xref: /freebsd/sys/dev/bwn/if_bwn.c (revision 137a344c6341d1469432e9deb3a25593f96672ad)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
15  *    redistribution must be conditioned upon including a substantially
16  *    similar Disclaimer requirement for further binary redistribution.
17  *
18  * NO WARRANTY
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
22  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
23  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
24  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
27  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
29  * THE POSSIBILITY OF SUCH DAMAGES.
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 /*
36  * The Broadcom Wireless LAN controller driver.
37  */
38 
39 #include "opt_bwn.h"
40 #include "opt_wlan.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/malloc.h>
46 #include <sys/module.h>
47 #include <sys/endian.h>
48 #include <sys/errno.h>
49 #include <sys/firmware.h>
50 #include <sys/lock.h>
51 #include <sys/mutex.h>
52 #include <machine/bus.h>
53 #include <machine/resource.h>
54 #include <sys/bus.h>
55 #include <sys/rman.h>
56 #include <sys/socket.h>
57 #include <sys/sockio.h>
58 
59 #include <net/ethernet.h>
60 #include <net/if.h>
61 #include <net/if_var.h>
62 #include <net/if_arp.h>
63 #include <net/if_dl.h>
64 #include <net/if_llc.h>
65 #include <net/if_media.h>
66 #include <net/if_types.h>
67 
68 #include <dev/pci/pcivar.h>
69 #include <dev/pci/pcireg.h>
70 
71 #include <net80211/ieee80211_var.h>
72 #include <net80211/ieee80211_radiotap.h>
73 #include <net80211/ieee80211_regdomain.h>
74 #include <net80211/ieee80211_phy.h>
75 #include <net80211/ieee80211_ratectl.h>
76 
77 #include <dev/bwn/if_bwn_siba.h>
78 
79 #include <dev/bwn/if_bwnreg.h>
80 #include <dev/bwn/if_bwnvar.h>
81 
82 #include <dev/bwn/if_bwn_debug.h>
83 #include <dev/bwn/if_bwn_misc.h>
84 #include <dev/bwn/if_bwn_util.h>
85 #include <dev/bwn/if_bwn_phy_common.h>
86 #include <dev/bwn/if_bwn_phy_g.h>
87 #include <dev/bwn/if_bwn_phy_lp.h>
88 #include <dev/bwn/if_bwn_phy_n.h>
89 
90 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
91     "Broadcom driver parameters");
92 
93 /*
94  * Tunable & sysctl variables.
95  */
96 
97 #ifdef BWN_DEBUG
98 static	int bwn_debug = 0;
99 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
100     "Broadcom debugging printfs");
101 #endif
102 
103 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
104 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
105     "uses Bad Frames Preemption");
106 static int	bwn_bluetooth = 1;
107 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
108     "turns on Bluetooth Coexistence");
109 static int	bwn_hwpctl = 0;
110 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
111     "uses H/W power control");
112 static int	bwn_msi_disable = 0;		/* MSI disabled  */
113 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
114 static int	bwn_usedma = 1;
115 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
116     "uses DMA");
117 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
118 static int	bwn_wme = 1;
119 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
120     "uses WME support");
121 
122 static void	bwn_attach_pre(struct bwn_softc *);
123 static int	bwn_attach_post(struct bwn_softc *);
124 static void	bwn_sprom_bugfixes(device_t);
125 static int	bwn_init(struct bwn_softc *);
126 static void	bwn_parent(struct ieee80211com *);
127 static void	bwn_start(struct bwn_softc *);
128 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
129 static int	bwn_attach_core(struct bwn_mac *);
130 static int	bwn_phy_getinfo(struct bwn_mac *, int);
131 static int	bwn_chiptest(struct bwn_mac *);
132 static int	bwn_setup_channels(struct bwn_mac *, int, int);
133 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
134 		    uint16_t);
135 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
136 		    const struct bwn_channelinfo *, const uint8_t []);
137 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
138 		    const struct ieee80211_bpf_params *);
139 static void	bwn_updateslot(struct ieee80211com *);
140 static void	bwn_update_promisc(struct ieee80211com *);
141 static void	bwn_wme_init(struct bwn_mac *);
142 static int	bwn_wme_update(struct ieee80211com *);
143 static void	bwn_wme_clear(struct bwn_softc *);
144 static void	bwn_wme_load(struct bwn_mac *);
145 static void	bwn_wme_loadparams(struct bwn_mac *,
146 		    const struct wmeParams *, uint16_t);
147 static void	bwn_scan_start(struct ieee80211com *);
148 static void	bwn_scan_end(struct ieee80211com *);
149 static void	bwn_set_channel(struct ieee80211com *);
150 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
151 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
152 		    const uint8_t [IEEE80211_ADDR_LEN],
153 		    const uint8_t [IEEE80211_ADDR_LEN]);
154 static void	bwn_vap_delete(struct ieee80211vap *);
155 static void	bwn_stop(struct bwn_softc *);
156 static int	bwn_core_init(struct bwn_mac *);
157 static void	bwn_core_start(struct bwn_mac *);
158 static void	bwn_core_exit(struct bwn_mac *);
159 static void	bwn_bt_disable(struct bwn_mac *);
160 static int	bwn_chip_init(struct bwn_mac *);
161 static void	bwn_set_txretry(struct bwn_mac *, int, int);
162 static void	bwn_rate_init(struct bwn_mac *);
163 static void	bwn_set_phytxctl(struct bwn_mac *);
164 static void	bwn_spu_setdelay(struct bwn_mac *, int);
165 static void	bwn_bt_enable(struct bwn_mac *);
166 static void	bwn_set_macaddr(struct bwn_mac *);
167 static void	bwn_crypt_init(struct bwn_mac *);
168 static void	bwn_chip_exit(struct bwn_mac *);
169 static int	bwn_fw_fillinfo(struct bwn_mac *);
170 static int	bwn_fw_loaducode(struct bwn_mac *);
171 static int	bwn_gpio_init(struct bwn_mac *);
172 static int	bwn_fw_loadinitvals(struct bwn_mac *);
173 static int	bwn_phy_init(struct bwn_mac *);
174 static void	bwn_set_txantenna(struct bwn_mac *, int);
175 static void	bwn_set_opmode(struct bwn_mac *);
176 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
177 static uint8_t	bwn_plcp_getcck(const uint8_t);
178 static uint8_t	bwn_plcp_getofdm(const uint8_t);
179 static void	bwn_pio_init(struct bwn_mac *);
180 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
181 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
182 		    int);
183 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
184 		    struct bwn_pio_rxqueue *, int);
185 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
186 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
187 		    uint16_t);
188 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
189 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
190 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
191 static void	bwn_pio_handle_txeof(struct bwn_mac *,
192 		    const struct bwn_txstatus *);
193 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
194 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
195 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
196 		    uint16_t);
197 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
198 		    uint32_t);
199 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
200 		    struct mbuf *);
201 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
202 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
203 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
204 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
205 		    uint16_t, uint32_t);
206 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
207 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
208 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
209 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
210 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
211 		    uint16_t, struct bwn_pio_txpkt **);
212 static void	bwn_dma_init(struct bwn_mac *);
213 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
214 static int	bwn_dma_mask2type(uint64_t);
215 static uint64_t	bwn_dma_mask(struct bwn_mac *);
216 static uint16_t	bwn_dma_base(int, int);
217 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
218 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
219 		    int, struct bwn_dmadesc_generic **,
220 		    struct bwn_dmadesc_meta **);
221 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
222 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
223 		    int, int);
224 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
225 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
226 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
227 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
228 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
229 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
230 		    int, struct bwn_dmadesc_generic **,
231 		    struct bwn_dmadesc_meta **);
232 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
233 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
234 		    int, int);
235 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
236 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
237 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
238 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
239 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
240 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
241 static void	bwn_dma_setup(struct bwn_dma_ring *);
242 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
243 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
244 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
245 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
246 static void	bwn_dma_rx(struct bwn_dma_ring *);
247 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
248 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
249 		    struct bwn_dmadesc_meta *);
250 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
251 static int	bwn_dma_gettype(struct bwn_mac *);
252 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
253 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
254 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
255 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
256 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
257 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
258 		    int);
259 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
260 		    bus_size_t, int);
261 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
262 static void	bwn_ratectl_tx_complete(const struct ieee80211_node *,
263 		    const struct bwn_txstatus *);
264 static void	bwn_dma_handle_txeof(struct bwn_mac *,
265 		    const struct bwn_txstatus *);
266 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
267 		    struct mbuf *);
268 static int	bwn_dma_getslot(struct bwn_dma_ring *);
269 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
270 		    uint8_t);
271 static int	bwn_dma_attach(struct bwn_mac *);
272 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
273 		    int, int, int);
274 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
275 		    const struct bwn_txstatus *, uint16_t, int *);
276 static void	bwn_dma_free(struct bwn_mac *);
277 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
278 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
279 		    const char *, struct bwn_fwfile *);
280 static void	bwn_release_firmware(struct bwn_mac *);
281 static void	bwn_do_release_fw(struct bwn_fwfile *);
282 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
283 static int	bwn_fwinitvals_write(struct bwn_mac *,
284 		    const struct bwn_fwinitvals *, size_t, size_t);
285 static uint16_t	bwn_ant2phy(int);
286 static void	bwn_mac_write_bssid(struct bwn_mac *);
287 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
288 		    const uint8_t *);
289 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
290 		    const uint8_t *, size_t, const uint8_t *);
291 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
292 		    const uint8_t *);
293 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
294 		    const uint8_t *);
295 static void	bwn_phy_exit(struct bwn_mac *);
296 static void	bwn_core_stop(struct bwn_mac *);
297 static int	bwn_switch_band(struct bwn_softc *,
298 		    struct ieee80211_channel *);
299 static void	bwn_phy_reset(struct bwn_mac *);
300 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
301 static void	bwn_set_pretbtt(struct bwn_mac *);
302 static int	bwn_intr(void *);
303 static void	bwn_intrtask(void *, int);
304 static void	bwn_restart(struct bwn_mac *, const char *);
305 static void	bwn_intr_ucode_debug(struct bwn_mac *);
306 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
307 static void	bwn_intr_atim_end(struct bwn_mac *);
308 static void	bwn_intr_beacon(struct bwn_mac *);
309 static void	bwn_intr_pmq(struct bwn_mac *);
310 static void	bwn_intr_noise(struct bwn_mac *);
311 static void	bwn_intr_txeof(struct bwn_mac *);
312 static void	bwn_hwreset(void *, int);
313 static void	bwn_handle_fwpanic(struct bwn_mac *);
314 static void	bwn_load_beacon0(struct bwn_mac *);
315 static void	bwn_load_beacon1(struct bwn_mac *);
316 static uint32_t	bwn_jssi_read(struct bwn_mac *);
317 static void	bwn_noise_gensample(struct bwn_mac *);
318 static void	bwn_handle_txeof(struct bwn_mac *,
319 		    const struct bwn_txstatus *);
320 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
321 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
322 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
323 		    struct mbuf *);
324 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
325 static int	bwn_set_txhdr(struct bwn_mac *,
326 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
327 		    uint16_t);
328 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
329 		    const uint8_t);
330 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
331 static uint8_t	bwn_get_fbrate(uint8_t);
332 static void	bwn_txpwr(void *, int);
333 static void	bwn_tasks(void *);
334 static void	bwn_task_15s(struct bwn_mac *);
335 static void	bwn_task_30s(struct bwn_mac *);
336 static void	bwn_task_60s(struct bwn_mac *);
337 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
338 		    uint8_t);
339 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
340 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
341 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
342 		    int, int);
343 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
344 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
345 static void	bwn_watchdog(void *);
346 static void	bwn_dma_stop(struct bwn_mac *);
347 static void	bwn_pio_stop(struct bwn_mac *);
348 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
349 static void	bwn_led_attach(struct bwn_mac *);
350 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
351 static void	bwn_led_event(struct bwn_mac *, int);
352 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
353 static void	bwn_led_blink_next(void *);
354 static void	bwn_led_blink_end(void *);
355 static void	bwn_rfswitch(void *);
356 static void	bwn_rf_turnon(struct bwn_mac *);
357 static void	bwn_rf_turnoff(struct bwn_mac *);
358 static void	bwn_sysctl_node(struct bwn_softc *);
359 
360 static struct resource_spec bwn_res_spec_legacy[] = {
361 	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
362 	{ -1,			0,		0 }
363 };
364 
365 static struct resource_spec bwn_res_spec_msi[] = {
366 	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
367 	{ -1,			0,		0 }
368 };
369 
370 static const struct bwn_channelinfo bwn_chantable_bg = {
371 	.channels = {
372 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
373 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
374 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
375 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
376 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
377 	.nchannels = 14
378 };
379 
380 static const struct bwn_channelinfo bwn_chantable_a = {
381 	.channels = {
382 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
383 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
384 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
385 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
386 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
387 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
388 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
389 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
390 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
391 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
392 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
393 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
394 		{ 6080, 216, 30 } },
395 	.nchannels = 37
396 };
397 
398 #if 0
399 static const struct bwn_channelinfo bwn_chantable_n = {
400 	.channels = {
401 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
402 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
403 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
404 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
405 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
406 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
407 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
408 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
409 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
410 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
411 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
412 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
413 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
414 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
415 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
416 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
417 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
418 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
419 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
420 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
421 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
422 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
423 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
424 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
425 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
426 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
427 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
428 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
429 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
430 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
431 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
432 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
433 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
434 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
435 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
436 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
437 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
438 	.nchannels = 110
439 };
440 #endif
441 
442 #define	VENDOR_LED_ACT(vendor)				\
443 {							\
444 	.vid = PCI_VENDOR_##vendor,			\
445 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
446 }
447 
448 static const struct {
449 	uint16_t	vid;
450 	uint8_t		led_act[BWN_LED_MAX];
451 } bwn_vendor_led_act[] = {
452 	VENDOR_LED_ACT(COMPAQ),
453 	VENDOR_LED_ACT(ASUSTEK)
454 };
455 
456 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
457 	{ BWN_VENDOR_LED_ACT_DEFAULT };
458 
459 #undef VENDOR_LED_ACT
460 
461 static const struct {
462 	int		on_dur;
463 	int		off_dur;
464 } bwn_led_duration[109] = {
465 	[0]	= { 400, 100 },
466 	[2]	= { 150, 75 },
467 	[4]	= { 90, 45 },
468 	[11]	= { 66, 34 },
469 	[12]	= { 53, 26 },
470 	[18]	= { 42, 21 },
471 	[22]	= { 35, 17 },
472 	[24]	= { 32, 16 },
473 	[36]	= { 21, 10 },
474 	[48]	= { 16, 8 },
475 	[72]	= { 11, 5 },
476 	[96]	= { 9, 4 },
477 	[108]	= { 7, 3 }
478 };
479 
480 static const uint16_t bwn_wme_shm_offsets[] = {
481 	[0] = BWN_WME_BESTEFFORT,
482 	[1] = BWN_WME_BACKGROUND,
483 	[2] = BWN_WME_VOICE,
484 	[3] = BWN_WME_VIDEO,
485 };
486 
487 static const struct siba_devid bwn_devs[] = {
488 	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
489 	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
490 	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
491 	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
492 	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
493 	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
494 	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
495 	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
496 	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
497 	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
498 };
499 
500 static const struct bwn_bus_ops *
501 bwn_get_bus_ops(device_t dev)
502 {
503 #if BWN_USE_SIBA
504 	return (NULL);
505 #else
506 	devclass_t	bus_cls;
507 
508 	bus_cls = device_get_devclass(device_get_parent(dev));
509 	if (bus_cls == devclass_find("bhnd"))
510 		return (&bwn_bhnd_bus_ops);
511 	else
512 		return (&bwn_siba_bus_ops);
513 #endif
514 }
515 
516 static int
517 bwn_probe(device_t dev)
518 {
519 	struct bwn_softc	*sc;
520 	int			 i;
521 
522 	sc = device_get_softc(dev);
523 	sc->sc_bus_ops = bwn_get_bus_ops(dev);
524 
525 	for (i = 0; i < nitems(bwn_devs); i++) {
526 		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
527 		    siba_get_device(dev) == bwn_devs[i].sd_device &&
528 		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
529 			return (BUS_PROBE_DEFAULT);
530 	}
531 
532 	return (ENXIO);
533 }
534 
535 int
536 bwn_attach(device_t dev)
537 {
538 	struct bwn_mac *mac;
539 	struct bwn_softc *sc = device_get_softc(dev);
540 	int error, i, msic, reg;
541 
542 	sc->sc_dev = dev;
543 #ifdef BWN_DEBUG
544 	sc->sc_debug = bwn_debug;
545 #endif
546 
547 	sc->sc_bus_ops = bwn_get_bus_ops(dev);
548 	if ((error = BWN_BUS_OPS_ATTACH(dev))) {
549 		device_printf(sc->sc_dev,
550 		    "bus-specific initialization failed (%d)\n", error);
551 		return (error);
552 	}
553 
554 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
555 		bwn_attach_pre(sc);
556 		bwn_sprom_bugfixes(dev);
557 		sc->sc_flags |= BWN_FLAG_ATTACHED;
558 	}
559 
560 	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
561 		if (siba_get_pci_device(dev) != 0x4313 &&
562 		    siba_get_pci_device(dev) != 0x431a &&
563 		    siba_get_pci_device(dev) != 0x4321) {
564 			device_printf(sc->sc_dev,
565 			    "skip 802.11 cores\n");
566 			return (ENODEV);
567 		}
568 	}
569 
570 	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
571 	mac->mac_sc = sc;
572 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
573 	if (bwn_bfp != 0)
574 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
575 
576 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
577 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
578 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
579 
580 	error = bwn_attach_core(mac);
581 	if (error)
582 		goto fail0;
583 	bwn_led_attach(mac);
584 
585 	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
586 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
587 	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
588 	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
589 	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
590 	    mac->mac_phy.rf_rev);
591 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
592 		device_printf(sc->sc_dev, "DMA (%d bits)\n",
593 		    mac->mac_method.dma.dmatype);
594 	else
595 		device_printf(sc->sc_dev, "PIO\n");
596 
597 #ifdef	BWN_GPL_PHY
598 	device_printf(sc->sc_dev,
599 	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
600 #endif
601 
602 	/*
603 	 * setup PCI resources and interrupt.
604 	 */
605 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
606 		msic = pci_msi_count(dev);
607 		if (bootverbose)
608 			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
609 	} else
610 		msic = 0;
611 
612 	mac->mac_intr_spec = bwn_res_spec_legacy;
613 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
614 		if (pci_alloc_msi(dev, &msic) == 0) {
615 			device_printf(sc->sc_dev,
616 			    "Using %d MSI messages\n", msic);
617 			mac->mac_intr_spec = bwn_res_spec_msi;
618 			mac->mac_msi = 1;
619 		}
620 	}
621 
622 	error = bus_alloc_resources(dev, mac->mac_intr_spec,
623 	    mac->mac_res_irq);
624 	if (error) {
625 		device_printf(sc->sc_dev,
626 		    "couldn't allocate IRQ resources (%d)\n", error);
627 		goto fail1;
628 	}
629 
630 	if (mac->mac_msi == 0)
631 		error = bus_setup_intr(dev, mac->mac_res_irq[0],
632 		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
633 		    &mac->mac_intrhand[0]);
634 	else {
635 		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
636 			error = bus_setup_intr(dev, mac->mac_res_irq[i],
637 			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
638 			    &mac->mac_intrhand[i]);
639 			if (error != 0) {
640 				device_printf(sc->sc_dev,
641 				    "couldn't setup interrupt (%d)\n", error);
642 				break;
643 			}
644 		}
645 	}
646 
647 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
648 
649 	/*
650 	 * calls attach-post routine
651 	 */
652 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
653 		bwn_attach_post(sc);
654 
655 	return (0);
656 fail1:
657 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
658 		pci_release_msi(dev);
659 fail0:
660 	BWN_BUS_OPS_DETACH(dev);
661 	free(mac, M_DEVBUF);
662 	return (error);
663 }
664 
665 static int
666 bwn_is_valid_ether_addr(uint8_t *addr)
667 {
668 	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
669 
670 	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
671 		return (FALSE);
672 
673 	return (TRUE);
674 }
675 
676 static int
677 bwn_attach_post(struct bwn_softc *sc)
678 {
679 	struct ieee80211com *ic = &sc->sc_ic;
680 
681 	ic->ic_softc = sc;
682 	ic->ic_name = device_get_nameunit(sc->sc_dev);
683 	/* XXX not right but it's not used anywhere important */
684 	ic->ic_phytype = IEEE80211_T_OFDM;
685 	ic->ic_opmode = IEEE80211_M_STA;
686 	ic->ic_caps =
687 		  IEEE80211_C_STA		/* station mode supported */
688 		| IEEE80211_C_MONITOR		/* monitor mode */
689 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
690 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
691 		| IEEE80211_C_SHSLOT		/* short slot time supported */
692 		| IEEE80211_C_WME		/* WME/WMM supported */
693 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
694 #if 0
695 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
696 #endif
697 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
698 		;
699 
700 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
701 
702 	IEEE80211_ADDR_COPY(ic->ic_macaddr,
703 	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
704 	    siba_sprom_get_mac_80211a(sc->sc_dev) :
705 	    siba_sprom_get_mac_80211bg(sc->sc_dev));
706 
707 	/* call MI attach routine. */
708 	ieee80211_ifattach(ic);
709 
710 	ic->ic_headroom = sizeof(struct bwn_txhdr);
711 
712 	/* override default methods */
713 	ic->ic_raw_xmit = bwn_raw_xmit;
714 	ic->ic_updateslot = bwn_updateslot;
715 	ic->ic_update_promisc = bwn_update_promisc;
716 	ic->ic_wme.wme_update = bwn_wme_update;
717 	ic->ic_scan_start = bwn_scan_start;
718 	ic->ic_scan_end = bwn_scan_end;
719 	ic->ic_set_channel = bwn_set_channel;
720 	ic->ic_vap_create = bwn_vap_create;
721 	ic->ic_vap_delete = bwn_vap_delete;
722 	ic->ic_transmit = bwn_transmit;
723 	ic->ic_parent = bwn_parent;
724 
725 	ieee80211_radiotap_attach(ic,
726 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
727 	    BWN_TX_RADIOTAP_PRESENT,
728 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
729 	    BWN_RX_RADIOTAP_PRESENT);
730 
731 	bwn_sysctl_node(sc);
732 
733 	if (bootverbose)
734 		ieee80211_announce(ic);
735 	return (0);
736 }
737 
738 static void
739 bwn_phy_detach(struct bwn_mac *mac)
740 {
741 
742 	if (mac->mac_phy.detach != NULL)
743 		mac->mac_phy.detach(mac);
744 }
745 
746 int
747 bwn_detach(device_t dev)
748 {
749 	struct bwn_softc *sc = device_get_softc(dev);
750 	struct bwn_mac *mac = sc->sc_curmac;
751 	struct ieee80211com *ic = &sc->sc_ic;
752 	int i;
753 
754 	sc->sc_flags |= BWN_FLAG_INVALID;
755 
756 	if (device_is_attached(sc->sc_dev)) {
757 		BWN_LOCK(sc);
758 		bwn_stop(sc);
759 		BWN_UNLOCK(sc);
760 		bwn_dma_free(mac);
761 		callout_drain(&sc->sc_led_blink_ch);
762 		callout_drain(&sc->sc_rfswitch_ch);
763 		callout_drain(&sc->sc_task_ch);
764 		callout_drain(&sc->sc_watchdog_ch);
765 		bwn_phy_detach(mac);
766 		ieee80211_draintask(ic, &mac->mac_hwreset);
767 		ieee80211_draintask(ic, &mac->mac_txpower);
768 		ieee80211_ifdetach(ic);
769 	}
770 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
771 	taskqueue_free(sc->sc_tq);
772 
773 	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
774 		if (mac->mac_intrhand[i] != NULL) {
775 			bus_teardown_intr(dev, mac->mac_res_irq[i],
776 			    mac->mac_intrhand[i]);
777 			mac->mac_intrhand[i] = NULL;
778 		}
779 	}
780 	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
781 	if (mac->mac_msi != 0)
782 		pci_release_msi(dev);
783 	mbufq_drain(&sc->sc_snd);
784 	bwn_release_firmware(mac);
785 	BWN_LOCK_DESTROY(sc);
786 	BWN_BUS_OPS_DETACH(dev);
787 	return (0);
788 }
789 
790 static void
791 bwn_attach_pre(struct bwn_softc *sc)
792 {
793 
794 	BWN_LOCK_INIT(sc);
795 	TAILQ_INIT(&sc->sc_maclist);
796 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
797 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
798 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
799 	mbufq_init(&sc->sc_snd, ifqmaxlen);
800 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
801 		taskqueue_thread_enqueue, &sc->sc_tq);
802 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
803 		"%s taskq", device_get_nameunit(sc->sc_dev));
804 }
805 
806 static void
807 bwn_sprom_bugfixes(device_t dev)
808 {
809 #define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
810 	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
811 	 (siba_get_pci_device(dev) == _device) &&			\
812 	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
813 	 (siba_get_pci_subdevice(dev) == _subdevice))
814 
815 	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
