xref: /freebsd/sys/dev/bwn/if_bwn.c (revision 5c831a5bd61576cacb48b39f8eeb47b92707a355)
1 /*-
2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  *
16  * NO WARRANTY
17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27  * THE POSSIBILITY OF SUCH DAMAGES.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 /*
34  * The Broadcom Wireless LAN controller driver.
35  */
36 
37 #include "opt_bwn.h"
38 #include "opt_wlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/malloc.h>
44 #include <sys/module.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/firmware.h>
48 #include <sys/lock.h>
49 #include <sys/mutex.h>
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 #include <sys/bus.h>
53 #include <sys/rman.h>
54 #include <sys/socket.h>
55 #include <sys/sockio.h>
56 
57 #include <net/ethernet.h>
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/if_arp.h>
61 #include <net/if_dl.h>
62 #include <net/if_llc.h>
63 #include <net/if_media.h>
64 #include <net/if_types.h>
65 
66 #include <dev/pci/pcivar.h>
67 #include <dev/pci/pcireg.h>
68 #include <dev/siba/siba_ids.h>
69 #include <dev/siba/sibareg.h>
70 #include <dev/siba/sibavar.h>
71 
72 #include <net80211/ieee80211_var.h>
73 #include <net80211/ieee80211_radiotap.h>
74 #include <net80211/ieee80211_regdomain.h>
75 #include <net80211/ieee80211_phy.h>
76 #include <net80211/ieee80211_ratectl.h>
77 
78 #include <dev/bwn/if_bwnreg.h>
79 #include <dev/bwn/if_bwnvar.h>
80 
81 #include <dev/bwn/if_bwn_debug.h>
82 #include <dev/bwn/if_bwn_misc.h>
83 #include <dev/bwn/if_bwn_util.h>
84 #include <dev/bwn/if_bwn_phy_common.h>
85 #include <dev/bwn/if_bwn_phy_g.h>
86 #include <dev/bwn/if_bwn_phy_lp.h>
87 #include <dev/bwn/if_bwn_phy_n.h>
88 
89 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90     "Broadcom driver parameters");
91 
92 /*
93  * Tunable & sysctl variables.
94  */
95 
96 #ifdef BWN_DEBUG
97 static	int bwn_debug = 0;
98 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99     "Broadcom debugging printfs");
100 #endif
101 
102 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104     "uses Bad Frames Preemption");
105 static int	bwn_bluetooth = 1;
106 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107     "turns on Bluetooth Coexistence");
108 static int	bwn_hwpctl = 0;
109 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110     "uses H/W power control");
111 static int	bwn_msi_disable = 0;		/* MSI disabled  */
112 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113 static int	bwn_usedma = 1;
114 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115     "uses DMA");
116 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117 static int	bwn_wme = 1;
118 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119     "uses WME support");
120 
121 static void	bwn_attach_pre(struct bwn_softc *);
122 static int	bwn_attach_post(struct bwn_softc *);
123 static void	bwn_sprom_bugfixes(device_t);
124 static int	bwn_init(struct bwn_softc *);
125 static void	bwn_parent(struct ieee80211com *);
126 static void	bwn_start(struct bwn_softc *);
127 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128 static int	bwn_attach_core(struct bwn_mac *);
129 static int	bwn_phy_getinfo(struct bwn_mac *, int);
130 static int	bwn_chiptest(struct bwn_mac *);
131 static int	bwn_setup_channels(struct bwn_mac *, int, int);
132 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133 		    uint16_t);
134 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135 		    const struct bwn_channelinfo *, const uint8_t []);
136 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137 		    const struct ieee80211_bpf_params *);
138 static void	bwn_updateslot(struct ieee80211com *);
139 static void	bwn_update_promisc(struct ieee80211com *);
140 static void	bwn_wme_init(struct bwn_mac *);
141 static int	bwn_wme_update(struct ieee80211com *);
142 static void	bwn_wme_clear(struct bwn_softc *);
143 static void	bwn_wme_load(struct bwn_mac *);
144 static void	bwn_wme_loadparams(struct bwn_mac *,
145 		    const struct wmeParams *, uint16_t);
146 static void	bwn_scan_start(struct ieee80211com *);
147 static void	bwn_scan_end(struct ieee80211com *);
148 static void	bwn_set_channel(struct ieee80211com *);
149 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151 		    const uint8_t [IEEE80211_ADDR_LEN],
152 		    const uint8_t [IEEE80211_ADDR_LEN]);
153 static void	bwn_vap_delete(struct ieee80211vap *);
154 static void	bwn_stop(struct bwn_softc *);
155 static int	bwn_core_init(struct bwn_mac *);
156 static void	bwn_core_start(struct bwn_mac *);
157 static void	bwn_core_exit(struct bwn_mac *);
158 static void	bwn_bt_disable(struct bwn_mac *);
159 static int	bwn_chip_init(struct bwn_mac *);
160 static void	bwn_set_txretry(struct bwn_mac *, int, int);
161 static void	bwn_rate_init(struct bwn_mac *);
162 static void	bwn_set_phytxctl(struct bwn_mac *);
163 static void	bwn_spu_setdelay(struct bwn_mac *, int);
164 static void	bwn_bt_enable(struct bwn_mac *);
165 static void	bwn_set_macaddr(struct bwn_mac *);
166 static void	bwn_crypt_init(struct bwn_mac *);
167 static void	bwn_chip_exit(struct bwn_mac *);
168 static int	bwn_fw_fillinfo(struct bwn_mac *);
169 static int	bwn_fw_loaducode(struct bwn_mac *);
170 static int	bwn_gpio_init(struct bwn_mac *);
171 static int	bwn_fw_loadinitvals(struct bwn_mac *);
172 static int	bwn_phy_init(struct bwn_mac *);
173 static void	bwn_set_txantenna(struct bwn_mac *, int);
174 static void	bwn_set_opmode(struct bwn_mac *);
175 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176 static uint8_t	bwn_plcp_getcck(const uint8_t);
177 static uint8_t	bwn_plcp_getofdm(const uint8_t);
178 static void	bwn_pio_init(struct bwn_mac *);
179 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181 		    int);
182 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183 		    struct bwn_pio_rxqueue *, int);
184 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186 		    uint16_t);
187 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190 static void	bwn_pio_handle_txeof(struct bwn_mac *,
191 		    const struct bwn_txstatus *);
192 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195 		    uint16_t);
196 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197 		    uint32_t);
198 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199 		    struct mbuf *);
200 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204 		    uint16_t, uint32_t);
205 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210 		    uint16_t, struct bwn_pio_txpkt **);
211 static void	bwn_dma_init(struct bwn_mac *);
212 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213 static int	bwn_dma_mask2type(uint64_t);
214 static uint64_t	bwn_dma_mask(struct bwn_mac *);
215 static uint16_t	bwn_dma_base(int, int);
216 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218 		    int, struct bwn_dmadesc_generic **,
219 		    struct bwn_dmadesc_meta **);
220 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222 		    int, int);
223 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229 		    int, struct bwn_dmadesc_generic **,
230 		    struct bwn_dmadesc_meta **);
231 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233 		    int, int);
234 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240 static void	bwn_dma_setup(struct bwn_dma_ring *);
241 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245 static void	bwn_dma_rx(struct bwn_dma_ring *);
246 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248 		    struct bwn_dmadesc_meta *);
249 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250 static int	bwn_dma_gettype(struct bwn_mac *);
251 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257 		    int);
258 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259 		    bus_size_t, int);
260 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261 static void	bwn_ratectl_tx_complete(const struct ieee80211_node *,
262 		    const struct bwn_txstatus *);
263 static void	bwn_dma_handle_txeof(struct bwn_mac *,
264 		    const struct bwn_txstatus *);
265 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
266 		    struct mbuf *);
267 static int	bwn_dma_getslot(struct bwn_dma_ring *);
268 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
269 		    uint8_t);
270 static int	bwn_dma_attach(struct bwn_mac *);
271 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
272 		    int, int, int);
273 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
274 		    const struct bwn_txstatus *, uint16_t, int *);
275 static void	bwn_dma_free(struct bwn_mac *);
276 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
277 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
278 		    const char *, struct bwn_fwfile *);
279 static void	bwn_release_firmware(struct bwn_mac *);
280 static void	bwn_do_release_fw(struct bwn_fwfile *);
281 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
282 static int	bwn_fwinitvals_write(struct bwn_mac *,
283 		    const struct bwn_fwinitvals *, size_t, size_t);
284 static uint16_t	bwn_ant2phy(int);
285 static void	bwn_mac_write_bssid(struct bwn_mac *);
286 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
287 		    const uint8_t *);
288 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
289 		    const uint8_t *, size_t, const uint8_t *);
290 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
291 		    const uint8_t *);
292 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
293 		    const uint8_t *);
294 static void	bwn_phy_exit(struct bwn_mac *);
295 static void	bwn_core_stop(struct bwn_mac *);
296 static int	bwn_switch_band(struct bwn_softc *,
297 		    struct ieee80211_channel *);
298 static void	bwn_phy_reset(struct bwn_mac *);
299 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
300 static void	bwn_set_pretbtt(struct bwn_mac *);
301 static int	bwn_intr(void *);
302 static void	bwn_intrtask(void *, int);
303 static void	bwn_restart(struct bwn_mac *, const char *);
304 static void	bwn_intr_ucode_debug(struct bwn_mac *);
305 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
306 static void	bwn_intr_atim_end(struct bwn_mac *);
307 static void	bwn_intr_beacon(struct bwn_mac *);
308 static void	bwn_intr_pmq(struct bwn_mac *);
309 static void	bwn_intr_noise(struct bwn_mac *);
310 static void	bwn_intr_txeof(struct bwn_mac *);
311 static void	bwn_hwreset(void *, int);
312 static void	bwn_handle_fwpanic(struct bwn_mac *);
313 static void	bwn_load_beacon0(struct bwn_mac *);
314 static void	bwn_load_beacon1(struct bwn_mac *);
315 static uint32_t	bwn_jssi_read(struct bwn_mac *);
316 static void	bwn_noise_gensample(struct bwn_mac *);
317 static void	bwn_handle_txeof(struct bwn_mac *,
318 		    const struct bwn_txstatus *);
319 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
320 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
321 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
322 		    struct mbuf *);
323 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
324 static int	bwn_set_txhdr(struct bwn_mac *,
325 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
326 		    uint16_t);
327 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
328 		    const uint8_t);
329 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
330 static uint8_t	bwn_get_fbrate(uint8_t);
331 static void	bwn_txpwr(void *, int);
332 static void	bwn_tasks(void *);
333 static void	bwn_task_15s(struct bwn_mac *);
334 static void	bwn_task_30s(struct bwn_mac *);
335 static void	bwn_task_60s(struct bwn_mac *);
336 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
337 		    uint8_t);
338 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
339 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
340 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
341 		    int, int);
342 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
343 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
344 static void	bwn_watchdog(void *);
345 static void	bwn_dma_stop(struct bwn_mac *);
346 static void	bwn_pio_stop(struct bwn_mac *);
347 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
348 static void	bwn_led_attach(struct bwn_mac *);
349 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
350 static void	bwn_led_event(struct bwn_mac *, int);
351 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
352 static void	bwn_led_blink_next(void *);
353 static void	bwn_led_blink_end(void *);
354 static void	bwn_rfswitch(void *);
355 static void	bwn_rf_turnon(struct bwn_mac *);
356 static void	bwn_rf_turnoff(struct bwn_mac *);
357 static void	bwn_sysctl_node(struct bwn_softc *);
358 
359 static struct resource_spec bwn_res_spec_legacy[] = {
360 	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
361 	{ -1,			0,		0 }
362 };
363 
364 static struct resource_spec bwn_res_spec_msi[] = {
365 	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
366 	{ -1,			0,		0 }
367 };
368 
369 static const struct bwn_channelinfo bwn_chantable_bg = {
370 	.channels = {
371 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
372 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
373 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
374 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
375 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
376 	.nchannels = 14
377 };
378 
379 static const struct bwn_channelinfo bwn_chantable_a = {
380 	.channels = {
381 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
382 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
383 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
384 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
385 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
386 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
387 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
388 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
389 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
390 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
391 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
392 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
393 		{ 6080, 216, 30 } },
394 	.nchannels = 37
395 };
396 
397 #if 0
398 static const struct bwn_channelinfo bwn_chantable_n = {
399 	.channels = {
400 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
401 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
402 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
403 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
404 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
405 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
406 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
407 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
408 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
409 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
410 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
411 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
412 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
413 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
414 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
415 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
416 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
417 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
418 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
419 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
420 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
421 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
422 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
423 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
424 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
425 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
426 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
427 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
428 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
429 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
430 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
431 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
432 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
433 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
434 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
435 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
436 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
437 	.nchannels = 110
438 };
439 #endif
440 
441 #define	VENDOR_LED_ACT(vendor)				\
442 {							\
443 	.vid = PCI_VENDOR_##vendor,			\
444 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
445 }
446 
447 static const struct {
448 	uint16_t	vid;
449 	uint8_t		led_act[BWN_LED_MAX];
450 } bwn_vendor_led_act[] = {
451 	VENDOR_LED_ACT(COMPAQ),
452 	VENDOR_LED_ACT(ASUSTEK)
453 };
454 
455 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
456 	{ BWN_VENDOR_LED_ACT_DEFAULT };
457 
458 #undef VENDOR_LED_ACT
459 
460 static const struct {
461 	int		on_dur;
462 	int		off_dur;
463 } bwn_led_duration[109] = {
464 	[0]	= { 400, 100 },
465 	[2]	= { 150, 75 },
466 	[4]	= { 90, 45 },
467 	[11]	= { 66, 34 },
468 	[12]	= { 53, 26 },
469 	[18]	= { 42, 21 },
470 	[22]	= { 35, 17 },
471 	[24]	= { 32, 16 },
472 	[36]	= { 21, 10 },
473 	[48]	= { 16, 8 },
474 	[72]	= { 11, 5 },
475 	[96]	= { 9, 4 },
476 	[108]	= { 7, 3 }
477 };
478 
479 static const uint16_t bwn_wme_shm_offsets[] = {
480 	[0] = BWN_WME_BESTEFFORT,
481 	[1] = BWN_WME_BACKGROUND,
482 	[2] = BWN_WME_VOICE,
483 	[3] = BWN_WME_VIDEO,
484 };
485 
486 static const struct siba_devid bwn_devs[] = {
487 	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
488 	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
489 	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
490 	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
491 	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
492 	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
493 	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
494 	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
495 	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
496 	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
497 };
498 
499 static int
500 bwn_probe(device_t dev)
501 {
502 	int i;
503 
504 	for (i = 0; i < nitems(bwn_devs); i++) {
505 		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
506 		    siba_get_device(dev) == bwn_devs[i].sd_device &&
507 		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
508 			return (BUS_PROBE_DEFAULT);
509 	}
510 
511 	return (ENXIO);
512 }
513 
514 static int
515 bwn_attach(device_t dev)
516 {
517 	struct bwn_mac *mac;
518 	struct bwn_softc *sc = device_get_softc(dev);
519 	int error, i, msic, reg;
520 
521 	sc->sc_dev = dev;
522 #ifdef BWN_DEBUG
523 	sc->sc_debug = bwn_debug;
524 #endif
525 
526 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
527 		bwn_attach_pre(sc);
528 		bwn_sprom_bugfixes(dev);
529 		sc->sc_flags |= BWN_FLAG_ATTACHED;
530 	}
531 
532 	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
533 		if (siba_get_pci_device(dev) != 0x4313 &&
534 		    siba_get_pci_device(dev) != 0x431a &&
535 		    siba_get_pci_device(dev) != 0x4321) {
536 			device_printf(sc->sc_dev,
537 			    "skip 802.11 cores\n");
538 			return (ENODEV);
539 		}
540 	}
541 
542 	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
543 	mac->mac_sc = sc;
544 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
545 	if (bwn_bfp != 0)
546 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
547 
548 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
549 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
550 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
551 
552 	error = bwn_attach_core(mac);
553 	if (error)
554 		goto fail0;
555 	bwn_led_attach(mac);
556 
557 	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
558 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
559 	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
560 	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
561 	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
562 	    mac->mac_phy.rf_rev);
563 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
564 		device_printf(sc->sc_dev, "DMA (%d bits)\n",
565 		    mac->mac_method.dma.dmatype);
566 	else
567 		device_printf(sc->sc_dev, "PIO\n");
568 
569 #ifdef	BWN_GPL_PHY
570 	device_printf(sc->sc_dev,
571 	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
572 #endif
573 
574 	/*
575 	 * setup PCI resources and interrupt.
