64_RXADDREXT_MASK;
3122                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3123                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3124                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3125                     ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3126                     | (trans << 1));
3127                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3128                     sizeof(struct bwn_dmadesc64));
3129         } else {
3130                 ring32 = (uint32_t)(dr->dr_ring_dmabase);
3131                 addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3132                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3133                 value |= BWN_DMA32_RXENABLE;
3134                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3135                     & BWN_DMA32_RXADDREXT_MASK;
3136                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3137                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3138                     (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3139                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3140                     sizeof(struct bwn_dmadesc32));
3141         }
3142 }
3143
3144 static void
3145 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3146 {
3147
3148         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3149         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3150             dr->dr_ring_dmap);
3151 }
3152
3153 static void
3154 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3155 {
3156
3157         if (dr->dr_tx) {
3158                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3159                 if (dr->dr_type == BWN_DMA_64BIT) {
3160                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3161                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3162                 } else
3163                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3164         } else {
3165                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3166                 if (dr->dr_type == BWN_DMA_64BIT) {
3167                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3168                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3169                 } else
3170                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3171         }
3172 }
3173
3174 static void
3175 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3176 {
3177         struct bwn_dmadesc_generic *desc;
3178         struct bwn_dmadesc_meta *meta;
3179         struct bwn_mac *mac = dr->dr_mac;
3180         struct bwn_dma *dma = &mac->mac_method.dma;
3181         struct bwn_softc *sc = mac->mac_sc;
3182         int i;
3183
3184         if (!dr->dr_usedslot)
3185                 return;
3186         for (i = 0; i < dr->dr_numslots; i++) {
3187                 dr->getdesc(dr, i, &desc, &meta);
3188
3189                 if (meta->mt_m == NULL) {
3190                         if (!dr->dr_tx)
3191                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3192                                     __func__);
3193                         continue;
3194                 }
3195                 if (dr->dr_tx) {
3196                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3197                                 bus_dmamap_unload(dr->dr_txring_dtag,
3198                                     meta->mt_dmap);
3199                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3200                                 bus_dmamap_unload(dma->txbuf_dtag,
3201                                     meta->mt_dmap);
3202                 } else
3203                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3204                 bwn_dma_free_descbuf(dr, meta);
3205         }
3206 }
3207
3208 static int
3209 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3210     int type)
3211 {
3212         struct bwn_softc *sc = mac->mac_sc;
3213         uint32_t value;
3214         int i;
3215         uint16_t offset;
3216
3217         for (i = 0; i < 10; i++) {
3218                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3219                     BWN_DMA32_TXSTATUS;
3220                 value = BWN_READ_4(mac, base + offset);
3221                 if (type == BWN_DMA_64BIT) {
3222                         value &= BWN_DMA64_TXSTAT;
3223                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3224                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3225                             value == BWN_DMA64_TXSTAT_STOPPED)
3226                                 break;
3227                 } else {
3228                         value &= BWN_DMA32_TXSTATE;
3229                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3230                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3231                             value == BWN_DMA32_TXSTAT_STOPPED)
3232                                 break;
3233                 }
3234                 DELAY(1000);
3235         }
3236         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3237         BWN_WRITE_4(mac, base + offset, 0);
3238         for (i = 0; i < 10; i++) {
3239                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3240                                                    BWN_DMA32_TXSTATUS;
3241                 value = BWN_READ_4(mac, base + offset);
3242                 if (type == BWN_DMA_64BIT) {
3243                         value &= BWN_DMA64_TXSTAT;
3244                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3245                                 i = -1;
3246                                 break;
3247                         }
3248                 } else {
3249                         value &= BWN_DMA32_TXSTATE;
3250                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3251                                 i = -1;
3252                                 break;
3253                         }
3254                 }
3255                 DELAY(1000);
3256         }
3257         if (i != -1) {
3258                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3259                 return (ENODEV);
3260         }
3261         DELAY(1000);
3262
3263         return (0);
3264 }
3265
3266 static int
3267 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3268     int type)
3269 {
3270         struct bwn_softc *sc = mac->mac_sc;
3271         uint32_t value;
3272         int i;
3273         uint16_t offset;
3274
3275         offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3276         BWN_WRITE_4(mac, base + offset, 0);
3277         for (i = 0; i < 10; i++) {
3278                 offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3279                     BWN_DMA32_RXSTATUS;
3280                 value = BWN_READ_4(mac, base + offset);
3281                 if (type == BWN_DMA_64BIT) {
3282                         value &= BWN_DMA64_RXSTAT;
3283                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3284                                 i = -1;
3285                                 break;
3286                         }
3287                 } else {
3288                         value &= BWN_DMA32_RXSTATE;
3289                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3290                                 i = -1;
3291                                 break;
3292                         }
3293                 }
3294                 DELAY(1000);
3295         }
3296         if (i != -1) {
3297                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3298                 return (ENODEV);
3299         }
3300
3301         return (0);
3302 }
3303
3304 static void
3305 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3306     struct bwn_dmadesc_meta *meta)
3307 {
3308
3309         if (meta->mt_m != NULL) {
3310                 m_freem(meta->mt_m);
3311                 meta->mt_m = NULL;
3312         }
3313         if (meta->mt_ni != NULL) {
3314                 ieee80211_free_node(meta->mt_ni);
3315                 meta->mt_ni = NULL;
3316         }
3317 }
3318
3319 static void
3320 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3321 {
3322         struct bwn_rxhdr4 *rxhdr;
3323         unsigned char *frame;
3324
3325         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3326         rxhdr->frame_len = 0;
3327
3328         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3329             sizeof(struct bwn_plcp6) + 2,
3330             ("%s:%d: fail", __func__, __LINE__));
3331         frame = mtod(m, char *) + dr->dr_frameoffset;
3332         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3333 }
3334
3335 static uint8_t
3336 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3337 {
3338         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3339
3340         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3341             == 0xff);
3342 }
3343
3344 static void
3345 bwn_wme_init(struct bwn_mac *mac)
3346 {
3347
3348         bwn_wme_load(mac);
3349
3350         /* enable WME support. */
3351         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3352         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3353             BWN_IFSCTL_USE_EDCF);
3354 }
3355
3356 static void
3357 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3358 {
3359         struct bwn_softc *sc = mac->mac_sc;
3360         struct ieee80211com *ic = &sc->sc_ic;
3361         uint16_t delay; /* microsec */
3362
3363         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3364         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3365                 delay = 500;
3366         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3367                 delay = max(delay, (uint16_t)2400);
3368
3369         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3370 }
3371
3372 static void
3373 bwn_bt_enable(struct bwn_mac *mac)
3374 {
3375         struct bwn_softc *sc = mac->mac_sc;
3376         uint64_t hf;
3377
3378         if (bwn_bluetooth == 0)
3379                 return;
3380         if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3381                 return;
3382         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3383                 return;
3384
3385         hf = bwn_hf_read(mac);
3386         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3387                 hf |= BWN_HF_BT_COEXISTALT;
3388         else
3389                 hf |= BWN_HF_BT_COEXIST;
3390         bwn_hf_write(mac, hf);
3391 }
3392
3393 static void
3394 bwn_set_macaddr(struct bwn_mac *mac)
3395 {
3396
3397         bwn_mac_write_bssid(mac);
3398         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3399             mac->mac_sc->sc_ic.ic_macaddr);
3400 }
3401
3402 static void
3403 bwn_clear_keys(struct bwn_mac *mac)
3404 {
3405         int i;
3406
3407         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3408                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3409                     ("%s:%d: fail", __func__, __LINE__));
3410
3411                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3412                     NULL, BWN_SEC_KEYSIZE, NULL);
3413                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3414                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3415                             NULL, BWN_SEC_KEYSIZE, NULL);
3416                 }
3417                 mac->mac_key[i].keyconf = NULL;
3418         }
3419 }
3420
3421 static void
3422 bwn_crypt_init(struct bwn_mac *mac)
3423 {
3424         struct bwn_softc *sc = mac->mac_sc;
3425
3426         mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3427         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3428             ("%s:%d: fail", __func__, __LINE__));
3429         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3430         mac->mac_ktp *= 2;
3431         if (siba_get_revid(sc->sc_dev) >= 5)
3432                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3433         bwn_clear_keys(mac);
3434 }
3435
3436 static void
3437 bwn_chip_exit(struct bwn_mac *mac)
3438 {
3439         struct bwn_softc *sc = mac->mac_sc;
3440
3441         bwn_phy_exit(mac);
3442         siba_gpio_set(sc->sc_dev, 0);
3443 }
3444
3445 static int
3446 bwn_fw_fillinfo(struct bwn_mac *mac)
3447 {
3448         int error;
3449
3450         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3451         if (error == 0)
3452                 return (0);
3453         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3454         if (error == 0)
3455                 return (0);
3456         return (error);
3457 }
3458
3459 static int
3460 bwn_gpio_init(struct bwn_mac *mac)
3461 {
3462         struct bwn_softc *sc = mac->mac_sc;
3463         uint32_t mask = 0x1f, set = 0xf, value;
3464
3465         BWN_WRITE_4(mac, BWN_MACCTL,
3466             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3467         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3468             BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3469
3470         if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3471                 mask |= 0x0060;
3472                 set |= 0x0060;
3473         }
3474         if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3475                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3476                     BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3477                 mask |= 0x0200;
3478                 set |= 0x0200;
3479         }
3480         if (siba_get_revid(sc->sc_dev) >= 2)
3481                 mask |= 0x0010;
3482
3483         value = siba_gpio_get(sc->sc_dev);
3484         if (value == -1)
3485                 return (0);
3486         siba_gpio_set(sc->sc_dev, (value & mask) | set);
3487
3488         return (0);
3489 }
3490
3491 static int
3492 bwn_fw_loadinitvals(struct bwn_mac *mac)
3493 {
3494 #define GETFWOFFSET(fwp, offset)                                \
3495         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3496         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3497         const struct bwn_fwhdr *hdr;
3498         struct bwn_fw *fw = &mac->mac_fw;
3499         int error;
3500
3501         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3502         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3503             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3504         if (error)
3505                 return (error);
3506         if (fw->initvals_band.fw) {
3507                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3508                 error = bwn_fwinitvals_write(mac,
3509                     GETFWOFFSET(fw->initvals_band, hdr_len),
3510                     be32toh(hdr->size),
3511                     fw->initvals_band.fw->datasize - hdr_len);
3512         }
3513         return (error);
3514 #undef GETFWOFFSET
3515 }
3516
3517 static int
3518 bwn_phy_init(struct bwn_mac *mac)
3519 {
3520         struct bwn_softc *sc = mac->mac_sc;
3521         int error;
3522
3523         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3524         mac->mac_phy.rf_onoff(mac, 1);
3525         error = mac->mac_phy.init(mac);
3526         if (error) {
3527                 device_printf(sc->sc_dev, "PHY init failed\n");
3528                 goto fail0;
3529         }
3530         error = bwn_switch_channel(mac,
3531             mac->mac_phy.get_default_chan(mac));
3532         if (error) {
3533                 device_printf(sc->sc_dev,
3534                     "failed to switch default channel\n");
3535                 goto fail1;
3536         }
3537         return (0);
3538 fail1:
3539         if (mac->mac_phy.exit)
3540                 mac->mac_phy.exit(mac);
3541 fail0:
3542         mac->mac_phy.rf_onoff(mac, 0);
3543
3544         return (error);
3545 }
3546
3547 static void
3548 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3549 {
3550         uint16_t ant;
3551         uint16_t tmp;
3552
3553         ant = bwn_ant2phy(antenna);
3554
3555         /* For ACK/CTS */
3556         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3557         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3558         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3559         /* For Probe Resposes */
3560         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3561         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3562         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3563 }
3564
3565 static void
3566 bwn_set_opmode(struct bwn_mac *mac)
3567 {
3568         struct bwn_softc *sc = mac->mac_sc;
3569         struct ieee80211com *ic = &sc->sc_ic;
3570         uint32_t ctl;
3571         uint16_t cfp_pretbtt;
3572
3573         ctl = BWN_READ_4(mac, BWN_MACCTL);
3574         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3575             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3576             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3577         ctl |= BWN_MACCTL_STA;
3578
3579         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3580             ic->ic_opmode == IEEE80211_M_MBSS)
3581                 ctl |= BWN_MACCTL_HOSTAP;
3582         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3583                 ctl &= ~BWN_MACCTL_STA;
3584         ctl |= sc->sc_filters;
3585
3586         if (siba_get_revid(sc->sc_dev) <= 4)
3587                 ctl |= BWN_MACCTL_PROMISC;
3588
3589         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3590
3591         cfp_pretbtt = 2;
3592         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3593                 if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3594                     siba_get_chiprev(sc->sc_dev) == 3)
3595                         cfp_pretbtt = 100;
3596                 else
3597                         cfp_pretbtt = 50;
3598         }
3599         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3600 }
3601
3602 static int
3603 bwn_dma_gettype(struct bwn_mac *mac)
3604 {
3605         uint32_t tmp;
3606         uint16_t base;
3607
3608         tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3609         if (tmp & SIBA_TGSHIGH_DMA64)
3610                 return (BWN_DMA_64BIT);
3611         base = bwn_dma_base(0, 0);
3612         BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3613         tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3614         if (tmp & BWN_DMA32_TXADDREXT_MASK)
3615                 return (BWN_DMA_32BIT);
3616
3617         return (BWN_DMA_30BIT);
3618 }
3619
3620 static void
3621 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3622 {
3623         if (!error) {
3624                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3625                 *((bus_addr_t *)arg) = seg->ds_addr;
3626         }
3627 }
3628
3629 void
3630 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3631 {
3632         struct bwn_phy *phy = &mac->mac_phy;
3633         struct bwn_softc *sc = mac->mac_sc;
3634         unsigned int i, max_loop;
3635         uint16_t value;
3636         uint32_t buffer[5] = {
3637                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3638         };
3639
3640         if (ofdm) {
3641                 max_loop = 0x1e;
3642                 buffer[0] = 0x000201cc;
3643         } else {
3644                 max_loop = 0xfa;
3645                 buffer[0] = 0x000b846e;
3646         }
3647
3648         BWN_ASSERT_LOCKED(mac->mac_sc);
3649
3650         for (i = 0; i < 5; i++)
3651                 bwn_ram_write(mac, i * 4, buffer[i]);
3652
3653         BWN_WRITE_2(mac, 0x0568, 0x0000);
3654         BWN_WRITE_2(mac, 0x07c0,
3655             (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3656
3657         value = (ofdm ? 0x41 : 0x40);
3658         BWN_WRITE_2(mac, 0x050c, value);
3659
3660         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3661             phy->type == BWN_PHYTYPE_LCN)
3662                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3663         BWN_WRITE_2(mac, 0x0508, 0x0000);
3664         BWN_WRITE_2(mac, 0x050a, 0x0000);
3665         BWN_WRITE_2(mac, 0x054c, 0x0000);
3666         BWN_WRITE_2(mac, 0x056a, 0x0014);
3667         BWN_WRITE_2(mac, 0x0568, 0x0826);
3668         BWN_WRITE_2(mac, 0x0500, 0x0000);
3669
3670         /* XXX TODO: n phy pa override? */
3671
3672         switch (phy->type) {
3673         case BWN_PHYTYPE_N:
3674         case BWN_PHYTYPE_LCN:
3675                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3676                 break;
3677         case BWN_PHYTYPE_LP:
3678                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3679                 break;
3680         default:
3681                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3682                 break;