816 	    siba_get_pci_subdevice(dev) == 0x4e &&
817 	    siba_get_pci_revid(dev) > 0x40)
818 		siba_sprom_set_bf_lo(dev,
819 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
820 	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
821 	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
822 		siba_sprom_set_bf_lo(dev,
823 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
824 	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
825 		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
826 		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
827 		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
828 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
829 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
830 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
831 		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
832 			siba_sprom_set_bf_lo(dev,
833 			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
834 	}
835 #undef	BWN_ISDEV
836 }
837 
838 static void
839 bwn_parent(struct ieee80211com *ic)
840 {
841 	struct bwn_softc *sc = ic->ic_softc;
842 	int startall = 0;
843 
844 	BWN_LOCK(sc);
845 	if (ic->ic_nrunning > 0) {
846 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
847 			bwn_init(sc);
848 			startall = 1;
849 		} else
850 			bwn_update_promisc(ic);
851 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
852 		bwn_stop(sc);
853 	BWN_UNLOCK(sc);
854 
855 	if (startall)
856 		ieee80211_start_all(ic);
857 }
858 
859 static int
860 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
861 {
862 	struct bwn_softc *sc = ic->ic_softc;
863 	int error;
864 
865 	BWN_LOCK(sc);
866 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
867 		BWN_UNLOCK(sc);
868 		return (ENXIO);
869 	}
870 	error = mbufq_enqueue(&sc->sc_snd, m);
871 	if (error) {
872 		BWN_UNLOCK(sc);
873 		return (error);
874 	}
875 	bwn_start(sc);
876 	BWN_UNLOCK(sc);
877 	return (0);
878 }
879 
880 static void
881 bwn_start(struct bwn_softc *sc)
882 {
883 	struct bwn_mac *mac = sc->sc_curmac;
884 	struct ieee80211_frame *wh;
885 	struct ieee80211_node *ni;
886 	struct ieee80211_key *k;
887 	struct mbuf *m;
888 
889 	BWN_ASSERT_LOCKED(sc);
890 
891 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
892 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
893 		return;
894 
895 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
896 		if (bwn_tx_isfull(sc, m))
897 			break;
898 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
899 		if (ni == NULL) {
900 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
901 			m_freem(m);
902 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
903 			continue;
904 		}
905 		wh = mtod(m, struct ieee80211_frame *);
906 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
907 			k = ieee80211_crypto_encap(ni, m);
908 			if (k == NULL) {
909 				if_inc_counter(ni->ni_vap->iv_ifp,
910 				    IFCOUNTER_OERRORS, 1);
911 				ieee80211_free_node(ni);
912 				m_freem(m);
913 				continue;
914 			}
915 		}
916 		wh = NULL;	/* Catch any invalid use */
917 		if (bwn_tx_start(sc, ni, m) != 0) {
918 			if (ni != NULL) {
919 				if_inc_counter(ni->ni_vap->iv_ifp,
920 				    IFCOUNTER_OERRORS, 1);
921 				ieee80211_free_node(ni);
922 			}
923 			continue;
924 		}
925 		sc->sc_watchdog_timer = 5;
926 	}
927 }
928 
929 static int
930 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
931 {
932 	struct bwn_dma_ring *dr;
933 	struct bwn_mac *mac = sc->sc_curmac;
934 	struct bwn_pio_txqueue *tq;
935 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
936 
937 	BWN_ASSERT_LOCKED(sc);
938 
939 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
940 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
941 		if (dr->dr_stop == 1 ||
942 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
943 			dr->dr_stop = 1;
944 			goto full;
945 		}
946 	} else {
947 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
948 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
949 		    pktlen > (tq->tq_size - tq->tq_used))
950 			goto full;
951 	}
952 	return (0);
953 full:
954 	mbufq_prepend(&sc->sc_snd, m);
955 	return (1);
956 }
957 
958 static int
959 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
960 {
961 	struct bwn_mac *mac = sc->sc_curmac;
962 	int error;
963 
964 	BWN_ASSERT_LOCKED(sc);
965 
966 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
967 		m_freem(m);
968 		return (ENXIO);
969 	}
970 
971 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
972 	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
973 	if (error) {
974 		m_freem(m);
975 		return (error);
976 	}
977 	return (0);
978 }
979 
980 static int
981 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
982 {
983 	struct bwn_pio_txpkt *tp;
984 	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
985 	struct bwn_softc *sc = mac->mac_sc;
986 	struct bwn_txhdr txhdr;
987 	struct mbuf *m_new;
988 	uint32_t ctl32;
989 	int error;
990 	uint16_t ctl16;
991 
992 	BWN_ASSERT_LOCKED(sc);
993 
994 	/* XXX TODO send packets after DTIM */
995 
996 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
997 	tp = TAILQ_FIRST(&tq->tq_pktlist);
998 	tp->tp_ni = ni;
999 	tp->tp_m = m;
1000 
1001 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1002 	if (error) {
1003 		device_printf(sc->sc_dev, "tx fail\n");
1004 		return (error);
1005 	}
1006 
1007 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1008 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1009 	tq->tq_free--;
1010 
1011 	if (siba_get_revid(sc->sc_dev) >= 8) {
1012 		/*
1013 		 * XXX please removes m_defrag(9)
1014 		 */
1015 		m_new = m_defrag(m, M_NOWAIT);
1016 		if (m_new == NULL) {
1017 			device_printf(sc->sc_dev,
1018 			    "%s: can't defrag TX buffer\n",
1019 			    __func__);
1020 			return (ENOBUFS);
1021 		}
1022 		if (m_new->m_next != NULL)
1023 			device_printf(sc->sc_dev,
1024 			    "TODO: fragmented packets for PIO\n");
1025 		tp->tp_m = m_new;
1026 
1027 		/* send HEADER */
1028 		ctl32 = bwn_pio_write_multi_4(mac, tq,
1029 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1030 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1031 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1032 		/* send BODY */
1033 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1034 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1035 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1036 		    ctl32 | BWN_PIO8_TXCTL_EOF);
1037 	} else {
1038 		ctl16 = bwn_pio_write_multi_2(mac, tq,
1039 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1040 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1041 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1042 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1043 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1044 		    ctl16 | BWN_PIO_TXCTL_EOF);
1045 	}
1046 
1047 	return (0);
1048 }
1049 
1050 static struct bwn_pio_txqueue *
1051 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1052 {
1053 
1054 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1055 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1056 
1057 	switch (prio) {
1058 	case 0:
1059 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1060 	case 1:
1061 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1062 	case 2:
1063 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1064 	case 3:
1065 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1066 	}
1067 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1068 	return (NULL);
1069 }
1070 
1071 static int
1072 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1073 {
1074 #define	BWN_GET_TXHDRCACHE(slot)					\
1075 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1076 	struct bwn_dma *dma = &mac->mac_method.dma;
1077 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1078 	struct bwn_dmadesc_generic *desc;
1079 	struct bwn_dmadesc_meta *mt;
1080 	struct bwn_softc *sc = mac->mac_sc;
1081 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1082 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1083 
1084 	BWN_ASSERT_LOCKED(sc);
1085 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1086 
1087 	/* XXX send after DTIM */
1088 
1089 	slot = bwn_dma_getslot(dr);
1090 	dr->getdesc(dr, slot, &desc, &mt);
1091 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1092 	    ("%s:%d: fail", __func__, __LINE__));
1093 
1094 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1095 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1096 	    BWN_DMA_COOKIE(dr, slot));
1097 	if (error)
1098 		goto fail;
1099 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1100 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1101 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1102 	if (error) {
1103 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1104 		    __func__, error);
1105 		goto fail;
1106 	}
1107 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1108 	    BUS_DMASYNC_PREWRITE);
1109 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1110 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1111 	    BUS_DMASYNC_PREWRITE);
1112 
1113 	slot = bwn_dma_getslot(dr);
1114 	dr->getdesc(dr, slot, &desc, &mt);
1115 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1116 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1117 	mt->mt_m = m;
1118 	mt->mt_ni = ni;
1119 
1120 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1121 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1122 	if (error && error != EFBIG) {
1123 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1124 		    __func__, error);
1125 		goto fail;
1126 	}
1127 	if (error) {    /* error == EFBIG */
1128 		struct mbuf *m_new;
1129 
1130 		m_new = m_defrag(m, M_NOWAIT);
1131 		if (m_new == NULL) {
1132 			device_printf(sc->sc_dev,
1133 			    "%s: can't defrag TX buffer\n",
1134 			    __func__);
1135 			error = ENOBUFS;
1136 			goto fail;
1137 		} else {
1138 			m = m_new;
1139 		}
1140 
1141 		mt->mt_m = m;
1142 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1143 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1144 		if (error) {
1145 			device_printf(sc->sc_dev,
1146 			    "%s: can't load TX buffer (2) %d\n",
1147 			    __func__, error);
1148 			goto fail;
1149 		}
1150 	}
1151 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1152 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1153 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1154 	    BUS_DMASYNC_PREWRITE);
1155 
1156 	/* XXX send after DTIM */
1157 
1158 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1159 	return (0);
1160 fail:
1161 	dr->dr_curslot = backup[0];
1162 	dr->dr_usedslot = backup[1];
1163 	return (error);
1164 #undef BWN_GET_TXHDRCACHE
1165 }
1166 
1167 static void
1168 bwn_watchdog(void *arg)
1169 {
1170 	struct bwn_softc *sc = arg;
1171 
1172 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1173 		device_printf(sc->sc_dev, "device timeout\n");
1174 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1175 	}
1176 	callout_schedule(&sc->sc_watchdog_ch, hz);
1177 }
1178 
1179 static int
1180 bwn_attach_core(struct bwn_mac *mac)
1181 {
1182 	struct bwn_softc *sc = mac->mac_sc;
1183 	int error, have_bg = 0, have_a = 0;
1184 	uint32_t high;
1185 
1186 	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1187 	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1188 
1189 	siba_powerup(sc->sc_dev, 0);
1190 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1191 	have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1192 	have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1193 	if (high & BWN_TGSHIGH_DUALPHY) {
1194 		have_bg = 1;
1195 		have_a = 1;
1196 	}
1197 
1198 #if 0
1199 	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1200 	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1201 	    __func__,
1202 	    high,
1203 	    have_a,
1204 	    have_bg,
1205 	    siba_get_pci_device(sc->sc_dev),
1206 	    siba_get_chipid(sc->sc_dev));
1207 #endif
1208 
1209 	/*
1210 	 * Guess at whether it has A-PHY or G-PHY.
1211 	 * This is just used for resetting the core to probe things;
1212 	 * we will re-guess once it's all up and working.
1213 	 */
1214 	bwn_reset_core(mac, have_bg);
1215 
1216 	/*
1217 	 * Get the PHY version.
1218 	 */
1219 	error = bwn_phy_getinfo(mac, have_bg);
1220 	if (error)
1221 		goto fail;
1222 
1223 	/*
1224 	 * This is the whitelist of devices which we "believe"
1225 	 * the SPROM PHY config from.  The rest are "guessed".
1226 	 */
1227 	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1228 	    siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1229 	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1230 	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1231 	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1232 	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1233 		have_a = have_bg = 0;
1234 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1235 			have_a = 1;
1236 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1237 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1238 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1239 			have_bg = 1;
1240 		else
1241 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1242 			    mac->mac_phy.type));
1243 	}
1244 
1245 	/*
1246 	 * XXX The PHY-G support doesn't do 5GHz operation.
1247 	 */
1248 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1249 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1250 		device_printf(sc->sc_dev,
1251 		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1252 		    __func__);
1253 		have_a = 0;
1254 		have_bg = 1;
1255 	}
1256 
1257 	mac->mac_phy.phy_n = NULL;
1258 
1259 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1260 		mac->mac_phy.attach = bwn_phy_g_attach;
1261 		mac->mac_phy.detach = bwn_phy_g_detach;
1262 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1263 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1264 		mac->mac_phy.init = bwn_phy_g_init;
1265 		mac->mac_phy.exit = bwn_phy_g_exit;
1266 		mac->mac_phy.phy_read = bwn_phy_g_read;
1267 		mac->mac_phy.phy_write = bwn_phy_g_write;
1268 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1269 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1270 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1271 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1272 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1273 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1274 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1275 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1276 		mac->mac_phy.set_im = bwn_phy_g_im;
1277 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1278 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1279 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1280 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1281 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1282 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1283 		mac->mac_phy.init = bwn_phy_lp_init;
1284 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1285 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1286 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1287 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1288 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1289 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1290 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1291 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1292 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1293 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1294 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1295 	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1296 		mac->mac_phy.attach = bwn_phy_n_attach;
1297 		mac->mac_phy.detach = bwn_phy_n_detach;
1298 		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1299 		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1300 		mac->mac_phy.init = bwn_phy_n_init;
1301 		mac->mac_phy.exit = bwn_phy_n_exit;
1302 		mac->mac_phy.phy_read = bwn_phy_n_read;
1303 		mac->mac_phy.phy_write = bwn_phy_n_write;
1304 		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1305 		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1306 		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1307 		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1308 		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1309 		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1310 		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1311 		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1312 		mac->mac_phy.set_im = bwn_phy_n_im;
1313 		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1314 		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1315 		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1316 		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1317 	} else {
1318 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1319 		    mac->mac_phy.type);
1320 		error = ENXIO;
1321 		goto fail;
1322 	}
1323 
1324 	mac->mac_phy.gmode = have_bg;
1325 	if (mac->mac_phy.attach != NULL) {
1326 		error = mac->mac_phy.attach(mac);
1327 		if (error) {
1328 			device_printf(sc->sc_dev, "failed\n");
1329 			goto fail;
1330 		}
1331 	}
1332 
1333 	bwn_reset_core(mac, have_bg);
1334 
1335 	error = bwn_chiptest(mac);
1336 	if (error)
1337 		goto fail;
1338 	error = bwn_setup_channels(mac, have_bg, have_a);
1339 	if (error) {
1340 		device_printf(sc->sc_dev, "failed to setup channels\n");
1341 		goto fail;
1342 	}
1343 
1344 	if (sc->sc_curmac == NULL)
1345 		sc->sc_curmac = mac;
1346 
1347 	error = bwn_dma_attach(mac);
1348 	if (error != 0) {
1349 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1350 		goto fail;
1351 	}
1352 
1353 	mac->mac_phy.switch_analog(mac, 0);
1354 
1355 	siba_dev_down(sc->sc_dev, 0);
1356 fail:
1357 	siba_powerdown(sc->sc_dev);
1358 	bwn_release_firmware(mac);
1359 	return (error);
1360 }
1361 
1362 /*
1363  * Reset - SIBA.
1364  */
1365 void
1366 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1367 {
1368 	struct bwn_softc *sc = mac->mac_sc;
1369 	uint32_t low, ctl;
1370 	uint32_t flags = 0;
1371 
1372 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1373 
1374 	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1375 	if (g_mode)
1376 		flags |= BWN_TGSLOW_SUPPORT_G;
1377 
1378 	/* XXX N-PHY only; and hard-code to 20MHz for now */
1379 	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1380 		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1381 
1382 	siba_dev_up(sc->sc_dev, flags);
1383 	DELAY(2000);
1384 
1385 	/* Take PHY out of reset */
1386 	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1387 	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1388 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1389 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1390 	DELAY(2000);
1391 	low &= ~SIBA_TGSLOW_FGC;
1392 	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1393 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1394 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1395 	DELAY(2000);
1396 
1397 	if (mac->mac_phy.switch_analog != NULL)
1398 		mac->mac_phy.switch_analog(mac, 1);
1399 
1400 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1401 	if (g_mode)
1402 		ctl |= BWN_MACCTL_GMODE;
1403 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1404 }
1405 
1406 static int
1407 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1408 {
1409 	struct bwn_phy *phy = &mac->mac_phy;
1410 	struct bwn_softc *sc = mac->mac_sc;
1411 	uint32_t tmp;
1412 
1413 	/* PHY */
1414 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1415 	phy->gmode = gmode;
1416 	phy->rf_on = 1;
1417 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1418 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1419 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1420 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1421 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1422 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1423 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1424 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
1425 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1426 		goto unsupphy;
1427 
1428 	/* RADIO */
1429 	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1430 		if (siba_get_chiprev(sc->sc_dev) == 0)
1431 			tmp = 0x3205017f;
1432 		else if (siba_get_chiprev(sc->sc_dev) == 1)
1433 			tmp = 0x4205017f;
1434 		else
1435 			tmp = 0x5205017f;
1436 	} else {
1437 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1438 		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1439 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1440 		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1441 	}
1442 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1443 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1444 	phy->rf_manuf = (tmp & 0x00000fff);
1445 
1446 	/*
1447 	 * For now, just always do full init (ie, what bwn has traditionally
1448 	 * done)
1449 	 */
1450 	phy->phy_do_full_init = 1;
1451 
1452 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1453 		goto unsupradio;
1454 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1455 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1456 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1457 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1458 	    (phy->type == BWN_PHYTYPE_N &&
1459 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1460 	    (phy->type == BWN_PHYTYPE_LP &&
1461 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1462 		goto unsupradio;
1463 
1464 	return (0);
1465 unsupphy:
1466 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1467 	    "analog %#x)\n",
1468 	    phy->type, phy->rev, phy->analog);
1469 	return (ENXIO);
1470 unsupradio:
1471 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1472 	    "rev %#x)\n",
1473 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1474 	return (ENXIO);
1475 }
1476 
1477 static int
1478 bwn_chiptest(struct bwn_mac *mac)
1479 {
1480 #define	TESTVAL0	0x55aaaa55
1481 #define	TESTVAL1	0xaa5555aa
1482 	struct bwn_softc *sc = mac->mac_sc;
1483 	uint32_t v, backup;
1484 
1485 	BWN_LOCK(sc);
1486 
1487 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1488 
1489 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1490 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1491 		goto error;
1492 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1493 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1494 		goto error;
1495 
1496 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1497 
1498 	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1499 	    (siba_get_revid(sc->sc_dev) <= 10)) {
1500 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1501 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1502 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1503 			goto error;
1504 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1505 			goto error;
1506 	}
1507 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1508 
1509 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1510 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1511 		goto error;
1512 
1513 	BWN_UNLOCK(sc);
1514 	return (0);
1515 error:
1516 	BWN_UNLOCK(sc);
1517 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1518 	return (ENODEV);
1519 }
1520 
1521 static int
1522 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1523 {
1524 	struct bwn_softc *sc = mac->mac_sc;
1525 	struct ieee80211com *ic = &sc->sc_ic;
1526 	uint8_t bands[IEEE80211_MODE_BYTES];
1527 
1528 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1529 	ic->ic_nchans = 0;
1530 
1531 	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1532 	    __func__,
1533 	    have_bg,
1534 	    have_a);
1535 
1536 	if (have_bg) {
1537 		memset(bands, 0, sizeof(bands));
1538 		setbit(bands, IEEE80211_MODE_11B);
1539 		setbit(bands, IEEE80211_MODE_11G);
1540 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1541 		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1542 	}
1543 
1544 	if (have_a) {
1545 		memset(bands, 0, sizeof(bands));
1546 		setbit(bands, IEEE80211_MODE_11A);
1547 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1548 		    &ic->ic_nchans, &bwn_chantable_a, bands);
1549 	}
1550 
1551 	mac->mac_phy.supports_2ghz = have_bg;
1552 	mac->mac_phy.supports_5ghz = have_a;
1553 
1554 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1555 }
1556 
1557 uint32_t
1558 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1559 {
1560 	uint32_t ret;
1561 
1562 	BWN_ASSERT_LOCKED(mac->mac_sc);
1563 
1564 	if (way == BWN_SHARED) {
1565 		KASSERT((offset & 0x0001) == 0,
1566 		    ("%s:%d warn", __func__, __LINE__));
1567 		if (offset & 0x0003) {
1568 			bwn_shm_ctlword(mac, way, offset >> 2);
1569 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1570 			ret <<= 16;
1571 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1572 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1573 			goto out;
1574 		}
1575 		offset >>= 2;
1576 	}
1577 	bwn_shm_ctlword(mac, way, offset);
1578 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1579 out:
1580 	return (ret);
1581 }
1582 
1583 uint16_t
1584 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1585 {
1586 	uint16_t ret;
1587 
1588 	BWN_ASSERT_LOCKED(mac->mac_sc);
1589 
1590 	if (way == BWN_SHARED) {
1591 		KASSERT((offset & 0x0001) == 0,
1592 		    ("%s:%d warn", __func__, __LINE__));
1593 		if (offset & 0x0003) {
1594 			bwn_shm_ctlword(mac, way, offset >> 2);
1595 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1596 			goto out;
1597 		}
1598 		offset >>= 2;
1599 	}
1600 	bwn_shm_ctlword(mac, way, offset);
1601 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1602 out:
1603 
1604 	return (ret);
1605 }
1606 
1607 static void
1608 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1609     uint16_t offset)
1610 {
1611 	uint32_t control;
1612 
1613 	control = way;
1614 	control <<= 16;
1615 	control |= offset;
1616 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1617 }
1618 
1619 void
1620 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1621     uint32_t value)
1622 {
1623 	BWN_ASSERT_LOCKED(mac->mac_sc);
1624 
1625 	if (way == BWN_SHARED) {
1626 		KASSERT((offset & 0x0001) == 0,
1627 		    ("%s:%d warn", __func__, __LINE__));
1628 		if (offset & 0x0003) {
1629 			bwn_shm_ctlword(mac, way, offset >> 2);
1630 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1631 				    (value >> 16) & 0xffff);
1632 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1633 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1634 			return;
1635 		}
1636 		offset >>= 2;
1637 	}
1638 	bwn_shm_ctlword(mac, way, offset);
1639 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1640 }
1641 
1642 void
1643 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1644     uint16_t value)
1645 {
1646 	BWN_ASSERT_LOCKED(mac->mac_sc);
1647 
1648 	if (way == BWN_SHARED) {
1649 		KASSERT((offset & 0x0001) == 0,
1650 		    ("%s:%d warn", __func__, __LINE__));
1651 		if (offset & 0x0003) {
1652 			bwn_shm_ctlword(mac, way, offset >> 2);
1653 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1654 			return;
1655 		}
1656 		offset >>= 2;
1657 	}
1658 	bwn_shm_ctlword(mac, way, offset);
1659 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1660 }
1661 
1662 static void
1663 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1664     const struct bwn_channelinfo *ci, const uint8_t bands[])
1665 {
1666 	int i, error;
1667 
1668 	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1669 		const struct bwn_channel *hc = &ci->channels[i];
1670 
1671 		error = ieee80211_add_channel(chans, maxchans, nchans,
1672 		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1673 	}
1674 }
1675 
1676 static int
1677 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1678 	const struct ieee80211_bpf_params *params)
1679 {
1680 	struct ieee80211com *ic = ni->ni_ic;
1681 	struct bwn_softc *sc = ic->ic_softc;
1682 	struct bwn_mac *mac = sc->sc_curmac;
1683 	int error;
1684 
1685 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1686 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1687 		m_freem(m);
1688 		return (ENETDOWN);
1689 	}
1690 
1691 	BWN_LOCK(sc);
1692 	if (bwn_tx_isfull(sc, m)) {
1693 		m_freem(m);
1694 		BWN_UNLOCK(sc);
1695 		return (ENOBUFS);
1696 	}
1697 
1698 	error = bwn_tx_start(sc, ni, m);
1699 	if (error == 0)
1700 		sc->sc_watchdog_timer = 5;
1701 	BWN_UNLOCK(sc);
1702 	return (error);
1703 }
1704 
1705 /*
1706  * Callback from the 802.11 layer to update the slot time
1707  * based on the current setting.  We use it to notify the
1708  * firmware of ERP changes and the f/w takes care of things
1709  * like slot time and preamble.
1710  */
1711 static void
1712 bwn_updateslot(struct ieee80211com *ic)
1713 {
1714 	struct bwn_softc *sc = ic->ic_softc;
1715 	struct bwn_mac *mac;
1716 
1717 	BWN_LOCK(sc);
1718 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1719 		mac = (struct bwn_mac *)sc->sc_curmac;
1720 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1721 	}
1722 	BWN_UNLOCK(sc);
1723 }
1724 
1725 /*
1726  * Callback from the 802.11 layer after a promiscuous mode change.
1727  * Note this interface does not check the operating mode as this
1728  * is an internal callback and we are expected to honor the current
1729  * state (e.g. this is used for setting the interface in promiscuous
1730  * mode when operating in hostap mode to do ACS).
1731  */
1732 static void
1733 bwn_update_promisc(struct ieee80211com *ic)
1734 {
1735 	struct bwn_softc *sc = ic->ic_softc;
1736 	struct bwn_mac *mac = sc->sc_curmac;
1737 
1738 	BWN_LOCK(sc);
1739 	mac = sc->sc_curmac;
1740 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1741 		if (ic->ic_promisc > 0)
1742 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1743 		else
1744 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1745 		bwn_set_opmode(mac);
1746 	}
1747 	BWN_UNLOCK(sc);
1748 }
1749 
1750 /*
1751  * Callback from the 802.11 layer to update WME parameters.