576 	 */
577 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
578 		msic = pci_msi_count(dev);
579 		if (bootverbose)
580 			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
581 	} else
582 		msic = 0;
583 
584 	mac->mac_intr_spec = bwn_res_spec_legacy;
585 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
586 		if (pci_alloc_msi(dev, &msic) == 0) {
587 			device_printf(sc->sc_dev,
588 			    "Using %d MSI messages\n", msic);
589 			mac->mac_intr_spec = bwn_res_spec_msi;
590 			mac->mac_msi = 1;
591 		}
592 	}
593 
594 	error = bus_alloc_resources(dev, mac->mac_intr_spec,
595 	    mac->mac_res_irq);
596 	if (error) {
597 		device_printf(sc->sc_dev,
598 		    "couldn't allocate IRQ resources (%d)\n", error);
599 		goto fail1;
600 	}
601 
602 	if (mac->mac_msi == 0)
603 		error = bus_setup_intr(dev, mac->mac_res_irq[0],
604 		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
605 		    &mac->mac_intrhand[0]);
606 	else {
607 		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
608 			error = bus_setup_intr(dev, mac->mac_res_irq[i],
609 			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
610 			    &mac->mac_intrhand[i]);
611 			if (error != 0) {
612 				device_printf(sc->sc_dev,
613 				    "couldn't setup interrupt (%d)\n", error);
614 				break;
615 			}
616 		}
617 	}
618 
619 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
620 
621 	/*
622 	 * calls attach-post routine
623 	 */
624 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
625 		bwn_attach_post(sc);
626 
627 	return (0);
628 fail1:
629 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
630 		pci_release_msi(dev);
631 fail0:
632 	free(mac, M_DEVBUF);
633 	return (error);
634 }
635 
636 static int
637 bwn_is_valid_ether_addr(uint8_t *addr)
638 {
639 	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
640 
641 	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
642 		return (FALSE);
643 
644 	return (TRUE);
645 }
646 
647 static int
648 bwn_attach_post(struct bwn_softc *sc)
649 {
650 	struct ieee80211com *ic = &sc->sc_ic;
651 
652 	ic->ic_softc = sc;
653 	ic->ic_name = device_get_nameunit(sc->sc_dev);
654 	/* XXX not right but it's not used anywhere important */
655 	ic->ic_phytype = IEEE80211_T_OFDM;
656 	ic->ic_opmode = IEEE80211_M_STA;
657 	ic->ic_caps =
658 		  IEEE80211_C_STA		/* station mode supported */
659 		| IEEE80211_C_MONITOR		/* monitor mode */
660 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
661 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
662 		| IEEE80211_C_SHSLOT		/* short slot time supported */
663 		| IEEE80211_C_WME		/* WME/WMM supported */
664 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
665 #if 0
666 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
667 #endif
668 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
669 		;
670 
671 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
672 
673 	IEEE80211_ADDR_COPY(ic->ic_macaddr,
674 	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
675 	    siba_sprom_get_mac_80211a(sc->sc_dev) :
676 	    siba_sprom_get_mac_80211bg(sc->sc_dev));
677 
678 	/* call MI attach routine. */
679 	ieee80211_ifattach(ic);
680 
681 	ic->ic_headroom = sizeof(struct bwn_txhdr);
682 
683 	/* override default methods */
684 	ic->ic_raw_xmit = bwn_raw_xmit;
685 	ic->ic_updateslot = bwn_updateslot;
686 	ic->ic_update_promisc = bwn_update_promisc;
687 	ic->ic_wme.wme_update = bwn_wme_update;
688 	ic->ic_scan_start = bwn_scan_start;
689 	ic->ic_scan_end = bwn_scan_end;
690 	ic->ic_set_channel = bwn_set_channel;
691 	ic->ic_vap_create = bwn_vap_create;
692 	ic->ic_vap_delete = bwn_vap_delete;
693 	ic->ic_transmit = bwn_transmit;
694 	ic->ic_parent = bwn_parent;
695 
696 	ieee80211_radiotap_attach(ic,
697 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
698 	    BWN_TX_RADIOTAP_PRESENT,
699 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
700 	    BWN_RX_RADIOTAP_PRESENT);
701 
702 	bwn_sysctl_node(sc);
703 
704 	if (bootverbose)
705 		ieee80211_announce(ic);
706 	return (0);
707 }
708 
709 static void
710 bwn_phy_detach(struct bwn_mac *mac)
711 {
712 
713 	if (mac->mac_phy.detach != NULL)
714 		mac->mac_phy.detach(mac);
715 }
716 
717 static int
718 bwn_detach(device_t dev)
719 {
720 	struct bwn_softc *sc = device_get_softc(dev);
721 	struct bwn_mac *mac = sc->sc_curmac;
722 	struct ieee80211com *ic = &sc->sc_ic;
723 	int i;
724 
725 	sc->sc_flags |= BWN_FLAG_INVALID;
726 
727 	if (device_is_attached(sc->sc_dev)) {
728 		BWN_LOCK(sc);
729 		bwn_stop(sc);
730 		BWN_UNLOCK(sc);
731 		bwn_dma_free(mac);
732 		callout_drain(&sc->sc_led_blink_ch);
733 		callout_drain(&sc->sc_rfswitch_ch);
734 		callout_drain(&sc->sc_task_ch);
735 		callout_drain(&sc->sc_watchdog_ch);
736 		bwn_phy_detach(mac);
737 		ieee80211_draintask(ic, &mac->mac_hwreset);
738 		ieee80211_draintask(ic, &mac->mac_txpower);
739 		ieee80211_ifdetach(ic);
740 	}
741 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
742 	taskqueue_free(sc->sc_tq);
743 
744 	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
745 		if (mac->mac_intrhand[i] != NULL) {
746 			bus_teardown_intr(dev, mac->mac_res_irq[i],
747 			    mac->mac_intrhand[i]);
748 			mac->mac_intrhand[i] = NULL;
749 		}
750 	}
751 	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
752 	if (mac->mac_msi != 0)
753 		pci_release_msi(dev);
754 	mbufq_drain(&sc->sc_snd);
755 	bwn_release_firmware(mac);
756 	BWN_LOCK_DESTROY(sc);
757 	return (0);
758 }
759 
760 static void
761 bwn_attach_pre(struct bwn_softc *sc)
762 {
763 
764 	BWN_LOCK_INIT(sc);
765 	TAILQ_INIT(&sc->sc_maclist);
766 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
767 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
768 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
769 	mbufq_init(&sc->sc_snd, ifqmaxlen);
770 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
771 		taskqueue_thread_enqueue, &sc->sc_tq);
772 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
773 		"%s taskq", device_get_nameunit(sc->sc_dev));
774 }
775 
776 static void
777 bwn_sprom_bugfixes(device_t dev)
778 {
779 #define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
780 	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
781 	 (siba_get_pci_device(dev) == _device) &&			\
782 	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
783 	 (siba_get_pci_subdevice(dev) == _subdevice))
784 
785 	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
786 	    siba_get_pci_subdevice(dev) == 0x4e &&
787 	    siba_get_pci_revid(dev) > 0x40)
788 		siba_sprom_set_bf_lo(dev,
789 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
790 	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
791 	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
792 		siba_sprom_set_bf_lo(dev,
793 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
794 	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
795 		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
796 		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
797 		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
798 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
799 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
800 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
801 		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
802 			siba_sprom_set_bf_lo(dev,
803 			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
804 	}
805 #undef	BWN_ISDEV
806 }
807 
808 static void
809 bwn_parent(struct ieee80211com *ic)
810 {
811 	struct bwn_softc *sc = ic->ic_softc;
812 	int startall = 0;
813 
814 	BWN_LOCK(sc);
815 	if (ic->ic_nrunning > 0) {
816 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
817 			bwn_init(sc);
818 			startall = 1;
819 		} else
820 			bwn_update_promisc(ic);
821 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
822 		bwn_stop(sc);
823 	BWN_UNLOCK(sc);
824 
825 	if (startall)
826 		ieee80211_start_all(ic);
827 }
828 
829 static int
830 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
831 {
832 	struct bwn_softc *sc = ic->ic_softc;
833 	int error;
834 
835 	BWN_LOCK(sc);
836 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
837 		BWN_UNLOCK(sc);
838 		return (ENXIO);
839 	}
840 	error = mbufq_enqueue(&sc->sc_snd, m);
841 	if (error) {
842 		BWN_UNLOCK(sc);
843 		return (error);
844 	}
845 	bwn_start(sc);
846 	BWN_UNLOCK(sc);
847 	return (0);
848 }
849 
850 static void
851 bwn_start(struct bwn_softc *sc)
852 {
853 	struct bwn_mac *mac = sc->sc_curmac;
854 	struct ieee80211_frame *wh;
855 	struct ieee80211_node *ni;
856 	struct ieee80211_key *k;
857 	struct mbuf *m;
858 
859 	BWN_ASSERT_LOCKED(sc);
860 
861 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
862 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
863 		return;
864 
865 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
866 		if (bwn_tx_isfull(sc, m))
867 			break;
868 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
869 		if (ni == NULL) {
870 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
871 			m_freem(m);
872 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
873 			continue;
874 		}
875 		wh = mtod(m, struct ieee80211_frame *);
876 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
877 			k = ieee80211_crypto_encap(ni, m);
878 			if (k == NULL) {
879 				if_inc_counter(ni->ni_vap->iv_ifp,
880 				    IFCOUNTER_OERRORS, 1);
881 				ieee80211_free_node(ni);
882 				m_freem(m);
883 				continue;
884 			}
885 		}
886 		wh = NULL;	/* Catch any invalid use */
887 		if (bwn_tx_start(sc, ni, m) != 0) {
888 			if (ni != NULL) {
889 				if_inc_counter(ni->ni_vap->iv_ifp,
890 				    IFCOUNTER_OERRORS, 1);
891 				ieee80211_free_node(ni);
892 			}
893 			continue;
894 		}
895 		sc->sc_watchdog_timer = 5;
896 	}
897 }
898 
899 static int
900 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
901 {
902 	struct bwn_dma_ring *dr;
903 	struct bwn_mac *mac = sc->sc_curmac;
904 	struct bwn_pio_txqueue *tq;
905 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
906 
907 	BWN_ASSERT_LOCKED(sc);
908 
909 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
910 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
911 		if (dr->dr_stop == 1 ||
912 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
913 			dr->dr_stop = 1;
914 			goto full;
915 		}
916 	} else {
917 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
918 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
919 		    pktlen > (tq->tq_size - tq->tq_used))
920 			goto full;
921 	}
922 	return (0);
923 full:
924 	mbufq_prepend(&sc->sc_snd, m);
925 	return (1);
926 }
927 
928 static int
929 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
930 {
931 	struct bwn_mac *mac = sc->sc_curmac;
932 	int error;
933 
934 	BWN_ASSERT_LOCKED(sc);
935 
936 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
937 		m_freem(m);
938 		return (ENXIO);
939 	}
940 
941 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
942 	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
943 	if (error) {
944 		m_freem(m);
945 		return (error);
946 	}
947 	return (0);
948 }
949 
950 static int
951 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
952 {
953 	struct bwn_pio_txpkt *tp;
954 	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
955 	struct bwn_softc *sc = mac->mac_sc;
956 	struct bwn_txhdr txhdr;
957 	struct mbuf *m_new;
958 	uint32_t ctl32;
959 	int error;
960 	uint16_t ctl16;
961 
962 	BWN_ASSERT_LOCKED(sc);
963 
964 	/* XXX TODO send packets after DTIM */
965 
966 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
967 	tp = TAILQ_FIRST(&tq->tq_pktlist);
968 	tp->tp_ni = ni;
969 	tp->tp_m = m;
970 
971 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
972 	if (error) {
973 		device_printf(sc->sc_dev, "tx fail\n");
974 		return (error);
975 	}
976 
977 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
978 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
979 	tq->tq_free--;
980 
981 	if (siba_get_revid(sc->sc_dev) >= 8) {
982 		/*
983 		 * XXX please removes m_defrag(9)
984 		 */
985 		m_new = m_defrag(m, M_NOWAIT);
986 		if (m_new == NULL) {
987 			device_printf(sc->sc_dev,
988 			    "%s: can't defrag TX buffer\n",
989 			    __func__);
990 			return (ENOBUFS);
991 		}
992 		if (m_new->m_next != NULL)
993 			device_printf(sc->sc_dev,
994 			    "TODO: fragmented packets for PIO\n");
995 		tp->tp_m = m_new;
996 
997 		/* send HEADER */
998 		ctl32 = bwn_pio_write_multi_4(mac, tq,
999 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1000 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1001 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1002 		/* send BODY */
1003 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1004 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1005 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1006 		    ctl32 | BWN_PIO8_TXCTL_EOF);
1007 	} else {
1008 		ctl16 = bwn_pio_write_multi_2(mac, tq,
1009 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1010 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1011 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1012 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1013 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1014 		    ctl16 | BWN_PIO_TXCTL_EOF);
1015 	}
1016 
1017 	return (0);
1018 }
1019 
1020 static struct bwn_pio_txqueue *
1021 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1022 {
1023 
1024 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1025 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1026 
1027 	switch (prio) {
1028 	case 0:
1029 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1030 	case 1:
1031 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1032 	case 2:
1033 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1034 	case 3:
1035 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1036 	}
1037 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1038 	return (NULL);
1039 }
1040 
1041 static int
1042 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1043 {
1044 #define	BWN_GET_TXHDRCACHE(slot)					\
1045 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1046 	struct bwn_dma *dma = &mac->mac_method.dma;
1047 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1048 	struct bwn_dmadesc_generic *desc;
1049 	struct bwn_dmadesc_meta *mt;
1050 	struct bwn_softc *sc = mac->mac_sc;
1051 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1052 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1053 
1054 	BWN_ASSERT_LOCKED(sc);
1055 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1056 
1057 	/* XXX send after DTIM */
1058 
1059 	slot = bwn_dma_getslot(dr);
1060 	dr->getdesc(dr, slot, &desc, &mt);
1061 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1062 	    ("%s:%d: fail", __func__, __LINE__));
1063 
1064 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1065 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1066 	    BWN_DMA_COOKIE(dr, slot));
1067 	if (error)
1068 		goto fail;
1069 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1070 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1071 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1072 	if (error) {
1073 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1074 		    __func__, error);
1075 		goto fail;
1076 	}
1077 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1078 	    BUS_DMASYNC_PREWRITE);
1079 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1080 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1081 	    BUS_DMASYNC_PREWRITE);
1082 
1083 	slot = bwn_dma_getslot(dr);
1084 	dr->getdesc(dr, slot, &desc, &mt);
1085 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1086 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1087 	mt->mt_m = m;
1088 	mt->mt_ni = ni;
1089 
1090 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1091 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1092 	if (error && error != EFBIG) {
1093 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1094 		    __func__, error);
1095 		goto fail;
1096 	}
1097 	if (error) {    /* error == EFBIG */
1098 		struct mbuf *m_new;
1099 
1100 		m_new = m_defrag(m, M_NOWAIT);
1101 		if (m_new == NULL) {
1102 			device_printf(sc->sc_dev,
1103 			    "%s: can't defrag TX buffer\n",
1104 			    __func__);
1105 			error = ENOBUFS;
1106 			goto fail;
1107 		} else {
1108 			m = m_new;
1109 		}
1110 
1111 		mt->mt_m = m;
1112 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1113 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1114 		if (error) {
1115 			device_printf(sc->sc_dev,
1116 			    "%s: can't load TX buffer (2) %d\n",
1117 			    __func__, error);
1118 			goto fail;
1119 		}
1120 	}
1121 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1122 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1123 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1124 	    BUS_DMASYNC_PREWRITE);
1125 
1126 	/* XXX send after DTIM */
1127 
1128 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1129 	return (0);
1130 fail:
1131 	dr->dr_curslot = backup[0];
1132 	dr->dr_usedslot = backup[1];
1133 	return (error);
1134 #undef BWN_GET_TXHDRCACHE
1135 }
1136 
1137 static void
1138 bwn_watchdog(void *arg)
1139 {
1140 	struct bwn_softc *sc = arg;
1141 
1142 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1143 		device_printf(sc->sc_dev, "device timeout\n");
1144 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1145 	}
1146 	callout_schedule(&sc->sc_watchdog_ch, hz);
1147 }
1148 
1149 static int
1150 bwn_attach_core(struct bwn_mac *mac)
1151 {
1152 	struct bwn_softc *sc = mac->mac_sc;
1153 	int error, have_bg = 0, have_a = 0;
1154 
1155 	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1156 	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1157 
1158 	if (bwn_is_bus_siba(mac)) {
1159 		uint32_t high;
1160 
1161 		siba_powerup(sc->sc_dev, 0);
1162 		high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1163 		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1164 		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1165 		if (high & BWN_TGSHIGH_DUALPHY) {
1166 			have_bg = 1;
1167 			have_a = 1;
1168 		}
1169 #if 0
1170 		device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1171 		    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1172 		    __func__,
1173 		    high,
1174 		    have_a,
1175 		    have_bg,
1176 		    siba_get_pci_device(sc->sc_dev),
1177 		    siba_get_chipid(sc->sc_dev));
1178 #endif
1179 	} else {
1180 		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1181 		error = ENXIO;
1182 		goto fail;
1183 	}
1184 
1185 	/*
1186 	 * Guess at whether it has A-PHY or G-PHY.
1187 	 * This is just used for resetting the core to probe things;
1188 	 * we will re-guess once it's all up and working.
1189 	 */
1190 	bwn_reset_core(mac, have_bg);
1191 
1192 	/*
1193 	 * Get the PHY version.
1194 	 */
1195 	error = bwn_phy_getinfo(mac, have_bg);
1196 	if (error)
1197 		goto fail;
1198 
1199 	/*
1200 	 * This is the whitelist of devices which we "believe"
1201 	 * the SPROM PHY config from.  The rest are "guessed".
1202 	 */
1203 	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1204 	    siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1205 	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1206 	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1207 	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1208 	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1209 		have_a = have_bg = 0;
1210 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1211 			have_a = 1;
1212 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1213 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1214 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1215 			have_bg = 1;
1216 		else
1217 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1218 			    mac->mac_phy.type));
1219 	}
1220 
1221 	/*
1222 	 * XXX The PHY-G support doesn't do 5GHz operation.
1223 	 */
1224 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1225 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1226 		device_printf(sc->sc_dev,
1227 		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1228 		    __func__);
1229 		have_a = 0;
1230 		have_bg = 1;
1231 	}
1232 
1233 	mac->mac_phy.phy_n = NULL;
1234 
1235 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1236 		mac->mac_phy.attach = bwn_phy_g_attach;
1237 		mac->mac_phy.detach = bwn_phy_g_detach;
1238 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1239 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1240 		mac->mac_phy.init = bwn_phy_g_init;
1241 		mac->mac_phy.exit = bwn_phy_g_exit;
1242 		mac->mac_phy.phy_read = bwn_phy_g_read;
1243 		mac->mac_phy.phy_write = bwn_phy_g_write;
1244 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1245 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1246 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1247 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1248 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1249 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1250 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1251 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1252 		mac->mac_phy.set_im = bwn_phy_g_im;
1253 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1254 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1255 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1256 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1257 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1258 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1259 		mac->mac_phy.init = bwn_phy_lp_init;
1260 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1261 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1262 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1263 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1264 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1265 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1266 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1267 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1268 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1269 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1270 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1271 	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1272 		mac->mac_phy.attach = bwn_phy_n_attach;
1273 		mac->mac_phy.detach = bwn_phy_n_detach;
1274 		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1275 		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1276 		mac->mac_phy.init = bwn_phy_n_init;
1277 		mac->mac_phy.exit = bwn_phy_n_exit;
1278 		mac->mac_phy.phy_read = bwn_phy_n_read;
1279 		mac->mac_phy.phy_write = bwn_phy_n_write;
1280 		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1281 		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1282 		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1283 		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1284 		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1285 		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1286 		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1287 		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1288 		mac->mac_phy.set_im = bwn_phy_n_im;
1289 		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1290 		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1291 		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1292 		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1293 	} else {
1294 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1295 		    mac->mac_phy.type);
1296 		error = ENXIO;
1297 		goto fail;
1298 	}
1299 
1300 	mac->mac_phy.gmode = have_bg;
1301 	if (mac->mac_phy.attach != NULL) {
1302 		error = mac->mac_phy.attach(mac);
1303 		if (error) {
1304 			device_printf(sc->sc_dev, "failed\n");
1305 			goto fail;
1306 		}
1307 	}
1308 
1309 	bwn_reset_core(mac, have_bg);
1310 
1311 	error = bwn_chiptest(mac);
1312 	if (error)
1313 		goto fail;
1314 	error = bwn_setup_channels(mac, have_bg, have_a);
1315 	if (error) {
1316 		device_printf(sc->sc_dev, "failed to setup channels\n");
1317 		goto fail;
1318 	}
1319 
1320 	if (sc->sc_curmac == NULL)
1321 		sc->sc_curmac = mac;
1322 
1323 	error = bwn_dma_attach(mac);
1324 	if (error != 0) {
1325 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1326 		goto fail;
1327 	}
1328 
1329 	mac->mac_phy.switch_analog(mac, 0);
1330 
1331 	siba_dev_down(sc->sc_dev, 0);
1332 fail:
1333 	siba_powerdown(sc->sc_dev);
1334 	bwn_release_firmware(mac);
1335 	return (error);
1336 }
1337 
1338 /*
1339  * Reset - SIBA.
1340  *
1341  * XXX TODO: implement BCMA version!
1342  */
1343 void
1344 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1345 {
1346 	struct bwn_softc *sc = mac->mac_sc;
1347 	uint32_t low, ctl;
1348 	uint32_t flags = 0;
1349 
1350 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1351 
1352 	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1353 	if (g_mode)
1354 		flags |= BWN_TGSLOW_SUPPORT_G;
1355 
1356 	/* XXX N-PHY only; and hard-code to 20MHz for now */
1357 	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1358 		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1359 
1360 	siba_dev_up(sc->sc_dev, flags);
1361 	DELAY(2000);
1362 
1363 	/* Take PHY out of reset */
1364 	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1365 	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1366 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1367 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1368 	DELAY(2000);
1369 	low &= ~SIBA_TGSLOW_FGC;
1370 	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1371 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1372 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1373 	DELAY(2000);
1374 
1375 	if (mac->mac_phy.switch_analog != NULL)
1376 		mac->mac_phy.switch_analog(mac, 1);
1377 
1378 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1379 	if (g_mode)
1380 		ctl |= BWN_MACCTL_GMODE;
1381 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1382 }
1383 
1384 static int
1385 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1386 {
1387 	struct bwn_phy *phy = &mac->mac_phy;
1388 	struct bwn_softc *sc = mac->mac_sc;
1389 	uint32_t tmp;
1390 
1391 	/* PHY */
1392 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1393 	phy->gmode = gmode;
1394 	phy->rf_on = 1;
1395 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1396 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1397 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1398 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1399 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1400 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1401 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1402 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1403 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1404 		goto unsupphy;
1405 
1406 	/* RADIO */
1407 	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1408 		if (siba_get_chiprev(sc->sc_dev) == 0)
1409 			tmp = 0x3205017f;
1410 		else if (siba_get_chiprev(sc->sc_dev) == 1)
1411 			tmp = 0x4205017f;
1412 		else
1413 			tmp = 0x5205017f;
1414 	} else {
1415 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1416 		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1417 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1418 		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1419 	}
1420 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1421 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1422 	phy->rf_manuf = (tmp & 0x00000fff);
1423 
1424 	/*
1425 	 * For now, just always do full init (ie, what bwn has traditionally
1426 	 * done)
1427 	 */
1428 	phy->phy_do_full_init = 1;
1429 
1430 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1431 		goto unsupradio;
1432 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1433 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1434 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1435 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1436 	    (phy->type == BWN_PHYTYPE_N &&
1437 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1438 	    (phy->type == BWN_PHYTYPE_LP &&
1439 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1440 		goto unsupradio;
1441 
1442 	return (0);
1443 unsupphy:
1444 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1445 	    "analog %#x)\n",
1446 	    phy->type, phy->rev, phy->analog);
1447 	return (ENXIO);
1448 unsupradio:
1449 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1450 	    "rev %#x)\n",
1451 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1452 	return (ENXIO);
1453 }
1454 
1455 static int
1456 bwn_chiptest(struct bwn_mac *mac)
1457 {
1458 #define	TESTVAL0	0x55aaaa55
1459 #define	TESTVAL1	0xaa5555aa
1460 	struct bwn_softc *sc = mac->mac_sc;
1461 	uint32_t v, backup;
1462 
1463 	BWN_LOCK(sc);
1464 
1465 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1466 
1467 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1468 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1469 		goto error;
1470 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1471 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1472 		goto error;
1473 
1474 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1475 
1476 	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1477 	    (siba_get_revid(sc->sc_dev) <= 10)) {
1478 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1479 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1480 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1481 			goto error;
1482 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1483 			goto error;
1484 	}
1485 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1486 
1487 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1488 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1489 		goto error;
1490 
1491 	BWN_UNLOCK(sc);
1492 	return (0);
1493 error:
1494 	BWN_UNLOCK(sc);
1495 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1496 	return (ENODEV);
1497 }
1498 
1499 static int
1500 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1501 {
1502 	struct bwn_softc *sc = mac->mac_sc;
1503 	struct ieee80211com *ic = &sc->sc_ic;
1504 	uint8_t bands[IEEE80211_MODE_BYTES];
1505 
1506 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1507 	ic->ic_nchans = 0;
1508 
1509 	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1510 	    __func__,
1511 	    have_bg,
1512 	    have_a);
1513 
1514 	if (have_bg) {
1515 		memset(bands, 0, sizeof(bands));
1516 		setbit(bands, IEEE80211_MODE_11B);
1517 		setbit(bands, IEEE80211_MODE_11G);
1518 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1519 		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1520 	}
1521 
1522 	if (have_a) {
1523 		memset(bands, 0, sizeof(bands));
1524 		setbit(bands, IEEE80211_MODE_11A);
1525 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1526 		    &ic->ic_nchans, &bwn_chantable_a, bands);
1527 	}
1528 
1529 	mac->mac_phy.supports_2ghz = have_bg;
1530 	mac->mac_phy.supports_5ghz = have_a;
1531 
1532 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1533 }
1534 
1535 uint32_t
1536 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1537 {
1538 	uint32_t ret;
1539 
1540 	BWN_ASSERT_LOCKED(mac->mac_sc);
1541 
1542 	if (way == BWN_SHARED) {
1543 		KASSERT((offset & 0x0001) == 0,
1544 		    ("%s:%d warn", __func__, __LINE__));
1545 		if (offset & 0x0003) {
1546 			bwn_shm_ctlword(mac, way, offset >> 2);
1547 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1548 			ret <<= 16;
1549 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1550 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1551 			goto out;
1552 		}
1553 		offset >>= 2;
1554 	}
1555 	bwn_shm_ctlword(mac, way, offset);
1556 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1557 out:
1558 	return (ret);
1559 }
1560 
1561 uint16_t
1562 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1563 {
1564 	uint16_t ret;
1565 
1566 	BWN_ASSERT_LOCKED(mac->mac_sc);
1567 
1568 	if (way == BWN_SHARED) {
1569 		KASSERT((offset & 0x0001) == 0,
1570 		    ("%s:%d warn", __func__, __LINE__));
1571 		if (offset & 0x0003) {
1572 			bwn_shm_ctlword(mac, way, offset >> 2);
1573 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1574 			goto out;
1575 		}
1576 		offset >>= 2;
1577 	}
1578 	bwn_shm_ctlword(mac, way, offset);
1579 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1580 out:
1581 
1582 	return (ret);
1583 }
1584 
1585 static void
1586 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1587     uint16_t offset)
1588 {
1589 	uint32_t control;
1590 
1591 	control = way;
1592 	control <<= 16;
1593 	control |= offset;
1594 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1595 }
1596 
1597 void
1598 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1599     uint32_t value)
1600 {
1601 	BWN_ASSERT_LOCKED(mac->mac_sc);
1602 
1603 	if (way == BWN_SHARED) {
1604 		KASSERT((offset & 0x0001) == 0,
1605 		    ("%s:%d warn", __func__, __LINE__));
1606 		if (offset & 0x0003) {
1607 			bwn_shm_ctlword(mac, way, offset >> 2);
1608 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1609 				    (value >> 16) & 0xffff);
1610 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1611 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1612 			return;
1613 		}
1614 		offset >>= 2;
1615 	}
1616 	bwn_shm_ctlword(mac, way, offset);
1617 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1618 }
1619 
1620 void
1621 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1622     uint16_t value)
1623 {
1624 	BWN_ASSERT_LOCKED(mac->mac_sc);
1625 
1626 	if (way == BWN_SHARED) {
1627 		KASSERT((offset & 0x0001) == 0,
1628 		    ("%s:%d warn", __func__, __LINE__));
1629 		if (offset & 0x0003) {
1630 			bwn_shm_ctlword(mac, way, offset >> 2);
1631 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1632 			return;
1633 		}
1634 		offset >>= 2;
1635 	}
1636 	bwn_shm_ctlword(mac, way, offset);
1637 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1638 }
1639 
1640 static void
1641 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1642     const struct bwn_channelinfo *ci, const uint8_t bands[])
1643 {
1644 	int i, error;
1645 
1646 	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1647 		const struct bwn_channel *hc = &ci->channels[i];
1648 
1649 		error = ieee80211_add_channel(chans, maxchans, nchans,
1650 		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1651 	}
1652 }
1653 
1654 static int
1655 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1656 	const struct ieee80211_bpf_params *params)
1657 {
1658 	struct ieee80211com *ic = ni->ni_ic;
1659 	struct bwn_softc *sc = ic->ic_softc;
1660 	struct bwn_mac *mac = sc->sc_curmac;
1661 	int error;
1662 
1663 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1664 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1665 		m_freem(m);
1666 		return (ENETDOWN);
1667 	}
1668 
1669 	BWN_LOCK(sc);
1670 	if (bwn_tx_isfull(sc, m)) {
1671 		m_freem(m);
1672 		BWN_UNLOCK(sc);
1673 		return (ENOBUFS);
1674 	}
1675 
1676 	error = bwn_tx_start(sc, ni, m);
1677 	if (error == 0)
1678 		sc->sc_watchdog_timer = 5;
1679 	BWN_UNLOCK(sc);
1680 	return (error);
1681 }
1682 
1683 /*
1684  * Callback from the 802.11 layer to update the slot time
1685  * based on the current setting.  We use it to notify the
1686  * firmware of ERP changes and the f/w takes care of things
1687  * like slot time and preamble.