3683         }
3684
3685         /* flush */
3686         BWN_READ_2(mac, 0x0502);
3687
3688         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3689                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3690         for (i = 0x00; i < max_loop; i++) {
3691                 value = BWN_READ_2(mac, 0x050e);
3692                 if (value & 0x0080)
3693                         break;
3694                 DELAY(10);
3695         }
3696         for (i = 0x00; i < 0x0a; i++) {
3697                 value = BWN_READ_2(mac, 0x050e);
3698                 if (value & 0x0400)
3699                         break;
3700                 DELAY(10);
3701         }
3702         for (i = 0x00; i < 0x19; i++) {
3703                 value = BWN_READ_2(mac, 0x0690);
3704                 if (!(value & 0x0100))
3705                         break;
3706                 DELAY(10);
3707         }
3708         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3709                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3710 }
3711
3712 void
3713 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3714 {
3715         uint32_t macctl;
3716
3717         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3718
3719         macctl = BWN_READ_4(mac, BWN_MACCTL);
3720         if (macctl & BWN_MACCTL_BIGENDIAN)
3721                 printf("TODO: need swap\n");
3722
3723         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3724         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3725         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3726 }
3727
3728 void
3729 bwn_mac_suspend(struct bwn_mac *mac)
3730 {
3731         struct bwn_softc *sc = mac->mac_sc;
3732         int i;
3733         uint32_t tmp;
3734
3735         KASSERT(mac->mac_suspended >= 0,
3736             ("%s:%d: fail", __func__, __LINE__));
3737
3738         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3739             __func__, mac->mac_suspended);
3740
3741         if (mac->mac_suspended == 0) {
3742                 bwn_psctl(mac, BWN_PS_AWAKE);
3743                 BWN_WRITE_4(mac, BWN_MACCTL,
3744                             BWN_READ_4(mac, BWN_MACCTL)
3745                             & ~BWN_MACCTL_ON);
3746                 BWN_READ_4(mac, BWN_MACCTL);
3747                 for (i = 35; i; i--) {
3748                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3749                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3750                                 goto out;
3751                         DELAY(10);
3752                 }
3753                 for (i = 40; i; i--) {
3754                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3755                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3756                                 goto out;
3757                         DELAY(1000);
3758                 }
3759                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3760         }
3761 out:
3762         mac->mac_suspended++;
3763 }
3764
3765 void
3766 bwn_mac_enable(struct bwn_mac *mac)
3767 {
3768         struct bwn_softc *sc = mac->mac_sc;
3769         uint16_t state;
3770
3771         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3772             __func__, mac->mac_suspended);
3773
3774         state = bwn_shm_read_2(mac, BWN_SHARED,
3775             BWN_SHARED_UCODESTAT);
3776         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3777             state != BWN_SHARED_UCODESTAT_SLEEP) {
3778                 DPRINTF(sc, BWN_DEBUG_FW,
3779                     "%s: warn: firmware state (%d)\n",
3780                     __func__, state);
3781         }
3782
3783         mac->mac_suspended--;
3784         KASSERT(mac->mac_suspended >= 0,
3785             ("%s:%d: fail", __func__, __LINE__));
3786         if (mac->mac_suspended == 0) {
3787                 BWN_WRITE_4(mac, BWN_MACCTL,
3788                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3789                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3790                 BWN_READ_4(mac, BWN_MACCTL);
3791                 BWN_READ_4(mac, BWN_INTR_REASON);
3792                 bwn_psctl(mac, 0);
3793         }
3794 }
3795
3796 void
3797 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3798 {
3799         struct bwn_softc *sc = mac->mac_sc;
3800         int i;
3801         uint16_t ucstat;
3802
3803         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3804             ("%s:%d: fail", __func__, __LINE__));
3805         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3806             ("%s:%d: fail", __func__, __LINE__));
3807
3808         /* XXX forcibly awake and hwps-off */
3809
3810         BWN_WRITE_4(mac, BWN_MACCTL,
3811             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3812             ~BWN_MACCTL_HWPS);
3813         BWN_READ_4(mac, BWN_MACCTL);
3814         if (siba_get_revid(sc->sc_dev) >= 5) {
3815                 for (i = 0; i < 100; i++) {
3816                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3817                             BWN_SHARED_UCODESTAT);
3818                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3819                                 break;
3820                         DELAY(10);
3821                 }
3822         }
3823         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3824             ucstat);
3825 }
3826
3827 static int
3828 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3829 {
3830         struct bwn_softc *sc = mac->mac_sc;
3831         struct bwn_fw *fw = &mac->mac_fw;
3832         const uint8_t rev = siba_get_revid(sc->sc_dev);
3833         const char *filename;
3834         uint32_t high;
3835         int error;
3836
3837         /* microcode */
3838         filename = NULL;
3839         switch (rev) {
3840         case 42:
3841                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3842                         filename = "ucode42";
3843                 break;
3844         case 40:
3845                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3846                         filename = "ucode40";
3847                 break;
3848         case 33:
3849                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3850                         filename = "ucode33_lcn40";
3851                 break;
3852         case 30:
3853                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3854                         filename = "ucode30_mimo";
3855                 break;
3856         case 29:
3857                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3858                         filename = "ucode29_mimo";
3859                 break;
3860         case 26:
3861                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3862                         filename = "ucode26_mimo";
3863                 break;
3864         case 28:
3865         case 25:
3866                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3867                         filename = "ucode25_mimo";
3868                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3869                         filename = "ucode25_lcn";
3870                 break;
3871         case 24:
3872                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3873                         filename = "ucode24_lcn";
3874                 break;
3875         case 23:
3876                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3877                         filename = "ucode16_mimo";
3878                 break;
3879         case 16:
3880         case 17:
3881         case 18:
3882         case 19:
3883                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
3884                         filename = "ucode16_mimo";
3885                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3886                         filename = "ucode16_lp";
3887                 break;
3888         case 15:
3889                 filename = "ucode15";
3890                 break;
3891         case 14:
3892                 filename = "ucode14";
3893                 break;
3894         case 13:
3895                 filename = "ucode13";
3896                 break;
3897         case 12:
3898         case 11:
3899                 filename = "ucode11";
3900                 break;
3901         case 10:
3902         case 9:
3903         case 8:
3904         case 7:
3905         case 6:
3906         case 5:
3907                 filename = "ucode5";
3908                 break;
3909         default:
3910                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3911                 bwn_release_firmware(mac);
3912                 return (EOPNOTSUPP);
3913         }
3914
3915         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3916         error = bwn_fw_get(mac, type, filename, &fw->ucode);
3917         if (error) {
3918                 bwn_release_firmware(mac);
3919                 return (error);
3920         }
3921
3922         /* PCM */
3923         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3924         if (rev >= 5 && rev <= 10) {
3925                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3926                 if (error == ENOENT)
3927                         fw->no_pcmfile = 1;
3928                 else if (error) {
3929                         bwn_release_firmware(mac);
3930                         return (error);
3931                 }
3932         } else if (rev < 11) {
3933                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3934                 return (EOPNOTSUPP);
3935         }
3936
3937         /* initvals */
3938         high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3939         switch (mac->mac_phy.type) {
3940         case BWN_PHYTYPE_A:
3941                 if (rev < 5 || rev > 10)
3942                         goto fail1;
3943                 if (high & BWN_TGSHIGH_HAVE_2GHZ)
3944                         filename = "a0g1initvals5";
3945                 else
3946                         filename = "a0g0initvals5";
3947                 break;
3948         case BWN_PHYTYPE_G:
3949                 if (rev >= 5 && rev <= 10)
3950                         filename = "b0g0initvals5";
3951                 else if (rev >= 13)
3952                         filename = "b0g0initvals13";
3953                 else
3954                         goto fail1;
3955                 break;
3956         case BWN_PHYTYPE_LP:
3957                 if (rev == 13)
3958                         filename = "lp0initvals13";
3959                 else if (rev == 14)
3960                         filename = "lp0initvals14";
3961                 else if (rev >= 15)
3962                         filename = "lp0initvals15";
3963                 else
3964                         goto fail1;
3965                 break;
3966         case BWN_PHYTYPE_N:
3967                 if (rev == 30)
3968                         filename = "n16initvals30";
3969                 else if (rev == 28 || rev == 25)
3970                         filename = "n0initvals25";
3971                 else if (rev == 24)
3972                         filename = "n0initvals24";
3973                 else if (rev == 23)
3974                         filename = "n0initvals16";
3975                 else if (rev >= 16 && rev <= 18)
3976                         filename = "n0initvals16";
3977                 else if (rev >= 11 && rev <= 12)
3978                         filename = "n0initvals11";
3979                 else
3980                         goto fail1;
3981                 break;
3982         default:
3983                 goto fail1;
3984         }
3985         error = bwn_fw_get(mac, type, filename, &fw->initvals);
3986         if (error) {
3987                 bwn_release_firmware(mac);
3988                 return (error);
3989         }
3990
3991         /* bandswitch initvals */
3992         switch (mac->mac_phy.type) {
3993         case BWN_PHYTYPE_A:
3994                 if (rev >= 5 && rev <= 10) {
3995                         if (high & BWN_TGSHIGH_HAVE_2GHZ)
3996                                 filename = "a0g1bsinitvals5";
3997                         else
3998                                 filename = "a0g0bsinitvals5";
3999                 } else if (rev >= 11)
4000                         filename = NULL;
4001                 else
4002                         goto fail1;
4003                 break;
4004         case BWN_PHYTYPE_G:
4005                 if (rev >= 5 && rev <= 10)
4006                         filename = "b0g0bsinitvals5";
4007                 else if (rev >= 11)
4008                         filename = NULL;
4009                 else
4010                         goto fail1;
4011                 break;
4012         case BWN_PHYTYPE_LP:
4013                 if (rev == 13)
4014                         filename = "lp0bsinitvals13";
4015                 else if (rev == 14)
4016                         filename = "lp0bsinitvals14";
4017                 else if (rev >= 15)
4018                         filename = "lp0bsinitvals15";
4019                 else
4020                         goto fail1;
4021                 break;
4022         case BWN_PHYTYPE_N:
4023                 if (rev == 30)
4024                         filename = "n16bsinitvals30";
4025                 else if (rev == 28 || rev == 25)
4026                         filename = "n0bsinitvals25";
4027                 else if (rev == 24)
4028                         filename = "n0bsinitvals24";
4029                 else if (rev == 23)
4030                         filename = "n0bsinitvals16";
4031                 else if (rev >= 16 && rev <= 18)
4032                         filename = "n0bsinitvals16";
4033                 else if (rev >= 11 && rev <= 12)
4034                         filename = "n0bsinitvals11";
4035                 else
4036                         goto fail1;
4037                 break;
4038         default:
4039                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
4040                     mac->mac_phy.type);
4041                 goto fail1;
4042         }
4043         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4044         if (error) {
4045                 bwn_release_firmware(mac);
4046                 return (error);
4047         }
4048         return (0);
4049 fail1:
4050         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4051             rev, mac->mac_phy.type);
4052         bwn_release_firmware(mac);
4053         return (EOPNOTSUPP);
4054 }
4055
4056 static int
4057 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4058     const char *name, struct bwn_fwfile *bfw)
4059 {
4060         const struct bwn_fwhdr *hdr;
4061         struct bwn_softc *sc = mac->mac_sc;
4062         const struct firmware *fw;
4063         char namebuf[64];
4064
4065         if (name == NULL) {
4066                 bwn_do_release_fw(bfw);
4067                 return (0);
4068         }
4069         if (bfw->filename != NULL) {
4070                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4071                         return (0);
4072                 bwn_do_release_fw(bfw);
4073         }
4074
4075         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4076             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4077             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4078         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
4079         fw = firmware_get(namebuf);
4080         if (fw == NULL) {
4081                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4082                     namebuf);
4083                 return (ENOENT);
4084         }
4085         if (fw->datasize < sizeof(struct bwn_fwhdr))
4086                 goto fail;
4087         hdr = (const struct bwn_fwhdr *)(fw->data);
4088         switch (hdr->type) {
4089         case BWN_FWTYPE_UCODE:
4090         case BWN_FWTYPE_PCM:
4091                 if (be32toh(hdr->size) !=
4092                     (fw->datasize - sizeof(struct bwn_fwhdr)))
4093                         goto fail;
4094                 /* FALLTHROUGH */
4095         case BWN_FWTYPE_IV:
4096                 if (hdr->ver != 1)
4097                         goto fail;
4098                 break;
4099         default:
4100                 goto fail;
4101         }
4102         bfw->filename = name;
4103         bfw->fw = fw;
4104         bfw->type = type;
4105         return (0);
4106 fail:
4107         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4108         if (fw != NULL)
4109                 firmware_put(fw, FIRMWARE_UNLOAD);
4110         return (EPROTO);
4111 }
4112
4113 static void
4114 bwn_release_firmware(struct bwn_mac *mac)
4115 {
4116
4117         bwn_do_release_fw(&mac->mac_fw.ucode);
4118         bwn_do_release_fw(&mac->mac_fw.pcm);
4119         bwn_do_release_fw(&mac->mac_fw.initvals);
4120         bwn_do_release_fw(&mac->mac_fw.initvals_band);
4121 }
4122
4123 static void
4124 bwn_do_release_fw(struct bwn_fwfile *bfw)
4125 {
4126
4127         if (bfw->fw != NULL)
4128                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4129         bfw->fw = NULL;
4130         bfw->filename = NULL;
4131 }
4132
4133 static int
4134 bwn_fw_loaducode(struct bwn_mac *mac)
4135 {
4136 #define GETFWOFFSET(fwp, offset)        \
4137         ((const uint32_t *)((const char *)fwp.fw->data + offset))
4138 #define GETFWSIZE(fwp, offset)  \
4139         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
4140         struct bwn_softc *sc = mac->mac_sc;
4141         const uint32_t *data;
4142         unsigned int i;
4143         uint32_t ctl;
4144         uint16_t date, fwcaps, time;
4145         int error = 0;
4146
4147         ctl = BWN_READ_4(mac, BWN_MACCTL);
4148         ctl |= BWN_MACCTL_MCODE_JMP0;
4149         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4150             __LINE__));
4151         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4152         for (i = 0; i < 64; i++)
4153                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4154         for (i = 0; i < 4096; i += 2)
4155                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4156
4157         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4158         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4159         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4160              i++) {
4161                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4162                 DELAY(10);
4163         }
4164
4165         if (mac->mac_fw.pcm.fw) {
4166                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4167                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4168                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4169                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4170                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4171                     sizeof(struct bwn_fwhdr)); i++) {
4172                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4173                         DELAY(10);
4174                 }
4175         }
4176
4177         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4178         BWN_WRITE_4(mac, BWN_MACCTL,
4179             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4180             BWN_MACCTL_MCODE_RUN);
4181
4182         for (i = 0; i < 21; i++) {
4183                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4184                         break;
4185                 if (i >= 20) {
4186                         device_printf(sc->sc_dev, "ucode timeout\n");
4187                         error = ENXIO;
4188                         goto error;
4189                 }
4190                 DELAY(50000);
4191         }
4192         BWN_READ_4(mac, BWN_INTR_REASON);
4193
4194         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4195         if (mac->mac_fw.rev <= 0x128) {
4196                 device_printf(sc->sc_dev, "the firmware is too old\n");
4197                 error = EOPNOTSUPP;
4198                 goto error;
4199         }
4200
4201         /*
4202          * Determine firmware header version; needed for TX/RX packet
4203          * handling.
4204          */
4205         if (mac->mac_fw.rev >= 598)
4206                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4207         else if (mac->mac_fw.rev >= 410)
4208                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4209         else
4210                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4211
4212         /*
4213          * We don't support rev 598 or later; that requires
4214          * another round of changes to the TX/RX descriptor
4215          * and status layout.
4216          *
4217          * So, complain this is the case and exit out, rather
4218          * than attaching and then failing.