1752  */
1753 static int
1754 bwn_wme_update(struct ieee80211com *ic)
1755 {
1756 	struct bwn_softc *sc = ic->ic_softc;
1757 	struct bwn_mac *mac = sc->sc_curmac;
1758 	struct chanAccParams chp;
1759 	struct wmeParams *wmep;
1760 	int i;
1761 
1762 	ieee80211_wme_ic_getparams(ic, &chp);
1763 
1764 	BWN_LOCK(sc);
1765 	mac = sc->sc_curmac;
1766 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1767 		bwn_mac_suspend(mac);
1768 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1769 			wmep = &chp.cap_wmeParams[i];
1770 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1771 		}
1772 		bwn_mac_enable(mac);
1773 	}
1774 	BWN_UNLOCK(sc);
1775 	return (0);
1776 }
1777 
1778 static void
1779 bwn_scan_start(struct ieee80211com *ic)
1780 {
1781 	struct bwn_softc *sc = ic->ic_softc;
1782 	struct bwn_mac *mac;
1783 
1784 	BWN_LOCK(sc);
1785 	mac = sc->sc_curmac;
1786 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1787 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1788 		bwn_set_opmode(mac);
1789 		/* disable CFP update during scan */
1790 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1791 	}
1792 	BWN_UNLOCK(sc);
1793 }
1794 
1795 static void
1796 bwn_scan_end(struct ieee80211com *ic)
1797 {
1798 	struct bwn_softc *sc = ic->ic_softc;
1799 	struct bwn_mac *mac;
1800 
1801 	BWN_LOCK(sc);
1802 	mac = sc->sc_curmac;
1803 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1804 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1805 		bwn_set_opmode(mac);
1806 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1807 	}
1808 	BWN_UNLOCK(sc);
1809 }
1810 
1811 static void
1812 bwn_set_channel(struct ieee80211com *ic)
1813 {
1814 	struct bwn_softc *sc = ic->ic_softc;
1815 	struct bwn_mac *mac = sc->sc_curmac;
1816 	struct bwn_phy *phy = &mac->mac_phy;
1817 	int chan, error;
1818 
1819 	BWN_LOCK(sc);
1820 
1821 	error = bwn_switch_band(sc, ic->ic_curchan);
1822 	if (error)
1823 		goto fail;
1824 	bwn_mac_suspend(mac);
1825 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1826 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1827 	if (chan != phy->chan)
1828 		bwn_switch_channel(mac, chan);
1829 
1830 	/* TX power level */
1831 	if (ic->ic_curchan->ic_maxpower != 0 &&
1832 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1833 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1834 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1835 		    BWN_TXPWR_IGNORE_TSSI);
1836 	}
1837 
1838 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1839 	if (phy->set_antenna)
1840 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1841 
1842 	if (sc->sc_rf_enabled != phy->rf_on) {
1843 		if (sc->sc_rf_enabled) {
1844 			bwn_rf_turnon(mac);
1845 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1846 				device_printf(sc->sc_dev,
1847 				    "please turn on the RF switch\n");
1848 		} else
1849 			bwn_rf_turnoff(mac);
1850 	}
1851 
1852 	bwn_mac_enable(mac);
1853 
1854 fail:
1855 	/*
1856 	 * Setup radio tap channel freq and flags
1857 	 */
1858 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1859 		htole16(ic->ic_curchan->ic_freq);
1860 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1861 		htole16(ic->ic_curchan->ic_flags & 0xffff);
1862 
1863 	BWN_UNLOCK(sc);
1864 }
1865 
1866 static struct ieee80211vap *
1867 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1868     enum ieee80211_opmode opmode, int flags,
1869     const uint8_t bssid[IEEE80211_ADDR_LEN],
1870     const uint8_t mac[IEEE80211_ADDR_LEN])
1871 {
1872 	struct ieee80211vap *vap;
1873 	struct bwn_vap *bvp;
1874 
1875 	switch (opmode) {
1876 	case IEEE80211_M_HOSTAP:
1877 	case IEEE80211_M_MBSS:
1878 	case IEEE80211_M_STA:
1879 	case IEEE80211_M_WDS:
1880 	case IEEE80211_M_MONITOR:
1881 	case IEEE80211_M_IBSS:
1882 	case IEEE80211_M_AHDEMO:
1883 		break;
1884 	default:
1885 		return (NULL);
1886 	}
1887 
1888 	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1889 	vap = &bvp->bv_vap;
1890 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1891 	/* override with driver methods */
1892 	bvp->bv_newstate = vap->iv_newstate;
1893 	vap->iv_newstate = bwn_newstate;
1894 
1895 	/* override max aid so sta's cannot assoc when we're out of sta id's */
1896 	vap->iv_max_aid = BWN_STAID_MAX;
1897 
1898 	ieee80211_ratectl_init(vap);
1899 
1900 	/* complete setup */
1901 	ieee80211_vap_attach(vap, ieee80211_media_change,
1902 	    ieee80211_media_status, mac);
1903 	return (vap);
1904 }
1905 
1906 static void
1907 bwn_vap_delete(struct ieee80211vap *vap)
1908 {
1909 	struct bwn_vap *bvp = BWN_VAP(vap);
1910 
1911 	ieee80211_ratectl_deinit(vap);
1912 	ieee80211_vap_detach(vap);
1913 	free(bvp, M_80211_VAP);
1914 }
1915 
1916 static int
1917 bwn_init(struct bwn_softc *sc)
1918 {
1919 	struct bwn_mac *mac;
1920 	int error;
1921 
1922 	BWN_ASSERT_LOCKED(sc);
1923 
1924 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1925 
1926 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1927 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1928 	sc->sc_filters = 0;
1929 	bwn_wme_clear(sc);
1930 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1931 	sc->sc_rf_enabled = 1;
1932 
1933 	mac = sc->sc_curmac;
1934 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1935 		error = bwn_core_init(mac);
1936 		if (error != 0)
1937 			return (error);
1938 	}
1939 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1940 		bwn_core_start(mac);
1941 
1942 	bwn_set_opmode(mac);
1943 	bwn_set_pretbtt(mac);
1944 	bwn_spu_setdelay(mac, 0);
1945 	bwn_set_macaddr(mac);
1946 
1947 	sc->sc_flags |= BWN_FLAG_RUNNING;
1948 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1949 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1950 
1951 	return (0);
1952 }
1953 
1954 static void
1955 bwn_stop(struct bwn_softc *sc)
1956 {
1957 	struct bwn_mac *mac = sc->sc_curmac;
1958 
1959 	BWN_ASSERT_LOCKED(sc);
1960 
1961 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1962 
1963 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1964 		/* XXX FIXME opmode not based on VAP */
1965 		bwn_set_opmode(mac);
1966 		bwn_set_macaddr(mac);
1967 	}
1968 
1969 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1970 		bwn_core_stop(mac);
1971 
1972 	callout_stop(&sc->sc_led_blink_ch);
1973 	sc->sc_led_blinking = 0;
1974 
1975 	bwn_core_exit(mac);
1976 	sc->sc_rf_enabled = 0;
1977 
1978 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1979 }
1980 
1981 static void
1982 bwn_wme_clear(struct bwn_softc *sc)
1983 {
1984 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1985 	struct wmeParams *p;
1986 	unsigned int i;
1987 
1988 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1989 	    ("%s:%d: fail", __func__, __LINE__));
1990 
1991 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1992 		p = &(sc->sc_wmeParams[i]);
1993 
1994 		switch (bwn_wme_shm_offsets[i]) {
1995 		case BWN_WME_VOICE:
1996 			p->wmep_txopLimit = 0;
1997 			p->wmep_aifsn = 2;
1998 			/* XXX FIXME: log2(cwmin) */
1999 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2000 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2001 			break;
2002 		case BWN_WME_VIDEO:
2003 			p->wmep_txopLimit = 0;
2004 			p->wmep_aifsn = 2;
2005 			/* XXX FIXME: log2(cwmin) */
2006 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2007 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2008 			break;
2009 		case BWN_WME_BESTEFFORT:
2010 			p->wmep_txopLimit = 0;
2011 			p->wmep_aifsn = 3;
2012 			/* XXX FIXME: log2(cwmin) */
2013 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2014 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2015 			break;
2016 		case BWN_WME_BACKGROUND:
2017 			p->wmep_txopLimit = 0;
2018 			p->wmep_aifsn = 7;
2019 			/* XXX FIXME: log2(cwmin) */
2020 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2021 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2022 			break;
2023 		default:
2024 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2025 		}
2026 	}
2027 }
2028 
2029 static int
2030 bwn_core_init(struct bwn_mac *mac)
2031 {
2032 	struct bwn_softc *sc = mac->mac_sc;
2033 	uint64_t hf;
2034 	int error;
2035 
2036 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2037 	    ("%s:%d: fail", __func__, __LINE__));
2038 
2039 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2040 
2041 	siba_powerup(sc->sc_dev, 0);
2042 	if (!siba_dev_isup(sc->sc_dev))
2043 		bwn_reset_core(mac, mac->mac_phy.gmode);
2044 
2045 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2046 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2047 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2048 	BWN_GETTIME(mac->mac_phy.nexttime);
2049 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2050 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2051 	mac->mac_stats.link_noise = -95;
2052 	mac->mac_reason_intr = 0;
2053 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2054 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2055 #ifdef BWN_DEBUG
2056 	if (sc->sc_debug & BWN_DEBUG_XMIT)
2057 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2058 #endif
2059 	mac->mac_suspended = 1;
2060 	mac->mac_task_state = 0;
2061 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2062 
2063 	mac->mac_phy.init_pre(mac);
2064 
2065 	siba_pcicore_intr(sc->sc_dev);
2066 
2067 	siba_fix_imcfglobug(sc->sc_dev);
2068 	bwn_bt_disable(mac);
2069 	if (mac->mac_phy.prepare_hw) {
2070 		error = mac->mac_phy.prepare_hw(mac);
2071 		if (error)
2072 			goto fail0;
2073 	}
2074 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2075 	error = bwn_chip_init(mac);
2076 	if (error)
2077 		goto fail0;
2078 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2079 	    siba_get_revid(sc->sc_dev));
2080 	hf = bwn_hf_read(mac);
2081 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2082 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2083 		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2084 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2085 		if (mac->mac_phy.rev == 1)
2086 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2087 	}
2088 	if (mac->mac_phy.rf_ver == 0x2050) {
2089 		if (mac->mac_phy.rf_rev < 6)
2090 			hf |= BWN_HF_FORCE_VCO_RECALC;
2091 		if (mac->mac_phy.rf_rev == 6)
2092 			hf |= BWN_HF_4318_TSSI;
2093 	}
2094 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2095 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2096 	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2097 	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2098 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2099 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2100 	bwn_hf_write(mac, hf);
2101 
2102 	/* Tell the firmware about the MAC capabilities */
2103 	if (siba_get_revid(sc->sc_dev) >= 13) {
2104 		uint32_t cap;
2105 		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2106 		DPRINTF(sc, BWN_DEBUG_RESET,
2107 		    "%s: hw capabilities: 0x%08x\n",
2108 		    __func__, cap);
2109 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2110 		    cap & 0xffff);
2111 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2112 		    (cap >> 16) & 0xffff);
2113 	}
2114 
2115 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2116 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2117 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2118 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2119 
2120 	bwn_rate_init(mac);
2121 	bwn_set_phytxctl(mac);
2122 
2123 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2124 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2125 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2126 
2127 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2128 		bwn_pio_init(mac);
2129 	else
2130 		bwn_dma_init(mac);
2131 	bwn_wme_init(mac);
2132 	bwn_spu_setdelay(mac, 1);
2133 	bwn_bt_enable(mac);
2134 
2135 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2136 	siba_powerup(sc->sc_dev,
2137 	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2138 	bwn_set_macaddr(mac);
2139 	bwn_crypt_init(mac);
2140 
2141 	/* XXX LED initializatin */
2142 
2143 	mac->mac_status = BWN_MAC_STATUS_INITED;
2144 
2145 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2146 	return (error);
2147 
2148 fail0:
2149 	siba_powerdown(sc->sc_dev);
2150 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2151 	    ("%s:%d: fail", __func__, __LINE__));
2152 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2153 	return (error);
2154 }
2155 
2156 static void
2157 bwn_core_start(struct bwn_mac *mac)
2158 {
2159 	struct bwn_softc *sc = mac->mac_sc;
2160 	uint32_t tmp;
2161 
2162 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2163 	    ("%s:%d: fail", __func__, __LINE__));
2164 
2165 	if (siba_get_revid(sc->sc_dev) < 5)
2166 		return;
2167 
2168 	while (1) {
2169 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2170 		if (!(tmp & 0x00000001))
2171 			break;
2172 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2173 	}
2174 
2175 	bwn_mac_enable(mac);
2176 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2177 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2178 
2179 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2180 }
2181 
2182 static void
2183 bwn_core_exit(struct bwn_mac *mac)
2184 {
2185 	struct bwn_softc *sc = mac->mac_sc;
2186 	uint32_t macctl;
2187 
2188 	BWN_ASSERT_LOCKED(mac->mac_sc);
2189 
2190 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2191 	    ("%s:%d: fail", __func__, __LINE__));
2192 
2193 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2194 		return;
2195 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2196 
2197 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2198 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2199 	macctl |= BWN_MACCTL_MCODE_JMP0;
2200 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2201 
2202 	bwn_dma_stop(mac);
2203 	bwn_pio_stop(mac);
2204 	bwn_chip_exit(mac);
2205 	mac->mac_phy.switch_analog(mac, 0);
2206 	siba_dev_down(sc->sc_dev, 0);
2207 	siba_powerdown(sc->sc_dev);
2208 }
2209 
2210 static void
2211 bwn_bt_disable(struct bwn_mac *mac)
2212 {
2213 	struct bwn_softc *sc = mac->mac_sc;
2214 
2215 	(void)sc;
2216 	/* XXX do nothing yet */
2217 }
2218 
2219 static int
2220 bwn_chip_init(struct bwn_mac *mac)
2221 {
2222 	struct bwn_softc *sc = mac->mac_sc;
2223 	struct bwn_phy *phy = &mac->mac_phy;
2224 	uint32_t macctl;
2225 	int error;
2226 
2227 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2228 	if (phy->gmode)
2229 		macctl |= BWN_MACCTL_GMODE;
2230 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2231 
2232 	error = bwn_fw_fillinfo(mac);
2233 	if (error)
2234 		return (error);
2235 	error = bwn_fw_loaducode(mac);
2236 	if (error)
2237 		return (error);
2238 
2239 	error = bwn_gpio_init(mac);
2240 	if (error)
2241 		return (error);
2242 
2243 	error = bwn_fw_loadinitvals(mac);
2244 	if (error) {
2245 		siba_gpio_set(sc->sc_dev, 0);
2246 		return (error);
2247 	}
2248 	phy->switch_analog(mac, 1);
2249 	error = bwn_phy_init(mac);
2250 	if (error) {
2251 		siba_gpio_set(sc->sc_dev, 0);
2252 		return (error);
2253 	}
2254 	if (phy->set_im)
2255 		phy->set_im(mac, BWN_IMMODE_NONE);
2256 	if (phy->set_antenna)
2257 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2258 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2259 
2260 	if (phy->type == BWN_PHYTYPE_B)
2261 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2262 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2263 	if (siba_get_revid(sc->sc_dev) < 5)
2264 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2265 
2266 	BWN_WRITE_4(mac, BWN_MACCTL,
2267 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2268 	BWN_WRITE_4(mac, BWN_MACCTL,
2269 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2270 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2271 
2272 	bwn_set_opmode(mac);
2273 	if (siba_get_revid(sc->sc_dev) < 3) {
2274 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2275 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2276 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2277 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2278 	} else {
2279 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2280 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2281 	}
2282 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2283 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2284 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2285 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2286 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2287 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2288 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2289 
2290 	bwn_mac_phy_clock_set(mac, true);
2291 
2292 	/* SIBA powerup */
2293 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2294 	return (error);
2295 }
2296 
2297 /* read hostflags */
2298 uint64_t
2299 bwn_hf_read(struct bwn_mac *mac)
2300 {
2301 	uint64_t ret;
2302 
2303 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2304 	ret <<= 16;
2305 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2306 	ret <<= 16;
2307 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2308 	return (ret);
2309 }
2310 
2311 void
2312 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2313 {
2314 
2315 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2316 	    (value & 0x00000000ffffull));
2317 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2318 	    (value & 0x0000ffff0000ull) >> 16);
2319 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2320 	    (value & 0xffff00000000ULL) >> 32);
2321 }
2322 
2323 static void
2324 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2325 {
2326 
2327 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2328 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2329 }
2330 
2331 static void
2332 bwn_rate_init(struct bwn_mac *mac)
2333 {
2334 
2335 	switch (mac->mac_phy.type) {
2336 	case BWN_PHYTYPE_A:
2337 	case BWN_PHYTYPE_G:
2338 	case BWN_PHYTYPE_LP:
2339 	case BWN_PHYTYPE_N:
2340 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2341 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2342 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2343 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2344 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2345 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2346 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2347 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2348 			break;
2349 		/* FALLTHROUGH */
2350 	case BWN_PHYTYPE_B:
2351 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2352 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2353 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2354 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2355 		break;
2356 	default:
2357 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2358 	}
2359 }
2360 
2361 static void
2362 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2363 {
2364 	uint16_t offset;
2365 
2366 	if (ofdm) {
2367 		offset = 0x480;
2368 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2369 	} else {
2370 		offset = 0x4c0;
2371 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2372 	}
2373 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2374 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2375 }
2376 
2377 static uint8_t
2378 bwn_plcp_getcck(const uint8_t bitrate)
2379 {
2380 
2381 	switch (bitrate) {
2382 	case BWN_CCK_RATE_1MB:
2383 		return (0x0a);
2384 	case BWN_CCK_RATE_2MB:
2385 		return (0x14);
2386 	case BWN_CCK_RATE_5MB:
2387 		return (0x37);
2388 	case BWN_CCK_RATE_11MB:
2389 		return (0x6e);
2390 	}
2391 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2392 	return (0);
2393 }
2394 
2395 static uint8_t
2396 bwn_plcp_getofdm(const uint8_t bitrate)
2397 {
2398 
2399 	switch (bitrate) {
2400 	case BWN_OFDM_RATE_6MB:
2401 		return (0xb);
2402 	case BWN_OFDM_RATE_9MB:
2403 		return (0xf);
2404 	case BWN_OFDM_RATE_12MB:
2405 		return (0xa);
2406 	case BWN_OFDM_RATE_18MB:
2407 		return (0xe);
2408 	case BWN_OFDM_RATE_24MB:
2409 		return (0x9);
2410 	case BWN_OFDM_RATE_36MB:
2411 		return (0xd);
2412 	case BWN_OFDM_RATE_48MB:
2413 		return (0x8);
2414 	case BWN_OFDM_RATE_54MB:
2415 		return (0xc);
2416 	}
2417 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2418 	return (0);
2419 }
2420 
2421 static void
2422 bwn_set_phytxctl(struct bwn_mac *mac)
2423 {
2424 	uint16_t ctl;
2425 
2426 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2427 	    BWN_TX_PHY_TXPWR);
2428 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2429 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2430 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2431 }
2432 
2433 static void
2434 bwn_pio_init(struct bwn_mac *mac)
2435 {
2436 	struct bwn_pio *pio = &mac->mac_method.pio;
2437 
2438 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2439 	    & ~BWN_MACCTL_BIGENDIAN);
2440 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2441 
2442 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2443 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2444 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2445 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2446 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2447 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2448 }
2449 
2450 static void
2451 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2452     int index)
2453 {
2454 	struct bwn_pio_txpkt *tp;
2455 	struct bwn_softc *sc = mac->mac_sc;
2456 	unsigned int i;
2457 
2458 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2459 	tq->tq_index = index;
2460 
2461 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2462 	if (siba_get_revid(sc->sc_dev) >= 8)
2463 		tq->tq_size = 1920;
2464 	else {
2465 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2466 		tq->tq_size -= 80;
2467 	}
2468 
2469 	TAILQ_INIT(&tq->tq_pktlist);
2470 	for (i = 0; i < N(tq->tq_pkts); i++) {
2471 		tp = &(tq->tq_pkts[i]);
2472 		tp->tp_index = i;
2473 		tp->tp_queue = tq;
2474 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2475 	}
2476 }
2477 
2478 static uint16_t
2479 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2480 {
2481 	struct bwn_softc *sc = mac->mac_sc;
2482 	static const uint16_t bases[] = {
2483 		BWN_PIO_BASE0,
2484 		BWN_PIO_BASE1,
2485 		BWN_PIO_BASE2,
2486 		BWN_PIO_BASE3,
2487 		BWN_PIO_BASE4,
2488 		BWN_PIO_BASE5,
2489 		BWN_PIO_BASE6,
2490 		BWN_PIO_BASE7,
2491 	};
2492 	static const uint16_t bases_rev11[] = {
2493 		BWN_PIO11_BASE0,
2494 		BWN_PIO11_BASE1,
2495 		BWN_PIO11_BASE2,
2496 		BWN_PIO11_BASE3,
2497 		BWN_PIO11_BASE4,
2498 		BWN_PIO11_BASE5,
2499 	};
2500 
2501 	if (siba_get_revid(sc->sc_dev) >= 11) {
2502 		if (index >= N(bases_rev11))
2503 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2504 		return (bases_rev11[index]);
2505 	}
2506 	if (index >= N(bases))
2507 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2508 	return (bases[index]);
2509 }
2510 
2511 static void
2512 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2513     int index)
2514 {
2515 	struct bwn_softc *sc = mac->mac_sc;
2516 
2517 	prq->prq_mac = mac;
2518 	prq->prq_rev = siba_get_revid(sc->sc_dev);
2519 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2520 	bwn_dma_rxdirectfifo(mac, index, 1);
2521 }
2522 
2523 static void
2524 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2525 {
2526 	if (tq == NULL)
2527 		return;
2528 	bwn_pio_cancel_tx_packets(tq);
2529 }
2530 
2531 static void
2532 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2533 {
2534 
2535 	bwn_destroy_pioqueue_tx(pio);
2536 }
2537 
2538 static uint16_t
2539 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2540     uint16_t offset)
2541 {
2542 
2543 	return (BWN_READ_2(mac, tq->tq_base + offset));
2544 }
2545 
2546 static void
2547 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2548 {
2549 	uint32_t ctl;
2550 	int type;
2551 	uint16_t base;
2552 
2553 	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2554 	base = bwn_dma_base(type, idx);
2555 	if (type == BWN_DMA_64BIT) {
2556 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2557 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2558 		if (enable)
2559 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2560 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2561 	} else {
2562 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2563 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2564 		if (enable)
2565 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2566 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2567 	}
2568 }
2569 
2570 static uint64_t
2571 bwn_dma_mask(struct bwn_mac *mac)
2572 {
2573 	uint32_t tmp;
2574 	uint16_t base;
2575 
2576 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2577 	if (tmp & SIBA_TGSHIGH_DMA64)
2578 		return (BWN_DMA_BIT_MASK(64));
2579 	base = bwn_dma_base(0, 0);
2580 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2581 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2582 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2583 		return (BWN_DMA_BIT_MASK(32));
2584 
2585 	return (BWN_DMA_BIT_MASK(30));
2586 }
2587 
2588 static int
2589 bwn_dma_mask2type(uint64_t dmamask)
2590 {
2591 
2592 	if (dmamask == BWN_DMA_BIT_MASK(30))
2593 		return (BWN_DMA_30BIT);
2594 	if (dmamask == BWN_DMA_BIT_MASK(32))
2595 		return (BWN_DMA_32BIT);
2596 	if (dmamask == BWN_DMA_BIT_MASK(64))
2597 		return (BWN_DMA_64BIT);
2598 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2599 	return (BWN_DMA_30BIT);
2600 }
2601 
2602 static void
2603 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2604 {
2605 	struct bwn_pio_txpkt *tp;
2606 	unsigned int i;
2607 
2608 	for (i = 0; i < N(tq->tq_pkts); i++) {
2609 		tp = &(tq->tq_pkts[i]);
2610 		if (tp->tp_m) {
2611 			m_freem(tp->tp_m);
2612 			tp->tp_m = NULL;
2613 		}
2614 	}
2615 }
2616 
2617 static uint16_t
2618 bwn_dma_base(int type, int controller_idx)
2619 {
2620 	static const uint16_t map64[] = {
2621 		BWN_DMA64_BASE0,
2622 		BWN_DMA64_BASE1,
2623 		BWN_DMA64_BASE2,
2624 		BWN_DMA64_BASE3,
2625 		BWN_DMA64_BASE4,
2626 		BWN_DMA64_BASE5,
2627 	};
2628 	static const uint16_t map32[] = {
2629 		BWN_DMA32_BASE0,
2630 		BWN_DMA32_BASE1,
2631 		BWN_DMA32_BASE2,
2632 		BWN_DMA32_BASE3,
2633 		BWN_DMA32_BASE4,
2634 		BWN_DMA32_BASE5,
2635 	};
2636 
2637 	if (type == BWN_DMA_64BIT) {
2638 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2639 		    ("%s:%d: fail", __func__, __LINE__));
2640 		return (map64[controller_idx]);
2641 	}
2642 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2643 	    ("%s:%d: fail", __func__, __LINE__));
2644 	return (map32[controller_idx]);
2645 }
2646 
2647 static void
2648 bwn_dma_init(struct bwn_mac *mac)
2649 {
2650 	struct bwn_dma *dma = &mac->mac_method.dma;
2651 
2652 	/* setup TX DMA channels. */
2653 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2654 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2655 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2656 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2657 	bwn_dma_setup(dma->mcast);
2658 	/* setup RX DMA channel. */
2659 	bwn_dma_setup(dma->rx);
2660 }
2661 
2662 static struct bwn_dma_ring *
2663 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2664     int for_tx, int type)
2665 {
2666 	struct bwn_dma *dma = &mac->mac_method.dma;
2667 	struct bwn_dma_ring *dr;
2668 	struct bwn_dmadesc_generic *desc;
2669 	struct bwn_dmadesc_meta *mt;
2670 	struct bwn_softc *sc = mac->mac_sc;
2671 	int error, i;
2672 
2673 	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2674 	if (dr == NULL)
2675 		goto out;
2676 	dr->dr_numslots = BWN_RXRING_SLOTS;
2677 	if (for_tx)
2678 		dr->dr_numslots = BWN_TXRING_SLOTS;
2679 
2680 	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2681 	    M_DEVBUF, M_NOWAIT | M_ZERO);
2682 	if (dr->dr_meta == NULL)
2683 		goto fail0;
2684 
2685 	dr->dr_type = type;
2686 	dr->dr_mac = mac;
2687 	dr->dr_base = bwn_dma_base(type, controller_index);
2688 	dr->dr_index = controller_index;
2689 	if (type == BWN_DMA_64BIT) {
2690 		dr->getdesc = bwn_dma_64_getdesc;
2691 		dr->setdesc = bwn_dma_64_setdesc;
2692 		dr->start_transfer = bwn_dma_64_start_transfer;
2693 		dr->suspend = bwn_dma_64_suspend;
2694 		dr->resume = bwn_dma_64_resume;
2695 		dr->get_curslot = bwn_dma_64_get_curslot;
2696 		dr->set_curslot = bwn_dma_64_set_curslot;
2697 	} else {
2698 		dr->getdesc = bwn_dma_32_getdesc;
2699 		dr->setdesc = bwn_dma_32_setdesc;
2700 		dr->start_transfer = bwn_dma_32_start_transfer;
2701 		dr->suspend = bwn_dma_32_suspend;
2702 		dr->resume = bwn_dma_32_resume;
2703 		dr->get_curslot = bwn_dma_32_get_curslot;
2704 		dr->set_curslot = bwn_dma_32_set_curslot;
2705 	}
2706 	if (for_tx) {
2707 		dr->dr_tx = 1;
2708 		dr->dr_curslot = -1;
2709 	} else {
2710 		if (dr->dr_index == 0) {
2711 			switch (mac->mac_fw.fw_hdr_format) {
2712 			case BWN_FW_HDR_351:
2713 			case BWN_FW_HDR_410:
2714 				dr->dr_rx_bufsize =
2715 				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2716 				dr->dr_frameoffset =
2717 				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2718 				break;
2719 			case BWN_FW_HDR_598:
2720 				dr->dr_rx_bufsize =
2721 				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2722 				dr->dr_frameoffset =
2723 				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2724 				break;
2725 			}
2726 		} else
2727 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2728 	}
2729 
2730 	error = bwn_dma_allocringmemory(dr);
2731 	if (error)
2732 		goto fail2;
2733 
2734 	if (for_tx) {
2735 		/*
2736 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2737 		 * BWN_TX_SLOTS_PER_FRAME
2738 		 */
2739 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2740 		    ("%s:%d: fail", __func__, __LINE__));
2741 
2742 		dr->dr_txhdr_cache = contigmalloc(
2743 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2744 		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2745 		    0, BUS_SPACE_MAXADDR, 8, 0);