1688  */
1689 static void
1690 bwn_updateslot(struct ieee80211com *ic)
1691 {
1692 	struct bwn_softc *sc = ic->ic_softc;
1693 	struct bwn_mac *mac;
1694 
1695 	BWN_LOCK(sc);
1696 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1697 		mac = (struct bwn_mac *)sc->sc_curmac;
1698 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1699 	}
1700 	BWN_UNLOCK(sc);
1701 }
1702 
1703 /*
1704  * Callback from the 802.11 layer after a promiscuous mode change.
1705  * Note this interface does not check the operating mode as this
1706  * is an internal callback and we are expected to honor the current
1707  * state (e.g. this is used for setting the interface in promiscuous
1708  * mode when operating in hostap mode to do ACS).
1709  */
1710 static void
1711 bwn_update_promisc(struct ieee80211com *ic)
1712 {
1713 	struct bwn_softc *sc = ic->ic_softc;
1714 	struct bwn_mac *mac = sc->sc_curmac;
1715 
1716 	BWN_LOCK(sc);
1717 	mac = sc->sc_curmac;
1718 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1719 		if (ic->ic_promisc > 0)
1720 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1721 		else
1722 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1723 		bwn_set_opmode(mac);
1724 	}
1725 	BWN_UNLOCK(sc);
1726 }
1727 
1728 /*
1729  * Callback from the 802.11 layer to update WME parameters.
1730  */
1731 static int
1732 bwn_wme_update(struct ieee80211com *ic)
1733 {
1734 	struct bwn_softc *sc = ic->ic_softc;
1735 	struct bwn_mac *mac = sc->sc_curmac;
1736 	struct wmeParams *wmep;
1737 	int i;
1738 
1739 	BWN_LOCK(sc);
1740 	mac = sc->sc_curmac;
1741 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1742 		bwn_mac_suspend(mac);
1743 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1744 			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1745 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1746 		}
1747 		bwn_mac_enable(mac);
1748 	}
1749 	BWN_UNLOCK(sc);
1750 	return (0);
1751 }
1752 
1753 static void
1754 bwn_scan_start(struct ieee80211com *ic)
1755 {
1756 	struct bwn_softc *sc = ic->ic_softc;
1757 	struct bwn_mac *mac;
1758 
1759 	BWN_LOCK(sc);
1760 	mac = sc->sc_curmac;
1761 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1762 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1763 		bwn_set_opmode(mac);
1764 		/* disable CFP update during scan */
1765 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1766 	}
1767 	BWN_UNLOCK(sc);
1768 }
1769 
1770 static void
1771 bwn_scan_end(struct ieee80211com *ic)
1772 {
1773 	struct bwn_softc *sc = ic->ic_softc;
1774 	struct bwn_mac *mac;
1775 
1776 	BWN_LOCK(sc);
1777 	mac = sc->sc_curmac;
1778 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1779 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1780 		bwn_set_opmode(mac);
1781 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1782 	}
1783 	BWN_UNLOCK(sc);
1784 }
1785 
1786 static void
1787 bwn_set_channel(struct ieee80211com *ic)
1788 {
1789 	struct bwn_softc *sc = ic->ic_softc;
1790 	struct bwn_mac *mac = sc->sc_curmac;
1791 	struct bwn_phy *phy = &mac->mac_phy;
1792 	int chan, error;
1793 
1794 	BWN_LOCK(sc);
1795 
1796 	error = bwn_switch_band(sc, ic->ic_curchan);
1797 	if (error)
1798 		goto fail;
1799 	bwn_mac_suspend(mac);
1800 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1801 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1802 	if (chan != phy->chan)
1803 		bwn_switch_channel(mac, chan);
1804 
1805 	/* TX power level */
1806 	if (ic->ic_curchan->ic_maxpower != 0 &&
1807 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1808 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1809 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1810 		    BWN_TXPWR_IGNORE_TSSI);
1811 	}
1812 
1813 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1814 	if (phy->set_antenna)
1815 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1816 
1817 	if (sc->sc_rf_enabled != phy->rf_on) {
1818 		if (sc->sc_rf_enabled) {
1819 			bwn_rf_turnon(mac);
1820 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1821 				device_printf(sc->sc_dev,
1822 				    "please turn on the RF switch\n");
1823 		} else
1824 			bwn_rf_turnoff(mac);
1825 	}
1826 
1827 	bwn_mac_enable(mac);
1828 
1829 fail:
1830 	/*
1831 	 * Setup radio tap channel freq and flags
1832 	 */
1833 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1834 		htole16(ic->ic_curchan->ic_freq);
1835 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1836 		htole16(ic->ic_curchan->ic_flags & 0xffff);
1837 
1838 	BWN_UNLOCK(sc);
1839 }
1840 
1841 static struct ieee80211vap *
1842 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1843     enum ieee80211_opmode opmode, int flags,
1844     const uint8_t bssid[IEEE80211_ADDR_LEN],
1845     const uint8_t mac[IEEE80211_ADDR_LEN])
1846 {
1847 	struct ieee80211vap *vap;
1848 	struct bwn_vap *bvp;
1849 
1850 	switch (opmode) {
1851 	case IEEE80211_M_HOSTAP:
1852 	case IEEE80211_M_MBSS:
1853 	case IEEE80211_M_STA:
1854 	case IEEE80211_M_WDS:
1855 	case IEEE80211_M_MONITOR:
1856 	case IEEE80211_M_IBSS:
1857 	case IEEE80211_M_AHDEMO:
1858 		break;
1859 	default:
1860 		return (NULL);
1861 	}
1862 
1863 	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1864 	vap = &bvp->bv_vap;
1865 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1866 	/* override with driver methods */
1867 	bvp->bv_newstate = vap->iv_newstate;
1868 	vap->iv_newstate = bwn_newstate;
1869 
1870 	/* override max aid so sta's cannot assoc when we're out of sta id's */
1871 	vap->iv_max_aid = BWN_STAID_MAX;
1872 
1873 	ieee80211_ratectl_init(vap);
1874 
1875 	/* complete setup */
1876 	ieee80211_vap_attach(vap, ieee80211_media_change,
1877 	    ieee80211_media_status, mac);
1878 	return (vap);
1879 }
1880 
1881 static void
1882 bwn_vap_delete(struct ieee80211vap *vap)
1883 {
1884 	struct bwn_vap *bvp = BWN_VAP(vap);
1885 
1886 	ieee80211_ratectl_deinit(vap);
1887 	ieee80211_vap_detach(vap);
1888 	free(bvp, M_80211_VAP);
1889 }
1890 
1891 static int
1892 bwn_init(struct bwn_softc *sc)
1893 {
1894 	struct bwn_mac *mac;
1895 	int error;
1896 
1897 	BWN_ASSERT_LOCKED(sc);
1898 
1899 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1900 
1901 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1902 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1903 	sc->sc_filters = 0;
1904 	bwn_wme_clear(sc);
1905 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1906 	sc->sc_rf_enabled = 1;
1907 
1908 	mac = sc->sc_curmac;
1909 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1910 		error = bwn_core_init(mac);
1911 		if (error != 0)
1912 			return (error);
1913 	}
1914 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1915 		bwn_core_start(mac);
1916 
1917 	bwn_set_opmode(mac);
1918 	bwn_set_pretbtt(mac);
1919 	bwn_spu_setdelay(mac, 0);
1920 	bwn_set_macaddr(mac);
1921 
1922 	sc->sc_flags |= BWN_FLAG_RUNNING;
1923 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1924 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1925 
1926 	return (0);
1927 }
1928 
1929 static void
1930 bwn_stop(struct bwn_softc *sc)
1931 {
1932 	struct bwn_mac *mac = sc->sc_curmac;
1933 
1934 	BWN_ASSERT_LOCKED(sc);
1935 
1936 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1937 
1938 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1939 		/* XXX FIXME opmode not based on VAP */
1940 		bwn_set_opmode(mac);
1941 		bwn_set_macaddr(mac);
1942 	}
1943 
1944 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1945 		bwn_core_stop(mac);
1946 
1947 	callout_stop(&sc->sc_led_blink_ch);
1948 	sc->sc_led_blinking = 0;
1949 
1950 	bwn_core_exit(mac);
1951 	sc->sc_rf_enabled = 0;
1952 
1953 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1954 }
1955 
1956 static void
1957 bwn_wme_clear(struct bwn_softc *sc)
1958 {
1959 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1960 	struct wmeParams *p;
1961 	unsigned int i;
1962 
1963 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1964 	    ("%s:%d: fail", __func__, __LINE__));
1965 
1966 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1967 		p = &(sc->sc_wmeParams[i]);
1968 
1969 		switch (bwn_wme_shm_offsets[i]) {
1970 		case BWN_WME_VOICE:
1971 			p->wmep_txopLimit = 0;
1972 			p->wmep_aifsn = 2;
1973 			/* XXX FIXME: log2(cwmin) */
1974 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1975 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1976 			break;
1977 		case BWN_WME_VIDEO:
1978 			p->wmep_txopLimit = 0;
1979 			p->wmep_aifsn = 2;
1980 			/* XXX FIXME: log2(cwmin) */
1981 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1982 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1983 			break;
1984 		case BWN_WME_BESTEFFORT:
1985 			p->wmep_txopLimit = 0;
1986 			p->wmep_aifsn = 3;
1987 			/* XXX FIXME: log2(cwmin) */
1988 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1989 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1990 			break;
1991 		case BWN_WME_BACKGROUND:
1992 			p->wmep_txopLimit = 0;
1993 			p->wmep_aifsn = 7;
1994 			/* XXX FIXME: log2(cwmin) */
1995 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1996 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1997 			break;
1998 		default:
1999 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2000 		}
2001 	}
2002 }
2003 
2004 static int
2005 bwn_core_init(struct bwn_mac *mac)
2006 {
2007 	struct bwn_softc *sc = mac->mac_sc;
2008 	uint64_t hf;
2009 	int error;
2010 
2011 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2012 	    ("%s:%d: fail", __func__, __LINE__));
2013 
2014 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2015 
2016 	siba_powerup(sc->sc_dev, 0);
2017 	if (!siba_dev_isup(sc->sc_dev))
2018 		bwn_reset_core(mac, mac->mac_phy.gmode);
2019 
2020 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2021 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2022 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2023 	BWN_GETTIME(mac->mac_phy.nexttime);
2024 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2025 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2026 	mac->mac_stats.link_noise = -95;
2027 	mac->mac_reason_intr = 0;
2028 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2029 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2030 #ifdef BWN_DEBUG
2031 	if (sc->sc_debug & BWN_DEBUG_XMIT)
2032 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2033 #endif
2034 	mac->mac_suspended = 1;
2035 	mac->mac_task_state = 0;
2036 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2037 
2038 	mac->mac_phy.init_pre(mac);
2039 
2040 	siba_pcicore_intr(sc->sc_dev);
2041 
2042 	siba_fix_imcfglobug(sc->sc_dev);
2043 	bwn_bt_disable(mac);
2044 	if (mac->mac_phy.prepare_hw) {
2045 		error = mac->mac_phy.prepare_hw(mac);
2046 		if (error)
2047 			goto fail0;
2048 	}
2049 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2050 	error = bwn_chip_init(mac);
2051 	if (error)
2052 		goto fail0;
2053 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2054 	    siba_get_revid(sc->sc_dev));
2055 	hf = bwn_hf_read(mac);
2056 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2057 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2058 		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2059 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2060 		if (mac->mac_phy.rev == 1)
2061 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2062 	}
2063 	if (mac->mac_phy.rf_ver == 0x2050) {
2064 		if (mac->mac_phy.rf_rev < 6)
2065 			hf |= BWN_HF_FORCE_VCO_RECALC;
2066 		if (mac->mac_phy.rf_rev == 6)
2067 			hf |= BWN_HF_4318_TSSI;
2068 	}
2069 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2070 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2071 	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2072 	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2073 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2074 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2075 	bwn_hf_write(mac, hf);
2076 
2077 	/* Tell the firmware about the MAC capabilities */
2078 	if (siba_get_revid(sc->sc_dev) >= 13) {
2079 		uint32_t cap;
2080 		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2081 		DPRINTF(sc, BWN_DEBUG_RESET,
2082 		    "%s: hw capabilities: 0x%08x\n",
2083 		    __func__, cap);
2084 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2085 		    cap & 0xffff);
2086 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2087 		    (cap >> 16) & 0xffff);
2088 	}
2089 
2090 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2091 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2092 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2093 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2094 
2095 	bwn_rate_init(mac);
2096 	bwn_set_phytxctl(mac);
2097 
2098 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2099 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2100 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2101 
2102 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2103 		bwn_pio_init(mac);
2104 	else
2105 		bwn_dma_init(mac);
2106 	bwn_wme_init(mac);
2107 	bwn_spu_setdelay(mac, 1);
2108 	bwn_bt_enable(mac);
2109 
2110 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2111 	siba_powerup(sc->sc_dev,
2112 	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2113 	bwn_set_macaddr(mac);
2114 	bwn_crypt_init(mac);
2115 
2116 	/* XXX LED initializatin */
2117 
2118 	mac->mac_status = BWN_MAC_STATUS_INITED;
2119 
2120 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2121 	return (error);
2122 
2123 fail0:
2124 	siba_powerdown(sc->sc_dev);
2125 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2126 	    ("%s:%d: fail", __func__, __LINE__));
2127 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2128 	return (error);
2129 }
2130 
2131 static void
2132 bwn_core_start(struct bwn_mac *mac)
2133 {
2134 	struct bwn_softc *sc = mac->mac_sc;
2135 	uint32_t tmp;
2136 
2137 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2138 	    ("%s:%d: fail", __func__, __LINE__));
2139 
2140 	if (siba_get_revid(sc->sc_dev) < 5)
2141 		return;
2142 
2143 	while (1) {
2144 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2145 		if (!(tmp & 0x00000001))
2146 			break;
2147 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2148 	}
2149 
2150 	bwn_mac_enable(mac);
2151 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2152 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2153 
2154 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2155 }
2156 
2157 static void
2158 bwn_core_exit(struct bwn_mac *mac)
2159 {
2160 	struct bwn_softc *sc = mac->mac_sc;
2161 	uint32_t macctl;
2162 
2163 	BWN_ASSERT_LOCKED(mac->mac_sc);
2164 
2165 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2166 	    ("%s:%d: fail", __func__, __LINE__));
2167 
2168 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2169 		return;
2170 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2171 
2172 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2173 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2174 	macctl |= BWN_MACCTL_MCODE_JMP0;
2175 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2176 
2177 	bwn_dma_stop(mac);
2178 	bwn_pio_stop(mac);
2179 	bwn_chip_exit(mac);
2180 	mac->mac_phy.switch_analog(mac, 0);
2181 	siba_dev_down(sc->sc_dev, 0);
2182 	siba_powerdown(sc->sc_dev);
2183 }
2184 
2185 static void
2186 bwn_bt_disable(struct bwn_mac *mac)
2187 {
2188 	struct bwn_softc *sc = mac->mac_sc;
2189 
2190 	(void)sc;
2191 	/* XXX do nothing yet */
2192 }
2193 
2194 static int
2195 bwn_chip_init(struct bwn_mac *mac)
2196 {
2197 	struct bwn_softc *sc = mac->mac_sc;
2198 	struct bwn_phy *phy = &mac->mac_phy;
2199 	uint32_t macctl;
2200 	int error;
2201 
2202 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2203 	if (phy->gmode)
2204 		macctl |= BWN_MACCTL_GMODE;
2205 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2206 
2207 	error = bwn_fw_fillinfo(mac);
2208 	if (error)
2209 		return (error);
2210 	error = bwn_fw_loaducode(mac);
2211 	if (error)
2212 		return (error);
2213 
2214 	error = bwn_gpio_init(mac);
2215 	if (error)
2216 		return (error);
2217 
2218 	error = bwn_fw_loadinitvals(mac);
2219 	if (error) {
2220 		siba_gpio_set(sc->sc_dev, 0);
2221 		return (error);
2222 	}
2223 	phy->switch_analog(mac, 1);
2224 	error = bwn_phy_init(mac);
2225 	if (error) {
2226 		siba_gpio_set(sc->sc_dev, 0);
2227 		return (error);
2228 	}
2229 	if (phy->set_im)
2230 		phy->set_im(mac, BWN_IMMODE_NONE);
2231 	if (phy->set_antenna)
2232 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2233 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2234 
2235 	if (phy->type == BWN_PHYTYPE_B)
2236 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2237 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2238 	if (siba_get_revid(sc->sc_dev) < 5)
2239 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2240 
2241 	BWN_WRITE_4(mac, BWN_MACCTL,
2242 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2243 	BWN_WRITE_4(mac, BWN_MACCTL,
2244 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2245 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2246 
2247 	bwn_set_opmode(mac);
2248 	if (siba_get_revid(sc->sc_dev) < 3) {
2249 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2250 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2251 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2252 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2253 	} else {
2254 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2255 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2256 	}
2257 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2258 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2259 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2260 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2261 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2262 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2263 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2264 
2265 	bwn_mac_phy_clock_set(mac, true);
2266 
2267 	/* SIBA powerup */
2268 	/* XXX TODO: BCMA powerup */
2269 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2270 	return (error);
2271 }
2272 
2273 /* read hostflags */
2274 uint64_t
2275 bwn_hf_read(struct bwn_mac *mac)
2276 {
2277 	uint64_t ret;
2278 
2279 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2280 	ret <<= 16;
2281 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2282 	ret <<= 16;
2283 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2284 	return (ret);
2285 }
2286 
2287 void
2288 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2289 {
2290 
2291 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2292 	    (value & 0x00000000ffffull));
2293 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2294 	    (value & 0x0000ffff0000ull) >> 16);
2295 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2296 	    (value & 0xffff00000000ULL) >> 32);
2297 }
2298 
2299 static void
2300 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2301 {
2302 
2303 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2304 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2305 }
2306 
2307 static void
2308 bwn_rate_init(struct bwn_mac *mac)
2309 {
2310 
2311 	switch (mac->mac_phy.type) {
2312 	case BWN_PHYTYPE_A:
2313 	case BWN_PHYTYPE_G:
2314 	case BWN_PHYTYPE_LP:
2315 	case BWN_PHYTYPE_N:
2316 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2317 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2318 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2319 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2320 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2321 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2322 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2323 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2324 			break;
2325 		/* FALLTHROUGH */
2326 	case BWN_PHYTYPE_B:
2327 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2328 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2329 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2330 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2331 		break;
2332 	default:
2333 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2334 	}
2335 }
2336 
2337 static void
2338 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2339 {
2340 	uint16_t offset;
2341 
2342 	if (ofdm) {
2343 		offset = 0x480;
2344 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2345 	} else {
2346 		offset = 0x4c0;
2347 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2348 	}
2349 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2350 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2351 }
2352 
2353 static uint8_t
2354 bwn_plcp_getcck(const uint8_t bitrate)
2355 {
2356 
2357 	switch (bitrate) {
2358 	case BWN_CCK_RATE_1MB:
2359 		return (0x0a);
2360 	case BWN_CCK_RATE_2MB:
2361 		return (0x14);
2362 	case BWN_CCK_RATE_5MB:
2363 		return (0x37);
2364 	case BWN_CCK_RATE_11MB:
2365 		return (0x6e);
2366 	}
2367 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2368 	return (0);
2369 }
2370 
2371 static uint8_t
2372 bwn_plcp_getofdm(const uint8_t bitrate)
2373 {
2374 
2375 	switch (bitrate) {
2376 	case BWN_OFDM_RATE_6MB:
2377 		return (0xb);
2378 	case BWN_OFDM_RATE_9MB:
2379 		return (0xf);
2380 	case BWN_OFDM_RATE_12MB:
2381 		return (0xa);
2382 	case BWN_OFDM_RATE_18MB:
2383 		return (0xe);
2384 	case BWN_OFDM_RATE_24MB:
2385 		return (0x9);
2386 	case BWN_OFDM_RATE_36MB:
2387 		return (0xd);
2388 	case BWN_OFDM_RATE_48MB:
2389 		return (0x8);
2390 	case BWN_OFDM_RATE_54MB:
2391 		return (0xc);
2392 	}
2393 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2394 	return (0);
2395 }
2396 
2397 static void
2398 bwn_set_phytxctl(struct bwn_mac *mac)
2399 {
2400 	uint16_t ctl;
2401 
2402 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2403 	    BWN_TX_PHY_TXPWR);
2404 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2405 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2406 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2407 }
2408 
2409 static void
2410 bwn_pio_init(struct bwn_mac *mac)
2411 {
2412 	struct bwn_pio *pio = &mac->mac_method.pio;
2413 
2414 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2415 	    & ~BWN_MACCTL_BIGENDIAN);
2416 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2417 
2418 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2419 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2420 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2421 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2422 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2423 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2424 }
2425 
2426 static void
2427 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2428     int index)
2429 {