4219          */
4220 #if 0
4221         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4222                 device_printf(sc->sc_dev,
4223                     "firmware is too new (>=598); not supported\n");
4224                 error = EOPNOTSUPP;
4225                 goto error;
4226         }
4227 #endif
4228
4229         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4230             BWN_SHARED_UCODE_PATCH);
4231         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4232         mac->mac_fw.opensource = (date == 0xffff);
4233         if (bwn_wme != 0)
4234                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4235         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4236
4237         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4238         if (mac->mac_fw.opensource == 0) {
4239                 device_printf(sc->sc_dev,
4240                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4241                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4242                 if (mac->mac_fw.no_pcmfile)
4243                         device_printf(sc->sc_dev,
4244                             "no HW crypto acceleration due to pcm5\n");
4245         } else {
4246                 mac->mac_fw.patch = time;
4247                 fwcaps = bwn_fwcaps_read(mac);
4248                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4249                         device_printf(sc->sc_dev,
4250                             "disabling HW crypto acceleration\n");
4251                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4252                 }
4253                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4254                         device_printf(sc->sc_dev, "disabling WME support\n");
4255                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4256                 }
4257         }
4258
4259         if (BWN_ISOLDFMT(mac))
4260                 device_printf(sc->sc_dev, "using old firmware image\n");
4261
4262         return (0);
4263
4264 error:
4265         BWN_WRITE_4(mac, BWN_MACCTL,
4266             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4267             BWN_MACCTL_MCODE_JMP0);
4268
4269         return (error);
4270 #undef GETFWSIZE
4271 #undef GETFWOFFSET
4272 }
4273
4274 /* OpenFirmware only */
4275 static uint16_t
4276 bwn_fwcaps_read(struct bwn_mac *mac)
4277 {
4278
4279         KASSERT(mac->mac_fw.opensource == 1,
4280             ("%s:%d: fail", __func__, __LINE__));
4281         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4282 }
4283
4284 static int
4285 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4286     size_t count, size_t array_size)
4287 {
4288 #define GET_NEXTIV16(iv)                                                \
4289         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4290             sizeof(uint16_t) + sizeof(uint16_t)))
4291 #define GET_NEXTIV32(iv)                                                \
4292         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4293             sizeof(uint16_t) + sizeof(uint32_t)))
4294         struct bwn_softc *sc = mac->mac_sc;
4295         const struct bwn_fwinitvals *iv;
4296         uint16_t offset;
4297         size_t i;
4298         uint8_t bit32;
4299
4300         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4301             ("%s:%d: fail", __func__, __LINE__));
4302         iv = ivals;
4303         for (i = 0; i < count; i++) {
4304                 if (array_size < sizeof(iv->offset_size))
4305                         goto fail;
4306                 array_size -= sizeof(iv->offset_size);
4307                 offset = be16toh(iv->offset_size);
4308                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4309                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4310                 if (offset >= 0x1000)
4311                         goto fail;
4312                 if (bit32) {
4313                         if (array_size < sizeof(iv->data.d32))
4314                                 goto fail;
4315                         array_size -= sizeof(iv->data.d32);
4316                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4317                         iv = GET_NEXTIV32(iv);
4318                 } else {
4319
4320                         if (array_size < sizeof(iv->data.d16))
4321                                 goto fail;
4322                         array_size -= sizeof(iv->data.d16);
4323                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4324
4325                         iv = GET_NEXTIV16(iv);
4326                 }
4327         }
4328         if (array_size != 0)
4329                 goto fail;
4330         return (0);
4331 fail:
4332         device_printf(sc->sc_dev, "initvals: invalid format\n");
4333         return (EPROTO);
4334 #undef GET_NEXTIV16
4335 #undef GET_NEXTIV32
4336 }
4337
4338 int
4339 bwn_switch_channel(struct bwn_mac *mac, int chan)
4340 {
4341         struct bwn_phy *phy = &(mac->mac_phy);
4342         struct bwn_softc *sc = mac->mac_sc;
4343         struct ieee80211com *ic = &sc->sc_ic;
4344         uint16_t channelcookie, savedcookie;
4345         int error;
4346
4347         if (chan == 0xffff)
4348                 chan = phy->get_default_chan(mac);
4349
4350         channelcookie = chan;
4351         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4352                 channelcookie |= 0x100;
4353         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4354         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4355         error = phy->switch_channel(mac, chan);
4356         if (error)
4357                 goto fail;
4358
4359         mac->mac_phy.chan = chan;
4360         DELAY(8000);
4361         return (0);
4362 fail:
4363         device_printf(sc->sc_dev, "failed to switch channel\n");
4364         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4365         return (error);
4366 }
4367
4368 static uint16_t
4369 bwn_ant2phy(int antenna)
4370 {
4371
4372         switch (antenna) {
4373         case BWN_ANT0:
4374                 return (BWN_TX_PHY_ANT0);
4375         case BWN_ANT1:
4376                 return (BWN_TX_PHY_ANT1);
4377         case BWN_ANT2:
4378                 return (BWN_TX_PHY_ANT2);
4379         case BWN_ANT3:
4380                 return (BWN_TX_PHY_ANT3);
4381         case BWN_ANTAUTO:
4382                 return (BWN_TX_PHY_ANT01AUTO);
4383         }
4384         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4385         return (0);
4386 }
4387
4388 static void
4389 bwn_wme_load(struct bwn_mac *mac)
4390 {
4391         struct bwn_softc *sc = mac->mac_sc;
4392         int i;
4393
4394         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4395             ("%s:%d: fail", __func__, __LINE__));
4396
4397         bwn_mac_suspend(mac);
4398         for (i = 0; i < N(sc->sc_wmeParams); i++)
4399                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4400                     bwn_wme_shm_offsets[i]);
4401         bwn_mac_enable(mac);
4402 }
4403
4404 static void
4405 bwn_wme_loadparams(struct bwn_mac *mac,
4406     const struct wmeParams *p, uint16_t shm_offset)
4407 {
4408 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4409         struct bwn_softc *sc = mac->mac_sc;
4410         uint16_t params[BWN_NR_WMEPARAMS];
4411         int slot, tmp;
4412         unsigned int i;
4413
4414         slot = BWN_READ_2(mac, BWN_RNG) &
4415             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4416
4417         memset(&params, 0, sizeof(params));
4418
4419         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4420             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4421             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4422
4423         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4424         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4425         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4426         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4427         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4428         params[BWN_WMEPARAM_BSLOTS] = slot;
4429         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4430
4431         for (i = 0; i < N(params); i++) {
4432                 if (i == BWN_WMEPARAM_STATUS) {
4433                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4434                             shm_offset + (i * 2));
4435                         tmp |= 0x100;
4436                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4437                             tmp);
4438                 } else {
4439                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4440                             params[i]);
4441                 }
4442         }
4443 }
4444
4445 static void
4446 bwn_mac_write_bssid(struct bwn_mac *mac)
4447 {
4448         struct bwn_softc *sc = mac->mac_sc;
4449         uint32_t tmp;
4450         int i;
4451         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4452
4453         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4454         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4455         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4456             IEEE80211_ADDR_LEN);
4457
4458         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4459                 tmp = (uint32_t) (mac_bssid[i + 0]);
4460                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4461                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4462                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4463                 bwn_ram_write(mac, 0x20 + i, tmp);
4464         }
4465 }
4466
4467 static void
4468 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4469     const uint8_t *macaddr)
4470 {
4471         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4472         uint16_t data;
4473
4474         if (!mac)
4475                 macaddr = zero;
4476
4477         offset |= 0x0020;
4478         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4479
4480         data = macaddr[0];
4481         data |= macaddr[1] << 8;
4482         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4483         data = macaddr[2];
4484         data |= macaddr[3] << 8;
4485         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4486         data = macaddr[4];
4487         data |= macaddr[5] << 8;
4488         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4489 }
4490
4491 static void
4492 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4493     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4494 {
4495         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4496         uint8_t per_sta_keys_start = 8;
4497
4498         if (BWN_SEC_NEWAPI(mac))
4499                 per_sta_keys_start = 4;
4500
4501         KASSERT(index < mac->mac_max_nr_keys,
4502             ("%s:%d: fail", __func__, __LINE__));
4503         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4504             ("%s:%d: fail", __func__, __LINE__));
4505
4506         if (index >= per_sta_keys_start)
4507                 bwn_key_macwrite(mac, index, NULL);
4508         if (key)
4509                 memcpy(buf, key, key_len);
4510         bwn_key_write(mac, index, algorithm, buf);
4511         if (index >= per_sta_keys_start)
4512                 bwn_key_macwrite(mac, index, mac_addr);
4513
4514         mac->mac_key[index].algorithm = algorithm;
4515 }
4516
4517 static void
4518 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4519 {
4520         struct bwn_softc *sc = mac->mac_sc;
4521         uint32_t addrtmp[2] = { 0, 0 };
4522         uint8_t start = 8;
4523
4524         if (BWN_SEC_NEWAPI(mac))
4525                 start = 4;
4526
4527         KASSERT(index >= start,
4528             ("%s:%d: fail", __func__, __LINE__));
4529         index -= start;
4530
4531         if (addr) {
4532                 addrtmp[0] = addr[0];
4533                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4534                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4535                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4536                 addrtmp[1] = addr[4];
4537                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4538         }
4539
4540         if (siba_get_revid(sc->sc_dev) >= 5) {
4541                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4542                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4543         } else {
4544                 if (index >= 8) {
4545                         bwn_shm_write_4(mac, BWN_SHARED,
4546                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4547                         bwn_shm_write_2(mac, BWN_SHARED,
4548                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4549                 }
4550         }
4551 }
4552
4553 static void
4554 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4555     const uint8_t *key)
4556 {
4557         unsigned int i;
4558         uint32_t offset;
4559         uint16_t kidx, value;
4560
4561         kidx = BWN_SEC_KEY2FW(mac, index);
4562         bwn_shm_write_2(mac, BWN_SHARED,
4563             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4564
4565         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4566         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4567                 value = key[i];
4568                 value |= (uint16_t)(key[i + 1]) << 8;
4569                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4570         }
4571 }
4572
4573 static void
4574 bwn_phy_exit(struct bwn_mac *mac)
4575 {
4576
4577         mac->mac_phy.rf_onoff(mac, 0);
4578         if (mac->mac_phy.exit != NULL)
4579                 mac->mac_phy.exit(mac);
4580 }
4581
4582 static void
4583 bwn_dma_free(struct bwn_mac *mac)
4584 {
4585         struct bwn_dma *dma;
4586
4587         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4588                 return;
4589         dma = &mac->mac_method.dma;
4590
4591         bwn_dma_ringfree(&dma->rx);
4592         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4593         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4594         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4595         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4596         bwn_dma_ringfree(&dma->mcast);
4597 }
4598
4599 static void
4600 bwn_core_stop(struct bwn_mac *mac)
4601 {
4602         struct bwn_softc *sc = mac->mac_sc;
4603
4604         BWN_ASSERT_LOCKED(sc);
4605
4606         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4607                 return;
4608
4609         callout_stop(&sc->sc_rfswitch_ch);
4610         callout_stop(&sc->sc_task_ch);
4611         callout_stop(&sc->sc_watchdog_ch);
4612         sc->sc_watchdog_timer = 0;
4613         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4614         BWN_READ_4(mac, BWN_INTR_MASK);
4615         bwn_mac_suspend(mac);
4616
4617         mac->mac_status = BWN_MAC_STATUS_INITED;
4618 }
4619
4620 static int
4621 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4622 {
4623         struct bwn_mac *up_dev = NULL;
4624         struct bwn_mac *down_dev;
4625         struct bwn_mac *mac;
4626         int err, status;
4627         uint8_t gmode;
4628
4629         BWN_ASSERT_LOCKED(sc);
4630
4631         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4632                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4633                     mac->mac_phy.supports_2ghz) {
4634                         up_dev = mac;
4635                         gmode = 1;
4636                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4637                     mac->mac_phy.supports_5ghz) {
4638                         up_dev = mac;
4639                         gmode = 0;
4640                 } else {
4641                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4642                         return (EINVAL);
4643                 }
4644                 if (up_dev != NULL)
4645                         break;
4646         }
4647         if (up_dev == NULL) {
4648                 device_printf(sc->sc_dev, "Could not find a device\n");
4649                 return (ENODEV);
4650         }
4651         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4652                 return (0);
4653
4654         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4655             "switching to %s-GHz band\n",
4656             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4657
4658         down_dev = sc->sc_curmac;
4659         status = down_dev->mac_status;
4660         if (status >= BWN_MAC_STATUS_STARTED)
4661                 bwn_core_stop(down_dev);
4662         if (status >= BWN_MAC_STATUS_INITED)
4663                 bwn_core_exit(down_dev);
4664
4665         if (down_dev != up_dev)
4666                 bwn_phy_reset(down_dev);
4667
4668         up_dev->mac_phy.gmode = gmode;
4669         if (status >= BWN_MAC_STATUS_INITED) {
4670                 err = bwn_core_init(up_dev);
4671                 if (err) {
4672                         device_printf(sc->sc_dev,
4673                             "fatal: failed to initialize for %s-GHz\n",
4674                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4675                         goto fail;
4676                 }
4677         }
4678         if (status >= BWN_MAC_STATUS_STARTED)
4679                 bwn_core_start(up_dev);
4680         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4681         sc->sc_curmac = up_dev;
4682
4683         return (0);
4684 fail:
4685         sc->sc_curmac = NULL;
4686         return (err);
4687 }
4688
4689 static void
4690 bwn_rf_turnon(struct bwn_mac *mac)
4691 {
4692
4693         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4694
4695         bwn_mac_suspend(mac);
4696         mac->mac_phy.rf_onoff(mac, 1);
4697         mac->mac_phy.rf_on = 1;
4698         bwn_mac_enable(mac);
4699 }
4700
4701 static void
4702 bwn_rf_turnoff(struct bwn_mac *mac)
4703 {
4704
4705         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4706
4707         bwn_mac_suspend(mac);
4708         mac->mac_phy.rf_onoff(mac, 0);
4709         mac->mac_phy.rf_on = 0;
4710         bwn_mac_enable(mac);
4711 }
4712
4713 /*
4714  * SSB PHY reset.
4715  */
4716 static void
4717 bwn_phy_reset_siba(struct bwn_mac *mac)
4718 {
4719         struct bwn_softc *sc = mac->mac_sc;
4720
4721         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4722             ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4723              BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4724         DELAY(1000);
4725         siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4726             (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4727         DELAY(1000);
4728 }
4729
4730 static void
4731 bwn_phy_reset(struct bwn_mac *mac)
4732 {
4733
4734         if (bwn_is_bus_siba(mac)) {
4735                 bwn_phy_reset_siba(mac);
4736         } else {
4737                 BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4738         }
4739 }
4740
4741 static int
4742 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4743 {
4744         struct bwn_vap *bvp = BWN_VAP(vap);
4745         struct ieee80211com *ic= vap->iv_ic;
4746         enum ieee80211_state ostate = vap->iv_state;
4747         struct bwn_softc *sc = ic->ic_softc;
4748         struct bwn_mac *mac = sc->sc_curmac;
4749         int error;
4750
4751         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4752             ieee80211_state_name[vap->iv_state],
4753             ieee80211_state_name[nstate]);
4754
4755         error = bvp->bv_newstate(vap, nstate, arg);
4756         if (error != 0)
4757                 return (error);
4758
4759         BWN_LOCK(sc);
4760
4761         bwn_led_newstate(mac, nstate);
4762
4763         /*
4764          * Clear the BSSID when we stop a STA
4765          */
4766         if (vap->iv_opmode == IEEE80211_M_STA) {
4767                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4768                         /*
4769                          * Clear out the BSSID.  If we reassociate to
4770                          * the same AP, this will reinialize things
4771                          * correctly...