2746 		if (dr->dr_txhdr_cache == NULL) {
2747 			device_printf(sc->sc_dev,
2748 			    "can't allocate TX header DMA memory\n");
2749 			goto fail1;
2750 		}
2751 
2752 		/*
2753 		 * Create TX ring DMA stuffs
2754 		 */
2755 		error = bus_dma_tag_create(dma->parent_dtag,
2756 				    BWN_ALIGN, 0,
2757 				    BUS_SPACE_MAXADDR,
2758 				    BUS_SPACE_MAXADDR,
2759 				    NULL, NULL,
2760 				    BWN_HDRSIZE(mac),
2761 				    1,
2762 				    BUS_SPACE_MAXSIZE_32BIT,
2763 				    0,
2764 				    NULL, NULL,
2765 				    &dr->dr_txring_dtag);
2766 		if (error) {
2767 			device_printf(sc->sc_dev,
2768 			    "can't create TX ring DMA tag: TODO frees\n");
2769 			goto fail2;
2770 		}
2771 
2772 		for (i = 0; i < dr->dr_numslots; i += 2) {
2773 			dr->getdesc(dr, i, &desc, &mt);
2774 
2775 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2776 			mt->mt_m = NULL;
2777 			mt->mt_ni = NULL;
2778 			mt->mt_islast = 0;
2779 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2780 			    &mt->mt_dmap);
2781 			if (error) {
2782 				device_printf(sc->sc_dev,
2783 				     "can't create RX buf DMA map\n");
2784 				goto fail2;
2785 			}
2786 
2787 			dr->getdesc(dr, i + 1, &desc, &mt);
2788 
2789 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2790 			mt->mt_m = NULL;
2791 			mt->mt_ni = NULL;
2792 			mt->mt_islast = 1;
2793 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2794 			    &mt->mt_dmap);
2795 			if (error) {
2796 				device_printf(sc->sc_dev,
2797 				     "can't create RX buf DMA map\n");
2798 				goto fail2;
2799 			}
2800 		}
2801 	} else {
2802 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2803 		    &dr->dr_spare_dmap);
2804 		if (error) {
2805 			device_printf(sc->sc_dev,
2806 			    "can't create RX buf DMA map\n");
2807 			goto out;		/* XXX wrong! */
2808 		}
2809 
2810 		for (i = 0; i < dr->dr_numslots; i++) {
2811 			dr->getdesc(dr, i, &desc, &mt);
2812 
2813 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2814 			    &mt->mt_dmap);
2815 			if (error) {
2816 				device_printf(sc->sc_dev,
2817 				    "can't create RX buf DMA map\n");
2818 				goto out;	/* XXX wrong! */
2819 			}
2820 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2821 			if (error) {
2822 				device_printf(sc->sc_dev,
2823 				    "failed to allocate RX buf\n");
2824 				goto out;	/* XXX wrong! */
2825 			}
2826 		}
2827 
2828 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2829 		    BUS_DMASYNC_PREWRITE);
2830 
2831 		dr->dr_usedslot = dr->dr_numslots;
2832 	}
2833 
2834       out:
2835 	return (dr);
2836 
2837 fail2:
2838 	if (dr->dr_txhdr_cache != NULL) {
2839 		contigfree(dr->dr_txhdr_cache,
2840 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2841 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2842 	}
2843 fail1:
2844 	free(dr->dr_meta, M_DEVBUF);
2845 fail0:
2846 	free(dr, M_DEVBUF);
2847 	return (NULL);
2848 }
2849 
2850 static void
2851 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2852 {
2853 
2854 	if (dr == NULL)
2855 		return;
2856 
2857 	bwn_dma_free_descbufs(*dr);
2858 	bwn_dma_free_ringmemory(*dr);
2859 
2860 	if ((*dr)->dr_txhdr_cache != NULL) {
2861 		contigfree((*dr)->dr_txhdr_cache,
2862 		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2863 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2864 	}
2865 	free((*dr)->dr_meta, M_DEVBUF);
2866 	free(*dr, M_DEVBUF);
2867 
2868 	*dr = NULL;
2869 }
2870 
2871 static void
2872 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2873     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2874 {
2875 	struct bwn_dmadesc32 *desc;
2876 
2877 	*meta = &(dr->dr_meta[slot]);
2878 	desc = dr->dr_ring_descbase;
2879 	desc = &(desc[slot]);
2880 
2881 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2882 }
2883 
2884 static void
2885 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2886     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2887     int start, int end, int irq)
2888 {
2889 	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2890 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2891 	uint32_t addr, addrext, ctl;
2892 	int slot;
2893 
2894 	slot = (int)(&(desc->dma.dma32) - descbase);
2895 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2896 	    ("%s:%d: fail", __func__, __LINE__));
2897 
2898 	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2899 	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2900 	addr |= siba_dma_translation(sc->sc_dev);
2901 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2902 	if (slot == dr->dr_numslots - 1)
2903 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2904 	if (start)
2905 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2906 	if (end)
2907 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2908 	if (irq)
2909 		ctl |= BWN_DMA32_DCTL_IRQ;
2910 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2911 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2912 
2913 	desc->dma.dma32.control = htole32(ctl);
2914 	desc->dma.dma32.address = htole32(addr);
2915 }
2916 
2917 static void
2918 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2919 {
2920 
2921 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2922 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2923 }
2924 
2925 static void
2926 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2927 {
2928 
2929 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2930 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2931 }
2932 
2933 static void
2934 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2935 {
2936 
2937 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2938 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2939 }
2940 
2941 static int
2942 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2943 {
2944 	uint32_t val;
2945 
2946 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2947 	val &= BWN_DMA32_RXDPTR;
2948 
2949 	return (val / sizeof(struct bwn_dmadesc32));
2950 }
2951 
2952 static void
2953 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2954 {
2955 
2956 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2957 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2958 }
2959 
2960 static void
2961 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2962     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2963 {
2964 	struct bwn_dmadesc64 *desc;
2965 
2966 	*meta = &(dr->dr_meta[slot]);
2967 	desc = dr->dr_ring_descbase;
2968 	desc = &(desc[slot]);
2969 
2970 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2971 }
2972 
2973 static void
2974 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2975     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2976     int start, int end, int irq)
2977 {
2978 	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2979 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2980 	int slot;
2981 	uint32_t ctl0 = 0, ctl1 = 0;
2982 	uint32_t addrlo, addrhi;
2983 	uint32_t addrext;
2984 
2985 	slot = (int)(&(desc->dma.dma64) - descbase);
2986 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2987 	    ("%s:%d: fail", __func__, __LINE__));
2988 
2989 	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2990 	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2991 	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2992 	    30;
2993 	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2994 	if (slot == dr->dr_numslots - 1)
2995 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2996 	if (start)
2997 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2998 	if (end)
2999 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3000 	if (irq)
3001 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
3002 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3003 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3004 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
3005 
3006 	desc->dma.dma64.control0 = htole32(ctl0);
3007 	desc->dma.dma64.control1 = htole32(ctl1);
3008 	desc->dma.dma64.address_low = htole32(addrlo);
3009 	desc->dma.dma64.address_high = htole32(addrhi);
3010 }
3011 
3012 static void
3013 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3014 {
3015 
3016 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3017 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3018 }
3019 
3020 static void
3021 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3022 {
3023 
3024 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3025 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3026 }
3027 
3028 static void
3029 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3030 {
3031 
3032 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3033 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3034 }
3035 
3036 static int
3037 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3038 {
3039 	uint32_t val;
3040 
3041 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3042 	val &= BWN_DMA64_RXSTATDPTR;
3043 
3044 	return (val / sizeof(struct bwn_dmadesc64));
3045 }
3046 
3047 static void
3048 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3049 {
3050 
3051 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3052 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3053 }
3054 
3055 static int
3056 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3057 {
3058 	struct bwn_mac *mac = dr->dr_mac;
3059 	struct bwn_dma *dma = &mac->mac_method.dma;
3060 	struct bwn_softc *sc = mac->mac_sc;
3061 	int error;
3062 
3063 	error = bus_dma_tag_create(dma->parent_dtag,
3064 			    BWN_ALIGN, 0,
3065 			    BUS_SPACE_MAXADDR,
3066 			    BUS_SPACE_MAXADDR,
3067 			    NULL, NULL,
3068 			    BWN_DMA_RINGMEMSIZE,
3069 			    1,
3070 			    BUS_SPACE_MAXSIZE_32BIT,
3071 			    0,
3072 			    NULL, NULL,
3073 			    &dr->dr_ring_dtag);
3074 	if (error) {
3075 		device_printf(sc->sc_dev,
3076 		    "can't create TX ring DMA tag: TODO frees\n");
3077 		return (-1);
3078 	}
3079 
3080 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3081 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3082 	    &dr->dr_ring_dmap);
3083 	if (error) {
3084 		device_printf(sc->sc_dev,
3085 		    "can't allocate DMA mem: TODO frees\n");
3086 		return (-1);
3087 	}
3088 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3089 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3090 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3091 	if (error) {
3092 		device_printf(sc->sc_dev,
3093 		    "can't load DMA mem: TODO free\n");
3094 		return (-1);
3095 	}
3096 
3097 	return (0);
3098 }
3099 
3100 static void
3101 bwn_dma_setup(struct bwn_dma_ring *dr)
3102 {
3103 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3104 	uint64_t ring64;
3105 	uint32_t addrext, ring32, value;
3106 	uint32_t trans = siba_dma_translation(sc->sc_dev);
3107 
3108 	if (dr->dr_tx) {
3109 		dr->dr_curslot = -1;
3110 
3111 		if (dr->dr_type == BWN_DMA_64BIT) {
3112 			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3113 			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3114 			    >> 30;
3115 			value = BWN_DMA64_TXENABLE;
3116 			value |= BWN_DMA64_TXPARITY_DISABLE;
3117 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3118 			    & BWN_DMA64_TXADDREXT_MASK;
3119 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3120 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3121 			    (ring64 & 0xffffffff));
3122 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3123 			    ((ring64 >> 32) &
3124 			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3125 		} else {
3126 			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3127 			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3128 			value = BWN_DMA32_TXENABLE;
3129 			value |= BWN_DMA32_TXPARITY_DISABLE;
3130 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3131 			    & BWN_DMA32_TXADDREXT_MASK;
3132 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3133 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3134 			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3135 		}
3136 		return;
3137 	}
3138 
3139 	/*
3140 	 * set for RX
3141 	 */
3142 	dr->dr_usedslot = dr->dr_numslots;
3143 
3144 	if (dr->dr_type == BWN_DMA_64BIT) {
3145 		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3146 		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3147 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3148 		value |= BWN_DMA64_RXENABLE;
3149 		value |= BWN_DMA64_RXPARITY_DISABLE;
3150 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3151 		    & BWN_DMA64_RXADDREXT_MASK;
3152 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3153 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3154 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3155 		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3156 		    | (trans << 1));
3157 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3158 		    sizeof(struct bwn_dmadesc64));
3159 	} else {
3160 		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3161 		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3162 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3163 		value |= BWN_DMA32_RXENABLE;
3164 		value |= BWN_DMA32_RXPARITY_DISABLE;
3165 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3166 		    & BWN_DMA32_RXADDREXT_MASK;
3167 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3168 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3169 		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3170 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3171 		    sizeof(struct bwn_dmadesc32));
3172 	}
3173 }
3174 
3175 static void
3176 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3177 {
3178 
3179 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3180 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3181 	    dr->dr_ring_dmap);
3182 }
3183 
3184 static void
3185 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3186 {
3187 
3188 	if (dr->dr_tx) {
3189 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3190 		if (dr->dr_type == BWN_DMA_64BIT) {
3191 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3192 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3193 		} else
3194 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3195 	} else {
3196 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3197 		if (dr->dr_type == BWN_DMA_64BIT) {
3198 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3199 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3200 		} else
3201 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3202 	}
3203 }
3204 
3205 static void
3206 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3207 {
3208 	struct bwn_dmadesc_generic *desc;
3209 	struct bwn_dmadesc_meta *meta;
3210 	struct bwn_mac *mac = dr->dr_mac;
3211 	struct bwn_dma *dma = &mac->mac_method.dma;
3212 	struct bwn_softc *sc = mac->mac_sc;
3213 	int i;
3214 
3215 	if (!dr->dr_usedslot)
3216 		return;
3217 	for (i = 0; i < dr->dr_numslots; i++) {
3218 		dr->getdesc(dr, i, &desc, &meta);
3219 
3220 		if (meta->mt_m == NULL) {
3221 			if (!dr->dr_tx)
3222 				device_printf(sc->sc_dev, "%s: not TX?\n",
3223 				    __func__);
3224 			continue;
3225 		}
3226 		if (dr->dr_tx) {
3227 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3228 				bus_dmamap_unload(dr->dr_txring_dtag,
3229 				    meta->mt_dmap);
3230 			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3231 				bus_dmamap_unload(dma->txbuf_dtag,
3232 				    meta->mt_dmap);
3233 		} else
3234 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3235 		bwn_dma_free_descbuf(dr, meta);
3236 	}
3237 }
3238 
3239 static int
3240 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3241     int type)
3242 {
3243 	struct bwn_softc *sc = mac->mac_sc;
3244 	uint32_t value;
3245 	int i;
3246 	uint16_t offset;
3247 
3248 	for (i = 0; i < 10; i++) {
3249 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3250 		    BWN_DMA32_TXSTATUS;
3251 		value = BWN_READ_4(mac, base + offset);
3252 		if (type == BWN_DMA_64BIT) {
3253 			value &= BWN_DMA64_TXSTAT;
3254 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3255 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3256 			    value == BWN_DMA64_TXSTAT_STOPPED)
3257 				break;
3258 		} else {
3259 			value &= BWN_DMA32_TXSTATE;
3260 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3261 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3262 			    value == BWN_DMA32_TXSTAT_STOPPED)
3263 				break;
3264 		}
3265 		DELAY(1000);
3266 	}
3267 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3268 	BWN_WRITE_4(mac, base + offset, 0);
3269 	for (i = 0; i < 10; i++) {
3270 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3271 						   BWN_DMA32_TXSTATUS;
3272 		value = BWN_READ_4(mac, base + offset);
3273 		if (type == BWN_DMA_64BIT) {
3274 			value &= BWN_DMA64_TXSTAT;
3275 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3276 				i = -1;
3277 				break;
3278 			}
3279 		} else {
3280 			value &= BWN_DMA32_TXSTATE;
3281 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3282 				i = -1;
3283 				break;
3284 			}
3285 		}
3286 		DELAY(1000);
3287 	}
3288 	if (i != -1) {
3289 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3290 		return (ENODEV);
3291 	}
3292 	DELAY(1000);
3293 
3294 	return (0);
3295 }
3296 
3297 static int
3298 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3299     int type)
3300 {
3301 	struct bwn_softc *sc = mac->mac_sc;
3302 	uint32_t value;
3303 	int i;
3304 	uint16_t offset;
3305 
3306 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3307 	BWN_WRITE_4(mac, base + offset, 0);
3308 	for (i = 0; i < 10; i++) {
3309 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3310 		    BWN_DMA32_RXSTATUS;
3311 		value = BWN_READ_4(mac, base + offset);
3312 		if (type == BWN_DMA_64BIT) {
3313 			value &= BWN_DMA64_RXSTAT;
3314 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3315 				i = -1;
3316 				break;
3317 			}
3318 		} else {
3319 			value &= BWN_DMA32_RXSTATE;
3320 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3321 				i = -1;
3322 				break;
3323 			}
3324 		}
3325 		DELAY(1000);
3326 	}
3327 	if (i != -1) {
3328 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3329 		return (ENODEV);
3330 	}
3331 
3332 	return (0);
3333 }
3334 
3335 static void
3336 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3337     struct bwn_dmadesc_meta *meta)
3338 {
3339 
3340 	if (meta->mt_m != NULL) {
3341 		m_freem(meta->mt_m);
3342 		meta->mt_m = NULL;
3343 	}
3344 	if (meta->mt_ni != NULL) {
3345 		ieee80211_free_node(meta->mt_ni);
3346 		meta->mt_ni = NULL;
3347 	}
3348 }
3349 
3350 static void
3351 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3352 {
3353 	struct bwn_rxhdr4 *rxhdr;
3354 	unsigned char *frame;
3355 
3356 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3357 	rxhdr->frame_len = 0;
3358 
3359 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3360 	    sizeof(struct bwn_plcp6) + 2,
3361 	    ("%s:%d: fail", __func__, __LINE__));
3362 	frame = mtod(m, char *) + dr->dr_frameoffset;
3363 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3364 }
3365 
3366 static uint8_t
3367 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3368 {
3369 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3370 
3371 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3372 	    == 0xff);
3373 }
3374 
3375 static void
3376 bwn_wme_init(struct bwn_mac *mac)
3377 {
3378 
3379 	bwn_wme_load(mac);
3380 
3381 	/* enable WME support. */
3382 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3383 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3384 	    BWN_IFSCTL_USE_EDCF);
3385 }
3386 
3387 static void
3388 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3389 {
3390 	struct bwn_softc *sc = mac->mac_sc;
3391 	struct ieee80211com *ic = &sc->sc_ic;
3392 	uint16_t delay;	/* microsec */
3393 
3394 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3395 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3396 		delay = 500;
3397 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3398 		delay = max(delay, (uint16_t)2400);
3399 
3400 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3401 }
3402 
3403 static void
3404 bwn_bt_enable(struct bwn_mac *mac)
3405 {
3406 	struct bwn_softc *sc = mac->mac_sc;
3407 	uint64_t hf;
3408 
3409 	if (bwn_bluetooth == 0)
3410 		return;
3411 	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3412 		return;
3413 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3414 		return;
3415 
3416 	hf = bwn_hf_read(mac);
3417 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3418 		hf |= BWN_HF_BT_COEXISTALT;
3419 	else
3420 		hf |= BWN_HF_BT_COEXIST;
3421 	bwn_hf_write(mac, hf);
3422 }
3423 
3424 static void
3425 bwn_set_macaddr(struct bwn_mac *mac)
3426 {
3427 
3428 	bwn_mac_write_bssid(mac);
3429 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3430 	    mac->mac_sc->sc_ic.ic_macaddr);
3431 }
3432 
3433 static void
3434 bwn_clear_keys(struct bwn_mac *mac)
3435 {
3436 	int i;
3437 
3438 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3439 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3440 		    ("%s:%d: fail", __func__, __LINE__));
3441 
3442 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3443 		    NULL, BWN_SEC_KEYSIZE, NULL);
3444 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3445 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3446 			    NULL, BWN_SEC_KEYSIZE, NULL);
3447 		}
3448 		mac->mac_key[i].keyconf = NULL;
3449 	}
3450 }
3451 
3452 static void
3453 bwn_crypt_init(struct bwn_mac *mac)
3454 {
3455 	struct bwn_softc *sc = mac->mac_sc;
3456 
3457 	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3458 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3459 	    ("%s:%d: fail", __func__, __LINE__));
3460 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3461 	mac->mac_ktp *= 2;
3462 	if (siba_get_revid(sc->sc_dev) >= 5)
3463 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3464 	bwn_clear_keys(mac);
3465 }
3466 
3467 static void
3468 bwn_chip_exit(struct bwn_mac *mac)
3469 {
3470 	struct bwn_softc *sc = mac->mac_sc;
3471 
3472 	bwn_phy_exit(mac);
3473 	siba_gpio_set(sc->sc_dev, 0);
3474 }
3475 
3476 static int
3477 bwn_fw_fillinfo(struct bwn_mac *mac)
3478 {
3479 	int error;
3480 
3481 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3482 	if (error == 0)
3483 		return (0);
3484 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3485 	if (error == 0)
3486 		return (0);
3487 	return (error);
3488 }
3489 
3490 static int
3491 bwn_gpio_init(struct bwn_mac *mac)
3492 {
3493 	struct bwn_softc *sc = mac->mac_sc;
3494 	uint32_t mask = 0x1f, set = 0xf, value;
3495 
3496 	BWN_WRITE_4(mac, BWN_MACCTL,
3497 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3498 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3499 	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3500 
3501 	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3502 		mask |= 0x0060;
3503 		set |= 0x0060;
3504 	}
3505 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3506 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3507 		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3508 		mask |= 0x0200;
3509 		set |= 0x0200;
3510 	}
3511 	if (siba_get_revid(sc->sc_dev) >= 2)
3512 		mask |= 0x0010;
3513 
3514 	value = siba_gpio_get(sc->sc_dev);
3515 	if (value == -1)
3516 		return (0);
3517 	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3518 
3519 	return (0);
3520 }
3521 
3522 static int
3523 bwn_fw_loadinitvals(struct bwn_mac *mac)
3524 {
3525 #define	GETFWOFFSET(fwp, offset)				\
3526 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3527 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3528 	const struct bwn_fwhdr *hdr;
3529 	struct bwn_fw *fw = &mac->mac_fw;
3530 	int error;
3531 
3532 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3533 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3534 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3535 	if (error)
3536 		return (error);
3537 	if (fw->initvals_band.fw) {
3538 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3539 		error = bwn_fwinitvals_write(mac,
3540 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3541 		    be32toh(hdr->size),
3542 		    fw->initvals_band.fw->datasize - hdr_len);
3543 	}
3544 	return (error);
3545 #undef GETFWOFFSET
3546 }
3547 
3548 static int
3549 bwn_phy_init(struct bwn_mac *mac)
3550 {
3551 	struct bwn_softc *sc = mac->mac_sc;
3552 	int error;
3553 
3554 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3555 	mac->mac_phy.rf_onoff(mac, 1);
3556 	error = mac->mac_phy.init(mac);
3557 	if (error) {
3558 		device_printf(sc->sc_dev, "PHY init failed\n");
3559 		goto fail0;
3560 	}
3561 	error = bwn_switch_channel(mac,
3562 	    mac->mac_phy.get_default_chan(mac));
3563 	if (error) {
3564 		device_printf(sc->sc_dev,
3565 		    "failed to switch default channel\n");
3566 		goto fail1;
3567 	}
3568 	return (0);
3569 fail1:
3570 	if (mac->mac_phy.exit)
3571 		mac->mac_phy.exit(mac);
3572 fail0:
3573 	mac->mac_phy.rf_onoff(mac, 0);
3574 
3575 	return (error);
3576 }
3577 
3578 static void
3579 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3580 {
3581 	uint16_t ant;
3582 	uint16_t tmp;
3583 
3584 	ant = bwn_ant2phy(antenna);
3585 
3586 	/* For ACK/CTS */
3587 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3588 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3589 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3590 	/* For Probe Resposes */
3591 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3592 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3593 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3594 }
3595 
3596 static void
3597 bwn_set_opmode(struct bwn_mac *mac)
3598 {
3599 	struct bwn_softc *sc = mac->mac_sc;
3600 	struct ieee80211com *ic = &sc->sc_ic;
3601 	uint32_t ctl;
3602 	uint16_t cfp_pretbtt;
3603 
3604 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3605 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3606 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3607 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3608 	ctl |= BWN_MACCTL_STA;
3609 
3610 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3611 	    ic->ic_opmode == IEEE80211_M_MBSS)
3612 		ctl |= BWN_MACCTL_HOSTAP;
3613 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3614 		ctl &= ~BWN_MACCTL_STA;
3615 	ctl |= sc->sc_filters;
3616 
3617 	if (siba_get_revid(sc->sc_dev) <= 4)
3618 		ctl |= BWN_MACCTL_PROMISC;
3619 
3620 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3621 
3622 	cfp_pretbtt = 2;
3623 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3624 		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3625 		    siba_get_chiprev(sc->sc_dev) == 3)
3626 			cfp_pretbtt = 100;
3627 		else
3628 			cfp_pretbtt = 50;
3629 	}
3630 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3631 }
3632 
3633 static int
3634 bwn_dma_gettype(struct bwn_mac *mac)
3635 {
3636 	uint32_t tmp;
3637 	uint16_t base;
3638 
3639 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3640 	if (tmp & SIBA_TGSHIGH_DMA64)
3641 		return (BWN_DMA_64BIT);
3642 	base = bwn_dma_base(0, 0);
3643 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3644 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3645 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3646 		return (BWN_DMA_32BIT);
3647 
3648 	return (BWN_DMA_30BIT);
3649 }
3650 
3651 static void
3652 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3653 {
3654 	if (!error) {
3655 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3656 		*((bus_addr_t *)arg) = seg->ds_addr;
3657 	}
3658 }
3659 
3660 void
3661 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3662 {
3663 	struct bwn_phy *phy = &mac->mac_phy;
3664 	struct bwn_softc *sc = mac->mac_sc;
3665 	unsigned int i, max_loop;
3666 	uint16_t value;
3667 	uint32_t buffer[5] = {
3668 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3669 	};
3670 
3671 	if (ofdm) {
3672 		max_loop = 0x1e;
3673 		buffer[0] = 0x000201cc;
3674 	} else {
3675 		max_loop = 0xfa;
3676 		buffer[0] = 0x000b846e;
3677 	}
3678 
3679 	BWN_ASSERT_LOCKED(mac->mac_sc);
3680 
3681 	for (i = 0; i < 5; i++)
3682 		bwn_ram_write(mac, i * 4, buffer[i]);
3683 
3684 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3685 	BWN_WRITE_2(mac, 0x07c0,
3686 	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3687 
3688 	value = (ofdm ? 0x41 : 0x40);
3689 	BWN_WRITE_2(mac, 0x050c, value);
3690 
3691 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3692 	    phy->type == BWN_PHYTYPE_LCN)
3693 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3694 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3695 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3696 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3697 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3698 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3699 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3700 
3701 	/* XXX TODO: n phy pa override? */
3702 
3703 	switch (phy->type) {
3704 	case BWN_PHYTYPE_N:
3705 	case BWN_PHYTYPE_LCN:
3706 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3707 		break;
3708 	case BWN_PHYTYPE_LP:
3709 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3710 		break;
3711 	default:
3712 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3713 		break;
3714 	}
3715 
3716 	/* flush */
3717 	BWN_READ_2(mac, 0x0502);
3718 
3719 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3720 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3721 	for (i = 0x00; i < max_loop; i++) {
3722 		value = BWN_READ_2(mac, 0x050e);
3723 		if (value & 0x0080)
3724 			break;
3725 		DELAY(10);
3726 	}
3727 	for (i = 0x00; i < 0x0a; i++) {
3728 		value = BWN_READ_2(mac, 0x050e);
3729 		if (value & 0x0400)
3730 			break;
3731 		DELAY(10);
3732 	}
3733 	for (i = 0x00; i < 0x19; i++) {
3734 		value = BWN_READ_2(mac, 0x0690);