2430 	struct bwn_pio_txpkt *tp;
2431 	struct bwn_softc *sc = mac->mac_sc;
2432 	unsigned int i;
2433 
2434 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2435 	tq->tq_index = index;
2436 
2437 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2438 	if (siba_get_revid(sc->sc_dev) >= 8)
2439 		tq->tq_size = 1920;
2440 	else {
2441 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2442 		tq->tq_size -= 80;
2443 	}
2444 
2445 	TAILQ_INIT(&tq->tq_pktlist);
2446 	for (i = 0; i < N(tq->tq_pkts); i++) {
2447 		tp = &(tq->tq_pkts[i]);
2448 		tp->tp_index = i;
2449 		tp->tp_queue = tq;
2450 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2451 	}
2452 }
2453 
2454 static uint16_t
2455 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2456 {
2457 	struct bwn_softc *sc = mac->mac_sc;
2458 	static const uint16_t bases[] = {
2459 		BWN_PIO_BASE0,
2460 		BWN_PIO_BASE1,
2461 		BWN_PIO_BASE2,
2462 		BWN_PIO_BASE3,
2463 		BWN_PIO_BASE4,
2464 		BWN_PIO_BASE5,
2465 		BWN_PIO_BASE6,
2466 		BWN_PIO_BASE7,
2467 	};
2468 	static const uint16_t bases_rev11[] = {
2469 		BWN_PIO11_BASE0,
2470 		BWN_PIO11_BASE1,
2471 		BWN_PIO11_BASE2,
2472 		BWN_PIO11_BASE3,
2473 		BWN_PIO11_BASE4,
2474 		BWN_PIO11_BASE5,
2475 	};
2476 
2477 	if (siba_get_revid(sc->sc_dev) >= 11) {
2478 		if (index >= N(bases_rev11))
2479 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2480 		return (bases_rev11[index]);
2481 	}
2482 	if (index >= N(bases))
2483 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2484 	return (bases[index]);
2485 }
2486 
2487 static void
2488 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2489     int index)
2490 {
2491 	struct bwn_softc *sc = mac->mac_sc;
2492 
2493 	prq->prq_mac = mac;
2494 	prq->prq_rev = siba_get_revid(sc->sc_dev);
2495 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2496 	bwn_dma_rxdirectfifo(mac, index, 1);
2497 }
2498 
2499 static void
2500 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2501 {
2502 	if (tq == NULL)
2503 		return;
2504 	bwn_pio_cancel_tx_packets(tq);
2505 }
2506 
2507 static void
2508 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2509 {
2510 
2511 	bwn_destroy_pioqueue_tx(pio);
2512 }
2513 
2514 static uint16_t
2515 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2516     uint16_t offset)
2517 {
2518 
2519 	return (BWN_READ_2(mac, tq->tq_base + offset));
2520 }
2521 
2522 static void
2523 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2524 {
2525 	uint32_t ctl;
2526 	int type;
2527 	uint16_t base;
2528 
2529 	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2530 	base = bwn_dma_base(type, idx);
2531 	if (type == BWN_DMA_64BIT) {
2532 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2533 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2534 		if (enable)
2535 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2536 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2537 	} else {
2538 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2539 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2540 		if (enable)
2541 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2542 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2543 	}
2544 }
2545 
2546 static uint64_t
2547 bwn_dma_mask(struct bwn_mac *mac)
2548 {
2549 	uint32_t tmp;
2550 	uint16_t base;
2551 
2552 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2553 	if (tmp & SIBA_TGSHIGH_DMA64)
2554 		return (BWN_DMA_BIT_MASK(64));
2555 	base = bwn_dma_base(0, 0);
2556 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2557 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2558 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2559 		return (BWN_DMA_BIT_MASK(32));
2560 
2561 	return (BWN_DMA_BIT_MASK(30));
2562 }
2563 
2564 static int
2565 bwn_dma_mask2type(uint64_t dmamask)
2566 {
2567 
2568 	if (dmamask == BWN_DMA_BIT_MASK(30))
2569 		return (BWN_DMA_30BIT);
2570 	if (dmamask == BWN_DMA_BIT_MASK(32))
2571 		return (BWN_DMA_32BIT);
2572 	if (dmamask == BWN_DMA_BIT_MASK(64))
2573 		return (BWN_DMA_64BIT);
2574 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2575 	return (BWN_DMA_30BIT);
2576 }
2577 
2578 static void
2579 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2580 {
2581 	struct bwn_pio_txpkt *tp;
2582 	unsigned int i;
2583 
2584 	for (i = 0; i < N(tq->tq_pkts); i++) {
2585 		tp = &(tq->tq_pkts[i]);
2586 		if (tp->tp_m) {
2587 			m_freem(tp->tp_m);
2588 			tp->tp_m = NULL;
2589 		}
2590 	}
2591 }
2592 
2593 static uint16_t
2594 bwn_dma_base(int type, int controller_idx)
2595 {
2596 	static const uint16_t map64[] = {
2597 		BWN_DMA64_BASE0,
2598 		BWN_DMA64_BASE1,
2599 		BWN_DMA64_BASE2,
2600 		BWN_DMA64_BASE3,
2601 		BWN_DMA64_BASE4,
2602 		BWN_DMA64_BASE5,
2603 	};
2604 	static const uint16_t map32[] = {
2605 		BWN_DMA32_BASE0,
2606 		BWN_DMA32_BASE1,
2607 		BWN_DMA32_BASE2,
2608 		BWN_DMA32_BASE3,
2609 		BWN_DMA32_BASE4,
2610 		BWN_DMA32_BASE5,
2611 	};
2612 
2613 	if (type == BWN_DMA_64BIT) {
2614 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2615 		    ("%s:%d: fail", __func__, __LINE__));
2616 		return (map64[controller_idx]);
2617 	}
2618 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2619 	    ("%s:%d: fail", __func__, __LINE__));
2620 	return (map32[controller_idx]);
2621 }
2622 
2623 static void
2624 bwn_dma_init(struct bwn_mac *mac)
2625 {
2626 	struct bwn_dma *dma = &mac->mac_method.dma;
2627 
2628 	/* setup TX DMA channels. */
2629 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2630 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2631 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2632 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2633 	bwn_dma_setup(dma->mcast);
2634 	/* setup RX DMA channel. */
2635 	bwn_dma_setup(dma->rx);
2636 }
2637 
2638 static struct bwn_dma_ring *
2639 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2640     int for_tx, int type)
2641 {
2642 	struct bwn_dma *dma = &mac->mac_method.dma;
2643 	struct bwn_dma_ring *dr;
2644 	struct bwn_dmadesc_generic *desc;
2645 	struct bwn_dmadesc_meta *mt;
2646 	struct bwn_softc *sc = mac->mac_sc;
2647 	int error, i;
2648 
2649 	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2650 	if (dr == NULL)
2651 		goto out;
2652 	dr->dr_numslots = BWN_RXRING_SLOTS;
2653 	if (for_tx)
2654 		dr->dr_numslots = BWN_TXRING_SLOTS;
2655 
2656 	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2657 	    M_DEVBUF, M_NOWAIT | M_ZERO);
2658 	if (dr->dr_meta == NULL)
2659 		goto fail0;
2660 
2661 	dr->dr_type = type;
2662 	dr->dr_mac = mac;
2663 	dr->dr_base = bwn_dma_base(type, controller_index);
2664 	dr->dr_index = controller_index;
2665 	if (type == BWN_DMA_64BIT) {
2666 		dr->getdesc = bwn_dma_64_getdesc;
2667 		dr->setdesc = bwn_dma_64_setdesc;
2668 		dr->start_transfer = bwn_dma_64_start_transfer;
2669 		dr->suspend = bwn_dma_64_suspend;
2670 		dr->resume = bwn_dma_64_resume;
2671 		dr->get_curslot = bwn_dma_64_get_curslot;
2672 		dr->set_curslot = bwn_dma_64_set_curslot;
2673 	} else {
2674 		dr->getdesc = bwn_dma_32_getdesc;
2675 		dr->setdesc = bwn_dma_32_setdesc;
2676 		dr->start_transfer = bwn_dma_32_start_transfer;
2677 		dr->suspend = bwn_dma_32_suspend;
2678 		dr->resume = bwn_dma_32_resume;
2679 		dr->get_curslot = bwn_dma_32_get_curslot;
2680 		dr->set_curslot = bwn_dma_32_set_curslot;
2681 	}
2682 	if (for_tx) {
2683 		dr->dr_tx = 1;
2684 		dr->dr_curslot = -1;
2685 	} else {
2686 		if (dr->dr_index == 0) {
2687 			switch (mac->mac_fw.fw_hdr_format) {
2688 			case BWN_FW_HDR_351:
2689 			case BWN_FW_HDR_410:
2690 				dr->dr_rx_bufsize =
2691 				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2692 				dr->dr_frameoffset =
2693 				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2694 				break;
2695 			case BWN_FW_HDR_598:
2696 				dr->dr_rx_bufsize =
2697 				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2698 				dr->dr_frameoffset =
2699 				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2700 				break;
2701 			}
2702 		} else
2703 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2704 	}
2705 
2706 	error = bwn_dma_allocringmemory(dr);
2707 	if (error)
2708 		goto fail2;
2709 
2710 	if (for_tx) {
2711 		/*
2712 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2713 		 * BWN_TX_SLOTS_PER_FRAME
2714 		 */
2715 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2716 		    ("%s:%d: fail", __func__, __LINE__));
2717 
2718 		dr->dr_txhdr_cache = contigmalloc(
2719 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2720 		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2721 		    0, BUS_SPACE_MAXADDR, 8, 0);
2722 		if (dr->dr_txhdr_cache == NULL) {
2723 			device_printf(sc->sc_dev,
2724 			    "can't allocate TX header DMA memory\n");
2725 			goto fail1;
2726 		}
2727 
2728 		/*
2729 		 * Create TX ring DMA stuffs
2730 		 */
2731 		error = bus_dma_tag_create(dma->parent_dtag,
2732 				    BWN_ALIGN, 0,
2733 				    BUS_SPACE_MAXADDR,
2734 				    BUS_SPACE_MAXADDR,
2735 				    NULL, NULL,
2736 				    BWN_HDRSIZE(mac),
2737 				    1,
2738 				    BUS_SPACE_MAXSIZE_32BIT,
2739 				    0,
2740 				    NULL, NULL,
2741 				    &dr->dr_txring_dtag);
2742 		if (error) {
2743 			device_printf(sc->sc_dev,
2744 			    "can't create TX ring DMA tag: TODO frees\n");
2745 			goto fail2;
2746 		}
2747 
2748 		for (i = 0; i < dr->dr_numslots; i += 2) {
2749 			dr->getdesc(dr, i, &desc, &mt);
2750 
2751 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2752 			mt->mt_m = NULL;
2753 			mt->mt_ni = NULL;
2754 			mt->mt_islast = 0;
2755 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2756 			    &mt->mt_dmap);
2757 			if (error) {
2758 				device_printf(sc->sc_dev,
2759 				     "can't create RX buf DMA map\n");
2760 				goto fail2;
2761 			}
2762 
2763 			dr->getdesc(dr, i + 1, &desc, &mt);
2764 
2765 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2766 			mt->mt_m = NULL;
2767 			mt->mt_ni = NULL;
2768 			mt->mt_islast = 1;
2769 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2770 			    &mt->mt_dmap);
2771 			if (error) {
2772 				device_printf(sc->sc_dev,
2773 				     "can't create RX buf DMA map\n");
2774 				goto fail2;
2775 			}
2776 		}
2777 	} else {
2778 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2779 		    &dr->dr_spare_dmap);
2780 		if (error) {
2781 			device_printf(sc->sc_dev,
2782 			    "can't create RX buf DMA map\n");
2783 			goto out;		/* XXX wrong! */
2784 		}
2785 
2786 		for (i = 0; i < dr->dr_numslots; i++) {
2787 			dr->getdesc(dr, i, &desc, &mt);
2788 
2789 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2790 			    &mt->mt_dmap);
2791 			if (error) {
2792 				device_printf(sc->sc_dev,
2793 				    "can't create RX buf DMA map\n");
2794 				goto out;	/* XXX wrong! */
2795 			}
2796 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2797 			if (error) {
2798 				device_printf(sc->sc_dev,
2799 				    "failed to allocate RX buf\n");
2800 				goto out;	/* XXX wrong! */
2801 			}
2802 		}
2803 
2804 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2805 		    BUS_DMASYNC_PREWRITE);
2806 
2807 		dr->dr_usedslot = dr->dr_numslots;
2808 	}
2809 
2810       out:
2811 	return (dr);
2812 
2813 fail2:
2814 	if (dr->dr_txhdr_cache != NULL) {
2815 		contigfree(dr->dr_txhdr_cache,
2816 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2817 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2818 	}
2819 fail1:
2820 	free(dr->dr_meta, M_DEVBUF);
2821 fail0:
2822 	free(dr, M_DEVBUF);
2823 	return (NULL);
2824 }
2825 
2826 static void
2827 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2828 {
2829 
2830 	if (dr == NULL)
2831 		return;
2832 
2833 	bwn_dma_free_descbufs(*dr);
2834 	bwn_dma_free_ringmemory(*dr);
2835 
2836 	if ((*dr)->dr_txhdr_cache != NULL) {
2837 		contigfree((*dr)->dr_txhdr_cache,
2838 		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2839 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2840 	}
2841 	free((*dr)->dr_meta, M_DEVBUF);
2842 	free(*dr, M_DEVBUF);
2843 
2844 	*dr = NULL;
2845 }
2846 
2847 static void
2848 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2849     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2850 {
2851 	struct bwn_dmadesc32 *desc;
2852 
2853 	*meta = &(dr->dr_meta[slot]);
2854 	desc = dr->dr_ring_descbase;
2855 	desc = &(desc[slot]);
2856 
2857 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2858 }
2859 
2860 static void
2861 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2862     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2863     int start, int end, int irq)
2864 {
2865 	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2866 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2867 	uint32_t addr, addrext, ctl;
2868 	int slot;
2869 
2870 	slot = (int)(&(desc->dma.dma32) - descbase);
2871 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2872 	    ("%s:%d: fail", __func__, __LINE__));
2873 
2874 	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2875 	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2876 	addr |= siba_dma_translation(sc->sc_dev);
2877 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2878 	if (slot == dr->dr_numslots - 1)
2879 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2880 	if (start)
2881 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2882 	if (end)
2883 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2884 	if (irq)
2885 		ctl |= BWN_DMA32_DCTL_IRQ;
2886 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2887 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2888 
2889 	desc->dma.dma32.control = htole32(ctl);
2890 	desc->dma.dma32.address = htole32(addr);
2891 }
2892 
2893 static void
2894 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2895 {
2896 
2897 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2898 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2899 }
2900 
2901 static void
2902 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2903 {
2904 
2905 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2906 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2907 }
2908 
2909 static void
2910 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2911 {
2912 
2913 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2914 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2915 }
2916 
2917 static int
2918 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2919 {
2920 	uint32_t val;
2921 
2922 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2923 	val &= BWN_DMA32_RXDPTR;
2924 
2925 	return (val / sizeof(struct bwn_dmadesc32));
2926 }
2927 
2928 static void
2929 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2930 {
2931 
2932 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2933 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2934 }
2935 
2936 static void
2937 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2938     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2939 {
2940 	struct bwn_dmadesc64 *desc;
2941 
2942 	*meta = &(dr->dr_meta[slot]);
2943 	desc = dr->dr_ring_descbase;
2944 	desc = &(desc[slot]);
2945 
2946 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2947 }
2948 
2949 static void
2950 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2951     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2952     int start, int end, int irq)
2953 {
2954 	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2955 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2956 	int slot;
2957 	uint32_t ctl0 = 0, ctl1 = 0;
2958 	uint32_t addrlo, addrhi;
2959 	uint32_t addrext;
2960 
2961 	slot = (int)(&(desc->dma.dma64) - descbase);
2962 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2963 	    ("%s:%d: fail", __func__, __LINE__));
2964 
2965 	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2966 	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2967 	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2968 	    30;
2969 	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2970 	if (slot == dr->dr_numslots - 1)
2971 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2972 	if (start)
2973 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2974 	if (end)
2975 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2976 	if (irq)
2977 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2978 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2979 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2980 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2981 
2982 	desc->dma.dma64.control0 = htole32(ctl0);
2983 	desc->dma.dma64.control1 = htole32(ctl1);
2984 	desc->dma.dma64.address_low = htole32(addrlo);
2985 	desc->dma.dma64.address_high = htole32(addrhi);
2986 }
2987 
2988 static void
2989 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2990 {
2991 
2992 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2993 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2994 }
2995 
2996 static void
2997 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2998 {
2999 
3000 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3001 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3002 }
3003 
3004 static void
3005 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3006 {
3007 
3008 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3009 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3010 }
3011 
3012 static int
3013 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3014 {
3015 	uint32_t val;
3016 
3017 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3018 	val &= BWN_DMA64_RXSTATDPTR;
3019 
3020 	return (val / sizeof(struct bwn_dmadesc64));
3021 }
3022 
3023 static void
3024 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3025 {
3026 
3027 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3028 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3029 }
3030 
3031 static int
3032 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3033 {
3034 	struct bwn_mac *mac = dr->dr_mac;
3035 	struct bwn_dma *dma = &mac->mac_method.dma;
3036 	struct bwn_softc *sc = mac->mac_sc;
3037 	int error;
3038 
3039 	error = bus_dma_tag_create(dma->parent_dtag,
3040 			    BWN_ALIGN, 0,
3041 			    BUS_SPACE_MAXADDR,
3042 			    BUS_SPACE_MAXADDR,
3043 			    NULL, NULL,
3044 			    BWN_DMA_RINGMEMSIZE,
3045 			    1,
3046 			    BUS_SPACE_MAXSIZE_32BIT,
3047 			    0,
3048 			    NULL, NULL,
3049 			    &dr->dr_ring_dtag);
3050 	if (error) {
3051 		device_printf(sc->sc_dev,
3052 		    "can't create TX ring DMA tag: TODO frees\n");
3053 		return (-1);
3054 	}
3055 
3056 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3057 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3058 	    &dr->dr_ring_dmap);
3059 	if (error) {
3060 		device_printf(sc->sc_dev,
3061 		    "can't allocate DMA mem: TODO frees\n");
3062 		return (-1);
3063 	}
3064 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3065 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3066 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3067 	if (error) {
3068 		device_printf(sc->sc_dev,
3069 		    "can't load DMA mem: TODO free\n");
3070 		return (-1);
3071 	}
3072 
3073 	return (0);
3074 }
3075 
3076 static void
3077 bwn_dma_setup(struct bwn_dma_ring *dr)
3078 {
3079 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3080 	uint64_t ring64;
3081 	uint32_t addrext, ring32, value;
3082 	uint32_t trans = siba_dma_translation(sc->sc_dev);
3083 
3084 	if (dr->dr_tx) {
3085 		dr->dr_curslot = -1;
3086 
3087 		if (dr->dr_type == BWN_DMA_64BIT) {
3088 			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3089 			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3090 			    >> 30;
3091 			value = BWN_DMA64_TXENABLE;
3092 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3093 			    & BWN_DMA64_TXADDREXT_MASK;
3094 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3095 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3096 			    (ring64 & 0xffffffff));
3097 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3098 			    ((ring64 >> 32) &
3099 			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3100 		} else {
3101 			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3102 			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3103 			value = BWN_DMA32_TXENABLE;
3104 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3105 			    & BWN_DMA32_TXADDREXT_MASK;
3106 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3107 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3108 			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3109 		}
3110 		return;
3111 	}
3112 
3113 	/*
3114 	 * set for RX
3115 	 */
3116 	dr->dr_usedslot = dr->dr_numslots;
3117 
3118 	if (dr->dr_type == BWN_DMA_64BIT) {
3119 		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3120 		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3121 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3122 		value |= BWN_DMA64_RXENABLE;
3123 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3124 		    & BWN_DMA64_RXADDREXT_MASK;
3125 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3126 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3127 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3128 		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3129 		    | (trans << 1));
3130 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3131 		    sizeof(struct bwn_dmadesc64));
3132 	} else {
3133 		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3134 		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3135 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3136 		value |= BWN_DMA32_RXENABLE;
3137 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3138 		    & BWN_DMA32_RXADDREXT_MASK;
3139 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3140 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3141 		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3142 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3143 		    sizeof(struct bwn_dmadesc32));
3144 	}
3145 }
3146 
3147 static void
3148 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3149 {
3150 
3151 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3152 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3153 	    dr->dr_ring_dmap);
3154 }
3155 
3156 static void
3157 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3158 {
3159 
3160 	if (dr->dr_tx) {
3161 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3162 		if (dr->dr_type == BWN_DMA_64BIT) {
3163 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3164 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3165 		} else
3166 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3167 	} else {
3168 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3169 		if (dr->dr_type == BWN_DMA_64BIT) {