4772                          */
4773                         if (ic->ic_opmode == IEEE80211_M_STA &&
4774                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4775                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4776                                 bwn_set_macaddr(mac);
4777                         }
4778                 }
4779         }
4780
4781         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4782             vap->iv_opmode == IEEE80211_M_AHDEMO) {
4783                 /* XXX nothing to do? */
4784         } else if (nstate == IEEE80211_S_RUN) {
4785                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4786                 bwn_set_opmode(mac);
4787                 bwn_set_pretbtt(mac);
4788                 bwn_spu_setdelay(mac, 0);
4789                 bwn_set_macaddr(mac);
4790         }
4791
4792         BWN_UNLOCK(sc);
4793
4794         return (error);
4795 }
4796
4797 static void
4798 bwn_set_pretbtt(struct bwn_mac *mac)
4799 {
4800         struct bwn_softc *sc = mac->mac_sc;
4801         struct ieee80211com *ic = &sc->sc_ic;
4802         uint16_t pretbtt;
4803
4804         if (ic->ic_opmode == IEEE80211_M_IBSS)
4805                 pretbtt = 2;
4806         else
4807                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4808         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4809         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4810 }
4811
4812 static int
4813 bwn_intr(void *arg)
4814 {
4815         struct bwn_mac *mac = arg;
4816         struct bwn_softc *sc = mac->mac_sc;
4817         uint32_t reason;
4818
4819         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4820             (sc->sc_flags & BWN_FLAG_INVALID))
4821                 return (FILTER_STRAY);
4822
4823         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4824
4825         reason = BWN_READ_4(mac, BWN_INTR_REASON);
4826         if (reason == 0xffffffff)       /* shared IRQ */
4827                 return (FILTER_STRAY);
4828         reason &= mac->mac_intr_mask;
4829         if (reason == 0)
4830                 return (FILTER_HANDLED);
4831         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4832
4833         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4834         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4835         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4836         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4837         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4838         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4839         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4840         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4841         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4842         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4843         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4844
4845         /* Disable interrupts. */
4846         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4847
4848         mac->mac_reason_intr = reason;
4849
4850         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4851         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4852
4853         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4854         return (FILTER_HANDLED);
4855 }
4856
4857 static void
4858 bwn_intrtask(void *arg, int npending)
4859 {
4860         struct bwn_mac *mac = arg;
4861         struct bwn_softc *sc = mac->mac_sc;
4862         uint32_t merged = 0;
4863         int i, tx = 0, rx = 0;
4864
4865         BWN_LOCK(sc);
4866         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4867             (sc->sc_flags & BWN_FLAG_INVALID)) {
4868                 BWN_UNLOCK(sc);
4869                 return;
4870         }
4871
4872         for (i = 0; i < N(mac->mac_reason); i++)
4873                 merged |= mac->mac_reason[i];
4874
4875         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4876                 device_printf(sc->sc_dev, "MAC trans error\n");
4877
4878         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4879                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4880                 mac->mac_phy.txerrors--;
4881                 if (mac->mac_phy.txerrors == 0) {
4882                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4883                         bwn_restart(mac, "PHY TX errors");
4884                 }
4885         }
4886
4887         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4888                 if (merged & BWN_DMAINTR_FATALMASK) {
4889                         device_printf(sc->sc_dev,
4890                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4891                             mac->mac_reason[0], mac->mac_reason[1],
4892                             mac->mac_reason[2], mac->mac_reason[3],
4893                             mac->mac_reason[4], mac->mac_reason[5]);
4894                         bwn_restart(mac, "DMA error");
4895                         BWN_UNLOCK(sc);
4896                         return;
4897                 }
4898                 if (merged & BWN_DMAINTR_NONFATALMASK) {
4899                         device_printf(sc->sc_dev,
4900                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
4901                             mac->mac_reason[0], mac->mac_reason[1],
4902                             mac->mac_reason[2], mac->mac_reason[3],
4903                             mac->mac_reason[4], mac->mac_reason[5]);
4904                 }
4905         }
4906
4907         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4908                 bwn_intr_ucode_debug(mac);
4909         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4910                 bwn_intr_tbtt_indication(mac);
4911         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4912                 bwn_intr_atim_end(mac);
4913         if (mac->mac_reason_intr & BWN_INTR_BEACON)
4914                 bwn_intr_beacon(mac);
4915         if (mac->mac_reason_intr & BWN_INTR_PMQ)
4916                 bwn_intr_pmq(mac);
4917         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4918                 bwn_intr_noise(mac);
4919
4920         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4921                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4922                         bwn_dma_rx(mac->mac_method.dma.rx);
4923                         rx = 1;
4924                 }
4925         } else
4926                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4927
4928         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4929         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4930         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4931         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4932         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4933
4934         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4935                 bwn_intr_txeof(mac);
4936                 tx = 1;
4937         }
4938
4939         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4940
4941         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4942                 int evt = BWN_LED_EVENT_NONE;
4943
4944                 if (tx && rx) {
4945                         if (sc->sc_rx_rate > sc->sc_tx_rate)
4946                                 evt = BWN_LED_EVENT_RX;
4947                         else
4948                                 evt = BWN_LED_EVENT_TX;
4949                 } else if (tx) {
4950                         evt = BWN_LED_EVENT_TX;
4951                 } else if (rx) {
4952                         evt = BWN_LED_EVENT_RX;
4953                 } else if (rx == 0) {
4954                         evt = BWN_LED_EVENT_POLL;
4955                 }
4956
4957                 if (evt != BWN_LED_EVENT_NONE)
4958                         bwn_led_event(mac, evt);
4959        }
4960
4961         if (mbufq_first(&sc->sc_snd) != NULL)
4962                 bwn_start(sc);
4963
4964         BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4965         BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4966
4967         BWN_UNLOCK(sc);
4968 }
4969
4970 static void
4971 bwn_restart(struct bwn_mac *mac, const char *msg)
4972 {
4973         struct bwn_softc *sc = mac->mac_sc;
4974         struct ieee80211com *ic = &sc->sc_ic;
4975
4976         if (mac->mac_status < BWN_MAC_STATUS_INITED)
4977                 return;
4978
4979         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4980         ieee80211_runtask(ic, &mac->mac_hwreset);
4981 }
4982
4983 static void
4984 bwn_intr_ucode_debug(struct bwn_mac *mac)
4985 {
4986         struct bwn_softc *sc = mac->mac_sc;
4987         uint16_t reason;
4988
4989         if (mac->mac_fw.opensource == 0)
4990                 return;
4991
4992         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4993         switch (reason) {
4994         case BWN_DEBUGINTR_PANIC:
4995                 bwn_handle_fwpanic(mac);
4996                 break;
4997         case BWN_DEBUGINTR_DUMP_SHM:
4998                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4999                 break;
5000         case BWN_DEBUGINTR_DUMP_REGS:
5001                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5002                 break;
5003         case BWN_DEBUGINTR_MARKER:
5004                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5005                 break;
5006         default:
5007                 device_printf(sc->sc_dev,
5008                     "ucode debug unknown reason: %#x\n", reason);
5009         }
5010
5011         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5012             BWN_DEBUGINTR_ACK);
5013 }
5014
5015 static void
5016 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5017 {
5018         struct bwn_softc *sc = mac->mac_sc;
5019         struct ieee80211com *ic = &sc->sc_ic;
5020
5021         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5022                 bwn_psctl(mac, 0);
5023         if (ic->ic_opmode == IEEE80211_M_IBSS)
5024                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5025 }
5026
5027 static void
5028 bwn_intr_atim_end(struct bwn_mac *mac)
5029 {
5030
5031         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5032                 BWN_WRITE_4(mac, BWN_MACCMD,
5033                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5034                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5035         }
5036 }
5037
5038 static void
5039 bwn_intr_beacon(struct bwn_mac *mac)
5040 {
5041         struct bwn_softc *sc = mac->mac_sc;
5042         struct ieee80211com *ic = &sc->sc_ic;
5043         uint32_t cmd, beacon0, beacon1;
5044
5045         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5046             ic->ic_opmode == IEEE80211_M_MBSS)
5047                 return;
5048
5049         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5050
5051         cmd = BWN_READ_4(mac, BWN_MACCMD);
5052         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5053         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5054
5055         if (beacon0 && beacon1) {
5056                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5057                 mac->mac_intr_mask |= BWN_INTR_BEACON;
5058                 return;
5059         }
5060
5061         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5062                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5063                 bwn_load_beacon0(mac);
5064                 bwn_load_beacon1(mac);
5065                 cmd = BWN_READ_4(mac, BWN_MACCMD);
5066                 cmd |= BWN_MACCMD_BEACON0_VALID;
5067                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5068         } else {
5069                 if (!beacon0) {
5070                         bwn_load_beacon0(mac);
5071                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5072                         cmd |= BWN_MACCMD_BEACON0_VALID;
5073                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5074                 } else if (!beacon1) {
5075                         bwn_load_beacon1(mac);
5076                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5077                         cmd |= BWN_MACCMD_BEACON1_VALID;
5078                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5079                 }
5080         }
5081 }
5082
5083 static void
5084 bwn_intr_pmq(struct bwn_mac *mac)
5085 {
5086         uint32_t tmp;
5087
5088         while (1) {
5089                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5090                 if (!(tmp & 0x00000008))
5091                         break;
5092         }
5093         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5094 }
5095
5096 static void
5097 bwn_intr_noise(struct bwn_mac *mac)
5098 {
5099         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5100         uint16_t tmp;
5101         uint8_t noise[4];
5102         uint8_t i, j;
5103         int32_t average;
5104
5105         if (mac->mac_phy.type != BWN_PHYTYPE_G)
5106                 return;
5107
5108         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5109         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5110         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5111             noise[3] == 0x7f)
5112                 goto new;
5113
5114         KASSERT(mac->mac_noise.noi_nsamples < 8,
5115             ("%s:%d: fail", __func__, __LINE__));
5116         i = mac->mac_noise.noi_nsamples;
5117         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5118         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5119         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5120         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5121         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5122         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5123         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5124         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5125         mac->mac_noise.noi_nsamples++;
5126         if (mac->mac_noise.noi_nsamples == 8) {
5127                 average = 0;
5128                 for (i = 0; i < 8; i++) {
5129                         for (j = 0; j < 4; j++)
5130                                 average += mac->mac_noise.noi_samples[i][j];
5131                 }
5132                 average = (((average / 32) * 125) + 64) / 128;
5133                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5134                 if (tmp >= 8)
5135                         average += 2;
5136                 else
5137                         average -= 25;
5138                 average -= (tmp == 8) ? 72 : 48;
5139
5140                 mac->mac_stats.link_noise = average;
5141                 mac->mac_noise.noi_running = 0;
5142                 return;
5143         }
5144 new:
5145         bwn_noise_gensample(mac);
5146 }
5147
5148 static int
5149 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5150 {
5151         struct bwn_mac *mac = prq->prq_mac;
5152         struct bwn_softc *sc = mac->mac_sc;
5153         unsigned int i;
5154
5155         BWN_ASSERT_LOCKED(sc);
5156
5157         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5158                 return (0);
5159
5160         for (i = 0; i < 5000; i++) {
5161                 if (bwn_pio_rxeof(prq) == 0)
5162                         break;
5163         }
5164         if (i >= 5000)
5165                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5166         return ((i > 0) ? 1 : 0);
5167 }
5168
5169 static void
5170 bwn_dma_rx(struct bwn_dma_ring *dr)
5171 {
5172         int slot, curslot;
5173
5174         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5175         curslot = dr->get_curslot(dr);
5176         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5177             ("%s:%d: fail", __func__, __LINE__));
5178
5179         slot = dr->dr_curslot;
5180         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5181                 bwn_dma_rxeof(dr, &slot);
5182
5183         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5184             BUS_DMASYNC_PREWRITE);
5185
5186         dr->set_curslot(dr, slot);
5187         dr->dr_curslot = slot;
5188 }
5189
5190 static void
5191 bwn_intr_txeof(struct bwn_mac *mac)
5192 {
5193         struct bwn_txstatus stat;
5194         uint32_t stat0, stat1;
5195         uint16_t tmp;
5196
5197         BWN_ASSERT_LOCKED(mac->mac_sc);
5198
5199         while (1) {
5200                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5201                 if (!(stat0 & 0x00000001))
5202                         break;
5203                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5204
5205                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5206                     "%s: stat0=0x%08x, stat1=0x%08x\n",
5207                     __func__,
5208                     stat0,
5209                     stat1);
5210
5211                 stat.cookie = (stat0 >> 16);
5212                 stat.seq = (stat1 & 0x0000ffff);
5213                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5214                 tmp = (stat0 & 0x0000ffff);
5215                 stat.framecnt = ((tmp & 0xf000) >> 12);
5216                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
5217                 stat.sreason = ((tmp & 0x001c) >> 2);
5218                 stat.pm = (tmp & 0x0080) ? 1 : 0;
5219                 stat.im = (tmp & 0x0040) ? 1 : 0;
5220                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5221                 stat.ack = (tmp & 0x0002) ? 1 : 0;
5222
5223                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5224                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5225                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5226                     __func__,
5227                     stat.cookie,
5228                     stat.seq,
5229                     stat.phy_stat,
5230                     stat.framecnt,
5231                     stat.rtscnt,
5232                     stat.sreason,
5233                     stat.pm,
5234                     stat.im,
5235                     stat.ampdu,
5236                     stat.ack);
5237
5238                 bwn_handle_txeof(mac, &stat);
5239         }
5240 }
5241
5242 static void
5243 bwn_hwreset(void *arg, int npending)
5244 {
5245         struct bwn_mac *mac = arg;
5246         struct bwn_softc *sc = mac->mac_sc;
5247         int error = 0;
5248         int prev_status;
5249
5250         BWN_LOCK(sc);
5251
5252         prev_status = mac->mac_status;
5253         if (prev_status >= BWN_MAC_STATUS_STARTED)
5254                 bwn_core_stop(mac);
5255         if (prev_status >= BWN_MAC_STATUS_INITED)
5256                 bwn_core_exit(mac);
5257
5258         if (prev_status >= BWN_MAC_STATUS_INITED) {
5259                 error = bwn_core_init(mac);
5260                 if (error)
5261                         goto out;
5262         }
5263         if (prev_status >= BWN_MAC_STATUS_STARTED)
5264                 bwn_core_start(mac);
5265 out:
5266         if (error) {
5267                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5268                 sc->sc_curmac = NULL;
5269         }
5270         BWN_UNLOCK(sc);
5271 }
5272
5273 static void
5274 bwn_handle_fwpanic(struct bwn_mac *mac)
5275 {
5276         struct bwn_softc *sc = mac->mac_sc;
5277         uint16_t reason;
5278
5279         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5280         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5281
5282         if (reason == BWN_FWPANIC_RESTART)
5283                 bwn_restart(mac, "ucode panic");
5284 }
5285
5286 static void
5287 bwn_load_beacon0(struct bwn_mac *mac)
5288 {
5289
5290         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5291 }
5292
5293 static void
5294 bwn_load_beacon1(struct bwn_mac *mac)
5295 {
5296
5297         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5298 }
5299
5300 static uint32_t
5301 bwn_jssi_read(struct bwn_mac *mac)
5302 {
5303         uint32_t val = 0;
5304
5305         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5306         val <<= 16;
5307         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5308
5309         return (val);
5310 }
5311
5312 static void
5313 bwn_noise_gensample(struct bwn_mac *mac)
5314 {
5315         uint32_t jssi = 0x7f7f7f7f;
5316
5317         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5318         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5319         BWN_WRITE_4(mac, BWN_MACCMD,