3735 		if (!(value & 0x0100))
3736 			break;
3737 		DELAY(10);
3738 	}
3739 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3740 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3741 }
3742 
3743 void
3744 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3745 {
3746 	uint32_t macctl;
3747 
3748 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3749 
3750 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3751 	if (macctl & BWN_MACCTL_BIGENDIAN)
3752 		printf("TODO: need swap\n");
3753 
3754 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3755 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3756 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3757 }
3758 
3759 void
3760 bwn_mac_suspend(struct bwn_mac *mac)
3761 {
3762 	struct bwn_softc *sc = mac->mac_sc;
3763 	int i;
3764 	uint32_t tmp;
3765 
3766 	KASSERT(mac->mac_suspended >= 0,
3767 	    ("%s:%d: fail", __func__, __LINE__));
3768 
3769 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3770 	    __func__, mac->mac_suspended);
3771 
3772 	if (mac->mac_suspended == 0) {
3773 		bwn_psctl(mac, BWN_PS_AWAKE);
3774 		BWN_WRITE_4(mac, BWN_MACCTL,
3775 			    BWN_READ_4(mac, BWN_MACCTL)
3776 			    & ~BWN_MACCTL_ON);
3777 		BWN_READ_4(mac, BWN_MACCTL);
3778 		for (i = 35; i; i--) {
3779 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3780 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3781 				goto out;
3782 			DELAY(10);
3783 		}
3784 		for (i = 40; i; i--) {
3785 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3786 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3787 				goto out;
3788 			DELAY(1000);
3789 		}
3790 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3791 	}
3792 out:
3793 	mac->mac_suspended++;
3794 }
3795 
3796 void
3797 bwn_mac_enable(struct bwn_mac *mac)
3798 {
3799 	struct bwn_softc *sc = mac->mac_sc;
3800 	uint16_t state;
3801 
3802 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3803 	    __func__, mac->mac_suspended);
3804 
3805 	state = bwn_shm_read_2(mac, BWN_SHARED,
3806 	    BWN_SHARED_UCODESTAT);
3807 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3808 	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3809 		DPRINTF(sc, BWN_DEBUG_FW,
3810 		    "%s: warn: firmware state (%d)\n",
3811 		    __func__, state);
3812 	}
3813 
3814 	mac->mac_suspended--;
3815 	KASSERT(mac->mac_suspended >= 0,
3816 	    ("%s:%d: fail", __func__, __LINE__));
3817 	if (mac->mac_suspended == 0) {
3818 		BWN_WRITE_4(mac, BWN_MACCTL,
3819 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3820 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3821 		BWN_READ_4(mac, BWN_MACCTL);
3822 		BWN_READ_4(mac, BWN_INTR_REASON);
3823 		bwn_psctl(mac, 0);
3824 	}
3825 }
3826 
3827 void
3828 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3829 {
3830 	struct bwn_softc *sc = mac->mac_sc;
3831 	int i;
3832 	uint16_t ucstat;
3833 
3834 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3835 	    ("%s:%d: fail", __func__, __LINE__));
3836 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3837 	    ("%s:%d: fail", __func__, __LINE__));
3838 
3839 	/* XXX forcibly awake and hwps-off */
3840 
3841 	BWN_WRITE_4(mac, BWN_MACCTL,
3842 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3843 	    ~BWN_MACCTL_HWPS);
3844 	BWN_READ_4(mac, BWN_MACCTL);
3845 	if (siba_get_revid(sc->sc_dev) >= 5) {
3846 		for (i = 0; i < 100; i++) {
3847 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3848 			    BWN_SHARED_UCODESTAT);
3849 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3850 				break;
3851 			DELAY(10);
3852 		}
3853 	}
3854 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3855 	    ucstat);
3856 }
3857 
3858 static int
3859 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3860 {
3861 	struct bwn_softc *sc = mac->mac_sc;
3862 	struct bwn_fw *fw = &mac->mac_fw;
3863 	const uint8_t rev = siba_get_revid(sc->sc_dev);
3864 	const char *filename;
3865 	uint32_t high;
3866 	int error;
3867 
3868 	/* microcode */
3869 	filename = NULL;
3870 	switch (rev) {
3871 	case 42:
3872 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3873 			filename = "ucode42";
3874 		break;
3875 	case 40:
3876 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3877 			filename = "ucode40";
3878 		break;
3879 	case 33:
3880 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3881 			filename = "ucode33_lcn40";
3882 		break;
3883 	case 30:
3884 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3885 			filename = "ucode30_mimo";
3886 		break;
3887 	case 29:
3888 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3889 			filename = "ucode29_mimo";
3890 		break;
3891 	case 26:
3892 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3893 			filename = "ucode26_mimo";
3894 		break;
3895 	case 28:
3896 	case 25:
3897 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3898 			filename = "ucode25_mimo";
3899 		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3900 			filename = "ucode25_lcn";
3901 		break;
3902 	case 24:
3903 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3904 			filename = "ucode24_lcn";
3905 		break;
3906 	case 23:
3907 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3908 			filename = "ucode16_mimo";
3909 		break;
3910 	case 16:
3911 	case 17:
3912 	case 18:
3913 	case 19:
3914 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3915 			filename = "ucode16_mimo";
3916 		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3917 			filename = "ucode16_lp";
3918 		break;
3919 	case 15:
3920 		filename = "ucode15";
3921 		break;
3922 	case 14:
3923 		filename = "ucode14";
3924 		break;
3925 	case 13:
3926 		filename = "ucode13";
3927 		break;
3928 	case 12:
3929 	case 11:
3930 		filename = "ucode11";
3931 		break;
3932 	case 10:
3933 	case 9:
3934 	case 8:
3935 	case 7:
3936 	case 6:
3937 	case 5:
3938 		filename = "ucode5";
3939 		break;
3940 	default:
3941 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3942 		bwn_release_firmware(mac);
3943 		return (EOPNOTSUPP);
3944 	}
3945 
3946 	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3947 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3948 	if (error) {
3949 		bwn_release_firmware(mac);
3950 		return (error);
3951 	}
3952 
3953 	/* PCM */
3954 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3955 	if (rev >= 5 && rev <= 10) {
3956 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3957 		if (error == ENOENT)
3958 			fw->no_pcmfile = 1;
3959 		else if (error) {
3960 			bwn_release_firmware(mac);
3961 			return (error);
3962 		}
3963 	} else if (rev < 11) {
3964 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3965 		bwn_release_firmware(mac);
3966 		return (EOPNOTSUPP);
3967 	}
3968 
3969 	/* initvals */
3970 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3971 	switch (mac->mac_phy.type) {
3972 	case BWN_PHYTYPE_A:
3973 		if (rev < 5 || rev > 10)
3974 			goto fail1;
3975 		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3976 			filename = "a0g1initvals5";
3977 		else
3978 			filename = "a0g0initvals5";
3979 		break;
3980 	case BWN_PHYTYPE_G:
3981 		if (rev >= 5 && rev <= 10)
3982 			filename = "b0g0initvals5";
3983 		else if (rev >= 13)
3984 			filename = "b0g0initvals13";
3985 		else
3986 			goto fail1;
3987 		break;
3988 	case BWN_PHYTYPE_LP:
3989 		if (rev == 13)
3990 			filename = "lp0initvals13";
3991 		else if (rev == 14)
3992 			filename = "lp0initvals14";
3993 		else if (rev >= 15)
3994 			filename = "lp0initvals15";
3995 		else
3996 			goto fail1;
3997 		break;
3998 	case BWN_PHYTYPE_N:
3999 		if (rev == 30)
4000 			filename = "n16initvals30";
4001 		else if (rev == 28 || rev == 25)
4002 			filename = "n0initvals25";
4003 		else if (rev == 24)
4004 			filename = "n0initvals24";
4005 		else if (rev == 23)
4006 			filename = "n0initvals16";
4007 		else if (rev >= 16 && rev <= 18)
4008 			filename = "n0initvals16";
4009 		else if (rev >= 11 && rev <= 12)
4010 			filename = "n0initvals11";
4011 		else
4012 			goto fail1;
4013 		break;
4014 	default:
4015 		goto fail1;
4016 	}
4017 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
4018 	if (error) {
4019 		bwn_release_firmware(mac);
4020 		return (error);
4021 	}
4022 
4023 	/* bandswitch initvals */
4024 	switch (mac->mac_phy.type) {
4025 	case BWN_PHYTYPE_A:
4026 		if (rev >= 5 && rev <= 10) {
4027 			if (high & BWN_TGSHIGH_HAVE_2GHZ)
4028 				filename = "a0g1bsinitvals5";
4029 			else
4030 				filename = "a0g0bsinitvals5";
4031 		} else if (rev >= 11)
4032 			filename = NULL;
4033 		else
4034 			goto fail1;
4035 		break;
4036 	case BWN_PHYTYPE_G:
4037 		if (rev >= 5 && rev <= 10)
4038 			filename = "b0g0bsinitvals5";
4039 		else if (rev >= 11)
4040 			filename = NULL;
4041 		else
4042 			goto fail1;
4043 		break;
4044 	case BWN_PHYTYPE_LP:
4045 		if (rev == 13)
4046 			filename = "lp0bsinitvals13";
4047 		else if (rev == 14)
4048 			filename = "lp0bsinitvals14";
4049 		else if (rev >= 15)
4050 			filename = "lp0bsinitvals15";
4051 		else
4052 			goto fail1;
4053 		break;
4054 	case BWN_PHYTYPE_N:
4055 		if (rev == 30)
4056 			filename = "n16bsinitvals30";
4057 		else if (rev == 28 || rev == 25)
4058 			filename = "n0bsinitvals25";
4059 		else if (rev == 24)
4060 			filename = "n0bsinitvals24";
4061 		else if (rev == 23)
4062 			filename = "n0bsinitvals16";
4063 		else if (rev >= 16 && rev <= 18)
4064 			filename = "n0bsinitvals16";
4065 		else if (rev >= 11 && rev <= 12)
4066 			filename = "n0bsinitvals11";
4067 		else
4068 			goto fail1;
4069 		break;
4070 	default:
4071 		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4072 		    mac->mac_phy.type);
4073 		goto fail1;
4074 	}
4075 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4076 	if (error) {
4077 		bwn_release_firmware(mac);
4078 		return (error);
4079 	}
4080 	return (0);
4081 fail1:
4082 	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4083 	    rev, mac->mac_phy.type);
4084 	bwn_release_firmware(mac);
4085 	return (EOPNOTSUPP);
4086 }
4087 
4088 static int
4089 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4090     const char *name, struct bwn_fwfile *bfw)
4091 {
4092 	const struct bwn_fwhdr *hdr;
4093 	struct bwn_softc *sc = mac->mac_sc;
4094 	const struct firmware *fw;
4095 	char namebuf[64];
4096 
4097 	if (name == NULL) {
4098 		bwn_do_release_fw(bfw);
4099 		return (0);
4100 	}
4101 	if (bfw->filename != NULL) {
4102 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4103 			return (0);
4104 		bwn_do_release_fw(bfw);
4105 	}
4106 
4107 	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4108 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4109 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4110 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4111 	fw = firmware_get(namebuf);
4112 	if (fw == NULL) {
4113 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4114 		    namebuf);
4115 		return (ENOENT);
4116 	}
4117 	if (fw->datasize < sizeof(struct bwn_fwhdr))
4118 		goto fail;
4119 	hdr = (const struct bwn_fwhdr *)(fw->data);
4120 	switch (hdr->type) {
4121 	case BWN_FWTYPE_UCODE:
4122 	case BWN_FWTYPE_PCM:
4123 		if (be32toh(hdr->size) !=
4124 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4125 			goto fail;
4126 		/* FALLTHROUGH */
4127 	case BWN_FWTYPE_IV:
4128 		if (hdr->ver != 1)
4129 			goto fail;
4130 		break;
4131 	default:
4132 		goto fail;
4133 	}
4134 	bfw->filename = name;
4135 	bfw->fw = fw;
4136 	bfw->type = type;
4137 	return (0);
4138 fail:
4139 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4140 	if (fw != NULL)
4141 		firmware_put(fw, FIRMWARE_UNLOAD);
4142 	return (EPROTO);
4143 }
4144 
4145 static void
4146 bwn_release_firmware(struct bwn_mac *mac)
4147 {
4148 
4149 	bwn_do_release_fw(&mac->mac_fw.ucode);
4150 	bwn_do_release_fw(&mac->mac_fw.pcm);
4151 	bwn_do_release_fw(&mac->mac_fw.initvals);
4152 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4153 }
4154 
4155 static void
4156 bwn_do_release_fw(struct bwn_fwfile *bfw)
4157 {
4158 
4159 	if (bfw->fw != NULL)
4160 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4161 	bfw->fw = NULL;
4162 	bfw->filename = NULL;
4163 }
4164 
4165 static int
4166 bwn_fw_loaducode(struct bwn_mac *mac)
4167 {
4168 #define	GETFWOFFSET(fwp, offset)	\
4169 	((const uint32_t *)((const char *)fwp.fw->data + offset))
4170 #define	GETFWSIZE(fwp, offset)	\
4171 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4172 	struct bwn_softc *sc = mac->mac_sc;
4173 	const uint32_t *data;
4174 	unsigned int i;
4175 	uint32_t ctl;
4176 	uint16_t date, fwcaps, time;
4177 	int error = 0;
4178 
4179 	ctl = BWN_READ_4(mac, BWN_MACCTL);
4180 	ctl |= BWN_MACCTL_MCODE_JMP0;
4181 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4182 	    __LINE__));
4183 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4184 	for (i = 0; i < 64; i++)
4185 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4186 	for (i = 0; i < 4096; i += 2)
4187 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4188 
4189 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4190 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4191 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4192 	     i++) {
4193 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4194 		DELAY(10);
4195 	}
4196 
4197 	if (mac->mac_fw.pcm.fw) {
4198 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4199 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4200 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4201 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4202 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4203 		    sizeof(struct bwn_fwhdr)); i++) {
4204 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4205 			DELAY(10);
4206 		}
4207 	}
4208 
4209 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4210 	BWN_WRITE_4(mac, BWN_MACCTL,
4211 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4212 	    BWN_MACCTL_MCODE_RUN);
4213 
4214 	for (i = 0; i < 21; i++) {
4215 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4216 			break;
4217 		if (i >= 20) {
4218 			device_printf(sc->sc_dev, "ucode timeout\n");
4219 			error = ENXIO;
4220 			goto error;
4221 		}
4222 		DELAY(50000);
4223 	}
4224 	BWN_READ_4(mac, BWN_INTR_REASON);
4225 
4226 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4227 	if (mac->mac_fw.rev <= 0x128) {
4228 		device_printf(sc->sc_dev, "the firmware is too old\n");
4229 		error = EOPNOTSUPP;
4230 		goto error;
4231 	}
4232 
4233 	/*
4234 	 * Determine firmware header version; needed for TX/RX packet
4235 	 * handling.
4236 	 */
4237 	if (mac->mac_fw.rev >= 598)
4238 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4239 	else if (mac->mac_fw.rev >= 410)
4240 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4241 	else
4242 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4243 
4244 	/*
4245 	 * We don't support rev 598 or later; that requires
4246 	 * another round of changes to the TX/RX descriptor
4247 	 * and status layout.
4248 	 *
4249 	 * So, complain this is the case and exit out, rather
4250 	 * than attaching and then failing.
4251 	 */
4252 #if 0
4253 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4254 		device_printf(sc->sc_dev,
4255 		    "firmware is too new (>=598); not supported\n");
4256 		error = EOPNOTSUPP;
4257 		goto error;
4258 	}
4259 #endif
4260 
4261 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4262 	    BWN_SHARED_UCODE_PATCH);
4263 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4264 	mac->mac_fw.opensource = (date == 0xffff);
4265 	if (bwn_wme != 0)
4266 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4267 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4268 
4269 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4270 	if (mac->mac_fw.opensource == 0) {
4271 		device_printf(sc->sc_dev,
4272 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4273 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4274 		if (mac->mac_fw.no_pcmfile)
4275 			device_printf(sc->sc_dev,
4276 			    "no HW crypto acceleration due to pcm5\n");
4277 	} else {
4278 		mac->mac_fw.patch = time;
4279 		fwcaps = bwn_fwcaps_read(mac);
4280 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4281 			device_printf(sc->sc_dev,
4282 			    "disabling HW crypto acceleration\n");
4283 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4284 		}
4285 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4286 			device_printf(sc->sc_dev, "disabling WME support\n");
4287 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4288 		}
4289 	}
4290 
4291 	if (BWN_ISOLDFMT(mac))
4292 		device_printf(sc->sc_dev, "using old firmware image\n");
4293 
4294 	return (0);
4295 
4296 error:
4297 	BWN_WRITE_4(mac, BWN_MACCTL,
4298 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4299 	    BWN_MACCTL_MCODE_JMP0);
4300 
4301 	return (error);
4302 #undef GETFWSIZE
4303 #undef GETFWOFFSET
4304 }
4305 
4306 /* OpenFirmware only */
4307 static uint16_t
4308 bwn_fwcaps_read(struct bwn_mac *mac)
4309 {
4310 
4311 	KASSERT(mac->mac_fw.opensource == 1,
4312 	    ("%s:%d: fail", __func__, __LINE__));
4313 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4314 }
4315 
4316 static int
4317 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4318     size_t count, size_t array_size)
4319 {
4320 #define	GET_NEXTIV16(iv)						\
4321 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4322 	    sizeof(uint16_t) + sizeof(uint16_t)))
4323 #define	GET_NEXTIV32(iv)						\
4324 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4325 	    sizeof(uint16_t) + sizeof(uint32_t)))
4326 	struct bwn_softc *sc = mac->mac_sc;
4327 	const struct bwn_fwinitvals *iv;
4328 	uint16_t offset;
4329 	size_t i;
4330 	uint8_t bit32;
4331 
4332 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4333 	    ("%s:%d: fail", __func__, __LINE__));
4334 	iv = ivals;
4335 	for (i = 0; i < count; i++) {
4336 		if (array_size < sizeof(iv->offset_size))
4337 			goto fail;
4338 		array_size -= sizeof(iv->offset_size);
4339 		offset = be16toh(iv->offset_size);
4340 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4341 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4342 		if (offset >= 0x1000)
4343 			goto fail;
4344 		if (bit32) {
4345 			if (array_size < sizeof(iv->data.d32))
4346 				goto fail;
4347 			array_size -= sizeof(iv->data.d32);
4348 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4349 			iv = GET_NEXTIV32(iv);
4350 		} else {
4351 
4352 			if (array_size < sizeof(iv->data.d16))
4353 				goto fail;
4354 			array_size -= sizeof(iv->data.d16);
4355 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4356 
4357 			iv = GET_NEXTIV16(iv);
4358 		}
4359 	}
4360 	if (array_size != 0)
4361 		goto fail;
4362 	return (0);
4363 fail:
4364 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4365 	return (EPROTO);
4366 #undef GET_NEXTIV16
4367 #undef GET_NEXTIV32
4368 }
4369 
4370 int
4371 bwn_switch_channel(struct bwn_mac *mac, int chan)
4372 {
4373 	struct bwn_phy *phy = &(mac->mac_phy);
4374 	struct bwn_softc *sc = mac->mac_sc;
4375 	struct ieee80211com *ic = &sc->sc_ic;
4376 	uint16_t channelcookie, savedcookie;
4377 	int error;
4378 
4379 	if (chan == 0xffff)
4380 		chan = phy->get_default_chan(mac);
4381 
4382 	channelcookie = chan;
4383 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4384 		channelcookie |= 0x100;
4385 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4386 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4387 	error = phy->switch_channel(mac, chan);
4388 	if (error)
4389 		goto fail;
4390 
4391 	mac->mac_phy.chan = chan;
4392 	DELAY(8000);
4393 	return (0);
4394 fail:
4395 	device_printf(sc->sc_dev, "failed to switch channel\n");
4396 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4397 	return (error);
4398 }
4399 
4400 static uint16_t
4401 bwn_ant2phy(int antenna)
4402 {
4403 
4404 	switch (antenna) {
4405 	case BWN_ANT0:
4406 		return (BWN_TX_PHY_ANT0);
4407 	case BWN_ANT1:
4408 		return (BWN_TX_PHY_ANT1);
4409 	case BWN_ANT2:
4410 		return (BWN_TX_PHY_ANT2);
4411 	case BWN_ANT3:
4412 		return (BWN_TX_PHY_ANT3);
4413 	case BWN_ANTAUTO:
4414 		return (BWN_TX_PHY_ANT01AUTO);
4415 	}
4416 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4417 	return (0);
4418 }
4419 
4420 static void
4421 bwn_wme_load(struct bwn_mac *mac)
4422 {
4423 	struct bwn_softc *sc = mac->mac_sc;
4424 	int i;
4425 
4426 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4427 	    ("%s:%d: fail", __func__, __LINE__));
4428 
4429 	bwn_mac_suspend(mac);
4430 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4431 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4432 		    bwn_wme_shm_offsets[i]);
4433 	bwn_mac_enable(mac);
4434 }
4435 
4436 static void
4437 bwn_wme_loadparams(struct bwn_mac *mac,
4438     const struct wmeParams *p, uint16_t shm_offset)
4439 {
4440 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4441 	struct bwn_softc *sc = mac->mac_sc;
4442 	uint16_t params[BWN_NR_WMEPARAMS];
4443 	int slot, tmp;
4444 	unsigned int i;
4445 
4446 	slot = BWN_READ_2(mac, BWN_RNG) &
4447 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4448 
4449 	memset(&params, 0, sizeof(params));
4450 
4451 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4452 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4453 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4454 
4455 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4456 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4457 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4458 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4459 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4460 	params[BWN_WMEPARAM_BSLOTS] = slot;
4461 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4462 
4463 	for (i = 0; i < N(params); i++) {
4464 		if (i == BWN_WMEPARAM_STATUS) {
4465 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4466 			    shm_offset + (i * 2));
4467 			tmp |= 0x100;
4468 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4469 			    tmp);
4470 		} else {
4471 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4472 			    params[i]);
4473 		}
4474 	}
4475 }
4476 
4477 static void
4478 bwn_mac_write_bssid(struct bwn_mac *mac)
4479 {
4480 	struct bwn_softc *sc = mac->mac_sc;
4481 	uint32_t tmp;
4482 	int i;
4483 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4484 
4485 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4486 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4487 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4488 	    IEEE80211_ADDR_LEN);
4489 
4490 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4491 		tmp = (uint32_t) (mac_bssid[i + 0]);
4492 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4493 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4494 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4495 		bwn_ram_write(mac, 0x20 + i, tmp);
4496 	}
4497 }
4498 
4499 static void
4500 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4501     const uint8_t *macaddr)
4502 {
4503 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4504 	uint16_t data;
4505 
4506 	if (!mac)
4507 		macaddr = zero;
4508 
4509 	offset |= 0x0020;
4510 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4511 
4512 	data = macaddr[0];
4513 	data |= macaddr[1] << 8;
4514 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4515 	data = macaddr[2];
4516 	data |= macaddr[3] << 8;
4517 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4518 	data = macaddr[4];
4519 	data |= macaddr[5] << 8;
4520 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4521 }
4522 
4523 static void
4524 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4525     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4526 {
4527 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4528 	uint8_t per_sta_keys_start = 8;
4529 
4530 	if (BWN_SEC_NEWAPI(mac))
4531 		per_sta_keys_start = 4;
4532 
4533 	KASSERT(index < mac->mac_max_nr_keys,
4534 	    ("%s:%d: fail", __func__, __LINE__));
4535 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4536 	    ("%s:%d: fail", __func__, __LINE__));
4537 
4538 	if (index >= per_sta_keys_start)
4539 		bwn_key_macwrite(mac, index, NULL);
4540 	if (key)
4541 		memcpy(buf, key, key_len);
4542 	bwn_key_write(mac, index, algorithm, buf);
4543 	if (index >= per_sta_keys_start)
4544 		bwn_key_macwrite(mac, index, mac_addr);
4545 
4546 	mac->mac_key[index].algorithm = algorithm;
4547 }
4548 
4549 static void
4550 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4551 {
4552 	struct bwn_softc *sc = mac->mac_sc;
4553 	uint32_t addrtmp[2] = { 0, 0 };
4554 	uint8_t start = 8;
4555 
4556 	if (BWN_SEC_NEWAPI(mac))
4557 		start = 4;
4558 
4559 	KASSERT(index >= start,
4560 	    ("%s:%d: fail", __func__, __LINE__));
4561 	index -= start;
4562 
4563 	if (addr) {
4564 		addrtmp[0] = addr[0];
4565 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4566 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4567 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4568 		addrtmp[1] = addr[4];
4569 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4570 	}
4571 
4572 	if (siba_get_revid(sc->sc_dev) >= 5) {
4573 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4574 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4575 	} else {
4576 		if (index >= 8) {
4577 			bwn_shm_write_4(mac, BWN_SHARED,
4578 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4579 			bwn_shm_write_2(mac, BWN_SHARED,
4580 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4581 		}
4582 	}
4583 }
4584 
4585 static void
4586 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4587     const uint8_t *key)
4588 {
4589 	unsigned int i;
4590 	uint32_t offset;
4591 	uint16_t kidx, value;
4592 
4593 	kidx = BWN_SEC_KEY2FW(mac, index);
4594 	bwn_shm_write_2(mac, BWN_SHARED,
4595 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4596 
4597 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4598 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4599 		value = key[i];
4600 		value |= (uint16_t)(key[i + 1]) << 8;
4601 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4602 	}
4603 }
4604 
4605 static void
4606 bwn_phy_exit(struct bwn_mac *mac)
4607 {
4608 
4609 	mac->mac_phy.rf_onoff(mac, 0);
4610 	if (mac->mac_phy.exit != NULL)
4611 		mac->mac_phy.exit(mac);
4612 }
4613 
4614 static void
4615 bwn_dma_free(struct bwn_mac *mac)
4616 {
4617 	struct bwn_dma *dma;
4618 
4619 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4620 		return;
4621 	dma = &mac->mac_method.dma;
4622 
4623 	bwn_dma_ringfree(&dma->rx);
4624 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4625 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4626 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4627 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4628 	bwn_dma_ringfree(&dma->mcast);
4629 }
4630 
4631 static void
4632 bwn_core_stop(struct bwn_mac *mac)
4633 {
4634 	struct bwn_softc *sc = mac->mac_sc;
4635 
4636 	BWN_ASSERT_LOCKED(sc);
4637 
4638 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4639 		return;
4640 
4641 	callout_stop(&sc->sc_rfswitch_ch);
4642 	callout_stop(&sc->sc_task_ch);
4643 	callout_stop(&sc->sc_watchdog_ch);
4644 	sc->sc_watchdog_timer = 0;
4645 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4646 	BWN_READ_4(mac, BWN_INTR_MASK);
4647 	bwn_mac_suspend(mac);
4648 
4649 	mac->mac_status = BWN_MAC_STATUS_INITED;
4650 }
4651 
4652 static int
4653 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4654 {
4655 	struct bwn_mac *up_dev = NULL;
4656 	struct bwn_mac *down_dev;
4657 	struct bwn_mac *mac;
4658 	int err, status;
4659 	uint8_t gmode;
4660 
4661 	BWN_ASSERT_LOCKED(sc);
4662 
4663 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4664 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4665 		    mac->mac_phy.supports_2ghz) {
4666 			up_dev = mac;
4667 			gmode = 1;
4668 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4669 		    mac->mac_phy.supports_5ghz) {
4670 			up_dev = mac;
4671 			gmode = 0;
4672 		} else {
4673 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4674 			return (EINVAL);
4675 		}
4676 		if (up_dev != NULL)
4677 			break;
4678 	}
4679 	if (up_dev == NULL) {
4680 		device_printf(sc->sc_dev, "Could not find a device\n");
4681 		return (ENODEV);
4682 	}
4683 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4684 		return (0);
4685 
4686 	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4687 	    "switching to %s-GHz band\n",
4688 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4689 
4690 	down_dev = sc->sc_curmac;
4691 	status = down_dev->mac_status;
4692 	if (status >= BWN_MAC_STATUS_STARTED)
4693 		bwn_core_stop(down_dev);
4694 	if (status >= BWN_MAC_STATUS_INITED)
4695 		bwn_core_exit(down_dev);
4696 
4697 	if (down_dev != up_dev)
4698 		bwn_phy_reset(down_dev);
4699 
4700 	up_dev->mac_phy.gmode = gmode;
4701 	if (status >= BWN_MAC_STATUS_INITED) {
4702 		err = bwn_core_init(up_dev);
4703 		if (err) {
4704 			device_printf(sc->sc_dev,
4705 			    "fatal: failed to initialize for %s-GHz\n",
4706 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4707 			goto fail;
4708 		}
4709 	}
4710 	if (status >= BWN_MAC_STATUS_STARTED)
4711 		bwn_core_start(up_dev);
4712 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4713 	sc->sc_curmac = up_dev;
4714 
4715 	return (0);
4716 fail:
4717 	sc->sc_curmac = NULL;
4718 	return (err);
4719 }
4720 
4721 static void
4722 bwn_rf_turnon(struct bwn_mac *mac)
4723 {
4724 
4725 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4726 
4727 	bwn_mac_suspend(mac);
4728 	mac->mac_phy.rf_onoff(mac, 1);
4729 	mac->mac_phy.rf_on = 1;
4730 	bwn_mac_enable(mac);
4731 }
4732 
4733 static void
4734 bwn_rf_turnoff(struct bwn_mac *mac)
4735 {
4736 
4737 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4738 
4739 	bwn_mac_suspend(mac);
4740 	mac->mac_phy.rf_onoff(mac, 0);
4741 	mac->mac_phy.rf_on = 0;
4742 	bwn_mac_enable(mac);
4743 }
4744 
4745 /*
4746  * PHY reset.