3170 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3171 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3172 		} else
3173 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3174 	}
3175 }
3176 
3177 static void
3178 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3179 {
3180 	struct bwn_dmadesc_generic *desc;
3181 	struct bwn_dmadesc_meta *meta;
3182 	struct bwn_mac *mac = dr->dr_mac;
3183 	struct bwn_dma *dma = &mac->mac_method.dma;
3184 	struct bwn_softc *sc = mac->mac_sc;
3185 	int i;
3186 
3187 	if (!dr->dr_usedslot)
3188 		return;
3189 	for (i = 0; i < dr->dr_numslots; i++) {
3190 		dr->getdesc(dr, i, &desc, &meta);
3191 
3192 		if (meta->mt_m == NULL) {
3193 			if (!dr->dr_tx)
3194 				device_printf(sc->sc_dev, "%s: not TX?\n",
3195 				    __func__);
3196 			continue;
3197 		}
3198 		if (dr->dr_tx) {
3199 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3200 				bus_dmamap_unload(dr->dr_txring_dtag,
3201 				    meta->mt_dmap);
3202 			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3203 				bus_dmamap_unload(dma->txbuf_dtag,
3204 				    meta->mt_dmap);
3205 		} else
3206 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3207 		bwn_dma_free_descbuf(dr, meta);
3208 	}
3209 }
3210 
3211 static int
3212 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3213     int type)
3214 {
3215 	struct bwn_softc *sc = mac->mac_sc;
3216 	uint32_t value;
3217 	int i;
3218 	uint16_t offset;
3219 
3220 	for (i = 0; i < 10; i++) {
3221 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3222 		    BWN_DMA32_TXSTATUS;
3223 		value = BWN_READ_4(mac, base + offset);
3224 		if (type == BWN_DMA_64BIT) {
3225 			value &= BWN_DMA64_TXSTAT;
3226 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3227 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3228 			    value == BWN_DMA64_TXSTAT_STOPPED)
3229 				break;
3230 		} else {
3231 			value &= BWN_DMA32_TXSTATE;
3232 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3233 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3234 			    value == BWN_DMA32_TXSTAT_STOPPED)
3235 				break;
3236 		}
3237 		DELAY(1000);
3238 	}
3239 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3240 	BWN_WRITE_4(mac, base + offset, 0);
3241 	for (i = 0; i < 10; i++) {
3242 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3243 						   BWN_DMA32_TXSTATUS;
3244 		value = BWN_READ_4(mac, base + offset);
3245 		if (type == BWN_DMA_64BIT) {
3246 			value &= BWN_DMA64_TXSTAT;
3247 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3248 				i = -1;
3249 				break;
3250 			}
3251 		} else {
3252 			value &= BWN_DMA32_TXSTATE;
3253 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3254 				i = -1;
3255 				break;
3256 			}
3257 		}
3258 		DELAY(1000);
3259 	}
3260 	if (i != -1) {
3261 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3262 		return (ENODEV);
3263 	}
3264 	DELAY(1000);
3265 
3266 	return (0);
3267 }
3268 
3269 static int
3270 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3271     int type)
3272 {
3273 	struct bwn_softc *sc = mac->mac_sc;
3274 	uint32_t value;
3275 	int i;
3276 	uint16_t offset;
3277 
3278 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3279 	BWN_WRITE_4(mac, base + offset, 0);
3280 	for (i = 0; i < 10; i++) {
3281 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3282 		    BWN_DMA32_RXSTATUS;
3283 		value = BWN_READ_4(mac, base + offset);
3284 		if (type == BWN_DMA_64BIT) {
3285 			value &= BWN_DMA64_RXSTAT;
3286 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3287 				i = -1;
3288 				break;
3289 			}
3290 		} else {
3291 			value &= BWN_DMA32_RXSTATE;
3292 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3293 				i = -1;
3294 				break;
3295 			}
3296 		}
3297 		DELAY(1000);
3298 	}
3299 	if (i != -1) {
3300 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3301 		return (ENODEV);
3302 	}
3303 
3304 	return (0);
3305 }
3306 
3307 static void
3308 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3309     struct bwn_dmadesc_meta *meta)
3310 {
3311 
3312 	if (meta->mt_m != NULL) {
3313 		m_freem(meta->mt_m);
3314 		meta->mt_m = NULL;
3315 	}
3316 	if (meta->mt_ni != NULL) {
3317 		ieee80211_free_node(meta->mt_ni);
3318 		meta->mt_ni = NULL;
3319 	}
3320 }
3321 
3322 static void
3323 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3324 {
3325 	struct bwn_rxhdr4 *rxhdr;
3326 	unsigned char *frame;
3327 
3328 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3329 	rxhdr->frame_len = 0;
3330 
3331 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3332 	    sizeof(struct bwn_plcp6) + 2,
3333 	    ("%s:%d: fail", __func__, __LINE__));
3334 	frame = mtod(m, char *) + dr->dr_frameoffset;
3335 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3336 }
3337 
3338 static uint8_t
3339 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3340 {
3341 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3342 
3343 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3344 	    == 0xff);
3345 }
3346 
3347 static void
3348 bwn_wme_init(struct bwn_mac *mac)
3349 {
3350 
3351 	bwn_wme_load(mac);
3352 
3353 	/* enable WME support. */
3354 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3355 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3356 	    BWN_IFSCTL_USE_EDCF);
3357 }
3358 
3359 static void
3360 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3361 {
3362 	struct bwn_softc *sc = mac->mac_sc;
3363 	struct ieee80211com *ic = &sc->sc_ic;
3364 	uint16_t delay;	/* microsec */
3365 
3366 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3367 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3368 		delay = 500;
3369 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3370 		delay = max(delay, (uint16_t)2400);
3371 
3372 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3373 }
3374 
3375 static void
3376 bwn_bt_enable(struct bwn_mac *mac)
3377 {
3378 	struct bwn_softc *sc = mac->mac_sc;
3379 	uint64_t hf;
3380 
3381 	if (bwn_bluetooth == 0)
3382 		return;
3383 	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3384 		return;
3385 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3386 		return;
3387 
3388 	hf = bwn_hf_read(mac);
3389 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3390 		hf |= BWN_HF_BT_COEXISTALT;
3391 	else
3392 		hf |= BWN_HF_BT_COEXIST;
3393 	bwn_hf_write(mac, hf);
3394 }
3395 
3396 static void
3397 bwn_set_macaddr(struct bwn_mac *mac)
3398 {
3399 
3400 	bwn_mac_write_bssid(mac);
3401 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3402 	    mac->mac_sc->sc_ic.ic_macaddr);
3403 }
3404 
3405 static void
3406 bwn_clear_keys(struct bwn_mac *mac)
3407 {
3408 	int i;
3409 
3410 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3411 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3412 		    ("%s:%d: fail", __func__, __LINE__));
3413 
3414 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3415 		    NULL, BWN_SEC_KEYSIZE, NULL);
3416 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3417 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3418 			    NULL, BWN_SEC_KEYSIZE, NULL);
3419 		}
3420 		mac->mac_key[i].keyconf = NULL;
3421 	}
3422 }
3423 
3424 static void
3425 bwn_crypt_init(struct bwn_mac *mac)
3426 {
3427 	struct bwn_softc *sc = mac->mac_sc;
3428 
3429 	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3430 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3431 	    ("%s:%d: fail", __func__, __LINE__));
3432 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3433 	mac->mac_ktp *= 2;
3434 	if (siba_get_revid(sc->sc_dev) >= 5)
3435 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3436 	bwn_clear_keys(mac);
3437 }
3438 
3439 static void
3440 bwn_chip_exit(struct bwn_mac *mac)
3441 {
3442 	struct bwn_softc *sc = mac->mac_sc;
3443 
3444 	bwn_phy_exit(mac);
3445 	siba_gpio_set(sc->sc_dev, 0);
3446 }
3447 
3448 static int
3449 bwn_fw_fillinfo(struct bwn_mac *mac)
3450 {
3451 	int error;
3452 
3453 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3454 	if (error == 0)
3455 		return (0);
3456 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3457 	if (error == 0)
3458 		return (0);
3459 	return (error);
3460 }
3461 
3462 static int
3463 bwn_gpio_init(struct bwn_mac *mac)
3464 {
3465 	struct bwn_softc *sc = mac->mac_sc;
3466 	uint32_t mask = 0x1f, set = 0xf, value;
3467 
3468 	BWN_WRITE_4(mac, BWN_MACCTL,
3469 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3470 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3471 	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3472 
3473 	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3474 		mask |= 0x0060;
3475 		set |= 0x0060;
3476 	}
3477 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3478 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3479 		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3480 		mask |= 0x0200;
3481 		set |= 0x0200;
3482 	}
3483 	if (siba_get_revid(sc->sc_dev) >= 2)
3484 		mask |= 0x0010;
3485 
3486 	value = siba_gpio_get(sc->sc_dev);
3487 	if (value == -1)
3488 		return (0);
3489 	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3490 
3491 	return (0);
3492 }
3493 
3494 static int
3495 bwn_fw_loadinitvals(struct bwn_mac *mac)
3496 {
3497 #define	GETFWOFFSET(fwp, offset)				\
3498 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3499 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3500 	const struct bwn_fwhdr *hdr;
3501 	struct bwn_fw *fw = &mac->mac_fw;
3502 	int error;
3503 
3504 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3505 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3506 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3507 	if (error)
3508 		return (error);
3509 	if (fw->initvals_band.fw) {
3510 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3511 		error = bwn_fwinitvals_write(mac,
3512 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3513 		    be32toh(hdr->size),
3514 		    fw->initvals_band.fw->datasize - hdr_len);
3515 	}
3516 	return (error);
3517 #undef GETFWOFFSET
3518 }
3519 
3520 static int
3521 bwn_phy_init(struct bwn_mac *mac)
3522 {
3523 	struct bwn_softc *sc = mac->mac_sc;
3524 	int error;
3525 
3526 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3527 	mac->mac_phy.rf_onoff(mac, 1);
3528 	error = mac->mac_phy.init(mac);
3529 	if (error) {
3530 		device_printf(sc->sc_dev, "PHY init failed\n");
3531 		goto fail0;
3532 	}
3533 	error = bwn_switch_channel(mac,
3534 	    mac->mac_phy.get_default_chan(mac));
3535 	if (error) {
3536 		device_printf(sc->sc_dev,
3537 		    "failed to switch default channel\n");
3538 		goto fail1;
3539 	}
3540 	return (0);
3541 fail1:
3542 	if (mac->mac_phy.exit)
3543 		mac->mac_phy.exit(mac);
3544 fail0:
3545 	mac->mac_phy.rf_onoff(mac, 0);
3546 
3547 	return (error);
3548 }
3549 
3550 static void
3551 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3552 {
3553 	uint16_t ant;
3554 	uint16_t tmp;
3555 
3556 	ant = bwn_ant2phy(antenna);
3557 
3558 	/* For ACK/CTS */
3559 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3560 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3561 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3562 	/* For Probe Resposes */
3563 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3564 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3565 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3566 }
3567 
3568 static void
3569 bwn_set_opmode(struct bwn_mac *mac)
3570 {
3571 	struct bwn_softc *sc = mac->mac_sc;
3572 	struct ieee80211com *ic = &sc->sc_ic;
3573 	uint32_t ctl;
3574 	uint16_t cfp_pretbtt;
3575 
3576 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3577 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3578 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3579 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3580 	ctl |= BWN_MACCTL_STA;
3581 
3582 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3583 	    ic->ic_opmode == IEEE80211_M_MBSS)
3584 		ctl |= BWN_MACCTL_HOSTAP;
3585 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3586 		ctl &= ~BWN_MACCTL_STA;
3587 	ctl |= sc->sc_filters;
3588 
3589 	if (siba_get_revid(sc->sc_dev) <= 4)
3590 		ctl |= BWN_MACCTL_PROMISC;
3591 
3592 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3593 
3594 	cfp_pretbtt = 2;
3595 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3596 		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3597 		    siba_get_chiprev(sc->sc_dev) == 3)
3598 			cfp_pretbtt = 100;
3599 		else
3600 			cfp_pretbtt = 50;
3601 	}
3602 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3603 }
3604 
3605 static int
3606 bwn_dma_gettype(struct bwn_mac *mac)
3607 {
3608 	uint32_t tmp;
3609 	uint16_t base;
3610 
3611 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3612 	if (tmp & SIBA_TGSHIGH_DMA64)
3613 		return (BWN_DMA_64BIT);
3614 	base = bwn_dma_base(0, 0);
3615 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3616 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3617 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3618 		return (BWN_DMA_32BIT);
3619 
3620 	return (BWN_DMA_30BIT);
3621 }
3622 
3623 static void
3624 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3625 {
3626 	if (!error) {
3627 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3628 		*((bus_addr_t *)arg) = seg->ds_addr;
3629 	}
3630 }
3631 
3632 void
3633 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3634 {
3635 	struct bwn_phy *phy = &mac->mac_phy;
3636 	struct bwn_softc *sc = mac->mac_sc;
3637 	unsigned int i, max_loop;
3638 	uint16_t value;
3639 	uint32_t buffer[5] = {
3640 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3641 	};
3642 
3643 	if (ofdm) {
3644 		max_loop = 0x1e;
3645 		buffer[0] = 0x000201cc;
3646 	} else {
3647 		max_loop = 0xfa;
3648 		buffer[0] = 0x000b846e;
3649 	}
3650 
3651 	BWN_ASSERT_LOCKED(mac->mac_sc);
3652 
3653 	for (i = 0; i < 5; i++)
3654 		bwn_ram_write(mac, i * 4, buffer[i]);
3655 
3656 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3657 	BWN_WRITE_2(mac, 0x07c0,
3658 	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3659 
3660 	value = (ofdm ? 0x41 : 0x40);
3661 	BWN_WRITE_2(mac, 0x050c, value);
3662 
3663 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3664 	    phy->type == BWN_PHYTYPE_LCN)
3665 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3666 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3667 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3668 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3669 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3670 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3671 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3672 
3673 	/* XXX TODO: n phy pa override? */
3674 
3675 	switch (phy->type) {
3676 	case BWN_PHYTYPE_N:
3677 	case BWN_PHYTYPE_LCN:
3678 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3679 		break;
3680 	case BWN_PHYTYPE_LP:
3681 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3682 		break;
3683 	default:
3684 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3685 		break;
3686 	}
3687 
3688 	/* flush */
3689 	BWN_READ_2(mac, 0x0502);
3690 
3691 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3692 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3693 	for (i = 0x00; i < max_loop; i++) {
3694 		value = BWN_READ_2(mac, 0x050e);
3695 		if (value & 0x0080)
3696 			break;
3697 		DELAY(10);
3698 	}
3699 	for (i = 0x00; i < 0x0a; i++) {
3700 		value = BWN_READ_2(mac, 0x050e);
3701 		if (value & 0x0400)
3702 			break;
3703 		DELAY(10);
3704 	}
3705 	for (i = 0x00; i < 0x19; i++) {
3706 		value = BWN_READ_2(mac, 0x0690);
3707 		if (!(value & 0x0100))
3708 			break;
3709 		DELAY(10);
3710 	}
3711 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3712 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3713 }
3714 
3715 void
3716 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3717 {
3718 	uint32_t macctl;
3719 
3720 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3721 
3722 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3723 	if (macctl & BWN_MACCTL_BIGENDIAN)
3724 		printf("TODO: need swap\n");
3725 
3726 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3727 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3728 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3729 }
3730 
3731 void
3732 bwn_mac_suspend(struct bwn_mac *mac)
3733 {
3734 	struct bwn_softc *sc = mac->mac_sc;
3735 	int i;
3736 	uint32_t tmp;
3737 
3738 	KASSERT(mac->mac_suspended >= 0,
3739 	    ("%s:%d: fail", __func__, __LINE__));
3740 
3741 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3742 	    __func__, mac->mac_suspended);
3743 
3744 	if (mac->mac_suspended == 0) {
3745 		bwn_psctl(mac, BWN_PS_AWAKE);
3746 		BWN_WRITE_4(mac, BWN_MACCTL,
3747 			    BWN_READ_4(mac, BWN_MACCTL)
3748 			    & ~BWN_MACCTL_ON);
3749 		BWN_READ_4(mac, BWN_MACCTL);
3750 		for (i = 35; i; i--) {
3751 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3752 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3753 				goto out;
3754 			DELAY(10);
3755 		}
3756 		for (i = 40; i; i--) {
3757 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3758 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3759 				goto out;
3760 			DELAY(1000);
3761 		}
3762 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3763 	}
3764 out:
3765 	mac->mac_suspended++;
3766 }
3767 
3768 void
3769 bwn_mac_enable(struct bwn_mac *mac)
3770 {
3771 	struct bwn_softc *sc = mac->mac_sc;
3772 	uint16_t state;
3773 
3774 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3775 	    __func__, mac->mac_suspended);
3776 
3777 	state = bwn_shm_read_2(mac, BWN_SHARED,
3778 	    BWN_SHARED_UCODESTAT);
3779 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3780 	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3781 		DPRINTF(sc, BWN_DEBUG_FW,
3782 		    "%s: warn: firmware state (%d)\n",
3783 		    __func__, state);
3784 	}
3785 
3786 	mac->mac_suspended--;
3787 	KASSERT(mac->mac_suspended >= 0,
3788 	    ("%s:%d: fail", __func__, __LINE__));
3789 	if (mac->mac_suspended == 0) {
3790 		BWN_WRITE_4(mac, BWN_MACCTL,
3791 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3792 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3793 		BWN_READ_4(mac, BWN_MACCTL);
3794 		BWN_READ_4(mac, BWN_INTR_REASON);
3795 		bwn_psctl(mac, 0);
3796 	}
3797 }
3798 
3799 void
3800 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3801 {
3802 	struct bwn_softc *sc = mac->mac_sc;
3803 	int i;
3804 	uint16_t ucstat;
3805 
3806 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3807 	    ("%s:%d: fail", __func__, __LINE__));
3808 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3809 	    ("%s:%d: fail", __func__, __LINE__));
3810 
3811 	/* XXX forcibly awake and hwps-off */
3812 
3813 	BWN_WRITE_4(mac, BWN_MACCTL,
3814 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3815 	    ~BWN_MACCTL_HWPS);
3816 	BWN_READ_4(mac, BWN_MACCTL);
3817 	if (siba_get_revid(sc->sc_dev) >= 5) {
3818 		for (i = 0; i < 100; i++) {
3819 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3820 			    BWN_SHARED_UCODESTAT);
3821 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3822 				break;
3823 			DELAY(10);
3824 		}
3825 	}
3826 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3827 	    ucstat);
3828 }
3829 
3830 static int
3831 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3832 {
3833 	struct bwn_softc *sc = mac->mac_sc;
3834 	struct bwn_fw *fw = &mac->mac_fw;
3835 	const uint8_t rev = siba_get_revid(sc->sc_dev);
3836 	const char *filename;
3837 	uint32_t high;
3838 	int error;
3839 
3840 	/* microcode */
3841 	filename = NULL;
3842 	switch (rev) {
3843 	case 42:
3844 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3845 			filename = "ucode42";
3846 		break;
3847 	case 40:
3848 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3849 			filename = "ucode40";
3850 		break;
3851 	case 33:
3852 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3853 			filename = "ucode33_lcn40";
3854 		break;
3855 	case 30:
3856 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3857 			filename = "ucode30_mimo";
3858 		break;
3859 	case 29:
3860 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3861 			filename = "ucode29_mimo";
3862 		break;
3863 	case 26:
3864 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3865 			filename = "ucode26_mimo";
3866 		break;
3867 	case 28:
3868 	case 25:
3869 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3870 			filename = "ucode25_mimo";
3871 		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3872 			filename = "ucode25_lcn";
3873 		break;
3874 	case 24:
3875 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3876 			filename = "ucode24_lcn";
3877 		break;
3878 	case 23:
3879 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3880 			filename = "ucode16_mimo";
3881 		break;
3882 	case 16:
3883 	case 17:
3884 	case 18:
3885 	case 19:
3886 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3887 			filename = "ucode16_mimo";
3888 		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3889 			filename = "ucode16_lp";
3890 		break;
3891 	case 15:
3892 		filename = "ucode15";
3893 		break;
3894 	case 14:
3895 		filename = "ucode14";
3896 		break;
3897 	case 13:
3898 		filename = "ucode13";
3899 		break;
3900 	case 12:
3901 	case 11:
3902 		filename = "ucode11";
3903 		break;
3904 	case 10:
3905 	case 9:
3906 	case 8:
3907 	case 7:
3908 	case 6:
3909 	case 5:
3910 		filename = "ucode5";
3911 		break;
3912 	default:
3913 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3914 		bwn_release_firmware(mac);
3915 		return (EOPNOTSUPP);
3916 	}
3917 
3918 	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3919 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3920 	if (error) {
3921 		bwn_release_firmware(mac);
3922 		return (error);
3923 	}
3924 
3925 	/* PCM */
3926 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3927 	if (rev >= 5 && rev <= 10) {
3928 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3929 		if (error == ENOENT)
3930 			fw->no_pcmfile = 1;
3931 		else if (error) {
3932 			bwn_release_firmware(mac);
3933 			return (error);
3934 		}
3935 	} else if (rev < 11) {
3936 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3937 		bwn_release_firmware(mac);
3938 		return (EOPNOTSUPP);
3939 	}
3940 
3941 	/* initvals */
3942 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3943 	switch (mac->mac_phy.type) {
3944 	case BWN_PHYTYPE_A:
3945 		if (rev < 5 || rev > 10)
3946 			goto fail1;
3947 		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3948 			filename = "a0g1initvals5";
3949 		else
3950 			filename = "a0g0initvals5";
3951 		break;
3952 	case BWN_PHYTYPE_G:
3953 		if (rev >= 5 && rev <= 10)
3954 			filename = "b0g0initvals5";
3955 		else if (rev >= 13)
3956 			filename = "b0g0initvals13";