5320             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5321 }
5322
5323 static int
5324 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5325 {
5326         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5327
5328         return (dr->dr_numslots - dr->dr_usedslot);
5329 }
5330
5331 static int
5332 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5333 {
5334         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5335
5336         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5337             ("%s:%d: fail", __func__, __LINE__));
5338         if (slot == dr->dr_numslots - 1)
5339                 return (0);
5340         return (slot + 1);
5341 }
5342
5343 static void
5344 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5345 {
5346         struct bwn_mac *mac = dr->dr_mac;
5347         struct bwn_softc *sc = mac->mac_sc;
5348         struct bwn_dma *dma = &mac->mac_method.dma;
5349         struct bwn_dmadesc_generic *desc;
5350         struct bwn_dmadesc_meta *meta;
5351         struct bwn_rxhdr4 *rxhdr;
5352         struct mbuf *m;
5353         uint32_t macstat;
5354         int32_t tmp;
5355         int cnt = 0;
5356         uint16_t len;
5357
5358         dr->getdesc(dr, *slot, &desc, &meta);
5359
5360         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5361         m = meta->mt_m;
5362
5363         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5364                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5365                 return;
5366         }
5367
5368         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5369         len = le16toh(rxhdr->frame_len);
5370         if (len <= 0) {
5371                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5372                 return;
5373         }
5374         if (bwn_dma_check_redzone(dr, m)) {
5375                 device_printf(sc->sc_dev, "redzone error.\n");
5376                 bwn_dma_set_redzone(dr, m);
5377                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5378                     BUS_DMASYNC_PREWRITE);
5379                 return;
5380         }
5381         if (len > dr->dr_rx_bufsize) {
5382                 tmp = len;
5383                 while (1) {
5384                         dr->getdesc(dr, *slot, &desc, &meta);
5385                         bwn_dma_set_redzone(dr, meta->mt_m);
5386                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5387                             BUS_DMASYNC_PREWRITE);
5388                         *slot = bwn_dma_nextslot(dr, *slot);
5389                         cnt++;
5390                         tmp -= dr->dr_rx_bufsize;
5391                         if (tmp <= 0)
5392                                 break;
5393                 }
5394                 device_printf(sc->sc_dev, "too small buffer "
5395                        "(len %u buffer %u dropped %d)\n",
5396                        len, dr->dr_rx_bufsize, cnt);
5397                 return;
5398         }
5399
5400         switch (mac->mac_fw.fw_hdr_format) {
5401         case BWN_FW_HDR_351:
5402         case BWN_FW_HDR_410:
5403                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5404                 break;
5405         case BWN_FW_HDR_598:
5406                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5407                 break;
5408         }
5409
5410         if (macstat & BWN_RX_MAC_FCSERR) {
5411                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5412                         device_printf(sc->sc_dev, "RX drop\n");
5413                         return;
5414                 }
5415         }
5416
5417         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5418         m_adj(m, dr->dr_frameoffset);
5419
5420         bwn_rxeof(dr->dr_mac, m, rxhdr);
5421 }
5422
5423 static void
5424 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5425 {
5426         struct bwn_softc *sc = mac->mac_sc;
5427         struct bwn_stats *stats = &mac->mac_stats;
5428
5429         BWN_ASSERT_LOCKED(mac->mac_sc);
5430
5431         if (status->im)
5432                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5433         if (status->ampdu)
5434                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5435         if (status->rtscnt) {
5436                 if (status->rtscnt == 0xf)
5437                         stats->rtsfail++;
5438                 else
5439                         stats->rts++;
5440         }
5441
5442         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5443                 bwn_dma_handle_txeof(mac, status);
5444         } else {
5445                 bwn_pio_handle_txeof(mac, status);
5446         }
5447
5448         bwn_phy_txpower_check(mac, 0);
5449 }
5450
5451 static uint8_t
5452 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5453 {
5454         struct bwn_mac *mac = prq->prq_mac;
5455         struct bwn_softc *sc = mac->mac_sc;
5456         struct bwn_rxhdr4 rxhdr;
5457         struct mbuf *m;
5458         uint32_t ctl32, macstat, v32;
5459         unsigned int i, padding;
5460         uint16_t ctl16, len, totlen, v16;
5461         unsigned char *mp;
5462         char *data;
5463
5464         memset(&rxhdr, 0, sizeof(rxhdr));
5465
5466         if (prq->prq_rev >= 8) {
5467                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5468                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5469                         return (0);
5470                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5471                     BWN_PIO8_RXCTL_FRAMEREADY);
5472                 for (i = 0; i < 10; i++) {
5473                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5474                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5475                                 goto ready;
5476                         DELAY(10);
5477                 }
5478         } else {
5479                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5480                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5481                         return (0);
5482                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5483                     BWN_PIO_RXCTL_FRAMEREADY);
5484                 for (i = 0; i < 10; i++) {
5485                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5486                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5487                                 goto ready;
5488                         DELAY(10);
5489                 }
5490         }
5491         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5492         return (1);
5493 ready:
5494         if (prq->prq_rev >= 8)
5495                 siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5496                     prq->prq_base + BWN_PIO8_RXDATA);
5497         else
5498                 siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5499                     prq->prq_base + BWN_PIO_RXDATA);
5500         len = le16toh(rxhdr.frame_len);
5501         if (len > 0x700) {
5502                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5503                 goto error;
5504         }
5505         if (len == 0) {
5506                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5507                 goto error;
5508         }
5509
5510         switch (mac->mac_fw.fw_hdr_format) {
5511         case BWN_FW_HDR_351:
5512         case BWN_FW_HDR_410:
5513                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
5514                 break;
5515         case BWN_FW_HDR_598:
5516                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
5517                 break;
5518         }
5519
5520         if (macstat & BWN_RX_MAC_FCSERR) {
5521                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5522                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5523                         goto error;
5524                 }
5525         }
5526
5527         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5528         totlen = len + padding;
5529         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5530         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5531         if (m == NULL) {
5532                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5533                 goto error;
5534         }
5535         mp = mtod(m, unsigned char *);
5536         if (prq->prq_rev >= 8) {
5537                 siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5538                     prq->prq_base + BWN_PIO8_RXDATA);
5539                 if (totlen & 3) {
5540                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5541                         data = &(mp[totlen - 1]);
5542                         switch (totlen & 3) {
5543                         case 3:
5544                                 *data = (v32 >> 16);
5545                                 data--;
5546                         case 2:
5547                                 *data = (v32 >> 8);
5548                                 data--;
5549                         case 1:
5550                                 *data = v32;
5551                         }
5552                 }
5553         } else {
5554                 siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5555                     prq->prq_base + BWN_PIO_RXDATA);
5556                 if (totlen & 1) {
5557                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5558                         mp[totlen - 1] = v16;
5559                 }
5560         }
5561
5562         m->m_len = m->m_pkthdr.len = totlen;
5563
5564         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5565
5566         return (1);
5567 error:
5568         if (prq->prq_rev >= 8)
5569                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5570                     BWN_PIO8_RXCTL_DATAREADY);
5571         else
5572                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5573         return (1);
5574 }
5575
5576 static int
5577 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5578     struct bwn_dmadesc_meta *meta, int init)
5579 {
5580         struct bwn_mac *mac = dr->dr_mac;
5581         struct bwn_dma *dma = &mac->mac_method.dma;
5582         struct bwn_rxhdr4 *hdr;
5583         bus_dmamap_t map;
5584         bus_addr_t paddr;
5585         struct mbuf *m;
5586         int error;
5587
5588         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5589         if (m == NULL) {
5590                 error = ENOBUFS;
5591
5592                 /*
5593                  * If the NIC is up and running, we need to:
5594                  * - Clear RX buffer's header.
5595                  * - Restore RX descriptor settings.
5596                  */
5597                 if (init)
5598                         return (error);
5599                 else
5600                         goto back;
5601         }
5602         m->m_len = m->m_pkthdr.len = MCLBYTES;
5603
5604         bwn_dma_set_redzone(dr, m);
5605
5606         /*
5607          * Try to load RX buf into temporary DMA map
5608          */
5609         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5610             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5611         if (error) {
5612                 m_freem(m);
5613
5614                 /*
5615                  * See the comment above
5616                  */
5617                 if (init)
5618                         return (error);
5619                 else
5620                         goto back;
5621         }
5622
5623         if (!init)
5624                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5625         meta->mt_m = m;
5626         meta->mt_paddr = paddr;
5627
5628         /*
5629          * Swap RX buf's DMA map with the loaded temporary one
5630          */
5631         map = meta->mt_dmap;
5632         meta->mt_dmap = dr->dr_spare_dmap;
5633         dr->dr_spare_dmap = map;
5634
5635 back:
5636         /*
5637          * Clear RX buf header
5638          */
5639         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5640         bzero(hdr, sizeof(*hdr));
5641         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5642             BUS_DMASYNC_PREWRITE);
5643
5644         /*
5645          * Setup RX buf descriptor
5646          */
5647         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5648             sizeof(*hdr), 0, 0, 0);
5649         return (error);
5650 }
5651
5652 static void
5653 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5654                  bus_size_t mapsz __unused, int error)
5655 {
5656
5657         if (!error) {
5658                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5659                 *((bus_addr_t *)arg) = seg->ds_addr;
5660         }
5661 }
5662
5663 static int
5664 bwn_hwrate2ieeerate(int rate)
5665 {
5666
5667         switch (rate) {
5668         case BWN_CCK_RATE_1MB:
5669                 return (2);
5670         case BWN_CCK_RATE_2MB:
5671                 return (4);
5672         case BWN_CCK_RATE_5MB:
5673                 return (11);
5674         case BWN_CCK_RATE_11MB:
5675                 return (22);
5676         case BWN_OFDM_RATE_6MB:
5677                 return (12);
5678         case BWN_OFDM_RATE_9MB:
5679                 return (18);
5680         case BWN_OFDM_RATE_12MB:
5681                 return (24);
5682         case BWN_OFDM_RATE_18MB:
5683                 return (36);
5684         case BWN_OFDM_RATE_24MB:
5685                 return (48);
5686         case BWN_OFDM_RATE_36MB:
5687                 return (72);
5688         case BWN_OFDM_RATE_48MB:
5689                 return (96);
5690         case BWN_OFDM_RATE_54MB:
5691                 return (108);
5692         default:
5693                 printf("Ooops\n");
5694                 return (0);
5695         }
5696 }
5697
5698 /*
5699  * Post process the RX provided RSSI.
5700  *
5701  * Valid for A, B, G, LP PHYs.
5702  */
5703 static int8_t
5704 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5705     int ofdm, int adjust_2053, int adjust_2050)
5706 {
5707         struct bwn_phy *phy = &mac->mac_phy;
5708         struct bwn_phy_g *gphy = &phy->phy_g;
5709         int tmp;
5710
5711         switch (phy->rf_ver) {
5712         case 0x2050:
5713                 if (ofdm) {
5714                         tmp = in_rssi;
5715                         if (tmp > 127)
5716                                 tmp -= 256;
5717                         tmp = tmp * 73 / 64;
5718                         if (adjust_2050)
5719                                 tmp += 25;
5720                         else
5721                                 tmp -= 3;
5722                 } else {
5723                         if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5724                             & BWN_BFL_RSSI) {
5725                                 if (in_rssi > 63)
5726                                         in_rssi = 63;
5727                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5728                                 tmp = (31 - tmp) * -131 / 128 - 57;
5729                         } else {
5730                                 tmp = in_rssi;
5731                                 tmp = (31 - tmp) * -149 / 128 - 68;
5732                         }
5733                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5734                                 tmp += 25;
5735                 }
5736                 break;
5737         case 0x2060:
5738                 if (in_rssi > 127)
5739                         tmp = in_rssi - 256;
5740                 else
5741                         tmp = in_rssi;
5742                 break;
5743         default:
5744                 tmp = in_rssi;
5745                 tmp = (tmp - 11) * 103 / 64;
5746                 if (adjust_2053)
5747                         tmp -= 109;
5748                 else
5749                         tmp -= 83;
5750         }
5751
5752         return (tmp);
5753 }
5754
5755 static void
5756 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5757 {
5758         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5759         struct bwn_plcp6 *plcp;
5760         struct bwn_softc *sc = mac->mac_sc;
5761         struct ieee80211_frame_min *wh;
5762         struct ieee80211_node *ni;
5763         struct ieee80211com *ic = &sc->sc_ic;
5764         uint32_t macstat;
5765         int padding, rate, rssi = 0, noise = 0, type;
5766         uint16_t phytype, phystat0, phystat3, chanstat;
5767         unsigned char *mp = mtod(m, unsigned char *);
5768         static int rx_mac_dec_rpt = 0;
5769
5770         BWN_ASSERT_LOCKED(sc);
5771
5772         phystat0 = le16toh(rxhdr->phy_status0);
5773
5774         /*
5775          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5776          * used for LP-PHY.
5777          */
5778         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5779
5780         switch (mac->mac_fw.fw_hdr_format) {
5781         case BWN_FW_HDR_351:
5782         case BWN_FW_HDR_410:
5783                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5784                 chanstat = le16toh(rxhdr->ps4.r351.channel);
5785                 break;
5786         case BWN_FW_HDR_598:
5787                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5788                 chanstat = le16toh(rxhdr->ps4.r598.channel);
5789                 break;
5790         }
5791
5792
5793         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5794
5795         if (macstat & BWN_RX_MAC_FCSERR)
5796                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5797         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5798                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5799         if (macstat & BWN_RX_MAC_DECERR)
5800                 goto drop;
5801
5802         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5803         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5804                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5805                     m->m_pkthdr.len);
5806                 goto drop;
5807         }
5808         plcp = (struct bwn_plcp6 *)(mp + padding);
5809         m_adj(m, sizeof(struct bwn_plcp6) + padding);
5810         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5811                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5812                     m->m_pkthdr.len);
5813                 goto drop;
5814         }
5815         wh = mtod(m, struct ieee80211_frame_min *);
5816
5817         if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5818                 device_printf(sc->sc_dev,
5819                     "RX decryption attempted (old %d keyidx %#x)\n",
5820                     BWN_ISOLDFMT(mac),
5821                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5822
5823         if (phystat0 & BWN_RX_PHYST0_OFDM)
5824                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
5825                     phytype == BWN_PHYTYPE_A);
5826         else
5827                 rate = bwn_plcp_get_cckrate(mac, plcp);
5828         if (rate == -1) {
5829                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5830                         goto drop;
5831         }
5832         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5833
5834         /* rssi/noise */
5835         switch (phytype) {
5836         case BWN_PHYTYPE_A:
5837         case BWN_PHYTYPE_B:
5838         case BWN_PHYTYPE_G:
5839         case BWN_PHYTYPE_LP:
5840                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5841                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
5842                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5843                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5844                 break;
5845         case BWN_PHYTYPE_N:
5846                 /* Broadcom has code for min/avg, but always used max */
5847                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5848                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5849                 else
5850                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5851 #if 0
5852                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5853                     "%s: power0=%d, power1=%d, power2=%d\n",
5854                     __func__,
5855                     rxhdr->phy.n.power0,
5856                     rxhdr->phy.n.power1,
5857                     rxhdr->ps2.n.power2);
5858 #endif
5859                 break;
5860         default:
5861                 /* XXX TODO: implement rssi for other PHYs */
5862                 break;
5863         }
5864
5865         /*
5866          * RSSI here is absolute, not relative to the noise floor.