4747  */
4748 static void
4749 bwn_phy_reset(struct bwn_mac *mac)
4750 {
4751 	struct bwn_softc *sc = mac->mac_sc;
4752 
4753 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4754 	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4755 	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4756 	DELAY(1000);
4757 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4758 	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4759 	DELAY(1000);
4760 }
4761 
4762 static int
4763 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4764 {
4765 	struct bwn_vap *bvp = BWN_VAP(vap);
4766 	struct ieee80211com *ic= vap->iv_ic;
4767 	enum ieee80211_state ostate = vap->iv_state;
4768 	struct bwn_softc *sc = ic->ic_softc;
4769 	struct bwn_mac *mac = sc->sc_curmac;
4770 	int error;
4771 
4772 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4773 	    ieee80211_state_name[vap->iv_state],
4774 	    ieee80211_state_name[nstate]);
4775 
4776 	error = bvp->bv_newstate(vap, nstate, arg);
4777 	if (error != 0)
4778 		return (error);
4779 
4780 	BWN_LOCK(sc);
4781 
4782 	bwn_led_newstate(mac, nstate);
4783 
4784 	/*
4785 	 * Clear the BSSID when we stop a STA
4786 	 */
4787 	if (vap->iv_opmode == IEEE80211_M_STA) {
4788 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4789 			/*
4790 			 * Clear out the BSSID.  If we reassociate to
4791 			 * the same AP, this will reinialize things
4792 			 * correctly...
4793 			 */
4794 			if (ic->ic_opmode == IEEE80211_M_STA &&
4795 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4796 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4797 				bwn_set_macaddr(mac);
4798 			}
4799 		}
4800 	}
4801 
4802 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4803 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4804 		/* XXX nothing to do? */
4805 	} else if (nstate == IEEE80211_S_RUN) {
4806 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4807 		bwn_set_opmode(mac);
4808 		bwn_set_pretbtt(mac);
4809 		bwn_spu_setdelay(mac, 0);
4810 		bwn_set_macaddr(mac);
4811 	}
4812 
4813 	BWN_UNLOCK(sc);
4814 
4815 	return (error);
4816 }
4817 
4818 static void
4819 bwn_set_pretbtt(struct bwn_mac *mac)
4820 {
4821 	struct bwn_softc *sc = mac->mac_sc;
4822 	struct ieee80211com *ic = &sc->sc_ic;
4823 	uint16_t pretbtt;
4824 
4825 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4826 		pretbtt = 2;
4827 	else
4828 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4829 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4830 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4831 }
4832 
4833 static int
4834 bwn_intr(void *arg)
4835 {
4836 	struct bwn_mac *mac = arg;
4837 	struct bwn_softc *sc = mac->mac_sc;
4838 	uint32_t reason;
4839 
4840 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4841 	    (sc->sc_flags & BWN_FLAG_INVALID))
4842 		return (FILTER_STRAY);
4843 
4844 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4845 
4846 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4847 	if (reason == 0xffffffff)	/* shared IRQ */
4848 		return (FILTER_STRAY);
4849 	reason &= mac->mac_intr_mask;
4850 	if (reason == 0)
4851 		return (FILTER_HANDLED);
4852 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4853 
4854 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4855 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4856 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4857 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4858 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4859 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4860 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4861 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4862 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4863 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4864 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4865 
4866 	/* Disable interrupts. */
4867 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4868 
4869 	mac->mac_reason_intr = reason;
4870 
4871 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4872 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4873 
4874 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4875 	return (FILTER_HANDLED);
4876 }
4877 
4878 static void
4879 bwn_intrtask(void *arg, int npending)
4880 {
4881 	struct bwn_mac *mac = arg;
4882 	struct bwn_softc *sc = mac->mac_sc;
4883 	uint32_t merged = 0;
4884 	int i, tx = 0, rx = 0;
4885 
4886 	BWN_LOCK(sc);
4887 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4888 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4889 		BWN_UNLOCK(sc);
4890 		return;
4891 	}
4892 
4893 	for (i = 0; i < N(mac->mac_reason); i++)
4894 		merged |= mac->mac_reason[i];
4895 
4896 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4897 		device_printf(sc->sc_dev, "MAC trans error\n");
4898 
4899 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4900 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4901 		mac->mac_phy.txerrors--;
4902 		if (mac->mac_phy.txerrors == 0) {
4903 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4904 			bwn_restart(mac, "PHY TX errors");
4905 		}
4906 	}
4907 
4908 	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4909 		if (merged & BWN_DMAINTR_FATALMASK) {
4910 			device_printf(sc->sc_dev,
4911 			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4912 			    mac->mac_reason[0], mac->mac_reason[1],
4913 			    mac->mac_reason[2], mac->mac_reason[3],
4914 			    mac->mac_reason[4], mac->mac_reason[5]);
4915 			bwn_restart(mac, "DMA error");
4916 			BWN_UNLOCK(sc);
4917 			return;
4918 		}
4919 		if (merged & BWN_DMAINTR_NONFATALMASK) {
4920 			device_printf(sc->sc_dev,
4921 			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4922 			    mac->mac_reason[0], mac->mac_reason[1],
4923 			    mac->mac_reason[2], mac->mac_reason[3],
4924 			    mac->mac_reason[4], mac->mac_reason[5]);
4925 		}
4926 	}
4927 
4928 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4929 		bwn_intr_ucode_debug(mac);
4930 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4931 		bwn_intr_tbtt_indication(mac);
4932 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4933 		bwn_intr_atim_end(mac);
4934 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4935 		bwn_intr_beacon(mac);
4936 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4937 		bwn_intr_pmq(mac);
4938 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4939 		bwn_intr_noise(mac);
4940 
4941 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4942 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4943 			bwn_dma_rx(mac->mac_method.dma.rx);
4944 			rx = 1;
4945 		}
4946 	} else
4947 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4948 
4949 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4950 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4951 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4952 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4953 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4954 
4955 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4956 		bwn_intr_txeof(mac);
4957 		tx = 1;
4958 	}
4959 
4960 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4961 
4962 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4963 		int evt = BWN_LED_EVENT_NONE;
4964 
4965 		if (tx && rx) {
4966 			if (sc->sc_rx_rate > sc->sc_tx_rate)
4967 				evt = BWN_LED_EVENT_RX;
4968 			else
4969 				evt = BWN_LED_EVENT_TX;
4970 		} else if (tx) {
4971 			evt = BWN_LED_EVENT_TX;
4972 		} else if (rx) {
4973 			evt = BWN_LED_EVENT_RX;
4974 		} else if (rx == 0) {
4975 			evt = BWN_LED_EVENT_POLL;
4976 		}
4977 
4978 		if (evt != BWN_LED_EVENT_NONE)
4979 			bwn_led_event(mac, evt);
4980        }
4981 
4982 	if (mbufq_first(&sc->sc_snd) != NULL)
4983 		bwn_start(sc);
4984 
4985 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4986 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4987 
4988 	BWN_UNLOCK(sc);
4989 }
4990 
4991 static void
4992 bwn_restart(struct bwn_mac *mac, const char *msg)
4993 {
4994 	struct bwn_softc *sc = mac->mac_sc;
4995 	struct ieee80211com *ic = &sc->sc_ic;
4996 
4997 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4998 		return;
4999 
5000 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5001 	ieee80211_runtask(ic, &mac->mac_hwreset);
5002 }
5003 
5004 static void
5005 bwn_intr_ucode_debug(struct bwn_mac *mac)
5006 {
5007 	struct bwn_softc *sc = mac->mac_sc;
5008 	uint16_t reason;
5009 
5010 	if (mac->mac_fw.opensource == 0)
5011 		return;
5012 
5013 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5014 	switch (reason) {
5015 	case BWN_DEBUGINTR_PANIC:
5016 		bwn_handle_fwpanic(mac);
5017 		break;
5018 	case BWN_DEBUGINTR_DUMP_SHM:
5019 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5020 		break;
5021 	case BWN_DEBUGINTR_DUMP_REGS:
5022 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5023 		break;
5024 	case BWN_DEBUGINTR_MARKER:
5025 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5026 		break;
5027 	default:
5028 		device_printf(sc->sc_dev,
5029 		    "ucode debug unknown reason: %#x\n", reason);
5030 	}
5031 
5032 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5033 	    BWN_DEBUGINTR_ACK);
5034 }
5035 
5036 static void
5037 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5038 {
5039 	struct bwn_softc *sc = mac->mac_sc;
5040 	struct ieee80211com *ic = &sc->sc_ic;
5041 
5042 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5043 		bwn_psctl(mac, 0);
5044 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5045 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5046 }
5047 
5048 static void
5049 bwn_intr_atim_end(struct bwn_mac *mac)
5050 {
5051 
5052 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5053 		BWN_WRITE_4(mac, BWN_MACCMD,
5054 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5055 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5056 	}
5057 }
5058 
5059 static void
5060 bwn_intr_beacon(struct bwn_mac *mac)
5061 {
5062 	struct bwn_softc *sc = mac->mac_sc;
5063 	struct ieee80211com *ic = &sc->sc_ic;
5064 	uint32_t cmd, beacon0, beacon1;
5065 
5066 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5067 	    ic->ic_opmode == IEEE80211_M_MBSS)
5068 		return;
5069 
5070 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5071 
5072 	cmd = BWN_READ_4(mac, BWN_MACCMD);
5073 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5074 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5075 
5076 	if (beacon0 && beacon1) {
5077 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5078 		mac->mac_intr_mask |= BWN_INTR_BEACON;
5079 		return;
5080 	}
5081 
5082 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5083 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5084 		bwn_load_beacon0(mac);
5085 		bwn_load_beacon1(mac);
5086 		cmd = BWN_READ_4(mac, BWN_MACCMD);
5087 		cmd |= BWN_MACCMD_BEACON0_VALID;
5088 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5089 	} else {
5090 		if (!beacon0) {
5091 			bwn_load_beacon0(mac);
5092 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5093 			cmd |= BWN_MACCMD_BEACON0_VALID;
5094 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5095 		} else if (!beacon1) {
5096 			bwn_load_beacon1(mac);
5097 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5098 			cmd |= BWN_MACCMD_BEACON1_VALID;
5099 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5100 		}
5101 	}
5102 }
5103 
5104 static void
5105 bwn_intr_pmq(struct bwn_mac *mac)
5106 {
5107 	uint32_t tmp;
5108 
5109 	while (1) {
5110 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5111 		if (!(tmp & 0x00000008))
5112 			break;
5113 	}
5114 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5115 }
5116 
5117 static void
5118 bwn_intr_noise(struct bwn_mac *mac)
5119 {
5120 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5121 	uint16_t tmp;
5122 	uint8_t noise[4];
5123 	uint8_t i, j;
5124 	int32_t average;
5125 
5126 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5127 		return;
5128 
5129 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5130 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5131 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5132 	    noise[3] == 0x7f)
5133 		goto new;
5134 
5135 	KASSERT(mac->mac_noise.noi_nsamples < 8,
5136 	    ("%s:%d: fail", __func__, __LINE__));
5137 	i = mac->mac_noise.noi_nsamples;
5138 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5139 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5140 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5141 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5142 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5143 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5144 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5145 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5146 	mac->mac_noise.noi_nsamples++;
5147 	if (mac->mac_noise.noi_nsamples == 8) {
5148 		average = 0;
5149 		for (i = 0; i < 8; i++) {
5150 			for (j = 0; j < 4; j++)
5151 				average += mac->mac_noise.noi_samples[i][j];
5152 		}
5153 		average = (((average / 32) * 125) + 64) / 128;
5154 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5155 		if (tmp >= 8)
5156 			average += 2;
5157 		else
5158 			average -= 25;
5159 		average -= (tmp == 8) ? 72 : 48;
5160 
5161 		mac->mac_stats.link_noise = average;
5162 		mac->mac_noise.noi_running = 0;
5163 		return;
5164 	}
5165 new:
5166 	bwn_noise_gensample(mac);
5167 }
5168 
5169 static int
5170 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5171 {
5172 	struct bwn_mac *mac = prq->prq_mac;
5173 	struct bwn_softc *sc = mac->mac_sc;
5174 	unsigned int i;
5175 
5176 	BWN_ASSERT_LOCKED(sc);
5177 
5178 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5179 		return (0);
5180 
5181 	for (i = 0; i < 5000; i++) {
5182 		if (bwn_pio_rxeof(prq) == 0)
5183 			break;
5184 	}
5185 	if (i >= 5000)
5186 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5187 	return ((i > 0) ? 1 : 0);
5188 }
5189 
5190 static void
5191 bwn_dma_rx(struct bwn_dma_ring *dr)
5192 {
5193 	int slot, curslot;
5194 
5195 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5196 	curslot = dr->get_curslot(dr);
5197 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5198 	    ("%s:%d: fail", __func__, __LINE__));
5199 
5200 	slot = dr->dr_curslot;
5201 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5202 		bwn_dma_rxeof(dr, &slot);
5203 
5204 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5205 	    BUS_DMASYNC_PREWRITE);
5206 
5207 	dr->set_curslot(dr, slot);
5208 	dr->dr_curslot = slot;
5209 }
5210 
5211 static void
5212 bwn_intr_txeof(struct bwn_mac *mac)
5213 {
5214 	struct bwn_txstatus stat;
5215 	uint32_t stat0, stat1;
5216 	uint16_t tmp;
5217 
5218 	BWN_ASSERT_LOCKED(mac->mac_sc);
5219 
5220 	while (1) {
5221 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5222 		if (!(stat0 & 0x00000001))
5223 			break;
5224 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5225 
5226 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5227 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5228 		    __func__,
5229 		    stat0,
5230 		    stat1);
5231 
5232 		stat.cookie = (stat0 >> 16);
5233 		stat.seq = (stat1 & 0x0000ffff);
5234 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5235 		tmp = (stat0 & 0x0000ffff);
5236 		stat.framecnt = ((tmp & 0xf000) >> 12);
5237 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5238 		stat.sreason = ((tmp & 0x001c) >> 2);
5239 		stat.pm = (tmp & 0x0080) ? 1 : 0;
5240 		stat.im = (tmp & 0x0040) ? 1 : 0;
5241 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5242 		stat.ack = (tmp & 0x0002) ? 1 : 0;
5243 
5244 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5245 		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5246 		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5247 		    __func__,
5248 		    stat.cookie,
5249 		    stat.seq,
5250 		    stat.phy_stat,
5251 		    stat.framecnt,
5252 		    stat.rtscnt,
5253 		    stat.sreason,
5254 		    stat.pm,
5255 		    stat.im,
5256 		    stat.ampdu,
5257 		    stat.ack);
5258 
5259 		bwn_handle_txeof(mac, &stat);
5260 	}
5261 }
5262 
5263 static void
5264 bwn_hwreset(void *arg, int npending)
5265 {
5266 	struct bwn_mac *mac = arg;
5267 	struct bwn_softc *sc = mac->mac_sc;
5268 	int error = 0;
5269 	int prev_status;
5270 
5271 	BWN_LOCK(sc);
5272 
5273 	prev_status = mac->mac_status;
5274 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5275 		bwn_core_stop(mac);
5276 	if (prev_status >= BWN_MAC_STATUS_INITED)
5277 		bwn_core_exit(mac);
5278 
5279 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5280 		error = bwn_core_init(mac);
5281 		if (error)
5282 			goto out;
5283 	}
5284 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5285 		bwn_core_start(mac);
5286 out:
5287 	if (error) {
5288 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5289 		sc->sc_curmac = NULL;
5290 	}
5291 	BWN_UNLOCK(sc);
5292 }
5293 
5294 static void
5295 bwn_handle_fwpanic(struct bwn_mac *mac)
5296 {
5297 	struct bwn_softc *sc = mac->mac_sc;
5298 	uint16_t reason;
5299 
5300 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5301 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5302 
5303 	if (reason == BWN_FWPANIC_RESTART)
5304 		bwn_restart(mac, "ucode panic");
5305 }
5306 
5307 static void
5308 bwn_load_beacon0(struct bwn_mac *mac)
5309 {
5310 
5311 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5312 }
5313 
5314 static void
5315 bwn_load_beacon1(struct bwn_mac *mac)
5316 {
5317 
5318 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5319 }
5320 
5321 static uint32_t
5322 bwn_jssi_read(struct bwn_mac *mac)
5323 {
5324 	uint32_t val = 0;
5325 
5326 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5327 	val <<= 16;
5328 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5329 
5330 	return (val);
5331 }
5332 
5333 static void
5334 bwn_noise_gensample(struct bwn_mac *mac)
5335 {
5336 	uint32_t jssi = 0x7f7f7f7f;
5337 
5338 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5339 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5340 	BWN_WRITE_4(mac, BWN_MACCMD,
5341 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5342 }
5343 
5344 static int
5345 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5346 {
5347 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5348 
5349 	return (dr->dr_numslots - dr->dr_usedslot);
5350 }
5351 
5352 static int
5353 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5354 {
5355 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5356 
5357 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5358 	    ("%s:%d: fail", __func__, __LINE__));
5359 	if (slot == dr->dr_numslots - 1)
5360 		return (0);
5361 	return (slot + 1);
5362 }
5363 
5364 static void
5365 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5366 {
5367 	struct bwn_mac *mac = dr->dr_mac;
5368 	struct bwn_softc *sc = mac->mac_sc;
5369 	struct bwn_dma *dma = &mac->mac_method.dma;
5370 	struct bwn_dmadesc_generic *desc;
5371 	struct bwn_dmadesc_meta *meta;
5372 	struct bwn_rxhdr4 *rxhdr;
5373 	struct mbuf *m;
5374 	uint32_t macstat;
5375 	int32_t tmp;
5376 	int cnt = 0;
5377 	uint16_t len;
5378 
5379 	dr->getdesc(dr, *slot, &desc, &meta);
5380 
5381 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5382 	m = meta->mt_m;
5383 
5384 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5385 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5386 		return;
5387 	}
5388 
5389 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5390 	len = le16toh(rxhdr->frame_len);
5391 	if (len <= 0) {
5392 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5393 		return;
5394 	}
5395 	if (bwn_dma_check_redzone(dr, m)) {
5396 		device_printf(sc->sc_dev, "redzone error.\n");
5397 		bwn_dma_set_redzone(dr, m);
5398 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5399 		    BUS_DMASYNC_PREWRITE);
5400 		return;
5401 	}
5402 	if (len > dr->dr_rx_bufsize) {
5403 		tmp = len;
5404 		while (1) {
5405 			dr->getdesc(dr, *slot, &desc, &meta);
5406 			bwn_dma_set_redzone(dr, meta->mt_m);
5407 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5408 			    BUS_DMASYNC_PREWRITE);
5409 			*slot = bwn_dma_nextslot(dr, *slot);
5410 			cnt++;
5411 			tmp -= dr->dr_rx_bufsize;
5412 			if (tmp <= 0)
5413 				break;
5414 		}
5415 		device_printf(sc->sc_dev, "too small buffer "
5416 		       "(len %u buffer %u dropped %d)\n",
5417 		       len, dr->dr_rx_bufsize, cnt);
5418 		return;
5419 	}
5420 
5421 	switch (mac->mac_fw.fw_hdr_format) {
5422 	case BWN_FW_HDR_351:
5423 	case BWN_FW_HDR_410:
5424 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5425 		break;
5426 	case BWN_FW_HDR_598:
5427 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5428 		break;
5429 	}
5430 
5431 	if (macstat & BWN_RX_MAC_FCSERR) {
5432 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5433 			device_printf(sc->sc_dev, "RX drop\n");
5434 			return;
5435 		}
5436 	}
5437 
5438 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5439 	m_adj(m, dr->dr_frameoffset);
5440 
5441 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5442 }
5443 
5444 static void
5445 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5446 {
5447 	struct bwn_softc *sc = mac->mac_sc;
5448 	struct bwn_stats *stats = &mac->mac_stats;
5449 
5450 	BWN_ASSERT_LOCKED(mac->mac_sc);
5451 
5452 	if (status->im)
5453 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5454 	if (status->ampdu)
5455 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5456 	if (status->rtscnt) {
5457 		if (status->rtscnt == 0xf)
5458 			stats->rtsfail++;
5459 		else
5460 			stats->rts++;
5461 	}
5462 
5463 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5464 		bwn_dma_handle_txeof(mac, status);
5465 	} else {
5466 		bwn_pio_handle_txeof(mac, status);
5467 	}
5468 
5469 	bwn_phy_txpower_check(mac, 0);
5470 }
5471 
5472 static uint8_t
5473 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5474 {
5475 	struct bwn_mac *mac = prq->prq_mac;
5476 	struct bwn_softc *sc = mac->mac_sc;
5477 	struct bwn_rxhdr4 rxhdr;
5478 	struct mbuf *m;
5479 	uint32_t ctl32, macstat, v32;
5480 	unsigned int i, padding;
5481 	uint16_t ctl16, len, totlen, v16;
5482 	unsigned char *mp;
5483 	char *data;
5484 
5485 	memset(&rxhdr, 0, sizeof(rxhdr));
5486 
5487 	if (prq->prq_rev >= 8) {
5488 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5489 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5490 			return (0);
5491 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5492 		    BWN_PIO8_RXCTL_FRAMEREADY);
5493 		for (i = 0; i < 10; i++) {
5494 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5495 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5496 				goto ready;
5497 			DELAY(10);
5498 		}
5499 	} else {
5500 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5501 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5502 			return (0);
5503 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5504 		    BWN_PIO_RXCTL_FRAMEREADY);
5505 		for (i = 0; i < 10; i++) {
5506 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5507 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5508 				goto ready;
5509 			DELAY(10);
5510 		}
5511 	}
5512 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5513 	return (1);
5514 ready:
5515 	if (prq->prq_rev >= 8)
5516 		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5517 		    prq->prq_base + BWN_PIO8_RXDATA);
5518 	else
5519 		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5520 		    prq->prq_base + BWN_PIO_RXDATA);
5521 	len = le16toh(rxhdr.frame_len);
5522 	if (len > 0x700) {
5523 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5524 		goto error;
5525 	}
5526 	if (len == 0) {
5527 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5528 		goto error;
5529 	}
5530 
5531 	switch (mac->mac_fw.fw_hdr_format) {
5532 	case BWN_FW_HDR_351:
5533 	case BWN_FW_HDR_410:
5534 		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5535 		break;
5536 	case BWN_FW_HDR_598:
5537 		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5538 		break;
5539 	}
5540 
5541 	if (macstat & BWN_RX_MAC_FCSERR) {
5542 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5543 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5544 			goto error;
5545 		}
5546 	}
5547 
5548 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5549 	totlen = len + padding;
5550 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5551 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5552 	if (m == NULL) {
5553 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5554 		goto error;
5555 	}
5556 	mp = mtod(m, unsigned char *);
5557 	if (prq->prq_rev >= 8) {
5558 		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5559 		    prq->prq_base + BWN_PIO8_RXDATA);
5560 		if (totlen & 3) {
5561 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5562 			data = &(mp[totlen - 1]);
5563 			switch (totlen & 3) {
5564 			case 3:
5565 				*data = (v32 >> 16);
5566 				data--;
5567 			case 2:
5568 				*data = (v32 >> 8);
5569 				data--;
5570 			case 1:
5571 				*data = v32;
5572 			}
5573 		}
5574 	} else {
5575 		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5576 		    prq->prq_base + BWN_PIO_RXDATA);
5577 		if (totlen & 1) {
5578 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5579 			mp[totlen - 1] = v16;
5580 		}
5581 	}
5582 
5583 	m->m_len = m->m_pkthdr.len = totlen;
5584 
5585 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5586 
5587 	return (1);
5588 error:
5589 	if (prq->prq_rev >= 8)
5590 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5591 		    BWN_PIO8_RXCTL_DATAREADY);
5592 	else
5593 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5594 	return (1);
5595 }
5596 
5597 static int
5598 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5599     struct bwn_dmadesc_meta *meta, int init)
5600 {
5601 	struct bwn_mac *mac = dr->dr_mac;
5602 	struct bwn_dma *dma = &mac->mac_method.dma;
5603 	struct bwn_rxhdr4 *hdr;
5604 	bus_dmamap_t map;
5605 	bus_addr_t paddr;
5606 	struct mbuf *m;
5607 	int error;
5608 
5609 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5610 	if (m == NULL) {
5611 		error = ENOBUFS;
5612 
5613 		/*
5614 		 * If the NIC is up and running, we need to:
5615 		 * - Clear RX buffer's header.
5616 		 * - Restore RX descriptor settings.
5617 		 */
5618 		if (init)
5619 			return (error);
5620 		else
5621 			goto back;
5622 	}
5623 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5624 
5625 	bwn_dma_set_redzone(dr, m);
5626 
5627 	/*
5628 	 * Try to load RX buf into temporary DMA map
5629 	 */
5630 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5631 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5632 	if (error) {
5633 		m_freem(m);
5634 
5635 		/*
5636 		 * See the comment above
5637 		 */
5638 		if (init)
5639 			return (error);
5640 		else
5641 			goto back;
5642 	}
5643 
5644 	if (!init)
5645 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5646 	meta->mt_m = m;
5647 	meta->mt_paddr = paddr;
5648 
5649 	/*
5650 	 * Swap RX buf's DMA map with the loaded temporary one
5651 	 */
5652 	map = meta->mt_dmap;
5653 	meta->mt_dmap = dr->dr_spare_dmap;
5654 	dr->dr_spare_dmap = map;
5655 
5656 back:
5657 	/*
5658 	 * Clear RX buf header
5659 	 */
5660 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5661 	bzero(hdr, sizeof(*hdr));
5662 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5663 	    BUS_DMASYNC_PREWRITE);
5664 
5665 	/*
5666 	 * Setup RX buf descriptor
5667 	 */
5668 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5669 	    sizeof(*hdr), 0, 0, 0);
5670 	return (error);
5671 }
5672 
5673 static void
5674 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5675 		 bus_size_t mapsz __unused, int error)
5676 {
5677 
5678 	if (!error) {
5679 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5680 		*((bus_addr_t *)arg) = seg->ds_addr;
5681 	}
5682 }
5683 
5684 static int
5685 bwn_hwrate2ieeerate(int rate)
5686 {
5687 
5688 	switch (rate) {
5689 	case BWN_CCK_RATE_1MB:
5690 		return (2);
5691 	case BWN_CCK_RATE_2MB:
5692 		return (4);
5693 	case BWN_CCK_RATE_5MB:
5694 		return (11);
5695 	case BWN_CCK_RATE_11MB:
5696 		return (22);
5697 	case BWN_OFDM_RATE_6MB:
5698 		return (12);
5699 	case BWN_OFDM_RATE_9MB:
5700 		return (18);
5701 	case BWN_OFDM_RATE_12MB:
5702 		return (24);
5703 	case BWN_OFDM_RATE_18MB:
5704 		return (36);
5705 	case BWN_OFDM_RATE_24MB:
5706 		return (48);
5707 	case BWN_OFDM_RATE_36MB:
5708 		return (72);
5709 	case BWN_OFDM_RATE_48MB:
5710 		return (96);
5711 	case BWN_OFDM_RATE_54MB:
5712 		return (108);
5713 	default:
5714 		printf("Ooops\n");
5715 		return (0);
5716 	}
5717 }
5718 
5719 /*
5720  * Post process the RX provided RSSI.