3957 		else
3958 			goto fail1;
3959 		break;
3960 	case BWN_PHYTYPE_LP:
3961 		if (rev == 13)
3962 			filename = "lp0initvals13";
3963 		else if (rev == 14)
3964 			filename = "lp0initvals14";
3965 		else if (rev >= 15)
3966 			filename = "lp0initvals15";
3967 		else
3968 			goto fail1;
3969 		break;
3970 	case BWN_PHYTYPE_N:
3971 		if (rev == 30)
3972 			filename = "n16initvals30";
3973 		else if (rev == 28 || rev == 25)
3974 			filename = "n0initvals25";
3975 		else if (rev == 24)
3976 			filename = "n0initvals24";
3977 		else if (rev == 23)
3978 			filename = "n0initvals16";
3979 		else if (rev >= 16 && rev <= 18)
3980 			filename = "n0initvals16";
3981 		else if (rev >= 11 && rev <= 12)
3982 			filename = "n0initvals11";
3983 		else
3984 			goto fail1;
3985 		break;
3986 	default:
3987 		goto fail1;
3988 	}
3989 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3990 	if (error) {
3991 		bwn_release_firmware(mac);
3992 		return (error);
3993 	}
3994 
3995 	/* bandswitch initvals */
3996 	switch (mac->mac_phy.type) {
3997 	case BWN_PHYTYPE_A:
3998 		if (rev >= 5 && rev <= 10) {
3999 			if (high & BWN_TGSHIGH_HAVE_2GHZ)
4000 				filename = "a0g1bsinitvals5";
4001 			else
4002 				filename = "a0g0bsinitvals5";
4003 		} else if (rev >= 11)
4004 			filename = NULL;
4005 		else
4006 			goto fail1;
4007 		break;
4008 	case BWN_PHYTYPE_G:
4009 		if (rev >= 5 && rev <= 10)
4010 			filename = "b0g0bsinitvals5";
4011 		else if (rev >= 11)
4012 			filename = NULL;
4013 		else
4014 			goto fail1;
4015 		break;
4016 	case BWN_PHYTYPE_LP:
4017 		if (rev == 13)
4018 			filename = "lp0bsinitvals13";
4019 		else if (rev == 14)
4020 			filename = "lp0bsinitvals14";
4021 		else if (rev >= 15)
4022 			filename = "lp0bsinitvals15";
4023 		else
4024 			goto fail1;
4025 		break;
4026 	case BWN_PHYTYPE_N:
4027 		if (rev == 30)
4028 			filename = "n16bsinitvals30";
4029 		else if (rev == 28 || rev == 25)
4030 			filename = "n0bsinitvals25";
4031 		else if (rev == 24)
4032 			filename = "n0bsinitvals24";
4033 		else if (rev == 23)
4034 			filename = "n0bsinitvals16";
4035 		else if (rev >= 16 && rev <= 18)
4036 			filename = "n0bsinitvals16";
4037 		else if (rev >= 11 && rev <= 12)
4038 			filename = "n0bsinitvals11";
4039 		else
4040 			goto fail1;
4041 		break;
4042 	default:
4043 		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4044 		    mac->mac_phy.type);
4045 		goto fail1;
4046 	}
4047 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4048 	if (error) {
4049 		bwn_release_firmware(mac);
4050 		return (error);
4051 	}
4052 	return (0);
4053 fail1:
4054 	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4055 	    rev, mac->mac_phy.type);
4056 	bwn_release_firmware(mac);
4057 	return (EOPNOTSUPP);
4058 }
4059 
4060 static int
4061 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4062     const char *name, struct bwn_fwfile *bfw)
4063 {
4064 	const struct bwn_fwhdr *hdr;
4065 	struct bwn_softc *sc = mac->mac_sc;
4066 	const struct firmware *fw;
4067 	char namebuf[64];
4068 
4069 	if (name == NULL) {
4070 		bwn_do_release_fw(bfw);
4071 		return (0);
4072 	}
4073 	if (bfw->filename != NULL) {
4074 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4075 			return (0);
4076 		bwn_do_release_fw(bfw);
4077 	}
4078 
4079 	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4080 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4081 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4082 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4083 	fw = firmware_get(namebuf);
4084 	if (fw == NULL) {
4085 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4086 		    namebuf);
4087 		return (ENOENT);
4088 	}
4089 	if (fw->datasize < sizeof(struct bwn_fwhdr))
4090 		goto fail;
4091 	hdr = (const struct bwn_fwhdr *)(fw->data);
4092 	switch (hdr->type) {
4093 	case BWN_FWTYPE_UCODE:
4094 	case BWN_FWTYPE_PCM:
4095 		if (be32toh(hdr->size) !=
4096 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4097 			goto fail;
4098 		/* FALLTHROUGH */
4099 	case BWN_FWTYPE_IV:
4100 		if (hdr->ver != 1)
4101 			goto fail;
4102 		break;
4103 	default:
4104 		goto fail;
4105 	}
4106 	bfw->filename = name;
4107 	bfw->fw = fw;
4108 	bfw->type = type;
4109 	return (0);
4110 fail:
4111 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4112 	if (fw != NULL)
4113 		firmware_put(fw, FIRMWARE_UNLOAD);
4114 	return (EPROTO);
4115 }
4116 
4117 static void
4118 bwn_release_firmware(struct bwn_mac *mac)
4119 {
4120 
4121 	bwn_do_release_fw(&mac->mac_fw.ucode);
4122 	bwn_do_release_fw(&mac->mac_fw.pcm);
4123 	bwn_do_release_fw(&mac->mac_fw.initvals);
4124 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4125 }
4126 
4127 static void
4128 bwn_do_release_fw(struct bwn_fwfile *bfw)
4129 {
4130 
4131 	if (bfw->fw != NULL)
4132 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4133 	bfw->fw = NULL;
4134 	bfw->filename = NULL;
4135 }
4136 
4137 static int
4138 bwn_fw_loaducode(struct bwn_mac *mac)
4139 {
4140 #define	GETFWOFFSET(fwp, offset)	\
4141 	((const uint32_t *)((const char *)fwp.fw->data + offset))
4142 #define	GETFWSIZE(fwp, offset)	\
4143 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4144 	struct bwn_softc *sc = mac->mac_sc;
4145 	const uint32_t *data;
4146 	unsigned int i;
4147 	uint32_t ctl;
4148 	uint16_t date, fwcaps, time;
4149 	int error = 0;
4150 
4151 	ctl = BWN_READ_4(mac, BWN_MACCTL);
4152 	ctl |= BWN_MACCTL_MCODE_JMP0;
4153 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4154 	    __LINE__));
4155 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4156 	for (i = 0; i < 64; i++)
4157 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4158 	for (i = 0; i < 4096; i += 2)
4159 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4160 
4161 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4162 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4163 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4164 	     i++) {
4165 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4166 		DELAY(10);
4167 	}
4168 
4169 	if (mac->mac_fw.pcm.fw) {
4170 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4171 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4172 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4173 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4174 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4175 		    sizeof(struct bwn_fwhdr)); i++) {
4176 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4177 			DELAY(10);
4178 		}
4179 	}
4180 
4181 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4182 	BWN_WRITE_4(mac, BWN_MACCTL,
4183 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4184 	    BWN_MACCTL_MCODE_RUN);
4185 
4186 	for (i = 0; i < 21; i++) {
4187 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4188 			break;
4189 		if (i >= 20) {
4190 			device_printf(sc->sc_dev, "ucode timeout\n");
4191 			error = ENXIO;
4192 			goto error;
4193 		}
4194 		DELAY(50000);
4195 	}
4196 	BWN_READ_4(mac, BWN_INTR_REASON);
4197 
4198 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4199 	if (mac->mac_fw.rev <= 0x128) {
4200 		device_printf(sc->sc_dev, "the firmware is too old\n");
4201 		error = EOPNOTSUPP;
4202 		goto error;
4203 	}
4204 
4205 	/*
4206 	 * Determine firmware header version; needed for TX/RX packet
4207 	 * handling.
4208 	 */
4209 	if (mac->mac_fw.rev >= 598)
4210 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4211 	else if (mac->mac_fw.rev >= 410)
4212 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4213 	else
4214 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4215 
4216 	/*
4217 	 * We don't support rev 598 or later; that requires
4218 	 * another round of changes to the TX/RX descriptor
4219 	 * and status layout.
4220 	 *
4221 	 * So, complain this is the case and exit out, rather
4222 	 * than attaching and then failing.
4223 	 */
4224 #if 0
4225 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4226 		device_printf(sc->sc_dev,
4227 		    "firmware is too new (>=598); not supported\n");
4228 		error = EOPNOTSUPP;
4229 		goto error;
4230 	}
4231 #endif
4232 
4233 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4234 	    BWN_SHARED_UCODE_PATCH);
4235 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4236 	mac->mac_fw.opensource = (date == 0xffff);
4237 	if (bwn_wme != 0)
4238 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4239 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4240 
4241 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4242 	if (mac->mac_fw.opensource == 0) {
4243 		device_printf(sc->sc_dev,
4244 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4245 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4246 		if (mac->mac_fw.no_pcmfile)
4247 			device_printf(sc->sc_dev,
4248 			    "no HW crypto acceleration due to pcm5\n");
4249 	} else {
4250 		mac->mac_fw.patch = time;
4251 		fwcaps = bwn_fwcaps_read(mac);
4252 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4253 			device_printf(sc->sc_dev,
4254 			    "disabling HW crypto acceleration\n");
4255 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4256 		}
4257 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4258 			device_printf(sc->sc_dev, "disabling WME support\n");
4259 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4260 		}
4261 	}
4262 
4263 	if (BWN_ISOLDFMT(mac))
4264 		device_printf(sc->sc_dev, "using old firmware image\n");
4265 
4266 	return (0);
4267 
4268 error:
4269 	BWN_WRITE_4(mac, BWN_MACCTL,
4270 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4271 	    BWN_MACCTL_MCODE_JMP0);
4272 
4273 	return (error);
4274 #undef GETFWSIZE
4275 #undef GETFWOFFSET
4276 }
4277 
4278 /* OpenFirmware only */
4279 static uint16_t
4280 bwn_fwcaps_read(struct bwn_mac *mac)
4281 {
4282 
4283 	KASSERT(mac->mac_fw.opensource == 1,
4284 	    ("%s:%d: fail", __func__, __LINE__));
4285 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4286 }
4287 
4288 static int
4289 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4290     size_t count, size_t array_size)
4291 {
4292 #define	GET_NEXTIV16(iv)						\
4293 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4294 	    sizeof(uint16_t) + sizeof(uint16_t)))
4295 #define	GET_NEXTIV32(iv)						\
4296 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4297 	    sizeof(uint16_t) + sizeof(uint32_t)))
4298 	struct bwn_softc *sc = mac->mac_sc;
4299 	const struct bwn_fwinitvals *iv;
4300 	uint16_t offset;
4301 	size_t i;
4302 	uint8_t bit32;
4303 
4304 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4305 	    ("%s:%d: fail", __func__, __LINE__));
4306 	iv = ivals;
4307 	for (i = 0; i < count; i++) {
4308 		if (array_size < sizeof(iv->offset_size))
4309 			goto fail;
4310 		array_size -= sizeof(iv->offset_size);
4311 		offset = be16toh(iv->offset_size);
4312 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4313 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4314 		if (offset >= 0x1000)
4315 			goto fail;
4316 		if (bit32) {
4317 			if (array_size < sizeof(iv->data.d32))
4318 				goto fail;
4319 			array_size -= sizeof(iv->data.d32);
4320 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4321 			iv = GET_NEXTIV32(iv);
4322 		} else {
4323 
4324 			if (array_size < sizeof(iv->data.d16))
4325 				goto fail;
4326 			array_size -= sizeof(iv->data.d16);
4327 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4328 
4329 			iv = GET_NEXTIV16(iv);
4330 		}
4331 	}
4332 	if (array_size != 0)
4333 		goto fail;
4334 	return (0);
4335 fail:
4336 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4337 	return (EPROTO);
4338 #undef GET_NEXTIV16
4339 #undef GET_NEXTIV32
4340 }
4341 
4342 int
4343 bwn_switch_channel(struct bwn_mac *mac, int chan)
4344 {
4345 	struct bwn_phy *phy = &(mac->mac_phy);
4346 	struct bwn_softc *sc = mac->mac_sc;
4347 	struct ieee80211com *ic = &sc->sc_ic;
4348 	uint16_t channelcookie, savedcookie;
4349 	int error;
4350 
4351 	if (chan == 0xffff)
4352 		chan = phy->get_default_chan(mac);
4353 
4354 	channelcookie = chan;
4355 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4356 		channelcookie |= 0x100;
4357 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4358 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4359 	error = phy->switch_channel(mac, chan);
4360 	if (error)
4361 		goto fail;
4362 
4363 	mac->mac_phy.chan = chan;
4364 	DELAY(8000);
4365 	return (0);
4366 fail:
4367 	device_printf(sc->sc_dev, "failed to switch channel\n");
4368 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4369 	return (error);
4370 }
4371 
4372 static uint16_t
4373 bwn_ant2phy(int antenna)
4374 {
4375 
4376 	switch (antenna) {
4377 	case BWN_ANT0:
4378 		return (BWN_TX_PHY_ANT0);
4379 	case BWN_ANT1:
4380 		return (BWN_TX_PHY_ANT1);
4381 	case BWN_ANT2:
4382 		return (BWN_TX_PHY_ANT2);
4383 	case BWN_ANT3:
4384 		return (BWN_TX_PHY_ANT3);
4385 	case BWN_ANTAUTO:
4386 		return (BWN_TX_PHY_ANT01AUTO);
4387 	}
4388 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4389 	return (0);
4390 }
4391 
4392 static void
4393 bwn_wme_load(struct bwn_mac *mac)
4394 {
4395 	struct bwn_softc *sc = mac->mac_sc;
4396 	int i;
4397 
4398 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4399 	    ("%s:%d: fail", __func__, __LINE__));
4400 
4401 	bwn_mac_suspend(mac);
4402 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4403 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4404 		    bwn_wme_shm_offsets[i]);
4405 	bwn_mac_enable(mac);
4406 }
4407 
4408 static void
4409 bwn_wme_loadparams(struct bwn_mac *mac,
4410     const struct wmeParams *p, uint16_t shm_offset)
4411 {
4412 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4413 	struct bwn_softc *sc = mac->mac_sc;
4414 	uint16_t params[BWN_NR_WMEPARAMS];
4415 	int slot, tmp;
4416 	unsigned int i;
4417 
4418 	slot = BWN_READ_2(mac, BWN_RNG) &
4419 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4420 
4421 	memset(&params, 0, sizeof(params));
4422 
4423 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4424 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4425 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4426 
4427 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4428 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4429 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4430 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4431 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4432 	params[BWN_WMEPARAM_BSLOTS] = slot;
4433 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4434 
4435 	for (i = 0; i < N(params); i++) {
4436 		if (i == BWN_WMEPARAM_STATUS) {
4437 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4438 			    shm_offset + (i * 2));
4439 			tmp |= 0x100;
4440 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4441 			    tmp);
4442 		} else {
4443 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4444 			    params[i]);
4445 		}
4446 	}
4447 }
4448 
4449 static void
4450 bwn_mac_write_bssid(struct bwn_mac *mac)
4451 {
4452 	struct bwn_softc *sc = mac->mac_sc;
4453 	uint32_t tmp;
4454 	int i;
4455 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4456 
4457 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4458 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4459 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4460 	    IEEE80211_ADDR_LEN);
4461 
4462 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4463 		tmp = (uint32_t) (mac_bssid[i + 0]);
4464 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4465 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4466 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4467 		bwn_ram_write(mac, 0x20 + i, tmp);
4468 	}
4469 }
4470 
4471 static void
4472 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4473     const uint8_t *macaddr)
4474 {
4475 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4476 	uint16_t data;
4477 
4478 	if (!mac)
4479 		macaddr = zero;
4480 
4481 	offset |= 0x0020;
4482 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4483 
4484 	data = macaddr[0];
4485 	data |= macaddr[1] << 8;
4486 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4487 	data = macaddr[2];
4488 	data |= macaddr[3] << 8;
4489 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4490 	data = macaddr[4];
4491 	data |= macaddr[5] << 8;
4492 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4493 }
4494 
4495 static void
4496 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4497     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4498 {
4499 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4500 	uint8_t per_sta_keys_start = 8;
4501 
4502 	if (BWN_SEC_NEWAPI(mac))
4503 		per_sta_keys_start = 4;
4504 
4505 	KASSERT(index < mac->mac_max_nr_keys,
4506 	    ("%s:%d: fail", __func__, __LINE__));
4507 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4508 	    ("%s:%d: fail", __func__, __LINE__));
4509 
4510 	if (index >= per_sta_keys_start)
4511 		bwn_key_macwrite(mac, index, NULL);
4512 	if (key)
4513 		memcpy(buf, key, key_len);
4514 	bwn_key_write(mac, index, algorithm, buf);
4515 	if (index >= per_sta_keys_start)
4516 		bwn_key_macwrite(mac, index, mac_addr);
4517 
4518 	mac->mac_key[index].algorithm = algorithm;
4519 }
4520 
4521 static void
4522 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4523 {
4524 	struct bwn_softc *sc = mac->mac_sc;
4525 	uint32_t addrtmp[2] = { 0, 0 };
4526 	uint8_t start = 8;
4527 
4528 	if (BWN_SEC_NEWAPI(mac))
4529 		start = 4;
4530 
4531 	KASSERT(index >= start,
4532 	    ("%s:%d: fail", __func__, __LINE__));
4533 	index -= start;
4534 
4535 	if (addr) {
4536 		addrtmp[0] = addr[0];
4537 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4538 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4539 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4540 		addrtmp[1] = addr[4];
4541 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4542 	}
4543 
4544 	if (siba_get_revid(sc->sc_dev) >= 5) {
4545 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4546 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4547 	} else {
4548 		if (index >= 8) {
4549 			bwn_shm_write_4(mac, BWN_SHARED,
4550 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4551 			bwn_shm_write_2(mac, BWN_SHARED,
4552 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4553 		}
4554 	}
4555 }
4556 
4557 static void
4558 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4559     const uint8_t *key)
4560 {
4561 	unsigned int i;
4562 	uint32_t offset;
4563 	uint16_t kidx, value;
4564 
4565 	kidx = BWN_SEC_KEY2FW(mac, index);
4566 	bwn_shm_write_2(mac, BWN_SHARED,
4567 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4568 
4569 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4570 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4571 		value = key[i];
4572 		value |= (uint16_t)(key[i + 1]) << 8;
4573 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4574 	}
4575 }
4576 
4577 static void
4578 bwn_phy_exit(struct bwn_mac *mac)
4579 {
4580 
4581 	mac->mac_phy.rf_onoff(mac, 0);
4582 	if (mac->mac_phy.exit != NULL)
4583 		mac->mac_phy.exit(mac);
4584 }
4585 
4586 static void
4587 bwn_dma_free(struct bwn_mac *mac)
4588 {
4589 	struct bwn_dma *dma;
4590 
4591 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4592 		return;
4593 	dma = &mac->mac_method.dma;
4594 
4595 	bwn_dma_ringfree(&dma->rx);
4596 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4597 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4598 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4599 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4600 	bwn_dma_ringfree(&dma->mcast);
4601 }
4602 
4603 static void
4604 bwn_core_stop(struct bwn_mac *mac)
4605 {
4606 	struct bwn_softc *sc = mac->mac_sc;
4607 
4608 	BWN_ASSERT_LOCKED(sc);
4609 
4610 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4611 		return;
4612 
4613 	callout_stop(&sc->sc_rfswitch_ch);
4614 	callout_stop(&sc->sc_task_ch);
4615 	callout_stop(&sc->sc_watchdog_ch);
4616 	sc->sc_watchdog_timer = 0;
4617 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4618 	BWN_READ_4(mac, BWN_INTR_MASK);
4619 	bwn_mac_suspend(mac);
4620 
4621 	mac->mac_status = BWN_MAC_STATUS_INITED;
4622 }
4623 
4624 static int
4625 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4626 {
4627 	struct bwn_mac *up_dev = NULL;
4628 	struct bwn_mac *down_dev;
4629 	struct bwn_mac *mac;
4630 	int err, status;
4631 	uint8_t gmode;
4632 
4633 	BWN_ASSERT_LOCKED(sc);
4634 
4635 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4636 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4637 		    mac->mac_phy.supports_2ghz) {
4638 			up_dev = mac;
4639 			gmode = 1;
4640 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4641 		    mac->mac_phy.supports_5ghz) {
4642 			up_dev = mac;
4643 			gmode = 0;
4644 		} else {
4645 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4646 			return (EINVAL);
4647 		}
4648 		if (up_dev != NULL)
4649 			break;
4650 	}
4651 	if (up_dev == NULL) {
4652 		device_printf(sc->sc_dev, "Could not find a device\n");
4653 		return (ENODEV);
4654 	}
4655 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4656 		return (0);
4657 
4658 	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4659 	    "switching to %s-GHz band\n",
4660 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4661 
4662 	down_dev = sc->sc_curmac;
4663 	status = down_dev->mac_status;
4664 	if (status >= BWN_MAC_STATUS_STARTED)
4665 		bwn_core_stop(down_dev);
4666 	if (status >= BWN_MAC_STATUS_INITED)
4667 		bwn_core_exit(down_dev);
4668 
4669 	if (down_dev != up_dev)
4670 		bwn_phy_reset(down_dev);
4671 
4672 	up_dev->mac_phy.gmode = gmode;
4673 	if (status >= BWN_MAC_STATUS_INITED) {
4674 		err = bwn_core_init(up_dev);
4675 		if (err) {
4676 			device_printf(sc->sc_dev,
4677 			    "fatal: failed to initialize for %s-GHz\n",
4678 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4679 			goto fail;
4680 		}
4681 	}
4682 	if (status >= BWN_MAC_STATUS_STARTED)
4683 		bwn_core_start(up_dev);
4684 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4685 	sc->sc_curmac = up_dev;
4686 
4687 	return (0);
4688 fail:
4689 	sc->sc_curmac = NULL;
4690 	return (err);
4691 }
4692 
4693 static void
4694 bwn_rf_turnon(struct bwn_mac *mac)
4695 {
4696 
4697 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4698 
4699 	bwn_mac_suspend(mac);
4700 	mac->mac_phy.rf_onoff(mac, 1);
4701 	mac->mac_phy.rf_on = 1;
4702 	bwn_mac_enable(mac);
4703 }
4704 
4705 static void
4706 bwn_rf_turnoff(struct bwn_mac *mac)
4707 {
4708 
4709 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4710 
4711 	bwn_mac_suspend(mac);
4712 	mac->mac_phy.rf_onoff(mac, 0);
4713 	mac->mac_phy.rf_on = 0;
4714 	bwn_mac_enable(mac);
4715 }
4716 
4717 /*
4718  * SSB PHY reset.