5867          */
5868         noise = mac->mac_stats.link_noise;
5869         rssi = rssi - noise;
5870
5871         /* RX radio tap */
5872         if (ieee80211_radiotap_active(ic))
5873                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5874         m_adj(m, -IEEE80211_CRC_LEN);
5875
5876         BWN_UNLOCK(sc);
5877
5878         ni = ieee80211_find_rxnode(ic, wh);
5879         if (ni != NULL) {
5880                 type = ieee80211_input(ni, m, rssi, noise);
5881                 ieee80211_free_node(ni);
5882         } else
5883                 type = ieee80211_input_all(ic, m, rssi, noise);
5884
5885         BWN_LOCK(sc);
5886         return;
5887 drop:
5888         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5889 }
5890
5891 static void
5892 bwn_dma_handle_txeof(struct bwn_mac *mac,
5893     const struct bwn_txstatus *status)
5894 {
5895         struct bwn_dma *dma = &mac->mac_method.dma;
5896         struct bwn_dma_ring *dr;
5897         struct bwn_dmadesc_generic *desc;
5898         struct bwn_dmadesc_meta *meta;
5899         struct bwn_softc *sc = mac->mac_sc;
5900         int slot;
5901         int retrycnt = 0;
5902
5903         BWN_ASSERT_LOCKED(sc);
5904
5905         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5906         if (dr == NULL) {
5907                 device_printf(sc->sc_dev, "failed to parse cookie\n");
5908                 return;
5909         }
5910         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5911
5912         while (1) {
5913                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
5914                     ("%s:%d: fail", __func__, __LINE__));
5915                 dr->getdesc(dr, slot, &desc, &meta);
5916
5917                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5918                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5919                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5920                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5921
5922                 if (meta->mt_islast) {
5923                         KASSERT(meta->mt_m != NULL,
5924                             ("%s:%d: fail", __func__, __LINE__));
5925
5926                         /*
5927                          * If we don't get an ACK, then we should log the
5928                          * full framecnt.  That may be 0 if it's a PHY
5929                          * failure, so ensure that gets logged as some
5930                          * retry attempt.
5931                          */
5932                         if (status->ack) {
5933                                 retrycnt = status->framecnt - 1;
5934                         } else {
5935                                 retrycnt = status->framecnt;
5936                                 if (retrycnt == 0)
5937                                         retrycnt = 1;
5938                         }
5939                         ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5940                             status->ack ?
5941                               IEEE80211_RATECTL_TX_SUCCESS :
5942                               IEEE80211_RATECTL_TX_FAILURE,
5943                             &retrycnt, 0);
5944                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5945                         meta->mt_ni = NULL;
5946                         meta->mt_m = NULL;
5947                 } else
5948                         KASSERT(meta->mt_m == NULL,
5949                             ("%s:%d: fail", __func__, __LINE__));
5950
5951                 dr->dr_usedslot--;
5952                 if (meta->mt_islast)
5953                         break;
5954                 slot = bwn_dma_nextslot(dr, slot);
5955         }
5956         sc->sc_watchdog_timer = 0;
5957         if (dr->dr_stop) {
5958                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5959                     ("%s:%d: fail", __func__, __LINE__));
5960                 dr->dr_stop = 0;
5961         }
5962 }
5963
5964 static void
5965 bwn_pio_handle_txeof(struct bwn_mac *mac,
5966     const struct bwn_txstatus *status)
5967 {
5968         struct bwn_pio_txqueue *tq;
5969         struct bwn_pio_txpkt *tp = NULL;
5970         struct bwn_softc *sc = mac->mac_sc;
5971         int retrycnt = 0;
5972
5973         BWN_ASSERT_LOCKED(sc);
5974
5975         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5976         if (tq == NULL)
5977                 return;
5978
5979         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5980         tq->tq_free++;
5981
5982         if (tp->tp_ni != NULL) {
5983                 /*
5984                  * Do any tx complete callback.  Note this must
5985                  * be done before releasing the node reference.
5986                  */
5987
5988                 /*
5989                  * If we don't get an ACK, then we should log the
5990                  * full framecnt.  That may be 0 if it's a PHY
5991                  * failure, so ensure that gets logged as some
5992                  * retry attempt.
5993                  */
5994                 if (status->ack) {
5995                         retrycnt = status->framecnt - 1;
5996                 } else {
5997                         retrycnt = status->framecnt;
5998                         if (retrycnt == 0)
5999                                 retrycnt = 1;
6000                 }
6001                 ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6002                     status->ack ?
6003                       IEEE80211_RATECTL_TX_SUCCESS :
6004                       IEEE80211_RATECTL_TX_FAILURE,
6005                     &retrycnt, 0);
6006
6007                 if (tp->tp_m->m_flags & M_TXCB)
6008                         ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6009                 ieee80211_free_node(tp->tp_ni);
6010                 tp->tp_ni = NULL;
6011         }
6012         m_freem(tp->tp_m);
6013         tp->tp_m = NULL;
6014         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6015
6016         sc->sc_watchdog_timer = 0;
6017 }
6018
6019 static void
6020 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6021 {
6022         struct bwn_softc *sc = mac->mac_sc;
6023         struct bwn_phy *phy = &mac->mac_phy;
6024         struct ieee80211com *ic = &sc->sc_ic;
6025         unsigned long now;
6026         bwn_txpwr_result_t result;
6027
6028         BWN_GETTIME(now);
6029
6030         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6031                 return;
6032         phy->nexttime = now + 2 * 1000;
6033
6034         if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6035             siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6036                 return;
6037
6038         if (phy->recalc_txpwr != NULL) {
6039                 result = phy->recalc_txpwr(mac,
6040                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6041                 if (result == BWN_TXPWR_RES_DONE)
6042                         return;
6043                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6044                     ("%s: fail", __func__));
6045                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6046
6047                 ieee80211_runtask(ic, &mac->mac_txpower);
6048         }
6049 }
6050
6051 static uint16_t
6052 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6053 {
6054
6055         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6056 }
6057
6058 static uint32_t
6059 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6060 {
6061
6062         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6063 }
6064
6065 static void
6066 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6067 {
6068
6069         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6070 }
6071
6072 static void
6073 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6074 {
6075
6076         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6077 }
6078
6079 static int
6080 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6081 {
6082
6083         switch (rate) {
6084         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6085         case 12:
6086                 return (BWN_OFDM_RATE_6MB);
6087         case 18:
6088                 return (BWN_OFDM_RATE_9MB);
6089         case 24:
6090                 return (BWN_OFDM_RATE_12MB);
6091         case 36:
6092                 return (BWN_OFDM_RATE_18MB);
6093         case 48:
6094                 return (BWN_OFDM_RATE_24MB);
6095         case 72:
6096                 return (BWN_OFDM_RATE_36MB);
6097         case 96:
6098                 return (BWN_OFDM_RATE_48MB);
6099         case 108:
6100                 return (BWN_OFDM_RATE_54MB);
6101         /* CCK rates (NB: not IEEE std, device-specific) */
6102         case 2:
6103                 return (BWN_CCK_RATE_1MB);
6104         case 4:
6105                 return (BWN_CCK_RATE_2MB);
6106         case 11:
6107                 return (BWN_CCK_RATE_5MB);
6108         case 22:
6109                 return (BWN_CCK_RATE_11MB);
6110         }
6111
6112         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6113         return (BWN_CCK_RATE_1MB);
6114 }
6115
6116 static uint16_t
6117 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6118 {
6119         struct bwn_phy *phy = &mac->mac_phy;
6120         uint16_t control = 0;
6121         uint16_t bw;
6122
6123         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6124         bw = BWN_TXH_PHY1_BW_20;
6125
6126         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6127                 control = bw;
6128         } else {
6129                 control = bw;
6130                 /* Figure out coding rate and modulation */
6131                 /* XXX TODO: table-ize, for MCS transmit */
6132                 /* Note: this is BWN_*_RATE values */
6133                 switch (bitrate) {
6134                 case BWN_CCK_RATE_1MB:
6135                         control |= 0;
6136                         break;
6137                 case BWN_CCK_RATE_2MB:
6138                         control |= 1;
6139                         break;
6140                 case BWN_CCK_RATE_5MB:
6141                         control |= 2;
6142                         break;
6143                 case BWN_CCK_RATE_11MB:
6144                         control |= 3;
6145                         break;
6146                 case BWN_OFDM_RATE_6MB:
6147                         control |= BWN_TXH_PHY1_CRATE_1_2;
6148                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6149                         break;
6150                 case BWN_OFDM_RATE_9MB:
6151                         control |= BWN_TXH_PHY1_CRATE_3_4;
6152                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6153                         break;
6154                 case BWN_OFDM_RATE_12MB:
6155                         control |= BWN_TXH_PHY1_CRATE_1_2;
6156                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6157                         break;
6158                 case BWN_OFDM_RATE_18MB:
6159                         control |= BWN_TXH_PHY1_CRATE_3_4;
6160                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6161                         break;
6162                 case BWN_OFDM_RATE_24MB:
6163                         control |= BWN_TXH_PHY1_CRATE_1_2;
6164                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6165                         break;
6166                 case BWN_OFDM_RATE_36MB:
6167                         control |= BWN_TXH_PHY1_CRATE_3_4;
6168                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6169                         break;
6170                 case BWN_OFDM_RATE_48MB:
6171                         control |= BWN_TXH_PHY1_CRATE_1_2;
6172                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6173                         break;
6174                 case BWN_OFDM_RATE_54MB:
6175                         control |= BWN_TXH_PHY1_CRATE_3_4;
6176                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6177                         break;
6178                 default:
6179                         break;
6180                 }
6181                 control |= BWN_TXH_PHY1_MODE_SISO;
6182         }
6183
6184         return control;
6185 }
6186
6187 static int
6188 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6189     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6190 {
6191         const struct bwn_phy *phy = &mac->mac_phy;
6192         struct bwn_softc *sc = mac->mac_sc;
6193         struct ieee80211_frame *wh;
6194         struct ieee80211_frame *protwh;
6195         struct ieee80211_frame_cts *cts;
6196         struct ieee80211_frame_rts *rts;
6197         const struct ieee80211_txparam *tp;
6198         struct ieee80211vap *vap = ni->ni_vap;
6199         struct ieee80211com *ic = &sc->sc_ic;
6200         struct mbuf *mprot;
6201         unsigned int len;
6202         uint32_t macctl = 0;
6203         int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6204         uint16_t phyctl = 0;
6205         uint8_t rate, rate_fb;
6206         int fill_phy_ctl1 = 0;
6207
6208         wh = mtod(m, struct ieee80211_frame *);
6209         memset(txhdr, 0, sizeof(*txhdr));
6210
6211         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6212         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6213         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6214
6215         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6216             || (phy->type == BWN_PHYTYPE_HT))
6217                 fill_phy_ctl1 = 1;
6218
6219         /*
6220          * Find TX rate
6221          */
6222         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6223         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6224                 rate = rate_fb = tp->mgmtrate;
6225         else if (ismcast)
6226                 rate = rate_fb = tp->mcastrate;
6227         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6228                 rate = rate_fb = tp->ucastrate;
6229         else {
6230                 /* XXX TODO: don't fall back to CCK rates for OFDM */
6231                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
6232                 rate = ni->ni_txrate;
6233
6234                 if (rix > 0)
6235                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6236                             IEEE80211_RATE_VAL;
6237                 else
6238                         rate_fb = rate;
6239         }
6240
6241         sc->sc_tx_rate = rate;
6242
6243         /* Note: this maps the select ieee80211 rate to hardware rate */
6244         rate = bwn_ieeerate2hwrate(sc, rate);
6245         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6246
6247         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6248             bwn_plcp_getcck(rate);
6249         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6250         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6251
6252         /* XXX rate/rate_fb is the hardware rate */
6253         if ((rate_fb == rate) ||
6254             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6255             (*(u_int16_t *)wh->i_dur == htole16(0)))
6256                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6257         else
6258                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6259                     m->m_pkthdr.len, rate, isshort);
6260
6261         /* XXX TX encryption */
6262
6263         switch (mac->mac_fw.fw_hdr_format) {
6264         case BWN_FW_HDR_351:
6265                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6266                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6267                 break;
6268         case BWN_FW_HDR_410:
6269                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6270                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6271                 break;
6272         case BWN_FW_HDR_598:
6273                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6274                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6275                 break;
6276         }
6277
6278         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6279             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6280
6281         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6282             BWN_TX_EFT_FB_CCK;
6283         txhdr->chan = phy->chan;
6284         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6285             BWN_TX_PHY_ENC_CCK;
6286         /* XXX preamble? obey net80211 */
6287         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6288              rate == BWN_CCK_RATE_11MB))
6289                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
6290
6291         if (! phy->gmode)
6292                 macctl |= BWN_TX_MAC_5GHZ;
6293
6294         /* XXX TX antenna selection */
6295
6296         switch (bwn_antenna_sanitize(mac, 0)) {
6297         case 0:
6298                 phyctl |= BWN_TX_PHY_ANT01AUTO;
6299                 break;
6300         case 1:
6301                 phyctl |= BWN_TX_PHY_ANT0;
6302                 break;
6303         case 2:
6304                 phyctl |= BWN_TX_PHY_ANT1;
6305                 break;
6306         case 3:
6307                 phyctl |= BWN_TX_PHY_ANT2;
6308                 break;
6309         case 4:
6310                 phyctl |= BWN_TX_PHY_ANT3;
6311                 break;
6312         default:
6313                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6314         }
6315
6316         if (!ismcast)
6317                 macctl |= BWN_TX_MAC_ACK;
6318
6319         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6320         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6321             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6322                 macctl |= BWN_TX_MAC_LONGFRAME;
6323
6324         if (ic->ic_flags & IEEE80211_F_USEPROT) {
6325                 /* XXX RTS rate is always 1MB??? */
6326                 /* XXX TODO: don't fall back to CCK rates for OFDM */
6327                 rts_rate = BWN_CCK_RATE_1MB;
6328                 rts_rate_fb = bwn_get_fbrate(rts_rate);
6329
6330                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
6331                 protdur = ieee80211_compute_duration(ic->ic_rt,
6332                     m->m_pkthdr.len, rate, isshort) +
6333                     + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6334
6335                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6336
6337                         switch (mac->mac_fw.fw_hdr_format) {
6338                         case BWN_FW_HDR_351:
6339                                 cts = (struct ieee80211_frame_cts *)
6340                                     txhdr->body.r351.rts_frame;
6341                                 break;
6342                         case BWN_FW_HDR_410:
6343                                 cts = (struct ieee80211_frame_cts *)
6344                                     txhdr->body.r410.rts_frame;
6345                                 break;
6346                         case BWN_FW_HDR_598:
6347                                 cts = (struct ieee80211_frame_cts *)
6348                                     txhdr->body.r598.rts_frame;
6349                                 break;
6350                         }
6351
6352                         mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6353                             protdur);
6354                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6355                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6356                             mprot->m_pkthdr.len);
6357                         m_freem(mprot);
6358                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6359                         len = sizeof(struct ieee80211_frame_cts);
6360                 } else {
6361                         switch (mac->mac_fw.fw_hdr_format) {
6362                         case BWN_FW_HDR_351:
6363                                 rts = (struct ieee80211_frame_rts *)
6364                                     txhdr->body.r351.rts_frame;
6365                                 break;
6366                         case BWN_FW_HDR_410:
6367                                 rts = (struct ieee80211_frame_rts *)
6368                                     txhdr->body.r410.rts_frame;
6369                                 break;
6370                         case BWN_FW_HDR_598:
6371                                 rts = (struct ieee80211_frame_rts *)
6372                                     txhdr->body.r598.rts_frame;
6373                                 break;
6374                         }
6375
6376                         /* XXX rate/rate_fb is the hardware rate */
6377                         protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6378                             isshort);
6379                         mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6380                             wh->i_addr2, protdur);
6381                         KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6382                         bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6383                             mprot->m_pkthdr.len);
6384                         m_freem(mprot);
6385                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
6386                         len = sizeof(struct ieee80211_frame_rts);
6387                 }
6388                 len += IEEE80211_CRC_LEN;
6389
6390                 switch (mac->mac_fw.fw_hdr_format) {
6391                 case BWN_FW_HDR_351:
6392                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6393                             &txhdr->body.r351.rts_plcp, len, rts_rate);
6394                         break;
6395                 case BWN_FW_HDR_410:
6396                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6397                             &txhdr->body.r410.rts_plcp, len, rts_rate);
6398                         break;
6399                 case BWN_FW_HDR_598:
6400                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6401                             &txhdr->body.r598.rts_plcp, len, rts_rate);
6402                         break;
6403                 }
6404
6405                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6406                     rts_rate_fb);
6407
6408                 switch (mac->mac_fw.fw_hdr_format) {
6409                 case BWN_FW_HDR_351:
6410                         protwh = (struct ieee80211_frame *)
6411                             &txhdr->body.r351.rts_frame;
6412                         break;
6413                 case BWN_FW_HDR_410:
6414                         protwh = (struct ieee80211_frame *)
6415                             &txhdr->body.r410.rts_frame;
6416                         break;
6417                 case BWN_FW_HDR_598:
6418                         protwh = (struct ieee80211_frame *)
6419                             &txhdr->body.r598.rts_frame;
6420                         break;
6421                 }
6422
6423                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6424
6425                 if (BWN_ISOFDMRATE(rts_rate)) {
6426                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6427                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6428                 } else {
6429                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6430                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6431                 }
6432                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6433                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6434
6435                 if (fill_phy_ctl1) {
6436                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6437                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6438                 }
6439         }
6440
6441         if (fill_phy_ctl1) {
6442                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6443                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6444         }
6445
6446         switch (mac->mac_fw.fw_hdr_format) {
6447         case BWN_FW_HDR_351:
6448                 txhdr->body.r351.cookie = htole16(cookie);
6449                 break;
6450         case BWN_FW_HDR_410:
6451                 txhdr->body.r410.cookie = htole16(cookie);
6452                 break;
6453         case BWN_FW_HDR_598:
6454                 txhdr->body.r598.cookie = htole16(cookie);
6455                 break;
6456         }
6457
6458         txhdr->macctl = htole32(macctl);
6459         txhdr->phyctl = htole16(phyctl);
6460
6461         /*
6462          * TX radio tap
6463          */
6464         if (ieee80211_radiotap_active_vap(vap)) {
6465                 sc->sc_tx_th.wt_flags = 0;
6466                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6467                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6468                 if (isshort &&
6469                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6470                      rate == BWN_CCK_RATE_11MB))
6471                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6472                 sc->sc_tx_th.wt_rate = rate;
6473
6474                 ieee80211_radiotap_tx(vap, m);
6475         }
6476
6477         return (0);
6478 }
6479
6480 static void
6481 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6482     const uint8_t rate)
6483 {
6484         uint32_t d, plen;
6485         uint8_t *raw = plcp->o.raw;
6486
6487         if (BWN_ISOFDMRATE(rate)) {
6488                 d = bwn_plcp_getofdm(rate);
6489                 KASSERT(!(octets & 0xf000),
6490                     ("%s:%d: fail", __func__, __LINE__));
6491                 d |= (octets << 5);
6492                 plcp->o.data = htole32(d);
6493         } else {
6494                 plen = octets * 16 / rate;
6495                 if ((octets * 16 % rate) > 0) {
6496                         plen++;
6497                         if ((rate == BWN_CCK_RATE_11MB)
6498                             && ((octets * 8 % 11) < 4)) {
6499                                 raw[1] = 0x84;
6500                         } else
6501                                 raw[1] = 0x04;
6502                 } else
6503                         raw[1] = 0x04;
6504                 plcp->o.data |= htole32(plen << 16);
6505                 raw[0] = bwn_plcp_getcck(rate);
6506         }
6507 }
6508
6509 static uint8_t
6510 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6511 {
6512         struct bwn_softc *sc = mac->mac_sc;
6513         uint8_t mask;
6514
6515         if (n == 0)
6516                 return (0);
6517         if (mac->mac_phy.gmode)
6518                 mask = siba_sprom_get_ant_bg(sc->sc_dev);
6519         else
6520                 mask = siba_sprom_get_ant_a(sc->sc_dev);
6521         if (!(mask & (1 << (n - 1))))
6522                 return (0);
6523         return (n);
6524 }
6525
6526 /*
6527  * Return a fallback rate for the given rate.