5721  *
5722  * Valid for A, B, G, LP PHYs.
5723  */
5724 static int8_t
5725 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5726     int ofdm, int adjust_2053, int adjust_2050)
5727 {
5728 	struct bwn_phy *phy = &mac->mac_phy;
5729 	struct bwn_phy_g *gphy = &phy->phy_g;
5730 	int tmp;
5731 
5732 	switch (phy->rf_ver) {
5733 	case 0x2050:
5734 		if (ofdm) {
5735 			tmp = in_rssi;
5736 			if (tmp > 127)
5737 				tmp -= 256;
5738 			tmp = tmp * 73 / 64;
5739 			if (adjust_2050)
5740 				tmp += 25;
5741 			else
5742 				tmp -= 3;
5743 		} else {
5744 			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5745 			    & BWN_BFL_RSSI) {
5746 				if (in_rssi > 63)
5747 					in_rssi = 63;
5748 				tmp = gphy->pg_nrssi_lt[in_rssi];
5749 				tmp = (31 - tmp) * -131 / 128 - 57;
5750 			} else {
5751 				tmp = in_rssi;
5752 				tmp = (31 - tmp) * -149 / 128 - 68;
5753 			}
5754 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5755 				tmp += 25;
5756 		}
5757 		break;
5758 	case 0x2060:
5759 		if (in_rssi > 127)
5760 			tmp = in_rssi - 256;
5761 		else
5762 			tmp = in_rssi;
5763 		break;
5764 	default:
5765 		tmp = in_rssi;
5766 		tmp = (tmp - 11) * 103 / 64;
5767 		if (adjust_2053)
5768 			tmp -= 109;
5769 		else
5770 			tmp -= 83;
5771 	}
5772 
5773 	return (tmp);
5774 }
5775 
5776 static void
5777 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5778 {
5779 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5780 	struct bwn_plcp6 *plcp;
5781 	struct bwn_softc *sc = mac->mac_sc;
5782 	struct ieee80211_frame_min *wh;
5783 	struct ieee80211_node *ni;
5784 	struct ieee80211com *ic = &sc->sc_ic;
5785 	uint32_t macstat;
5786 	int padding, rate, rssi = 0, noise = 0, type;
5787 	uint16_t phytype, phystat0, phystat3, chanstat;
5788 	unsigned char *mp = mtod(m, unsigned char *);
5789 	static int rx_mac_dec_rpt = 0;
5790 
5791 	BWN_ASSERT_LOCKED(sc);
5792 
5793 	phystat0 = le16toh(rxhdr->phy_status0);
5794 
5795 	/*
5796 	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5797 	 * used for LP-PHY.
5798 	 */
5799 	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5800 
5801 	switch (mac->mac_fw.fw_hdr_format) {
5802 	case BWN_FW_HDR_351:
5803 	case BWN_FW_HDR_410:
5804 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5805 		chanstat = le16toh(rxhdr->ps4.r351.channel);
5806 		break;
5807 	case BWN_FW_HDR_598:
5808 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5809 		chanstat = le16toh(rxhdr->ps4.r598.channel);
5810 		break;
5811 	}
5812 
5813 
5814 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5815 
5816 	if (macstat & BWN_RX_MAC_FCSERR)
5817 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5818 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5819 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5820 	if (macstat & BWN_RX_MAC_DECERR)
5821 		goto drop;
5822 
5823 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5824 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5825 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5826 		    m->m_pkthdr.len);
5827 		goto drop;
5828 	}
5829 	plcp = (struct bwn_plcp6 *)(mp + padding);
5830 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5831 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5832 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5833 		    m->m_pkthdr.len);
5834 		goto drop;
5835 	}
5836 	wh = mtod(m, struct ieee80211_frame_min *);
5837 
5838 	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5839 		device_printf(sc->sc_dev,
5840 		    "RX decryption attempted (old %d keyidx %#x)\n",
5841 		    BWN_ISOLDFMT(mac),
5842 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5843 
5844 	if (phystat0 & BWN_RX_PHYST0_OFDM)
5845 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5846 		    phytype == BWN_PHYTYPE_A);
5847 	else
5848 		rate = bwn_plcp_get_cckrate(mac, plcp);
5849 	if (rate == -1) {
5850 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5851 			goto drop;
5852 	}
5853 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5854 
5855 	/* rssi/noise */
5856 	switch (phytype) {
5857 	case BWN_PHYTYPE_A:
5858 	case BWN_PHYTYPE_B:
5859 	case BWN_PHYTYPE_G:
5860 	case BWN_PHYTYPE_LP:
5861 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5862 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5863 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5864 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5865 		break;
5866 	case BWN_PHYTYPE_N:
5867 		/* Broadcom has code for min/avg, but always used max */
5868 		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5869 			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5870 		else
5871 			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5872 #if 0
5873 		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5874 		    "%s: power0=%d, power1=%d, power2=%d\n",
5875 		    __func__,
5876 		    rxhdr->phy.n.power0,
5877 		    rxhdr->phy.n.power1,
5878 		    rxhdr->ps2.n.power2);
5879 #endif
5880 		break;
5881 	default:
5882 		/* XXX TODO: implement rssi for other PHYs */
5883 		break;
5884 	}
5885 
5886 	/*
5887 	 * RSSI here is absolute, not relative to the noise floor.
5888 	 */
5889 	noise = mac->mac_stats.link_noise;
5890 	rssi = rssi - noise;
5891 
5892 	/* RX radio tap */
5893 	if (ieee80211_radiotap_active(ic))
5894 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5895 	m_adj(m, -IEEE80211_CRC_LEN);
5896 
5897 	BWN_UNLOCK(sc);
5898 
5899 	ni = ieee80211_find_rxnode(ic, wh);
5900 	if (ni != NULL) {
5901 		type = ieee80211_input(ni, m, rssi, noise);
5902 		ieee80211_free_node(ni);
5903 	} else
5904 		type = ieee80211_input_all(ic, m, rssi, noise);
5905 
5906 	BWN_LOCK(sc);
5907 	return;
5908 drop:
5909 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5910 }
5911 
5912 static void
5913 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
5914     const struct bwn_txstatus *status)
5915 {
5916 	struct ieee80211_ratectl_tx_status txs;
5917 	int retrycnt = 0;
5918 
5919 	/*
5920 	 * If we don't get an ACK, then we should log the
5921 	 * full framecnt.  That may be 0 if it's a PHY
5922 	 * failure, so ensure that gets logged as some
5923 	 * retry attempt.
5924 	 */
5925 	txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
5926 	if (status->ack) {
5927 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
5928 		retrycnt = status->framecnt - 1;
5929 	} else {
5930 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
5931 		retrycnt = status->framecnt;
5932 		if (retrycnt == 0)
5933 			retrycnt = 1;
5934 	}
5935 	txs.long_retries = retrycnt;
5936 	ieee80211_ratectl_tx_complete(ni, &txs);
5937 }
5938 
5939 static void
5940 bwn_dma_handle_txeof(struct bwn_mac *mac,
5941     const struct bwn_txstatus *status)
5942 {
5943 	struct bwn_dma *dma = &mac->mac_method.dma;
5944 	struct bwn_dma_ring *dr;
5945 	struct bwn_dmadesc_generic *desc;
5946 	struct bwn_dmadesc_meta *meta;
5947 	struct bwn_softc *sc = mac->mac_sc;
5948 	int slot;
5949 
5950 	BWN_ASSERT_LOCKED(sc);
5951 
5952 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5953 	if (dr == NULL) {
5954 		device_printf(sc->sc_dev, "failed to parse cookie\n");
5955 		return;
5956 	}
5957 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5958 
5959 	while (1) {
5960 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5961 		    ("%s:%d: fail", __func__, __LINE__));
5962 		dr->getdesc(dr, slot, &desc, &meta);
5963 
5964 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5965 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5966 		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5967 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5968 
5969 		if (meta->mt_islast) {
5970 			KASSERT(meta->mt_m != NULL,
5971 			    ("%s:%d: fail", __func__, __LINE__));
5972 
5973 			bwn_ratectl_tx_complete(meta->mt_ni, status);
5974 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5975 			meta->mt_ni = NULL;
5976 			meta->mt_m = NULL;
5977 		} else
5978 			KASSERT(meta->mt_m == NULL,
5979 			    ("%s:%d: fail", __func__, __LINE__));
5980 
5981 		dr->dr_usedslot--;
5982 		if (meta->mt_islast)
5983 			break;
5984 		slot = bwn_dma_nextslot(dr, slot);
5985 	}
5986 	sc->sc_watchdog_timer = 0;
5987 	if (dr->dr_stop) {
5988 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5989 		    ("%s:%d: fail", __func__, __LINE__));
5990 		dr->dr_stop = 0;
5991 	}
5992 }
5993 
5994 static void
5995 bwn_pio_handle_txeof(struct bwn_mac *mac,
5996     const struct bwn_txstatus *status)
5997 {
5998 	struct bwn_pio_txqueue *tq;
5999 	struct bwn_pio_txpkt *tp = NULL;
6000 	struct bwn_softc *sc = mac->mac_sc;
6001 
6002 	BWN_ASSERT_LOCKED(sc);
6003 
6004 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6005 	if (tq == NULL)
6006 		return;
6007 
6008 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6009 	tq->tq_free++;
6010 
6011 	/* XXX ieee80211_tx_complete()? */
6012 	if (tp->tp_ni != NULL) {
6013 		/*
6014 		 * Do any tx complete callback.  Note this must
6015 		 * be done before releasing the node reference.
6016 		 */
6017 
6018 		bwn_ratectl_tx_complete(tp->tp_ni, status);
6019 		if (tp->tp_m->m_flags & M_TXCB)
6020 			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6021 		ieee80211_free_node(tp->tp_ni);
6022 		tp->tp_ni = NULL;
6023 	}
6024 	m_freem(tp->tp_m);
6025 	tp->tp_m = NULL;
6026 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6027 
6028 	sc->sc_watchdog_timer = 0;
6029 }
6030 
6031 static void
6032 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6033 {
6034 	struct bwn_softc *sc = mac->mac_sc;
6035 	struct bwn_phy *phy = &mac->mac_phy;
6036 	struct ieee80211com *ic = &sc->sc_ic;
6037 	unsigned long now;
6038 	bwn_txpwr_result_t result;
6039 
6040 	BWN_GETTIME(now);
6041 
6042 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6043 		return;
6044 	phy->nexttime = now + 2 * 1000;
6045 
6046 	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6047 	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6048 		return;
6049 
6050 	if (phy->recalc_txpwr != NULL) {
6051 		result = phy->recalc_txpwr(mac,
6052 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6053 		if (result == BWN_TXPWR_RES_DONE)
6054 			return;
6055 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6056 		    ("%s: fail", __func__));
6057 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6058 
6059 		ieee80211_runtask(ic, &mac->mac_txpower);
6060 	}
6061 }
6062 
6063 static uint16_t
6064 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6065 {
6066 
6067 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6068 }
6069 
6070 static uint32_t
6071 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6072 {
6073 
6074 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6075 }
6076 
6077 static void
6078 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6079 {
6080 
6081 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6082 }
6083 
6084 static void
6085 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6086 {
6087 
6088 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6089 }
6090 
6091 static int
6092 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6093 {
6094 
6095 	switch (rate) {
6096 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6097 	case 12:
6098 		return (BWN_OFDM_RATE_6MB);
6099 	case 18:
6100 		return (BWN_OFDM_RATE_9MB);
6101 	case 24:
6102 		return (BWN_OFDM_RATE_12MB);
6103 	case 36:
6104 		return (BWN_OFDM_RATE_18MB);
6105 	case 48:
6106 		return (BWN_OFDM_RATE_24MB);
6107 	case 72:
6108 		return (BWN_OFDM_RATE_36MB);
6109 	case 96:
6110 		return (BWN_OFDM_RATE_48MB);
6111 	case 108:
6112 		return (BWN_OFDM_RATE_54MB);
6113 	/* CCK rates (NB: not IEEE std, device-specific) */
6114 	case 2:
6115 		return (BWN_CCK_RATE_1MB);
6116 	case 4:
6117 		return (BWN_CCK_RATE_2MB);
6118 	case 11:
6119 		return (BWN_CCK_RATE_5MB);
6120 	case 22:
6121 		return (BWN_CCK_RATE_11MB);
6122 	}
6123 
6124 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6125 	return (BWN_CCK_RATE_1MB);
6126 }
6127 
6128 static uint16_t
6129 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6130 {
6131 	struct bwn_phy *phy = &mac->mac_phy;
6132 	uint16_t control = 0;
6133 	uint16_t bw;
6134 
6135 	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6136 	bw = BWN_TXH_PHY1_BW_20;
6137 
6138 	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6139 		control = bw;
6140 	} else {
6141 		control = bw;
6142 		/* Figure out coding rate and modulation */
6143 		/* XXX TODO: table-ize, for MCS transmit */
6144 		/* Note: this is BWN_*_RATE values */
6145 		switch (bitrate) {
6146 		case BWN_CCK_RATE_1MB:
6147 			control |= 0;
6148 			break;
6149 		case BWN_CCK_RATE_2MB:
6150 			control |= 1;
6151 			break;
6152 		case BWN_CCK_RATE_5MB:
6153 			control |= 2;
6154 			break;
6155 		case BWN_CCK_RATE_11MB:
6156 			control |= 3;
6157 			break;
6158 		case BWN_OFDM_RATE_6MB:
6159 			control |= BWN_TXH_PHY1_CRATE_1_2;
6160 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6161 			break;
6162 		case BWN_OFDM_RATE_9MB:
6163 			control |= BWN_TXH_PHY1_CRATE_3_4;
6164 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6165 			break;
6166 		case BWN_OFDM_RATE_12MB:
6167 			control |= BWN_TXH_PHY1_CRATE_1_2;
6168 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6169 			break;
6170 		case BWN_OFDM_RATE_18MB:
6171 			control |= BWN_TXH_PHY1_CRATE_3_4;
6172 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6173 			break;
6174 		case BWN_OFDM_RATE_24MB:
6175 			control |= BWN_TXH_PHY1_CRATE_1_2;
6176 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6177 			break;
6178 		case BWN_OFDM_RATE_36MB:
6179 			control |= BWN_TXH_PHY1_CRATE_3_4;
6180 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6181 			break;
6182 		case BWN_OFDM_RATE_48MB:
6183 			control |= BWN_TXH_PHY1_CRATE_1_2;
6184 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6185 			break;
6186 		case BWN_OFDM_RATE_54MB:
6187 			control |= BWN_TXH_PHY1_CRATE_3_4;
6188 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6189 			break;
6190 		default:
6191 			break;
6192 		}
6193 		control |= BWN_TXH_PHY1_MODE_SISO;
6194 	}
6195 
6196 	return control;
6197 }
6198 
6199 static int
6200 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6201     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6202 {
6203 	const struct bwn_phy *phy = &mac->mac_phy;
6204 	struct bwn_softc *sc = mac->mac_sc;
6205 	struct ieee80211_frame *wh;
6206 	struct ieee80211_frame *protwh;
6207 	struct ieee80211_frame_cts *cts;
6208 	struct ieee80211_frame_rts *rts;
6209 	const struct ieee80211_txparam *tp = ni->ni_txparms;
6210 	struct ieee80211vap *vap = ni->ni_vap;
6211 	struct ieee80211com *ic = &sc->sc_ic;
6212 	struct mbuf *mprot;
6213 	unsigned int len;
6214 	uint32_t macctl = 0;
6215 	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6216 	uint16_t phyctl = 0;
6217 	uint8_t rate, rate_fb;
6218 	int fill_phy_ctl1 = 0;
6219 
6220 	wh = mtod(m, struct ieee80211_frame *);
6221 	memset(txhdr, 0, sizeof(*txhdr));
6222 
6223 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6224 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6225 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6226 
6227 	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6228 	    || (phy->type == BWN_PHYTYPE_HT))
6229 		fill_phy_ctl1 = 1;
6230 
6231 	/*
6232 	 * Find TX rate
6233 	 */
6234 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6235 		rate = rate_fb = tp->mgmtrate;
6236 	else if (ismcast)
6237 		rate = rate_fb = tp->mcastrate;
6238 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6239 		rate = rate_fb = tp->ucastrate;
6240 	else {
6241 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6242 		rate = ni->ni_txrate;
6243 
6244 		if (rix > 0)
6245 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6246 			    IEEE80211_RATE_VAL;
6247 		else
6248 			rate_fb = rate;
6249 	}
6250 
6251 	sc->sc_tx_rate = rate;
6252 
6253 	/* Note: this maps the select ieee80211 rate to hardware rate */
6254 	rate = bwn_ieeerate2hwrate(sc, rate);
6255 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6256 
6257 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6258 	    bwn_plcp_getcck(rate);
6259 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6260 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6261 
6262 	/* XXX rate/rate_fb is the hardware rate */
6263 	if ((rate_fb == rate) ||
6264 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6265 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6266 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6267 	else
6268 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6269 		    m->m_pkthdr.len, rate, isshort);
6270 
6271 	/* XXX TX encryption */
6272 
6273 	switch (mac->mac_fw.fw_hdr_format) {
6274 	case BWN_FW_HDR_351:
6275 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6276 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6277 		break;
6278 	case BWN_FW_HDR_410:
6279 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6280 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6281 		break;
6282 	case BWN_FW_HDR_598:
6283 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6284 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6285 		break;
6286 	}
6287 
6288 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6289 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6290 
6291 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6292 	    BWN_TX_EFT_FB_CCK;
6293 	txhdr->chan = phy->chan;
6294 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6295 	    BWN_TX_PHY_ENC_CCK;
6296 	/* XXX preamble? obey net80211 */
6297 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6298 	     rate == BWN_CCK_RATE_11MB))
6299 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6300 
6301 	if (! phy->gmode)
6302 		macctl |= BWN_TX_MAC_5GHZ;
6303 
6304 	/* XXX TX antenna selection */
6305 
6306 	switch (bwn_antenna_sanitize(mac, 0)) {
6307 	case 0:
6308 		phyctl |= BWN_TX_PHY_ANT01AUTO;
6309 		break;
6310 	case 1:
6311 		phyctl |= BWN_TX_PHY_ANT0;
6312 		break;
6313 	case 2:
6314 		phyctl |= BWN_TX_PHY_ANT1;
6315 		break;
6316 	case 3:
6317 		phyctl |= BWN_TX_PHY_ANT2;
6318 		break;
6319 	case 4:
6320 		phyctl |= BWN_TX_PHY_ANT3;
6321 		break;
6322 	default:
6323 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6324 	}
6325 
6326 	if (!ismcast)
6327 		macctl |= BWN_TX_MAC_ACK;
6328 
6329 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6330 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6331 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6332 		macctl |= BWN_TX_MAC_LONGFRAME;
6333 
6334 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6335 		/* Note: don't fall back to CCK rates for 5G */
6336 		if (phy->gmode)
6337 			rts_rate = BWN_CCK_RATE_1MB;
6338 		else
6339 			rts_rate = BWN_OFDM_RATE_6MB;
6340 		rts_rate_fb = bwn_get_fbrate(rts_rate);
6341 
6342 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6343 		protdur = ieee80211_compute_duration(ic->ic_rt,
6344 		    m->m_pkthdr.len, rate, isshort) +
6345 		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6346 
6347 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6348 
6349 			switch (mac->mac_fw.fw_hdr_format) {
6350 			case BWN_FW_HDR_351:
6351 				cts = (struct ieee80211_frame_cts *)
6352 				    txhdr->body.r351.rts_frame;
6353 				break;
6354 			case BWN_FW_HDR_410:
6355 				cts = (struct ieee80211_frame_cts *)
6356 				    txhdr->body.r410.rts_frame;
6357 				break;
6358 			case BWN_FW_HDR_598:
6359 				cts = (struct ieee80211_frame_cts *)
6360 				    txhdr->body.r598.rts_frame;
6361 				break;
6362 			}
6363 
6364 			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6365 			    protdur);
6366 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6367 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6368 			    mprot->m_pkthdr.len);
6369 			m_freem(mprot);
6370 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6371 			len = sizeof(struct ieee80211_frame_cts);
6372 		} else {
6373 			switch (mac->mac_fw.fw_hdr_format) {
6374 			case BWN_FW_HDR_351:
6375 				rts = (struct ieee80211_frame_rts *)
6376 				    txhdr->body.r351.rts_frame;
6377 				break;
6378 			case BWN_FW_HDR_410:
6379 				rts = (struct ieee80211_frame_rts *)
6380 				    txhdr->body.r410.rts_frame;
6381 				break;
6382 			case BWN_FW_HDR_598:
6383 				rts = (struct ieee80211_frame_rts *)
6384 				    txhdr->body.r598.rts_frame;
6385 				break;
6386 			}
6387 
6388 			/* XXX rate/rate_fb is the hardware rate */
6389 			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6390 			    isshort);
6391 			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6392 			    wh->i_addr2, protdur);
6393 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6394 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6395 			    mprot->m_pkthdr.len);
6396 			m_freem(mprot);
6397 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6398 			len = sizeof(struct ieee80211_frame_rts);
6399 		}
6400 		len += IEEE80211_CRC_LEN;
6401 
6402 		switch (mac->mac_fw.fw_hdr_format) {
6403 		case BWN_FW_HDR_351:
6404 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6405 			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6406 			break;
6407 		case BWN_FW_HDR_410:
6408 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6409 			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6410 			break;
6411 		case BWN_FW_HDR_598:
6412 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6413 			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6414 			break;
6415 		}
6416 
6417 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6418 		    rts_rate_fb);
6419 
6420 		switch (mac->mac_fw.fw_hdr_format) {
6421 		case BWN_FW_HDR_351:
6422 			protwh = (struct ieee80211_frame *)
6423 			    &txhdr->body.r351.rts_frame;
6424 			break;
6425 		case BWN_FW_HDR_410:
6426 			protwh = (struct ieee80211_frame *)
6427 			    &txhdr->body.r410.rts_frame;
6428 			break;
6429 		case BWN_FW_HDR_598:
6430 			protwh = (struct ieee80211_frame *)
6431 			    &txhdr->body.r598.rts_frame;
6432 			break;
6433 		}
6434 
6435 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6436 
6437 		if (BWN_ISOFDMRATE(rts_rate)) {
6438 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6439 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6440 		} else {
6441 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6442 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6443 		}
6444 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6445 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6446 
6447 		if (fill_phy_ctl1) {
6448 			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6449 			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6450 		}
6451 	}
6452 
6453 	if (fill_phy_ctl1) {
6454 		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6455 		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6456 	}
6457 
6458 	switch (mac->mac_fw.fw_hdr_format) {
6459 	case BWN_FW_HDR_351:
6460 		txhdr->body.r351.cookie = htole16(cookie);
6461 		break;
6462 	case BWN_FW_HDR_410:
6463 		txhdr->body.r410.cookie = htole16(cookie);
6464 		break;
6465 	case BWN_FW_HDR_598:
6466 		txhdr->body.r598.cookie = htole16(cookie);
6467 		break;
6468 	}
6469 
6470 	txhdr->macctl = htole32(macctl);
6471 	txhdr->phyctl = htole16(phyctl);
6472 
6473 	/*
6474 	 * TX radio tap
6475 	 */
6476 	if (ieee80211_radiotap_active_vap(vap)) {
6477 		sc->sc_tx_th.wt_flags = 0;
6478 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6479 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6480 		if (isshort &&
6481 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6482 		     rate == BWN_CCK_RATE_11MB))
6483 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6484 		sc->sc_tx_th.wt_rate = rate;
6485 
6486 		ieee80211_radiotap_tx(vap, m);
6487 	}
6488 
6489 	return (0);
6490 }
6491 
6492 static void
6493 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6494     const uint8_t rate)
6495 {
6496 	uint32_t d, plen;
6497 	uint8_t *raw = plcp->o.raw;
6498 
6499 	if (BWN_ISOFDMRATE(rate)) {
6500 		d = bwn_plcp_getofdm(rate);
6501 		KASSERT(!(octets & 0xf000),
6502 		    ("%s:%d: fail", __func__, __LINE__));
6503 		d |= (octets << 5);
6504 		plcp->o.data = htole32(d);
6505 	} else {
6506 		plen = octets * 16 / rate;
6507 		if ((octets * 16 % rate) > 0) {
6508 			plen++;
6509 			if ((rate == BWN_CCK_RATE_11MB)
6510 			    && ((octets * 8 % 11) < 4)) {
6511 				raw[1] = 0x84;
6512 			} else
6513 				raw[1] = 0x04;
6514 		} else
6515 			raw[1] = 0x04;
6516 		plcp->o.data |= htole32(plen << 16);
6517 		raw[0] = bwn_plcp_getcck(rate);
6518 	}
6519 }
6520 
6521 static uint8_t
6522 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6523 {
6524 	struct bwn_softc *sc = mac->mac_sc;
6525 	uint8_t mask;
6526 
6527 	if (n == 0)
6528 		return (0);
6529 	if (mac->mac_phy.gmode)
6530 		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6531 	else
6532 		mask = siba_sprom_get_ant_a(sc->sc_dev);
6533 	if (!(mask & (1 << (n - 1))))
6534 		return (0);
6535 	return (n);
6536 }
6537 
6538 /*
6539  * Return a fallback rate for the given rate.
6540  *
6541  * Note: Don't fall back from OFDM to CCK.