4719  */
4720 static void
4721 bwn_phy_reset_siba(struct bwn_mac *mac)
4722 {
4723 	struct bwn_softc *sc = mac->mac_sc;
4724 
4725 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4726 	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4727 	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4728 	DELAY(1000);
4729 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4730 	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4731 	DELAY(1000);
4732 }
4733 
4734 static void
4735 bwn_phy_reset(struct bwn_mac *mac)
4736 {
4737 
4738 	if (bwn_is_bus_siba(mac)) {
4739 		bwn_phy_reset_siba(mac);
4740 	} else {
4741 		BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4742 	}
4743 }
4744 
4745 static int
4746 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4747 {
4748 	struct bwn_vap *bvp = BWN_VAP(vap);
4749 	struct ieee80211com *ic= vap->iv_ic;
4750 	enum ieee80211_state ostate = vap->iv_state;
4751 	struct bwn_softc *sc = ic->ic_softc;
4752 	struct bwn_mac *mac = sc->sc_curmac;
4753 	int error;
4754 
4755 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4756 	    ieee80211_state_name[vap->iv_state],
4757 	    ieee80211_state_name[nstate]);
4758 
4759 	error = bvp->bv_newstate(vap, nstate, arg);
4760 	if (error != 0)
4761 		return (error);
4762 
4763 	BWN_LOCK(sc);
4764 
4765 	bwn_led_newstate(mac, nstate);
4766 
4767 	/*
4768 	 * Clear the BSSID when we stop a STA
4769 	 */
4770 	if (vap->iv_opmode == IEEE80211_M_STA) {
4771 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4772 			/*
4773 			 * Clear out the BSSID.  If we reassociate to
4774 			 * the same AP, this will reinialize things
4775 			 * correctly...
4776 			 */
4777 			if (ic->ic_opmode == IEEE80211_M_STA &&
4778 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4779 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4780 				bwn_set_macaddr(mac);
4781 			}
4782 		}
4783 	}
4784 
4785 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4786 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4787 		/* XXX nothing to do? */
4788 	} else if (nstate == IEEE80211_S_RUN) {
4789 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4790 		bwn_set_opmode(mac);
4791 		bwn_set_pretbtt(mac);
4792 		bwn_spu_setdelay(mac, 0);
4793 		bwn_set_macaddr(mac);
4794 	}
4795 
4796 	BWN_UNLOCK(sc);
4797 
4798 	return (error);
4799 }
4800 
4801 static void
4802 bwn_set_pretbtt(struct bwn_mac *mac)
4803 {
4804 	struct bwn_softc *sc = mac->mac_sc;
4805 	struct ieee80211com *ic = &sc->sc_ic;
4806 	uint16_t pretbtt;
4807 
4808 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4809 		pretbtt = 2;
4810 	else
4811 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4812 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4813 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4814 }
4815 
4816 static int
4817 bwn_intr(void *arg)
4818 {
4819 	struct bwn_mac *mac = arg;
4820 	struct bwn_softc *sc = mac->mac_sc;
4821 	uint32_t reason;
4822 
4823 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4824 	    (sc->sc_flags & BWN_FLAG_INVALID))
4825 		return (FILTER_STRAY);
4826 
4827 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4828 
4829 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4830 	if (reason == 0xffffffff)	/* shared IRQ */
4831 		return (FILTER_STRAY);
4832 	reason &= mac->mac_intr_mask;
4833 	if (reason == 0)
4834 		return (FILTER_HANDLED);
4835 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4836 
4837 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4838 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4839 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4840 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4841 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4842 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4843 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4844 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4845 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4846 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4847 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4848 
4849 	/* Disable interrupts. */
4850 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4851 
4852 	mac->mac_reason_intr = reason;
4853 
4854 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4855 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4856 
4857 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4858 	return (FILTER_HANDLED);
4859 }
4860 
4861 static void
4862 bwn_intrtask(void *arg, int npending)
4863 {
4864 	struct bwn_mac *mac = arg;
4865 	struct bwn_softc *sc = mac->mac_sc;
4866 	uint32_t merged = 0;
4867 	int i, tx = 0, rx = 0;
4868 
4869 	BWN_LOCK(sc);
4870 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4871 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4872 		BWN_UNLOCK(sc);
4873 		return;
4874 	}
4875 
4876 	for (i = 0; i < N(mac->mac_reason); i++)
4877 		merged |= mac->mac_reason[i];
4878 
4879 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4880 		device_printf(sc->sc_dev, "MAC trans error\n");
4881 
4882 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4883 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4884 		mac->mac_phy.txerrors--;
4885 		if (mac->mac_phy.txerrors == 0) {
4886 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4887 			bwn_restart(mac, "PHY TX errors");
4888 		}
4889 	}
4890 
4891 	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4892 		if (merged & BWN_DMAINTR_FATALMASK) {
4893 			device_printf(sc->sc_dev,
4894 			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4895 			    mac->mac_reason[0], mac->mac_reason[1],
4896 			    mac->mac_reason[2], mac->mac_reason[3],
4897 			    mac->mac_reason[4], mac->mac_reason[5]);
4898 			bwn_restart(mac, "DMA error");
4899 			BWN_UNLOCK(sc);
4900 			return;
4901 		}
4902 		if (merged & BWN_DMAINTR_NONFATALMASK) {
4903 			device_printf(sc->sc_dev,
4904 			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4905 			    mac->mac_reason[0], mac->mac_reason[1],
4906 			    mac->mac_reason[2], mac->mac_reason[3],
4907 			    mac->mac_reason[4], mac->mac_reason[5]);
4908 		}
4909 	}
4910 
4911 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4912 		bwn_intr_ucode_debug(mac);
4913 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4914 		bwn_intr_tbtt_indication(mac);
4915 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4916 		bwn_intr_atim_end(mac);
4917 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4918 		bwn_intr_beacon(mac);
4919 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4920 		bwn_intr_pmq(mac);
4921 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4922 		bwn_intr_noise(mac);
4923 
4924 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4925 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4926 			bwn_dma_rx(mac->mac_method.dma.rx);
4927 			rx = 1;
4928 		}
4929 	} else
4930 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4931 
4932 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4933 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4934 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4935 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4936 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4937 
4938 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4939 		bwn_intr_txeof(mac);
4940 		tx = 1;
4941 	}
4942 
4943 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4944 
4945 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4946 		int evt = BWN_LED_EVENT_NONE;
4947 
4948 		if (tx && rx) {
4949 			if (sc->sc_rx_rate > sc->sc_tx_rate)
4950 				evt = BWN_LED_EVENT_RX;
4951 			else
4952 				evt = BWN_LED_EVENT_TX;
4953 		} else if (tx) {
4954 			evt = BWN_LED_EVENT_TX;
4955 		} else if (rx) {
4956 			evt = BWN_LED_EVENT_RX;
4957 		} else if (rx == 0) {
4958 			evt = BWN_LED_EVENT_POLL;
4959 		}
4960 
4961 		if (evt != BWN_LED_EVENT_NONE)
4962 			bwn_led_event(mac, evt);
4963        }
4964 
4965 	if (mbufq_first(&sc->sc_snd) != NULL)
4966 		bwn_start(sc);
4967 
4968 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4969 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4970 
4971 	BWN_UNLOCK(sc);
4972 }
4973 
4974 static void
4975 bwn_restart(struct bwn_mac *mac, const char *msg)
4976 {
4977 	struct bwn_softc *sc = mac->mac_sc;
4978 	struct ieee80211com *ic = &sc->sc_ic;
4979 
4980 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4981 		return;
4982 
4983 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4984 	ieee80211_runtask(ic, &mac->mac_hwreset);
4985 }
4986 
4987 static void
4988 bwn_intr_ucode_debug(struct bwn_mac *mac)
4989 {
4990 	struct bwn_softc *sc = mac->mac_sc;
4991 	uint16_t reason;
4992 
4993 	if (mac->mac_fw.opensource == 0)
4994 		return;
4995 
4996 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4997 	switch (reason) {
4998 	case BWN_DEBUGINTR_PANIC:
4999 		bwn_handle_fwpanic(mac);
5000 		break;
5001 	case BWN_DEBUGINTR_DUMP_SHM:
5002 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5003 		break;
5004 	case BWN_DEBUGINTR_DUMP_REGS:
5005 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5006 		break;
5007 	case BWN_DEBUGINTR_MARKER:
5008 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5009 		break;
5010 	default:
5011 		device_printf(sc->sc_dev,
5012 		    "ucode debug unknown reason: %#x\n", reason);
5013 	}
5014 
5015 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5016 	    BWN_DEBUGINTR_ACK);
5017 }
5018 
5019 static void
5020 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5021 {
5022 	struct bwn_softc *sc = mac->mac_sc;
5023 	struct ieee80211com *ic = &sc->sc_ic;
5024 
5025 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5026 		bwn_psctl(mac, 0);
5027 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5028 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5029 }
5030 
5031 static void
5032 bwn_intr_atim_end(struct bwn_mac *mac)
5033 {
5034 
5035 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5036 		BWN_WRITE_4(mac, BWN_MACCMD,
5037 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5038 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5039 	}
5040 }
5041 
5042 static void
5043 bwn_intr_beacon(struct bwn_mac *mac)
5044 {
5045 	struct bwn_softc *sc = mac->mac_sc;
5046 	struct ieee80211com *ic = &sc->sc_ic;
5047 	uint32_t cmd, beacon0, beacon1;
5048 
5049 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5050 	    ic->ic_opmode == IEEE80211_M_MBSS)
5051 		return;
5052 
5053 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5054 
5055 	cmd = BWN_READ_4(mac, BWN_MACCMD);
5056 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5057 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5058 
5059 	if (beacon0 && beacon1) {
5060 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5061 		mac->mac_intr_mask |= BWN_INTR_BEACON;
5062 		return;
5063 	}
5064 
5065 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5066 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5067 		bwn_load_beacon0(mac);
5068 		bwn_load_beacon1(mac);
5069 		cmd = BWN_READ_4(mac, BWN_MACCMD);
5070 		cmd |= BWN_MACCMD_BEACON0_VALID;
5071 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5072 	} else {
5073 		if (!beacon0) {
5074 			bwn_load_beacon0(mac);
5075 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5076 			cmd |= BWN_MACCMD_BEACON0_VALID;
5077 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5078 		} else if (!beacon1) {
5079 			bwn_load_beacon1(mac);
5080 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5081 			cmd |= BWN_MACCMD_BEACON1_VALID;
5082 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5083 		}
5084 	}
5085 }
5086 
5087 static void
5088 bwn_intr_pmq(struct bwn_mac *mac)
5089 {
5090 	uint32_t tmp;
5091 
5092 	while (1) {
5093 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5094 		if (!(tmp & 0x00000008))
5095 			break;
5096 	}
5097 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5098 }
5099 
5100 static void
5101 bwn_intr_noise(struct bwn_mac *mac)
5102 {
5103 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5104 	uint16_t tmp;
5105 	uint8_t noise[4];
5106 	uint8_t i, j;
5107 	int32_t average;
5108 
5109 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5110 		return;
5111 
5112 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5113 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5114 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5115 	    noise[3] == 0x7f)
5116 		goto new;
5117 
5118 	KASSERT(mac->mac_noise.noi_nsamples < 8,
5119 	    ("%s:%d: fail", __func__, __LINE__));
5120 	i = mac->mac_noise.noi_nsamples;
5121 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5122 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5123 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5124 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5125 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5126 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5127 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5128 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5129 	mac->mac_noise.noi_nsamples++;
5130 	if (mac->mac_noise.noi_nsamples == 8) {
5131 		average = 0;
5132 		for (i = 0; i < 8; i++) {
5133 			for (j = 0; j < 4; j++)
5134 				average += mac->mac_noise.noi_samples[i][j];
5135 		}
5136 		average = (((average / 32) * 125) + 64) / 128;
5137 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5138 		if (tmp >= 8)
5139 			average += 2;
5140 		else
5141 			average -= 25;
5142 		average -= (tmp == 8) ? 72 : 48;
5143 
5144 		mac->mac_stats.link_noise = average;
5145 		mac->mac_noise.noi_running = 0;
5146 		return;
5147 	}
5148 new:
5149 	bwn_noise_gensample(mac);
5150 }
5151 
5152 static int
5153 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5154 {
5155 	struct bwn_mac *mac = prq->prq_mac;
5156 	struct bwn_softc *sc = mac->mac_sc;
5157 	unsigned int i;
5158 
5159 	BWN_ASSERT_LOCKED(sc);
5160 
5161 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5162 		return (0);
5163 
5164 	for (i = 0; i < 5000; i++) {
5165 		if (bwn_pio_rxeof(prq) == 0)
5166 			break;
5167 	}
5168 	if (i >= 5000)
5169 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5170 	return ((i > 0) ? 1 : 0);
5171 }
5172 
5173 static void
5174 bwn_dma_rx(struct bwn_dma_ring *dr)
5175 {
5176 	int slot, curslot;
5177 
5178 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5179 	curslot = dr->get_curslot(dr);
5180 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5181 	    ("%s:%d: fail", __func__, __LINE__));
5182 
5183 	slot = dr->dr_curslot;
5184 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5185 		bwn_dma_rxeof(dr, &slot);
5186 
5187 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5188 	    BUS_DMASYNC_PREWRITE);
5189 
5190 	dr->set_curslot(dr, slot);
5191 	dr->dr_curslot = slot;
5192 }
5193 
5194 static void
5195 bwn_intr_txeof(struct bwn_mac *mac)
5196 {
5197 	struct bwn_txstatus stat;
5198 	uint32_t stat0, stat1;
5199 	uint16_t tmp;
5200 
5201 	BWN_ASSERT_LOCKED(mac->mac_sc);
5202 
5203 	while (1) {
5204 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5205 		if (!(stat0 & 0x00000001))
5206 			break;
5207 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5208 
5209 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5210 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5211 		    __func__,
5212 		    stat0,
5213 		    stat1);
5214 
5215 		stat.cookie = (stat0 >> 16);
5216 		stat.seq = (stat1 & 0x0000ffff);
5217 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5218 		tmp = (stat0 & 0x0000ffff);
5219 		stat.framecnt = ((tmp & 0xf000) >> 12);
5220 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5221 		stat.sreason = ((tmp & 0x001c) >> 2);
5222 		stat.pm = (tmp & 0x0080) ? 1 : 0;
5223 		stat.im = (tmp & 0x0040) ? 1 : 0;
5224 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5225 		stat.ack = (tmp & 0x0002) ? 1 : 0;
5226 
5227 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5228 		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5229 		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5230 		    __func__,
5231 		    stat.cookie,
5232 		    stat.seq,
5233 		    stat.phy_stat,
5234 		    stat.framecnt,
5235 		    stat.rtscnt,
5236 		    stat.sreason,
5237 		    stat.pm,
5238 		    stat.im,
5239 		    stat.ampdu,
5240 		    stat.ack);
5241 
5242 		bwn_handle_txeof(mac, &stat);
5243 	}
5244 }
5245 
5246 static void
5247 bwn_hwreset(void *arg, int npending)
5248 {
5249 	struct bwn_mac *mac = arg;
5250 	struct bwn_softc *sc = mac->mac_sc;
5251 	int error = 0;
5252 	int prev_status;
5253 
5254 	BWN_LOCK(sc);
5255 
5256 	prev_status = mac->mac_status;
5257 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5258 		bwn_core_stop(mac);
5259 	if (prev_status >= BWN_MAC_STATUS_INITED)
5260 		bwn_core_exit(mac);
5261 
5262 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5263 		error = bwn_core_init(mac);
5264 		if (error)
5265 			goto out;
5266 	}
5267 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5268 		bwn_core_start(mac);
5269 out:
5270 	if (error) {
5271 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5272 		sc->sc_curmac = NULL;
5273 	}
5274 	BWN_UNLOCK(sc);
5275 }
5276 
5277 static void
5278 bwn_handle_fwpanic(struct bwn_mac *mac)
5279 {
5280 	struct bwn_softc *sc = mac->mac_sc;
5281 	uint16_t reason;
5282 
5283 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5284 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5285 
5286 	if (reason == BWN_FWPANIC_RESTART)
5287 		bwn_restart(mac, "ucode panic");
5288 }
5289 
5290 static void
5291 bwn_load_beacon0(struct bwn_mac *mac)
5292 {
5293 
5294 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5295 }
5296 
5297 static void
5298 bwn_load_beacon1(struct bwn_mac *mac)
5299 {
5300 
5301 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5302 }
5303 
5304 static uint32_t
5305 bwn_jssi_read(struct bwn_mac *mac)
5306 {
5307 	uint32_t val = 0;
5308 
5309 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5310 	val <<= 16;
5311 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5312 
5313 	return (val);
5314 }
5315 
5316 static void
5317 bwn_noise_gensample(struct bwn_mac *mac)
5318 {
5319 	uint32_t jssi = 0x7f7f7f7f;
5320 
5321 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5322 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5323 	BWN_WRITE_4(mac, BWN_MACCMD,
5324 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5325 }
5326 
5327 static int
5328 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5329 {
5330 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5331 
5332 	return (dr->dr_numslots - dr->dr_usedslot);
5333 }
5334 
5335 static int
5336 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5337 {
5338 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5339 
5340 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5341 	    ("%s:%d: fail", __func__, __LINE__));
5342 	if (slot == dr->dr_numslots - 1)
5343 		return (0);
5344 	return (slot + 1);
5345 }
5346 
5347 static void
5348 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5349 {
5350 	struct bwn_mac *mac = dr->dr_mac;
5351 	struct bwn_softc *sc = mac->mac_sc;
5352 	struct bwn_dma *dma = &mac->mac_method.dma;
5353 	struct bwn_dmadesc_generic *desc;
5354 	struct bwn_dmadesc_meta *meta;
5355 	struct bwn_rxhdr4 *rxhdr;
5356 	struct mbuf *m;
5357 	uint32_t macstat;
5358 	int32_t tmp;
5359 	int cnt = 0;
5360 	uint16_t len;
5361 
5362 	dr->getdesc(dr, *slot, &desc, &meta);
5363 
5364 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5365 	m = meta->mt_m;
5366 
5367 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5368 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5369 		return;
5370 	}
5371 
5372 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5373 	len = le16toh(rxhdr->frame_len);
5374 	if (len <= 0) {
5375 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5376 		return;
5377 	}
5378 	if (bwn_dma_check_redzone(dr, m)) {
5379 		device_printf(sc->sc_dev, "redzone error.\n");
5380 		bwn_dma_set_redzone(dr, m);
5381 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5382 		    BUS_DMASYNC_PREWRITE);
5383 		return;
5384 	}
5385 	if (len > dr->dr_rx_bufsize) {
5386 		tmp = len;
5387 		while (1) {
5388 			dr->getdesc(dr, *slot, &desc, &meta);
5389 			bwn_dma_set_redzone(dr, meta->mt_m);
5390 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5391 			    BUS_DMASYNC_PREWRITE);
5392 			*slot = bwn_dma_nextslot(dr, *slot);
5393 			cnt++;
5394 			tmp -= dr->dr_rx_bufsize;
5395 			if (tmp <= 0)
5396 				break;
5397 		}
5398 		device_printf(sc->sc_dev, "too small buffer "
5399 		       "(len %u buffer %u dropped %d)\n",
5400 		       len, dr->dr_rx_bufsize, cnt);
5401 		return;
5402 	}
5403 
5404 	switch (mac->mac_fw.fw_hdr_format) {
5405 	case BWN_FW_HDR_351:
5406 	case BWN_FW_HDR_410:
5407 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5408 		break;
5409 	case BWN_FW_HDR_598:
5410 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5411 		break;
5412 	}
5413 
5414 	if (macstat & BWN_RX_MAC_FCSERR) {
5415 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5416 			device_printf(sc->sc_dev, "RX drop\n");
5417 			return;
5418 		}
5419 	}
5420 
5421 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5422 	m_adj(m, dr->dr_frameoffset);
5423 
5424 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5425 }
5426 
5427 static void
5428 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5429 {
5430 	struct bwn_softc *sc = mac->mac_sc;
5431 	struct bwn_stats *stats = &mac->mac_stats;
5432 
5433 	BWN_ASSERT_LOCKED(mac->mac_sc);
5434 
5435 	if (status->im)
5436 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5437 	if (status->ampdu)
5438 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5439 	if (status->rtscnt) {
5440 		if (status->rtscnt == 0xf)
5441 			stats->rtsfail++;
5442 		else
5443 			stats->rts++;
5444 	}
5445 
5446 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5447 		bwn_dma_handle_txeof(mac, status);
5448 	} else {
5449 		bwn_pio_handle_txeof(mac, status);
5450 	}
5451 
5452 	bwn_phy_txpower_check(mac, 0);
5453 }
5454 
5455 static uint8_t
5456 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5457 {
5458 	struct bwn_mac *mac = prq->prq_mac;
5459 	struct bwn_softc *sc = mac->mac_sc;
5460 	struct bwn_rxhdr4 rxhdr;
5461 	struct mbuf *m;
5462 	uint32_t ctl32, macstat, v32;
5463 	unsigned int i, padding;
5464 	uint16_t ctl16, len, totlen, v16;
5465 	unsigned char *mp;
5466 	char *data;
5467 
5468 	memset(&rxhdr, 0, sizeof(rxhdr));
5469 
5470 	if (prq->prq_rev >= 8) {
5471 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5472 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5473 			return (0);
5474 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5475 		    BWN_PIO8_RXCTL_FRAMEREADY);
5476 		for (i = 0; i < 10; i++) {
5477 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5478 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5479 				goto ready;
5480 			DELAY(10);
5481 		}
5482 	} else {
5483 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5484 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5485 			return (0);
5486 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5487 		    BWN_PIO_RXCTL_FRAMEREADY);
5488 		for (i = 0; i < 10; i++) {
5489 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5490 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5491 				goto ready;
5492 			DELAY(10);
5493 		}
5494 	}
5495 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5496 	return (1);
5497 ready:
5498 	if (prq->prq_rev >= 8)
5499 		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5500 		    prq->prq_base + BWN_PIO8_RXDATA);
5501 	else
5502 		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5503 		    prq->prq_base + BWN_PIO_RXDATA);
5504 	len = le16toh(rxhdr.frame_len);
5505 	if (len > 0x700) {
5506 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5507 		goto error;
5508 	}
5509 	if (len == 0) {
5510 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5511 		goto error;
5512 	}
5513 
5514 	switch (mac->mac_fw.fw_hdr_format) {
5515 	case BWN_FW_HDR_351:
5516 	case BWN_FW_HDR_410:
5517 		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5518 		break;
5519 	case BWN_FW_HDR_598:
5520 		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5521 		break;
5522 	}
5523 
5524 	if (macstat & BWN_RX_MAC_FCSERR) {
5525 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5526 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5527 			goto error;
5528 		}
5529 	}
5530 
5531 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5532 	totlen = len + padding;
5533 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5534 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5535 	if (m == NULL) {
5536 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5537 		goto error;
5538 	}
5539 	mp = mtod(m, unsigned char *);
5540 	if (prq->prq_rev >= 8) {
5541 		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5542 		    prq->prq_base + BWN_PIO8_RXDATA);
5543 		if (totlen & 3) {
5544 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5545 			data = &(mp[totlen - 1]);
5546 			switch (totlen & 3) {
5547 			case 3:
5548 				*data = (v32 >> 16);
5549 				data--;
5550 			case 2:
5551 				*data = (v32 >> 8);
5552 				data--;
5553 			case 1:
5554 				*data = v32;
5555 			}
5556 		}
5557 	} else {
5558 		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5559 		    prq->prq_base + BWN_PIO_RXDATA);
5560 		if (totlen & 1) {
5561 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5562 			mp[totlen - 1] = v16;
5563 		}
5564 	}
5565 
5566 	m->m_len = m->m_pkthdr.len = totlen;
5567 
5568 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5569 
5570 	return (1);
5571 error:
5572 	if (prq->prq_rev >= 8)
5573 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5574 		    BWN_PIO8_RXCTL_DATAREADY);
5575 	else
5576 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5577 	return (1);
5578 }
5579 
5580 static int
5581 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5582     struct bwn_dmadesc_meta *meta, int init)
5583 {
5584 	struct bwn_mac *mac = dr->dr_mac;
5585 	struct bwn_dma *dma = &mac->mac_method.dma;
5586 	struct bwn_rxhdr4 *hdr;
5587 	bus_dmamap_t map;
5588 	bus_addr_t paddr;
5589 	struct mbuf *m;
5590 	int error;
5591 
5592 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5593 	if (m == NULL) {
5594 		error = ENOBUFS;
5595 
5596 		/*
5597 		 * If the NIC is up and running, we need to:
5598 		 * - Clear RX buffer's header.