6528  *
6529  * Note: Don't fall back from OFDM to CCK.
6530  */
6531 static uint8_t
6532 bwn_get_fbrate(uint8_t bitrate)
6533 {
6534         switch (bitrate) {
6535         /* CCK */
6536         case BWN_CCK_RATE_1MB:
6537                 return (BWN_CCK_RATE_1MB);
6538         case BWN_CCK_RATE_2MB:
6539                 return (BWN_CCK_RATE_1MB);
6540         case BWN_CCK_RATE_5MB:
6541                 return (BWN_CCK_RATE_2MB);
6542         case BWN_CCK_RATE_11MB:
6543                 return (BWN_CCK_RATE_5MB);
6544
6545         /* OFDM */
6546         case BWN_OFDM_RATE_6MB:
6547                 return (BWN_OFDM_RATE_6MB);
6548         case BWN_OFDM_RATE_9MB:
6549                 return (BWN_OFDM_RATE_6MB);
6550         case BWN_OFDM_RATE_12MB:
6551                 return (BWN_OFDM_RATE_9MB);
6552         case BWN_OFDM_RATE_18MB:
6553                 return (BWN_OFDM_RATE_12MB);
6554         case BWN_OFDM_RATE_24MB:
6555                 return (BWN_OFDM_RATE_18MB);
6556         case BWN_OFDM_RATE_36MB:
6557                 return (BWN_OFDM_RATE_24MB);
6558         case BWN_OFDM_RATE_48MB:
6559                 return (BWN_OFDM_RATE_36MB);
6560         case BWN_OFDM_RATE_54MB:
6561                 return (BWN_OFDM_RATE_48MB);
6562         }
6563         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6564         return (0);
6565 }
6566
6567 static uint32_t
6568 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6569     uint32_t ctl, const void *_data, int len)
6570 {
6571         struct bwn_softc *sc = mac->mac_sc;
6572         uint32_t value = 0;
6573         const uint8_t *data = _data;
6574
6575         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6576             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6577         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6578
6579         siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6580             tq->tq_base + BWN_PIO8_TXDATA);
6581         if (len & 3) {
6582                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6583                     BWN_PIO8_TXCTL_24_31);
6584                 data = &(data[len - 1]);
6585                 switch (len & 3) {
6586                 case 3:
6587                         ctl |= BWN_PIO8_TXCTL_16_23;
6588                         value |= (uint32_t)(*data) << 16;
6589                         data--;
6590                 case 2:
6591                         ctl |= BWN_PIO8_TXCTL_8_15;
6592                         value |= (uint32_t)(*data) << 8;
6593                         data--;
6594                 case 1:
6595                         value |= (uint32_t)(*data);
6596                 }
6597                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6598                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6599         }
6600
6601         return (ctl);
6602 }
6603
6604 static void
6605 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6606     uint16_t offset, uint32_t value)
6607 {
6608
6609         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6610 }
6611
6612 static uint16_t
6613 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6614     uint16_t ctl, const void *_data, int len)
6615 {
6616         struct bwn_softc *sc = mac->mac_sc;
6617         const uint8_t *data = _data;
6618
6619         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6620         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6621
6622         siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6623             tq->tq_base + BWN_PIO_TXDATA);
6624         if (len & 1) {
6625                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6626                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6627                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6628         }
6629
6630         return (ctl);
6631 }
6632
6633 static uint16_t
6634 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6635     uint16_t ctl, struct mbuf *m0)
6636 {
6637         int i, j = 0;
6638         uint16_t data = 0;
6639         const uint8_t *buf;
6640         struct mbuf *m = m0;
6641
6642         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6643         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6644
6645         for (; m != NULL; m = m->m_next) {
6646                 buf = mtod(m, const uint8_t *);
6647                 for (i = 0; i < m->m_len; i++) {
6648                         if (!((j++) % 2))
6649                                 data |= buf[i];
6650                         else {
6651                                 data |= (buf[i] << 8);
6652                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6653                                 data = 0;
6654                         }
6655                 }
6656         }
6657         if (m0->m_pkthdr.len % 2) {
6658                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6659                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6660                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6661         }
6662
6663         return (ctl);
6664 }
6665
6666 static void
6667 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6668 {
6669
6670         /* XXX should exit if 5GHz band .. */
6671         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6672                 return;
6673
6674         BWN_WRITE_2(mac, 0x684, 510 + time);
6675         /* Disabled in Linux b43, can adversely effect performance */
6676 #if 0
6677         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6678 #endif
6679 }
6680
6681 static struct bwn_dma_ring *
6682 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6683 {
6684
6685         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6686                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6687
6688         switch (prio) {
6689         case 3:
6690                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6691         case 2:
6692                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6693         case 0:
6694                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6695         case 1:
6696                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6697         }
6698         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6699         return (NULL);
6700 }
6701
6702 static int
6703 bwn_dma_getslot(struct bwn_dma_ring *dr)
6704 {
6705         int slot;
6706
6707         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6708
6709         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6710         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6711         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6712
6713         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6714         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6715         dr->dr_curslot = slot;
6716         dr->dr_usedslot++;
6717
6718         return (slot);
6719 }
6720
6721 static struct bwn_pio_txqueue *
6722 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6723     struct bwn_pio_txpkt **pack)
6724 {
6725         struct bwn_pio *pio = &mac->mac_method.pio;
6726         struct bwn_pio_txqueue *tq = NULL;
6727         unsigned int index;
6728
6729         switch (cookie & 0xf000) {
6730         case 0x1000:
6731                 tq = &pio->wme[WME_AC_BK];
6732                 break;
6733         case 0x2000:
6734                 tq = &pio->wme[WME_AC_BE];
6735                 break;
6736         case 0x3000:
6737                 tq = &pio->wme[WME_AC_VI];
6738                 break;
6739         case 0x4000:
6740                 tq = &pio->wme[WME_AC_VO];
6741                 break;
6742         case 0x5000:
6743                 tq = &pio->mcast;
6744                 break;
6745         }
6746         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6747         if (tq == NULL)
6748                 return (NULL);
6749         index = (cookie & 0x0fff);
6750         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6751         if (index >= N(tq->tq_pkts))
6752                 return (NULL);
6753         *pack = &tq->tq_pkts[index];
6754         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6755         return (tq);
6756 }
6757
6758 static void
6759 bwn_txpwr(void *arg, int npending)
6760 {
6761         struct bwn_mac *mac = arg;
6762         struct bwn_softc *sc = mac->mac_sc;
6763
6764         BWN_LOCK(sc);
6765         if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6766             mac->mac_phy.set_txpwr != NULL)
6767                 mac->mac_phy.set_txpwr(mac);
6768         BWN_UNLOCK(sc);
6769 }
6770
6771 static void
6772 bwn_task_15s(struct bwn_mac *mac)
6773 {
6774         uint16_t reg;
6775
6776         if (mac->mac_fw.opensource) {
6777                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6778                 if (reg) {
6779                         bwn_restart(mac, "fw watchdog");
6780                         return;
6781                 }
6782                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6783         }
6784         if (mac->mac_phy.task_15s)
6785                 mac->mac_phy.task_15s(mac);
6786
6787         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6788 }
6789
6790 static void
6791 bwn_task_30s(struct bwn_mac *mac)
6792 {
6793
6794         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6795                 return;
6796         mac->mac_noise.noi_running = 1;
6797         mac->mac_noise.noi_nsamples = 0;
6798
6799         bwn_noise_gensample(mac);
6800 }
6801
6802 static void
6803 bwn_task_60s(struct bwn_mac *mac)
6804 {
6805
6806         if (mac->mac_phy.task_60s)
6807                 mac->mac_phy.task_60s(mac);
6808         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6809 }
6810
6811 static void
6812 bwn_tasks(void *arg)
6813 {
6814         struct bwn_mac *mac = arg;
6815         struct bwn_softc *sc = mac->mac_sc;
6816
6817         BWN_ASSERT_LOCKED(sc);
6818         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6819                 return;
6820
6821         if (mac->mac_task_state % 4 == 0)
6822                 bwn_task_60s(mac);
6823         if (mac->mac_task_state % 2 == 0)
6824                 bwn_task_30s(mac);
6825         bwn_task_15s(mac);
6826
6827         mac->mac_task_state++;
6828         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6829 }
6830
6831 static int
6832 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6833 {
6834         struct bwn_softc *sc = mac->mac_sc;
6835
6836         KASSERT(a == 0, ("not support APHY\n"));
6837
6838         switch (plcp->o.raw[0] & 0xf) {
6839         case 0xb:
6840                 return (BWN_OFDM_RATE_6MB);
6841         case 0xf:
6842                 return (BWN_OFDM_RATE_9MB);
6843         case 0xa:
6844                 return (BWN_OFDM_RATE_12MB);
6845         case 0xe:
6846                 return (BWN_OFDM_RATE_18MB);
6847         case 0x9:
6848                 return (BWN_OFDM_RATE_24MB);
6849         case 0xd:
6850                 return (BWN_OFDM_RATE_36MB);
6851         case 0x8:
6852                 return (BWN_OFDM_RATE_48MB);
6853         case 0xc:
6854                 return (BWN_OFDM_RATE_54MB);
6855         }
6856         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6857             plcp->o.raw[0] & 0xf);
6858         return (-1);
6859 }
6860
6861 static int
6862 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6863 {
6864         struct bwn_softc *sc = mac->mac_sc;
6865
6866         switch (plcp->o.raw[0]) {
6867         case 0x0a:
6868                 return (BWN_CCK_RATE_1MB);
6869         case 0x14:
6870                 return (BWN_CCK_RATE_2MB);
6871         case 0x37:
6872                 return (BWN_CCK_RATE_5MB);
6873         case 0x6e:
6874                 return (BWN_CCK_RATE_11MB);
6875         }
6876         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6877         return (-1);
6878 }
6879
6880 static void
6881 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6882     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6883     int rssi, int noise)
6884 {
6885         struct bwn_softc *sc = mac->mac_sc;
6886         const struct ieee80211_frame_min *wh;
6887         uint64_t tsf;
6888         uint16_t low_mactime_now;
6889         uint16_t mt;
6890
6891         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6892                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6893
6894         wh = mtod(m, const struct ieee80211_frame_min *);
6895         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6896                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6897
6898         bwn_tsf_read(mac, &tsf);
6899         low_mactime_now = tsf;
6900         tsf = tsf & ~0xffffULL;
6901
6902         switch (mac->mac_fw.fw_hdr_format) {
6903         case BWN_FW_HDR_351:
6904         case BWN_FW_HDR_410:
6905                 mt = le16toh(rxhdr->ps4.r351.mac_time);
6906                 break;
6907         case BWN_FW_HDR_598:
6908                 mt = le16toh(rxhdr->ps4.r598.mac_time);
6909                 break;
6910         }
6911
6912         tsf += mt;
6913         if (low_mactime_now < mt)
6914                 tsf -= 0x10000;
6915
6916         sc->sc_rx_th.wr_tsf = tsf;
6917         sc->sc_rx_th.wr_rate = rate;
6918         sc->sc_rx_th.wr_antsignal = rssi;
6919         sc->sc_rx_th.wr_antnoise = noise;
6920 }
6921
6922 static void
6923 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6924 {
6925         uint32_t low, high;
6926
6927         KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6928             ("%s:%d: fail", __func__, __LINE__));
6929
6930         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6931         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6932         *tsf = high;
6933         *tsf <<= 32;
6934         *tsf |= low;
6935 }
6936
6937 static int
6938 bwn_dma_attach(struct bwn_mac *mac)
6939 {
6940         struct bwn_dma *dma = &mac->mac_method.dma;
6941         struct bwn_softc *sc = mac->mac_sc;
6942         bus_addr_t lowaddr = 0;
6943         int error;
6944
6945         if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6946                 return (0);
6947
6948         KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6949
6950         mac->mac_flags |= BWN_MAC_FLAG_DMA;
6951
6952         dma->dmatype = bwn_dma_gettype(mac);
6953         if (dma->dmatype == BWN_DMA_30BIT)
6954                 lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6955         else if (dma->dmatype == BWN_DMA_32BIT)
6956                 lowaddr = BUS_SPACE_MAXADDR_32BIT;
6957         else
6958                 lowaddr = BUS_SPACE_MAXADDR;
6959
6960         /*
6961          * Create top level DMA tag
6962          */
6963         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), /* parent */
6964                                BWN_ALIGN, 0,            /* alignment, bounds */
6965                                lowaddr,                 /* lowaddr */
6966                                BUS_SPACE_MAXADDR,       /* highaddr */
6967                                NULL, NULL,              /* filter, filterarg */
6968                                BUS_SPACE_MAXSIZE,       /* maxsize */
6969                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
6970                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
6971                                0,                       /* flags */
6972                                NULL, NULL,              /* lockfunc, lockarg */
6973                                &dma->parent_dtag);
6974         if (error) {
6975                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6976                 return (error);
6977         }
6978
6979         /*
6980          * Create TX/RX mbuf DMA tag
6981          */
6982         error = bus_dma_tag_create(dma->parent_dtag,
6983                                 1,
6984                                 0,
6985                                 BUS_SPACE_MAXADDR,
6986                                 BUS_SPACE_MAXADDR,
6987                                 NULL, NULL,
6988                                 MCLBYTES,
6989                                 1,
6990                                 BUS_SPACE_MAXSIZE_32BIT,
6991                                 0,
6992                                 NULL, NULL,
6993                                 &dma->rxbuf_dtag);
6994         if (error) {
6995                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6996                 goto fail0;
6997         }
6998         error = bus_dma_tag_create(dma->parent_dtag,
6999                                 1,
7000                                 0,
7001                                 BUS_SPACE_MAXADDR,
7002                                 BUS_SPACE_MAXADDR,
7003                                 NULL, NULL,
7004                                 MCLBYTES,
7005                                 1,
7006                                 BUS_SPACE_MAXSIZE_32BIT,
7007                                 0,
7008                                 NULL, NULL,
7009                                 &dma->txbuf_dtag);
7010         if (error) {
7011                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7012                 goto fail1;
7013         }
7014
7015         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7016         if (!dma->wme[WME_AC_BK])
7017                 goto fail2;
7018
7019         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7020         if (!dma->wme[WME_AC_BE])
7021                 goto fail3;
7022
7023         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7024         if (!dma->wme[WME_AC_VI])
7025                 goto fail4;
7026
7027         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7028         if (!dma->wme[WME_AC_VO])
7029                 goto fail5;
7030
7031         dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7032         if (!dma->mcast)
7033                 goto fail6;
7034         dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7035         if (!dma->rx)
7036                 goto fail7;
7037
7038         return (error);
7039
7040 fail7:  bwn_dma_ringfree(&dma->mcast);
7041 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7042 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7043 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7044 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7045 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
7046 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
7047 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
7048         return (error);
7049 }
7050
7051 static struct bwn_dma_ring *
7052 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7053     uint16_t cookie, int *slot)
7054 {
7055         struct bwn_dma *dma = &mac->mac_method.dma;
7056         struct bwn_dma_ring *dr;
7057         struct bwn_softc *sc = mac->mac_sc;
7058
7059         BWN_ASSERT_LOCKED(mac->mac_sc);
7060
7061         switch (cookie & 0xf000) {
7062         case 0x1000:
7063                 dr = dma->wme[WME_AC_BK];
7064                 break;
7065         case 0x2000:
7066                 dr = dma->wme[WME_AC_BE];
7067                 break;
7068         case 0x3000:
7069                 dr = dma->wme[WME_AC_VI];
7070                 break;
7071         case 0x4000:
7072                 dr = dma->wme[WME_AC_VO];
7073                 break;
7074         case 0x5000:
7075                 dr = dma->mcast;
7076                 break;
7077         default:
7078                 dr = NULL;
7079                 KASSERT(0 == 1,
7080                     ("invalid cookie value %d", cookie & 0xf000));
7081         }
7082         *slot = (cookie & 0x0fff);
7083         if (*slot < 0 || *slot >= dr->dr_numslots) {
7084                 /*
7085                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7086                  * that it occurs events which have same H/W sequence numbers.