6542  */
6543 static uint8_t
6544 bwn_get_fbrate(uint8_t bitrate)
6545 {
6546 	switch (bitrate) {
6547 	/* CCK */
6548 	case BWN_CCK_RATE_1MB:
6549 		return (BWN_CCK_RATE_1MB);
6550 	case BWN_CCK_RATE_2MB:
6551 		return (BWN_CCK_RATE_1MB);
6552 	case BWN_CCK_RATE_5MB:
6553 		return (BWN_CCK_RATE_2MB);
6554 	case BWN_CCK_RATE_11MB:
6555 		return (BWN_CCK_RATE_5MB);
6556 
6557 	/* OFDM */
6558 	case BWN_OFDM_RATE_6MB:
6559 		return (BWN_OFDM_RATE_6MB);
6560 	case BWN_OFDM_RATE_9MB:
6561 		return (BWN_OFDM_RATE_6MB);
6562 	case BWN_OFDM_RATE_12MB:
6563 		return (BWN_OFDM_RATE_9MB);
6564 	case BWN_OFDM_RATE_18MB:
6565 		return (BWN_OFDM_RATE_12MB);
6566 	case BWN_OFDM_RATE_24MB:
6567 		return (BWN_OFDM_RATE_18MB);
6568 	case BWN_OFDM_RATE_36MB:
6569 		return (BWN_OFDM_RATE_24MB);
6570 	case BWN_OFDM_RATE_48MB:
6571 		return (BWN_OFDM_RATE_36MB);
6572 	case BWN_OFDM_RATE_54MB:
6573 		return (BWN_OFDM_RATE_48MB);
6574 	}
6575 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6576 	return (0);
6577 }
6578 
6579 static uint32_t
6580 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6581     uint32_t ctl, const void *_data, int len)
6582 {
6583 	struct bwn_softc *sc = mac->mac_sc;
6584 	uint32_t value = 0;
6585 	const uint8_t *data = _data;
6586 
6587 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6588 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6589 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6590 
6591 	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6592 	    tq->tq_base + BWN_PIO8_TXDATA);
6593 	if (len & 3) {
6594 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6595 		    BWN_PIO8_TXCTL_24_31);
6596 		data = &(data[len - 1]);
6597 		switch (len & 3) {
6598 		case 3:
6599 			ctl |= BWN_PIO8_TXCTL_16_23;
6600 			value |= (uint32_t)(*data) << 16;
6601 			data--;
6602 		case 2:
6603 			ctl |= BWN_PIO8_TXCTL_8_15;
6604 			value |= (uint32_t)(*data) << 8;
6605 			data--;
6606 		case 1:
6607 			value |= (uint32_t)(*data);
6608 		}
6609 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6610 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6611 	}
6612 
6613 	return (ctl);
6614 }
6615 
6616 static void
6617 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6618     uint16_t offset, uint32_t value)
6619 {
6620 
6621 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6622 }
6623 
6624 static uint16_t
6625 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6626     uint16_t ctl, const void *_data, int len)
6627 {
6628 	struct bwn_softc *sc = mac->mac_sc;
6629 	const uint8_t *data = _data;
6630 
6631 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6632 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6633 
6634 	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6635 	    tq->tq_base + BWN_PIO_TXDATA);
6636 	if (len & 1) {
6637 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6638 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6639 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6640 	}
6641 
6642 	return (ctl);
6643 }
6644 
6645 static uint16_t
6646 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6647     uint16_t ctl, struct mbuf *m0)
6648 {
6649 	int i, j = 0;
6650 	uint16_t data = 0;
6651 	const uint8_t *buf;
6652 	struct mbuf *m = m0;
6653 
6654 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6655 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6656 
6657 	for (; m != NULL; m = m->m_next) {
6658 		buf = mtod(m, const uint8_t *);
6659 		for (i = 0; i < m->m_len; i++) {
6660 			if (!((j++) % 2))
6661 				data |= buf[i];
6662 			else {
6663 				data |= (buf[i] << 8);
6664 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6665 				data = 0;
6666 			}
6667 		}
6668 	}
6669 	if (m0->m_pkthdr.len % 2) {
6670 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6671 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6672 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6673 	}
6674 
6675 	return (ctl);
6676 }
6677 
6678 static void
6679 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6680 {
6681 
6682 	/* XXX should exit if 5GHz band .. */
6683 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6684 		return;
6685 
6686 	BWN_WRITE_2(mac, 0x684, 510 + time);
6687 	/* Disabled in Linux b43, can adversely effect performance */
6688 #if 0
6689 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6690 #endif
6691 }
6692 
6693 static struct bwn_dma_ring *
6694 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6695 {
6696 
6697 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6698 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6699 
6700 	switch (prio) {
6701 	case 3:
6702 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6703 	case 2:
6704 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6705 	case 0:
6706 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6707 	case 1:
6708 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6709 	}
6710 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6711 	return (NULL);
6712 }
6713 
6714 static int
6715 bwn_dma_getslot(struct bwn_dma_ring *dr)
6716 {
6717 	int slot;
6718 
6719 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6720 
6721 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6722 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6723 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6724 
6725 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6726 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6727 	dr->dr_curslot = slot;
6728 	dr->dr_usedslot++;
6729 
6730 	return (slot);
6731 }
6732 
6733 static struct bwn_pio_txqueue *
6734 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6735     struct bwn_pio_txpkt **pack)
6736 {
6737 	struct bwn_pio *pio = &mac->mac_method.pio;
6738 	struct bwn_pio_txqueue *tq = NULL;
6739 	unsigned int index;
6740 
6741 	switch (cookie & 0xf000) {
6742 	case 0x1000:
6743 		tq = &pio->wme[WME_AC_BK];
6744 		break;
6745 	case 0x2000:
6746 		tq = &pio->wme[WME_AC_BE];
6747 		break;
6748 	case 0x3000:
6749 		tq = &pio->wme[WME_AC_VI];
6750 		break;
6751 	case 0x4000:
6752 		tq = &pio->wme[WME_AC_VO];
6753 		break;
6754 	case 0x5000:
6755 		tq = &pio->mcast;
6756 		break;
6757 	}
6758 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6759 	if (tq == NULL)
6760 		return (NULL);
6761 	index = (cookie & 0x0fff);
6762 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6763 	if (index >= N(tq->tq_pkts))
6764 		return (NULL);
6765 	*pack = &tq->tq_pkts[index];
6766 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6767 	return (tq);
6768 }
6769 
6770 static void
6771 bwn_txpwr(void *arg, int npending)
6772 {
6773 	struct bwn_mac *mac = arg;
6774 	struct bwn_softc *sc;
6775 
6776 	if (mac == NULL)
6777 		return;
6778 
6779 	sc = mac->mac_sc;
6780 
6781 	BWN_LOCK(sc);
6782 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6783 	    mac->mac_phy.set_txpwr != NULL)
6784 		mac->mac_phy.set_txpwr(mac);
6785 	BWN_UNLOCK(sc);
6786 }
6787 
6788 static void
6789 bwn_task_15s(struct bwn_mac *mac)
6790 {
6791 	uint16_t reg;
6792 
6793 	if (mac->mac_fw.opensource) {
6794 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6795 		if (reg) {
6796 			bwn_restart(mac, "fw watchdog");
6797 			return;
6798 		}
6799 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6800 	}
6801 	if (mac->mac_phy.task_15s)
6802 		mac->mac_phy.task_15s(mac);
6803 
6804 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6805 }
6806 
6807 static void
6808 bwn_task_30s(struct bwn_mac *mac)
6809 {
6810 
6811 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6812 		return;
6813 	mac->mac_noise.noi_running = 1;
6814 	mac->mac_noise.noi_nsamples = 0;
6815 
6816 	bwn_noise_gensample(mac);
6817 }
6818 
6819 static void
6820 bwn_task_60s(struct bwn_mac *mac)
6821 {
6822 
6823 	if (mac->mac_phy.task_60s)
6824 		mac->mac_phy.task_60s(mac);
6825 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6826 }
6827 
6828 static void
6829 bwn_tasks(void *arg)
6830 {
6831 	struct bwn_mac *mac = arg;
6832 	struct bwn_softc *sc = mac->mac_sc;
6833 
6834 	BWN_ASSERT_LOCKED(sc);
6835 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6836 		return;
6837 
6838 	if (mac->mac_task_state % 4 == 0)
6839 		bwn_task_60s(mac);
6840 	if (mac->mac_task_state % 2 == 0)
6841 		bwn_task_30s(mac);
6842 	bwn_task_15s(mac);
6843 
6844 	mac->mac_task_state++;
6845 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6846 }
6847 
6848 static int
6849 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6850 {
6851 	struct bwn_softc *sc = mac->mac_sc;
6852 
6853 	KASSERT(a == 0, ("not support APHY\n"));
6854 
6855 	switch (plcp->o.raw[0] & 0xf) {
6856 	case 0xb:
6857 		return (BWN_OFDM_RATE_6MB);
6858 	case 0xf:
6859 		return (BWN_OFDM_RATE_9MB);
6860 	case 0xa:
6861 		return (BWN_OFDM_RATE_12MB);
6862 	case 0xe:
6863 		return (BWN_OFDM_RATE_18MB);
6864 	case 0x9:
6865 		return (BWN_OFDM_RATE_24MB);
6866 	case 0xd:
6867 		return (BWN_OFDM_RATE_36MB);
6868 	case 0x8:
6869 		return (BWN_OFDM_RATE_48MB);
6870 	case 0xc:
6871 		return (BWN_OFDM_RATE_54MB);
6872 	}
6873 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6874 	    plcp->o.raw[0] & 0xf);
6875 	return (-1);
6876 }
6877 
6878 static int
6879 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6880 {
6881 	struct bwn_softc *sc = mac->mac_sc;
6882 
6883 	switch (plcp->o.raw[0]) {
6884 	case 0x0a:
6885 		return (BWN_CCK_RATE_1MB);
6886 	case 0x14:
6887 		return (BWN_CCK_RATE_2MB);
6888 	case 0x37:
6889 		return (BWN_CCK_RATE_5MB);
6890 	case 0x6e:
6891 		return (BWN_CCK_RATE_11MB);
6892 	}
6893 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6894 	return (-1);
6895 }
6896 
6897 static void
6898 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6899     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6900     int rssi, int noise)
6901 {
6902 	struct bwn_softc *sc = mac->mac_sc;
6903 	const struct ieee80211_frame_min *wh;
6904 	uint64_t tsf;
6905 	uint16_t low_mactime_now;
6906 	uint16_t mt;
6907 
6908 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6909 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6910 
6911 	wh = mtod(m, const struct ieee80211_frame_min *);
6912 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6913 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6914 
6915 	bwn_tsf_read(mac, &tsf);
6916 	low_mactime_now = tsf;
6917 	tsf = tsf & ~0xffffULL;
6918 
6919 	switch (mac->mac_fw.fw_hdr_format) {
6920 	case BWN_FW_HDR_351:
6921 	case BWN_FW_HDR_410:
6922 		mt = le16toh(rxhdr->ps4.r351.mac_time);
6923 		break;
6924 	case BWN_FW_HDR_598:
6925 		mt = le16toh(rxhdr->ps4.r598.mac_time);
6926 		break;
6927 	}
6928 
6929 	tsf += mt;
6930 	if (low_mactime_now < mt)
6931 		tsf -= 0x10000;
6932 
6933 	sc->sc_rx_th.wr_tsf = tsf;
6934 	sc->sc_rx_th.wr_rate = rate;
6935 	sc->sc_rx_th.wr_antsignal = rssi;
6936 	sc->sc_rx_th.wr_antnoise = noise;
6937 }
6938 
6939 static void
6940 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6941 {
6942 	uint32_t low, high;
6943 
6944 	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6945 	    ("%s:%d: fail", __func__, __LINE__));
6946 
6947 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6948 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6949 	*tsf = high;
6950 	*tsf <<= 32;
6951 	*tsf |= low;
6952 }
6953 
6954 static int
6955 bwn_dma_attach(struct bwn_mac *mac)
6956 {
6957 	struct bwn_dma *dma = &mac->mac_method.dma;
6958 	struct bwn_softc *sc = mac->mac_sc;
6959 	bus_addr_t lowaddr = 0;
6960 	int error;
6961 
6962 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6963 		return (0);
6964 
6965 	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6966 
6967 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6968 
6969 	dma->dmatype = bwn_dma_gettype(mac);
6970 	if (dma->dmatype == BWN_DMA_30BIT)
6971 		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6972 	else if (dma->dmatype == BWN_DMA_32BIT)
6973 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6974 	else
6975 		lowaddr = BUS_SPACE_MAXADDR;
6976 
6977 	/*
6978 	 * Create top level DMA tag
6979 	 */
6980 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6981 			       BWN_ALIGN, 0,		/* alignment, bounds */
6982 			       lowaddr,			/* lowaddr */
6983 			       BUS_SPACE_MAXADDR,	/* highaddr */
6984 			       NULL, NULL,		/* filter, filterarg */
6985 			       BUS_SPACE_MAXSIZE,	/* maxsize */
6986 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6987 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6988 			       0,			/* flags */
6989 			       NULL, NULL,		/* lockfunc, lockarg */
6990 			       &dma->parent_dtag);
6991 	if (error) {
6992 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6993 		return (error);
6994 	}
6995 
6996 	/*
6997 	 * Create TX/RX mbuf DMA tag
6998 	 */
6999 	error = bus_dma_tag_create(dma->parent_dtag,
7000 				1,
7001 				0,
7002 				BUS_SPACE_MAXADDR,
7003 				BUS_SPACE_MAXADDR,
7004 				NULL, NULL,
7005 				MCLBYTES,
7006 				1,
7007 				BUS_SPACE_MAXSIZE_32BIT,
7008 				0,
7009 				NULL, NULL,
7010 				&dma->rxbuf_dtag);
7011 	if (error) {
7012 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7013 		goto fail0;
7014 	}
7015 	error = bus_dma_tag_create(dma->parent_dtag,
7016 				1,
7017 				0,
7018 				BUS_SPACE_MAXADDR,
7019 				BUS_SPACE_MAXADDR,
7020 				NULL, NULL,
7021 				MCLBYTES,
7022 				1,
7023 				BUS_SPACE_MAXSIZE_32BIT,
7024 				0,
7025 				NULL, NULL,
7026 				&dma->txbuf_dtag);
7027 	if (error) {
7028 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7029 		goto fail1;
7030 	}
7031 
7032 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7033 	if (!dma->wme[WME_AC_BK])
7034 		goto fail2;
7035 
7036 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7037 	if (!dma->wme[WME_AC_BE])
7038 		goto fail3;
7039 
7040 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7041 	if (!dma->wme[WME_AC_VI])
7042 		goto fail4;
7043 
7044 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7045 	if (!dma->wme[WME_AC_VO])
7046 		goto fail5;
7047 
7048 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7049 	if (!dma->mcast)
7050 		goto fail6;
7051 	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7052 	if (!dma->rx)
7053 		goto fail7;
7054 
7055 	return (error);
7056 
7057 fail7:	bwn_dma_ringfree(&dma->mcast);
7058 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7059 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7060 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7061 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7062 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7063 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7064 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7065 	return (error);
7066 }
7067 
7068 static struct bwn_dma_ring *
7069 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7070     uint16_t cookie, int *slot)
7071 {
7072 	struct bwn_dma *dma = &mac->mac_method.dma;
7073 	struct bwn_dma_ring *dr;
7074 	struct bwn_softc *sc = mac->mac_sc;
7075 
7076 	BWN_ASSERT_LOCKED(mac->mac_sc);
7077 
7078 	switch (cookie & 0xf000) {
7079 	case 0x1000:
7080 		dr = dma->wme[WME_AC_BK];
7081 		break;
7082 	case 0x2000:
7083 		dr = dma->wme[WME_AC_BE];
7084 		break;
7085 	case 0x3000:
7086 		dr = dma->wme[WME_AC_VI];
7087 		break;
7088 	case 0x4000:
7089 		dr = dma->wme[WME_AC_VO];
7090 		break;
7091 	case 0x5000:
7092 		dr = dma->mcast;
7093 		break;
7094 	default:
7095 		dr = NULL;
7096 		KASSERT(0 == 1,
7097 		    ("invalid cookie value %d", cookie & 0xf000));
7098 	}
7099 	*slot = (cookie & 0x0fff);
7100 	if (*slot < 0 || *slot >= dr->dr_numslots) {
7101 		/*
7102 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7103 		 * that it occurs events which have same H/W sequence numbers.
7104 		 * When it's occurred just prints a WARNING msgs and ignores.
7105 		 */
7106 		KASSERT(status->seq == dma->lastseq,
7107 		    ("%s:%d: fail", __func__, __LINE__));
7108 		device_printf(sc->sc_dev,
7109 		    "out of slot ranges (0 < %d < %d)\n", *slot,
7110 		    dr->dr_numslots);
7111 		return (NULL);
7112 	}
7113 	dma->lastseq = status->seq;
7114 	return (dr);
7115 }
7116 
7117 static void
7118 bwn_dma_stop(struct bwn_mac *mac)
7119 {
7120 	struct bwn_dma *dma;
7121 
7122 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7123 		return;
7124 	dma = &mac->mac_method.dma;
7125 
7126 	bwn_dma_ringstop(&dma->rx);
7127 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7128 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7129 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7130 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7131 	bwn_dma_ringstop(&dma->mcast);
7132 }
7133 
7134 static void
7135 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7136 {
7137 
7138 	if (dr == NULL)
7139 		return;
7140 
7141 	bwn_dma_cleanup(*dr);
7142 }
7143 
7144 static void
7145 bwn_pio_stop(struct bwn_mac *mac)
7146 {
7147 	struct bwn_pio *pio;
7148 
7149 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7150 		return;
7151 	pio = &mac->mac_method.pio;
7152 
7153 	bwn_destroy_queue_tx(&pio->mcast);
7154 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7155 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7156 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7157 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7158 }
7159 
7160 static void
7161 bwn_led_attach(struct bwn_mac *mac)
7162 {
7163 	struct bwn_softc *sc = mac->mac_sc;
7164 	const uint8_t *led_act = NULL;
7165 	uint16_t val[BWN_LED_MAX];
7166 	int i;
7167 
7168 	sc->sc_led_idle = (2350 * hz) / 1000;
7169 	sc->sc_led_blink = 1;
7170 
7171 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7172 		if (siba_get_pci_subvendor(sc->sc_dev) ==
7173 		    bwn_vendor_led_act[i].vid) {
7174 			led_act = bwn_vendor_led_act[i].led_act;
7175 			break;
7176 		}
7177 	}
7178 	if (led_act == NULL)
7179 		led_act = bwn_default_led_act;
7180 
7181 	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7182 	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7183 	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7184 	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7185 
7186 	for (i = 0; i < BWN_LED_MAX; ++i) {
7187 		struct bwn_led *led = &sc->sc_leds[i];
7188 
7189 		if (val[i] == 0xff) {
7190 			led->led_act = led_act[i];
7191 		} else {
7192 			if (val[i] & BWN_LED_ACT_LOW)
7193 				led->led_flags |= BWN_LED_F_ACTLOW;
7194 			led->led_act = val[i] & BWN_LED_ACT_MASK;
7195 		}
7196 		led->led_mask = (1 << i);
7197 
7198 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7199 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7200 		    led->led_act == BWN_LED_ACT_BLINK) {
7201 			led->led_flags |= BWN_LED_F_BLINK;
7202 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7203 				led->led_flags |= BWN_LED_F_POLLABLE;
7204 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7205 				led->led_flags |= BWN_LED_F_SLOW;
7206 
7207 			if (sc->sc_blink_led == NULL) {
7208 				sc->sc_blink_led = led;
7209 				if (led->led_flags & BWN_LED_F_SLOW)
7210 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7211 			}
7212 		}
7213 
7214 		DPRINTF(sc, BWN_DEBUG_LED,
7215 		    "%dth led, act %d, lowact %d\n", i,
7216 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7217 	}
7218 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7219 }
7220 
7221 static __inline uint16_t
7222 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7223 {
7224 
7225 	if (led->led_flags & BWN_LED_F_ACTLOW)
7226 		on = !on;
7227 	if (on)
7228 		val |= led->led_mask;
7229 	else
7230 		val &= ~led->led_mask;
7231 	return val;
7232 }
7233 
7234 static void
7235 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7236 {
7237 	struct bwn_softc *sc = mac->mac_sc;
7238 	struct ieee80211com *ic = &sc->sc_ic;
7239 	uint16_t val;
7240 	int i;
7241 
7242 	if (nstate == IEEE80211_S_INIT) {
7243 		callout_stop(&sc->sc_led_blink_ch);
7244 		sc->sc_led_blinking = 0;
7245 	}
7246 
7247 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7248 		return;
7249 
7250 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7251 	for (i = 0; i < BWN_LED_MAX; ++i) {
7252 		struct bwn_led *led = &sc->sc_leds[i];
7253 		int on;
7254 
7255 		if (led->led_act == BWN_LED_ACT_UNKN ||
7256 		    led->led_act == BWN_LED_ACT_NULL)
7257 			continue;
7258 
7259 		if ((led->led_flags & BWN_LED_F_BLINK) &&
7260 		    nstate != IEEE80211_S_INIT)
7261 			continue;
7262 
7263 		switch (led->led_act) {
7264 		case BWN_LED_ACT_ON:    /* Always on */
7265 			on = 1;
7266 			break;
7267 		case BWN_LED_ACT_OFF:   /* Always off */
7268 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7269 			on = 0;
7270 			break;
7271 		default:
7272 			on = 1;
7273 			switch (nstate) {
7274 			case IEEE80211_S_INIT:
7275 				on = 0;
7276 				break;
7277 			case IEEE80211_S_RUN:
7278 				if (led->led_act == BWN_LED_ACT_11G &&
7279 				    ic->ic_curmode != IEEE80211_MODE_11G)
7280 					on = 0;
7281 				break;
7282 			default:
7283 				if (led->led_act == BWN_LED_ACT_ASSOC)
7284 					on = 0;
7285 				break;
7286 			}
7287 			break;
7288 		}
7289 
7290 		val = bwn_led_onoff(led, val, on);
7291 	}
7292 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7293 }
7294 
7295 static void
7296 bwn_led_event(struct bwn_mac *mac, int event)
7297 {
7298 	struct bwn_softc *sc = mac->mac_sc;
7299 	struct bwn_led *led = sc->sc_blink_led;
7300 	int rate;
7301 
7302 	if (event == BWN_LED_EVENT_POLL) {
7303 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7304 			return;
7305 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7306 			return;
7307 	}
7308 
7309 	sc->sc_led_ticks = ticks;
7310 	if (sc->sc_led_blinking)
7311 		return;
7312 
7313 	switch (event) {
7314 	case BWN_LED_EVENT_RX:
7315 		rate = sc->sc_rx_rate;
7316 		break;
7317 	case BWN_LED_EVENT_TX:
7318 		rate = sc->sc_tx_rate;
7319 		break;
7320 	case BWN_LED_EVENT_POLL:
7321 		rate = 0;
7322 		break;
7323 	default:
7324 		panic("unknown LED event %d\n", event);
7325 		break;
7326 	}
7327 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7328 	    bwn_led_duration[rate].off_dur);
7329 }
7330 
7331 static void
7332 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7333 {
7334 	struct bwn_softc *sc = mac->mac_sc;
7335 	struct bwn_led *led = sc->sc_blink_led;
7336 	uint16_t val;
7337 
7338 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7339 	val = bwn_led_onoff(led, val, 1);
7340 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7341 
7342 	if (led->led_flags & BWN_LED_F_SLOW) {
7343 		BWN_LED_SLOWDOWN(on_dur);
7344 		BWN_LED_SLOWDOWN(off_dur);
7345 	}
7346 
7347 	sc->sc_led_blinking = 1;
7348 	sc->sc_led_blink_offdur = off_dur;
7349 
7350 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7351 }
7352 
7353 static void
7354 bwn_led_blink_next(void *arg)
7355 {
7356 	struct bwn_mac *mac = arg;
7357 	struct bwn_softc *sc = mac->mac_sc;
7358 	uint16_t val;
7359 
7360 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7361 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7362 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7363 
7364 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7365 	    bwn_led_blink_end, mac);
7366 }
7367 
7368 static void
7369 bwn_led_blink_end(void *arg)
7370 {
7371 	struct bwn_mac *mac = arg;
7372 	struct bwn_softc *sc = mac->mac_sc;
7373 
7374 	sc->sc_led_blinking = 0;
7375 }
7376 
7377 static int
7378 bwn_suspend(device_t dev)
7379 {
7380 	struct bwn_softc *sc = device_get_softc(dev);
7381 
7382 	BWN_LOCK(sc);
7383 	bwn_stop(sc);
7384 	BWN_UNLOCK(sc);
7385 	return (0);
7386 }
7387 
7388 static int
7389 bwn_resume(device_t dev)
7390 {
7391 	struct bwn_softc *sc = device_get_softc(dev);
7392 	int error = EDOOFUS;
7393 
7394 	BWN_LOCK(sc);
7395 	if (sc->sc_ic.ic_nrunning > 0)
7396 		error = bwn_init(sc);
7397 	BWN_UNLOCK(sc);
7398 	if (error == 0)
7399 		ieee80211_start_all(&sc->sc_ic);
7400 	return (0);
7401 }
7402 
7403 static void
7404 bwn_rfswitch(void *arg)
7405 {
7406 	struct bwn_softc *sc = arg;
7407 	struct bwn_mac *mac = sc->sc_curmac;
7408 	int cur = 0, prev = 0;
7409 
7410 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7411 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7412 
7413 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7414 	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7415 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7416 			& BWN_RF_HWENABLED_HI_MASK))
7417 			cur = 1;
7418 	} else {
7419 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7420 		    & BWN_RF_HWENABLED_LO_MASK)
7421 			cur = 1;
7422 	}
7423 
7424 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7425 		prev = 1;
7426 
7427 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7428 	    __func__, cur, prev);
7429 
7430 	if (cur != prev) {
7431 		if (cur)
7432 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7433 		else
7434 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7435 
7436 		device_printf(sc->sc_dev,
7437 		    "status of RF switch is changed to %s\n",
7438 		    cur ? "ON" : "OFF");
7439 		if (cur != mac->mac_phy.rf_on) {
7440 			if (cur)
7441 				bwn_rf_turnon(mac);
7442 			else
7443 				bwn_rf_turnoff(mac);
7444 		}
7445 	}
7446 
7447 	callout_schedule(&sc->sc_rfswitch_ch, hz);
7448 }
7449 
7450 static void
7451 bwn_sysctl_node(struct bwn_softc *sc)
7452 {
7453 	device_t dev = sc->sc_dev;
7454 	struct bwn_mac *mac;
7455 	struct bwn_stats *stats;
7456 
7457 	/* XXX assume that count of MAC is only 1. */
7458 
7459 	if ((mac = sc->sc_curmac) == NULL)
7460 		return;
7461 	stats = &mac->mac_stats;
7462 
7463 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7464 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7465 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7466 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7467 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7468 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7469 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7470 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7471 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7472 
7473 #ifdef BWN_DEBUG
7474 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7475 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7476 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7477 #endif
7478 }
7479 
7480 static device_method_t bwn_methods[] = {
7481 	/* Device interface */
7482 	DEVMETHOD(device_probe,		bwn_probe),
7483 	DEVMETHOD(device_attach,	bwn_attach),
7484 	DEVMETHOD(device_detach,	bwn_detach),
7485 	DEVMETHOD(device_suspend,	bwn_suspend),
7486 	DEVMETHOD(device_resume,	bwn_resume),
7487 	DEVMETHOD_END
7488 };
7489 driver_t bwn_driver = {
7490 	"bwn",
7491 	bwn_methods,
7492 	sizeof(struct bwn_softc)
7493 };
7494 static devclass_t bwn_devclass;
7495 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7496 MODULE_DEPEND(bwn, bwn_pci, 1, 1, 1);
7497 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7498 MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
7499 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7500 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7501 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7502 MODULE_VERSION(bwn, 1);
7503