7087                  * When it's occurred just prints a WARNING msgs and ignores.
7088                  */
7089                 KASSERT(status->seq == dma->lastseq,
7090                     ("%s:%d: fail", __func__, __LINE__));
7091                 device_printf(sc->sc_dev,
7092                     "out of slot ranges (0 < %d < %d)\n", *slot,
7093                     dr->dr_numslots);
7094                 return (NULL);
7095         }
7096         dma->lastseq = status->seq;
7097         return (dr);
7098 }
7099
7100 static void
7101 bwn_dma_stop(struct bwn_mac *mac)
7102 {
7103         struct bwn_dma *dma;
7104
7105         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7106                 return;
7107         dma = &mac->mac_method.dma;
7108
7109         bwn_dma_ringstop(&dma->rx);
7110         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7111         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7112         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7113         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7114         bwn_dma_ringstop(&dma->mcast);
7115 }
7116
7117 static void
7118 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7119 {
7120
7121         if (dr == NULL)
7122                 return;
7123
7124         bwn_dma_cleanup(*dr);
7125 }
7126
7127 static void
7128 bwn_pio_stop(struct bwn_mac *mac)
7129 {
7130         struct bwn_pio *pio;
7131
7132         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7133                 return;
7134         pio = &mac->mac_method.pio;
7135
7136         bwn_destroy_queue_tx(&pio->mcast);
7137         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7138         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7139         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7140         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7141 }
7142
7143 static void
7144 bwn_led_attach(struct bwn_mac *mac)
7145 {
7146         struct bwn_softc *sc = mac->mac_sc;
7147         const uint8_t *led_act = NULL;
7148         uint16_t val[BWN_LED_MAX];
7149         int i;
7150
7151         sc->sc_led_idle = (2350 * hz) / 1000;
7152         sc->sc_led_blink = 1;
7153
7154         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7155                 if (siba_get_pci_subvendor(sc->sc_dev) ==
7156                     bwn_vendor_led_act[i].vid) {
7157                         led_act = bwn_vendor_led_act[i].led_act;
7158                         break;
7159                 }
7160         }
7161         if (led_act == NULL)
7162                 led_act = bwn_default_led_act;
7163
7164         val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7165         val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7166         val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7167         val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7168
7169         for (i = 0; i < BWN_LED_MAX; ++i) {
7170                 struct bwn_led *led = &sc->sc_leds[i];
7171
7172                 if (val[i] == 0xff) {
7173                         led->led_act = led_act[i];
7174                 } else {
7175                         if (val[i] & BWN_LED_ACT_LOW)
7176                                 led->led_flags |= BWN_LED_F_ACTLOW;
7177                         led->led_act = val[i] & BWN_LED_ACT_MASK;
7178                 }
7179                 led->led_mask = (1 << i);
7180
7181                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7182                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
7183                     led->led_act == BWN_LED_ACT_BLINK) {
7184                         led->led_flags |= BWN_LED_F_BLINK;
7185                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7186                                 led->led_flags |= BWN_LED_F_POLLABLE;
7187                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7188                                 led->led_flags |= BWN_LED_F_SLOW;
7189
7190                         if (sc->sc_blink_led == NULL) {
7191                                 sc->sc_blink_led = led;
7192                                 if (led->led_flags & BWN_LED_F_SLOW)
7193                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
7194                         }
7195                 }
7196
7197                 DPRINTF(sc, BWN_DEBUG_LED,
7198                     "%dth led, act %d, lowact %d\n", i,
7199                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7200         }
7201         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7202 }
7203
7204 static __inline uint16_t
7205 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7206 {
7207
7208         if (led->led_flags & BWN_LED_F_ACTLOW)
7209                 on = !on;
7210         if (on)
7211                 val |= led->led_mask;
7212         else
7213                 val &= ~led->led_mask;
7214         return val;
7215 }
7216
7217 static void
7218 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7219 {
7220         struct bwn_softc *sc = mac->mac_sc;
7221         struct ieee80211com *ic = &sc->sc_ic;
7222         uint16_t val;
7223         int i;
7224
7225         if (nstate == IEEE80211_S_INIT) {
7226                 callout_stop(&sc->sc_led_blink_ch);
7227                 sc->sc_led_blinking = 0;
7228         }
7229
7230         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7231                 return;
7232
7233         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7234         for (i = 0; i < BWN_LED_MAX; ++i) {
7235                 struct bwn_led *led = &sc->sc_leds[i];
7236                 int on;
7237
7238                 if (led->led_act == BWN_LED_ACT_UNKN ||
7239                     led->led_act == BWN_LED_ACT_NULL)
7240                         continue;
7241
7242                 if ((led->led_flags & BWN_LED_F_BLINK) &&
7243                     nstate != IEEE80211_S_INIT)
7244                         continue;
7245
7246                 switch (led->led_act) {
7247                 case BWN_LED_ACT_ON:    /* Always on */
7248                         on = 1;
7249                         break;
7250                 case BWN_LED_ACT_OFF:   /* Always off */
7251                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7252                         on = 0;
7253                         break;
7254                 default:
7255                         on = 1;
7256                         switch (nstate) {
7257                         case IEEE80211_S_INIT:
7258                                 on = 0;
7259                                 break;
7260                         case IEEE80211_S_RUN:
7261                                 if (led->led_act == BWN_LED_ACT_11G &&
7262                                     ic->ic_curmode != IEEE80211_MODE_11G)
7263                                         on = 0;
7264                                 break;
7265                         default:
7266                                 if (led->led_act == BWN_LED_ACT_ASSOC)
7267                                         on = 0;
7268                                 break;
7269                         }
7270                         break;
7271                 }
7272
7273                 val = bwn_led_onoff(led, val, on);
7274         }
7275         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7276 }
7277
7278 static void
7279 bwn_led_event(struct bwn_mac *mac, int event)
7280 {
7281         struct bwn_softc *sc = mac->mac_sc;
7282         struct bwn_led *led = sc->sc_blink_led;
7283         int rate;
7284
7285         if (event == BWN_LED_EVENT_POLL) {
7286                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7287                         return;
7288                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7289                         return;
7290         }
7291
7292         sc->sc_led_ticks = ticks;
7293         if (sc->sc_led_blinking)
7294                 return;
7295
7296         switch (event) {
7297         case BWN_LED_EVENT_RX:
7298                 rate = sc->sc_rx_rate;
7299                 break;
7300         case BWN_LED_EVENT_TX:
7301                 rate = sc->sc_tx_rate;
7302                 break;
7303         case BWN_LED_EVENT_POLL:
7304                 rate = 0;
7305                 break;
7306         default:
7307                 panic("unknown LED event %d\n", event);
7308                 break;
7309         }
7310         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7311             bwn_led_duration[rate].off_dur);
7312 }
7313
7314 static void
7315 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7316 {
7317         struct bwn_softc *sc = mac->mac_sc;
7318         struct bwn_led *led = sc->sc_blink_led;
7319         uint16_t val;
7320
7321         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7322         val = bwn_led_onoff(led, val, 1);
7323         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7324
7325         if (led->led_flags & BWN_LED_F_SLOW) {
7326                 BWN_LED_SLOWDOWN(on_dur);
7327                 BWN_LED_SLOWDOWN(off_dur);
7328         }
7329
7330         sc->sc_led_blinking = 1;
7331         sc->sc_led_blink_offdur = off_dur;
7332
7333         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7334 }
7335
7336 static void
7337 bwn_led_blink_next(void *arg)
7338 {
7339         struct bwn_mac *mac = arg;
7340         struct bwn_softc *sc = mac->mac_sc;
7341         uint16_t val;
7342
7343         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7344         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7345         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7346
7347         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7348             bwn_led_blink_end, mac);
7349 }
7350
7351 static void
7352 bwn_led_blink_end(void *arg)
7353 {
7354         struct bwn_mac *mac = arg;
7355         struct bwn_softc *sc = mac->mac_sc;
7356
7357         sc->sc_led_blinking = 0;
7358 }
7359
7360 static int
7361 bwn_suspend(device_t dev)
7362 {
7363         struct bwn_softc *sc = device_get_softc(dev);
7364
7365         BWN_LOCK(sc);
7366         bwn_stop(sc);
7367         BWN_UNLOCK(sc);
7368         return (0);
7369 }
7370
7371 static int
7372 bwn_resume(device_t dev)
7373 {
7374         struct bwn_softc *sc = device_get_softc(dev);
7375         int error = EDOOFUS;
7376
7377         BWN_LOCK(sc);
7378         if (sc->sc_ic.ic_nrunning > 0)
7379                 error = bwn_init(sc);
7380         BWN_UNLOCK(sc);
7381         if (error == 0)
7382                 ieee80211_start_all(&sc->sc_ic);
7383         return (0);
7384 }
7385
7386 static void
7387 bwn_rfswitch(void *arg)
7388 {
7389         struct bwn_softc *sc = arg;
7390         struct bwn_mac *mac = sc->sc_curmac;
7391         int cur = 0, prev = 0;
7392
7393         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7394             ("%s: invalid MAC status %d", __func__, mac->mac_status));
7395
7396         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7397             || mac->mac_phy.type == BWN_PHYTYPE_N) {
7398                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7399                         & BWN_RF_HWENABLED_HI_MASK))
7400                         cur = 1;
7401         } else {
7402                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7403                     & BWN_RF_HWENABLED_LO_MASK)
7404                         cur = 1;
7405         }
7406
7407         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7408                 prev = 1;
7409
7410         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7411             __func__, cur, prev);
7412
7413         if (cur != prev) {
7414                 if (cur)
7415                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7416                 else
7417                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7418
7419                 device_printf(sc->sc_dev,
7420                     "status of RF switch is changed to %s\n",
7421                     cur ? "ON" : "OFF");
7422                 if (cur != mac->mac_phy.rf_on) {
7423                         if (cur)
7424                                 bwn_rf_turnon(mac);
7425                         else
7426                                 bwn_rf_turnoff(mac);
7427                 }
7428         }
7429
7430         callout_schedule(&sc->sc_rfswitch_ch, hz);
7431 }
7432
7433 static void
7434 bwn_sysctl_node(struct bwn_softc *sc)
7435 {
7436         device_t dev = sc->sc_dev;
7437         struct bwn_mac *mac;
7438         struct bwn_stats *stats;
7439
7440         /* XXX assume that count of MAC is only 1. */
7441
7442         if ((mac = sc->sc_curmac) == NULL)
7443                 return;
7444         stats = &mac->mac_stats;
7445
7446         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7447             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7448             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7449         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7450             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7451             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7452         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7453             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7455
7456 #ifdef BWN_DEBUG
7457         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7458             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7459             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7460 #endif
7461 }
7462
7463 static device_method_t bwn_methods[] = {
7464         /* Device interface */
7465         DEVMETHOD(device_probe,         bwn_probe),
7466         DEVMETHOD(device_attach,        bwn_attach),
7467         DEVMETHOD(device_detach,        bwn_detach),
7468         DEVMETHOD(device_suspend,       bwn_suspend),
7469         DEVMETHOD(device_resume,        bwn_resume),
7470         DEVMETHOD_END
7471 };
7472 static driver_t bwn_driver = {
7473         "bwn",
7474         bwn_methods,
7475         sizeof(struct bwn_softc)
7476 };
7477 static devclass_t bwn_devclass;
7478 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7479 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7480 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
7481 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
7482 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7483 MODULE_VERSION(bwn, 1);