5599 		 * - Restore RX descriptor settings.
5600 		 */
5601 		if (init)
5602 			return (error);
5603 		else
5604 			goto back;
5605 	}
5606 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5607 
5608 	bwn_dma_set_redzone(dr, m);
5609 
5610 	/*
5611 	 * Try to load RX buf into temporary DMA map
5612 	 */
5613 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5614 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5615 	if (error) {
5616 		m_freem(m);
5617 
5618 		/*
5619 		 * See the comment above
5620 		 */
5621 		if (init)
5622 			return (error);
5623 		else
5624 			goto back;
5625 	}
5626 
5627 	if (!init)
5628 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5629 	meta->mt_m = m;
5630 	meta->mt_paddr = paddr;
5631 
5632 	/*
5633 	 * Swap RX buf's DMA map with the loaded temporary one
5634 	 */
5635 	map = meta->mt_dmap;
5636 	meta->mt_dmap = dr->dr_spare_dmap;
5637 	dr->dr_spare_dmap = map;
5638 
5639 back:
5640 	/*
5641 	 * Clear RX buf header
5642 	 */
5643 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5644 	bzero(hdr, sizeof(*hdr));
5645 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5646 	    BUS_DMASYNC_PREWRITE);
5647 
5648 	/*
5649 	 * Setup RX buf descriptor
5650 	 */
5651 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5652 	    sizeof(*hdr), 0, 0, 0);
5653 	return (error);
5654 }
5655 
5656 static void
5657 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5658 		 bus_size_t mapsz __unused, int error)
5659 {
5660 
5661 	if (!error) {
5662 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5663 		*((bus_addr_t *)arg) = seg->ds_addr;
5664 	}
5665 }
5666 
5667 static int
5668 bwn_hwrate2ieeerate(int rate)
5669 {
5670 
5671 	switch (rate) {
5672 	case BWN_CCK_RATE_1MB:
5673 		return (2);
5674 	case BWN_CCK_RATE_2MB:
5675 		return (4);
5676 	case BWN_CCK_RATE_5MB:
5677 		return (11);
5678 	case BWN_CCK_RATE_11MB:
5679 		return (22);
5680 	case BWN_OFDM_RATE_6MB:
5681 		return (12);
5682 	case BWN_OFDM_RATE_9MB:
5683 		return (18);
5684 	case BWN_OFDM_RATE_12MB:
5685 		return (24);
5686 	case BWN_OFDM_RATE_18MB:
5687 		return (36);
5688 	case BWN_OFDM_RATE_24MB:
5689 		return (48);
5690 	case BWN_OFDM_RATE_36MB:
5691 		return (72);
5692 	case BWN_OFDM_RATE_48MB:
5693 		return (96);
5694 	case BWN_OFDM_RATE_54MB:
5695 		return (108);
5696 	default:
5697 		printf("Ooops\n");
5698 		return (0);
5699 	}
5700 }
5701 
5702 /*
5703  * Post process the RX provided RSSI.
5704  *
5705  * Valid for A, B, G, LP PHYs.
5706  */
5707 static int8_t
5708 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5709     int ofdm, int adjust_2053, int adjust_2050)
5710 {
5711 	struct bwn_phy *phy = &mac->mac_phy;
5712 	struct bwn_phy_g *gphy = &phy->phy_g;
5713 	int tmp;
5714 
5715 	switch (phy->rf_ver) {
5716 	case 0x2050:
5717 		if (ofdm) {
5718 			tmp = in_rssi;
5719 			if (tmp > 127)
5720 				tmp -= 256;
5721 			tmp = tmp * 73 / 64;
5722 			if (adjust_2050)
5723 				tmp += 25;
5724 			else
5725 				tmp -= 3;
5726 		} else {
5727 			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5728 			    & BWN_BFL_RSSI) {
5729 				if (in_rssi > 63)
5730 					in_rssi = 63;
5731 				tmp = gphy->pg_nrssi_lt[in_rssi];
5732 				tmp = (31 - tmp) * -131 / 128 - 57;
5733 			} else {
5734 				tmp = in_rssi;
5735 				tmp = (31 - tmp) * -149 / 128 - 68;
5736 			}
5737 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5738 				tmp += 25;
5739 		}
5740 		break;
5741 	case 0x2060:
5742 		if (in_rssi > 127)
5743 			tmp = in_rssi - 256;
5744 		else
5745 			tmp = in_rssi;
5746 		break;
5747 	default:
5748 		tmp = in_rssi;
5749 		tmp = (tmp - 11) * 103 / 64;
5750 		if (adjust_2053)
5751 			tmp -= 109;
5752 		else
5753 			tmp -= 83;
5754 	}
5755 
5756 	return (tmp);
5757 }
5758 
5759 static void
5760 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5761 {
5762 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5763 	struct bwn_plcp6 *plcp;
5764 	struct bwn_softc *sc = mac->mac_sc;
5765 	struct ieee80211_frame_min *wh;
5766 	struct ieee80211_node *ni;
5767 	struct ieee80211com *ic = &sc->sc_ic;
5768 	uint32_t macstat;
5769 	int padding, rate, rssi = 0, noise = 0, type;
5770 	uint16_t phytype, phystat0, phystat3, chanstat;
5771 	unsigned char *mp = mtod(m, unsigned char *);
5772 	static int rx_mac_dec_rpt = 0;
5773 
5774 	BWN_ASSERT_LOCKED(sc);
5775 
5776 	phystat0 = le16toh(rxhdr->phy_status0);
5777 
5778 	/*
5779 	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5780 	 * used for LP-PHY.
5781 	 */
5782 	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5783 
5784 	switch (mac->mac_fw.fw_hdr_format) {
5785 	case BWN_FW_HDR_351:
5786 	case BWN_FW_HDR_410:
5787 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5788 		chanstat = le16toh(rxhdr->ps4.r351.channel);
5789 		break;
5790 	case BWN_FW_HDR_598:
5791 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5792 		chanstat = le16toh(rxhdr->ps4.r598.channel);
5793 		break;
5794 	}
5795 
5796 
5797 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5798 
5799 	if (macstat & BWN_RX_MAC_FCSERR)
5800 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5801 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5802 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5803 	if (macstat & BWN_RX_MAC_DECERR)
5804 		goto drop;
5805 
5806 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5807 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5808 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5809 		    m->m_pkthdr.len);
5810 		goto drop;
5811 	}
5812 	plcp = (struct bwn_plcp6 *)(mp + padding);
5813 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5814 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5815 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5816 		    m->m_pkthdr.len);
5817 		goto drop;
5818 	}
5819 	wh = mtod(m, struct ieee80211_frame_min *);
5820 
5821 	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5822 		device_printf(sc->sc_dev,
5823 		    "RX decryption attempted (old %d keyidx %#x)\n",
5824 		    BWN_ISOLDFMT(mac),
5825 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5826 
5827 	if (phystat0 & BWN_RX_PHYST0_OFDM)
5828 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5829 		    phytype == BWN_PHYTYPE_A);
5830 	else
5831 		rate = bwn_plcp_get_cckrate(mac, plcp);
5832 	if (rate == -1) {
5833 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5834 			goto drop;
5835 	}
5836 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5837 
5838 	/* rssi/noise */
5839 	switch (phytype) {
5840 	case BWN_PHYTYPE_A:
5841 	case BWN_PHYTYPE_B:
5842 	case BWN_PHYTYPE_G:
5843 	case BWN_PHYTYPE_LP:
5844 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5845 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5846 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5847 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5848 		break;
5849 	case BWN_PHYTYPE_N:
5850 		/* Broadcom has code for min/avg, but always used max */
5851 		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5852 			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5853 		else
5854 			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5855 #if 0
5856 		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5857 		    "%s: power0=%d, power1=%d, power2=%d\n",
5858 		    __func__,
5859 		    rxhdr->phy.n.power0,
5860 		    rxhdr->phy.n.power1,
5861 		    rxhdr->ps2.n.power2);
5862 #endif
5863 		break;
5864 	default:
5865 		/* XXX TODO: implement rssi for other PHYs */
5866 		break;
5867 	}
5868 
5869 	/*
5870 	 * RSSI here is absolute, not relative to the noise floor.
5871 	 */
5872 	noise = mac->mac_stats.link_noise;
5873 	rssi = rssi - noise;
5874 
5875 	/* RX radio tap */
5876 	if (ieee80211_radiotap_active(ic))
5877 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5878 	m_adj(m, -IEEE80211_CRC_LEN);
5879 
5880 	BWN_UNLOCK(sc);
5881 
5882 	ni = ieee80211_find_rxnode(ic, wh);
5883 	if (ni != NULL) {
5884 		type = ieee80211_input(ni, m, rssi, noise);
5885 		ieee80211_free_node(ni);
5886 	} else
5887 		type = ieee80211_input_all(ic, m, rssi, noise);
5888 
5889 	BWN_LOCK(sc);
5890 	return;
5891 drop:
5892 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5893 }
5894 
5895 static void
5896 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
5897     const struct bwn_txstatus *status)
5898 {
5899 	struct ieee80211_ratectl_tx_status txs;
5900 	int retrycnt = 0;
5901 
5902 	/*
5903 	 * If we don't get an ACK, then we should log the
5904 	 * full framecnt.  That may be 0 if it's a PHY
5905 	 * failure, so ensure that gets logged as some
5906 	 * retry attempt.
5907 	 */
5908 	txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
5909 	if (status->ack) {
5910 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
5911 		retrycnt = status->framecnt - 1;
5912 	} else {
5913 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
5914 		retrycnt = status->framecnt;
5915 		if (retrycnt == 0)
5916 			retrycnt = 1;
5917 	}
5918 	txs.long_retries = retrycnt;
5919 	ieee80211_ratectl_tx_complete(ni, &txs);
5920 }
5921 
5922 static void
5923 bwn_dma_handle_txeof(struct bwn_mac *mac,
5924     const struct bwn_txstatus *status)
5925 {
5926 	struct bwn_dma *dma = &mac->mac_method.dma;
5927 	struct bwn_dma_ring *dr;
5928 	struct bwn_dmadesc_generic *desc;
5929 	struct bwn_dmadesc_meta *meta;
5930 	struct bwn_softc *sc = mac->mac_sc;
5931 	int slot;
5932 
5933 	BWN_ASSERT_LOCKED(sc);
5934 
5935 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5936 	if (dr == NULL) {
5937 		device_printf(sc->sc_dev, "failed to parse cookie\n");
5938 		return;
5939 	}
5940 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5941 
5942 	while (1) {
5943 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5944 		    ("%s:%d: fail", __func__, __LINE__));
5945 		dr->getdesc(dr, slot, &desc, &meta);
5946 
5947 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5948 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5949 		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5950 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5951 
5952 		if (meta->mt_islast) {
5953 			KASSERT(meta->mt_m != NULL,
5954 			    ("%s:%d: fail", __func__, __LINE__));
5955 
5956 			bwn_ratectl_tx_complete(meta->mt_ni, status);
5957 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5958 			meta->mt_ni = NULL;
5959 			meta->mt_m = NULL;
5960 		} else
5961 			KASSERT(meta->mt_m == NULL,
5962 			    ("%s:%d: fail", __func__, __LINE__));
5963 
5964 		dr->dr_usedslot--;
5965 		if (meta->mt_islast)
5966 			break;
5967 		slot = bwn_dma_nextslot(dr, slot);
5968 	}
5969 	sc->sc_watchdog_timer = 0;
5970 	if (dr->dr_stop) {
5971 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5972 		    ("%s:%d: fail", __func__, __LINE__));
5973 		dr->dr_stop = 0;
5974 	}
5975 }
5976 
5977 static void
5978 bwn_pio_handle_txeof(struct bwn_mac *mac,
5979     const struct bwn_txstatus *status)
5980 {
5981 	struct bwn_pio_txqueue *tq;
5982 	struct bwn_pio_txpkt *tp = NULL;
5983 	struct bwn_softc *sc = mac->mac_sc;
5984 
5985 	BWN_ASSERT_LOCKED(sc);
5986 
5987 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5988 	if (tq == NULL)
5989 		return;
5990 
5991 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5992 	tq->tq_free++;
5993 
5994 	/* XXX ieee80211_tx_complete()? */
5995 	if (tp->tp_ni != NULL) {
5996 		/*
5997 		 * Do any tx complete callback.  Note this must
5998 		 * be done before releasing the node reference.
5999 		 */
6000 
6001 		bwn_ratectl_tx_complete(tp->tp_ni, status);
6002 		if (tp->tp_m->m_flags & M_TXCB)
6003 			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6004 		ieee80211_free_node(tp->tp_ni);
6005 		tp->tp_ni = NULL;
6006 	}
6007 	m_freem(tp->tp_m);
6008 	tp->tp_m = NULL;
6009 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6010 
6011 	sc->sc_watchdog_timer = 0;
6012 }
6013 
6014 static void
6015 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6016 {
6017 	struct bwn_softc *sc = mac->mac_sc;
6018 	struct bwn_phy *phy = &mac->mac_phy;
6019 	struct ieee80211com *ic = &sc->sc_ic;
6020 	unsigned long now;
6021 	bwn_txpwr_result_t result;
6022 
6023 	BWN_GETTIME(now);
6024 
6025 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6026 		return;
6027 	phy->nexttime = now + 2 * 1000;
6028 
6029 	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6030 	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6031 		return;
6032 
6033 	if (phy->recalc_txpwr != NULL) {
6034 		result = phy->recalc_txpwr(mac,
6035 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6036 		if (result == BWN_TXPWR_RES_DONE)
6037 			return;
6038 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6039 		    ("%s: fail", __func__));
6040 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6041 
6042 		ieee80211_runtask(ic, &mac->mac_txpower);
6043 	}
6044 }
6045 
6046 static uint16_t
6047 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6048 {
6049 
6050 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6051 }
6052 
6053 static uint32_t
6054 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6055 {
6056 
6057 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6058 }
6059 
6060 static void
6061 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6062 {
6063 
6064 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6065 }
6066 
6067 static void
6068 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6069 {
6070 
6071 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6072 }
6073 
6074 static int
6075 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6076 {
6077 
6078 	switch (rate) {
6079 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6080 	case 12:
6081 		return (BWN_OFDM_RATE_6MB);
6082 	case 18:
6083 		return (BWN_OFDM_RATE_9MB);
6084 	case 24:
6085 		return (BWN_OFDM_RATE_12MB);
6086 	case 36:
6087 		return (BWN_OFDM_RATE_18MB);
6088 	case 48:
6089 		return (BWN_OFDM_RATE_24MB);
6090 	case 72:
6091 		return (BWN_OFDM_RATE_36MB);
6092 	case 96:
6093 		return (BWN_OFDM_RATE_48MB);
6094 	case 108:
6095 		return (BWN_OFDM_RATE_54MB);
6096 	/* CCK rates (NB: not IEEE std, device-specific) */
6097 	case 2:
6098 		return (BWN_CCK_RATE_1MB);
6099 	case 4:
6100 		return (BWN_CCK_RATE_2MB);
6101 	case 11:
6102 		return (BWN_CCK_RATE_5MB);
6103 	case 22:
6104 		return (BWN_CCK_RATE_11MB);
6105 	}
6106 
6107 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6108 	return (BWN_CCK_RATE_1MB);
6109 }
6110 
6111 static uint16_t
6112 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6113 {
6114 	struct bwn_phy *phy = &mac->mac_phy;
6115 	uint16_t control = 0;
6116 	uint16_t bw;
6117 
6118 	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6119 	bw = BWN_TXH_PHY1_BW_20;
6120 
6121 	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6122 		control = bw;
6123 	} else {
6124 		control = bw;
6125 		/* Figure out coding rate and modulation */
6126 		/* XXX TODO: table-ize, for MCS transmit */
6127 		/* Note: this is BWN_*_RATE values */
6128 		switch (bitrate) {
6129 		case BWN_CCK_RATE_1MB:
6130 			control |= 0;
6131 			break;
6132 		case BWN_CCK_RATE_2MB:
6133 			control |= 1;
6134 			break;
6135 		case BWN_CCK_RATE_5MB:
6136 			control |= 2;
6137 			break;
6138 		case BWN_CCK_RATE_11MB:
6139 			control |= 3;
6140 			break;
6141 		case BWN_OFDM_RATE_6MB:
6142 			control |= BWN_TXH_PHY1_CRATE_1_2;
6143 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6144 			break;
6145 		case BWN_OFDM_RATE_9MB:
6146 			control |= BWN_TXH_PHY1_CRATE_3_4;
6147 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6148 			break;
6149 		case BWN_OFDM_RATE_12MB:
6150 			control |= BWN_TXH_PHY1_CRATE_1_2;
6151 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6152 			break;
6153 		case BWN_OFDM_RATE_18MB:
6154 			control |= BWN_TXH_PHY1_CRATE_3_4;
6155 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6156 			break;
6157 		case BWN_OFDM_RATE_24MB:
6158 			control |= BWN_TXH_PHY1_CRATE_1_2;
6159 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6160 			break;
6161 		case BWN_OFDM_RATE_36MB:
6162 			control |= BWN_TXH_PHY1_CRATE_3_4;
6163 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6164 			break;
6165 		case BWN_OFDM_RATE_48MB:
6166 			control |= BWN_TXH_PHY1_CRATE_1_2;
6167 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6168 			break;
6169 		case BWN_OFDM_RATE_54MB:
6170 			control |= BWN_TXH_PHY1_CRATE_3_4;
6171 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6172 			break;
6173 		default:
6174 			break;
6175 		}
6176 		control |= BWN_TXH_PHY1_MODE_SISO;
6177 	}
6178 
6179 	return control;
6180 }
6181 
6182 static int
6183 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6184     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6185 {
6186 	const struct bwn_phy *phy = &mac->mac_phy;
6187 	struct bwn_softc *sc = mac->mac_sc;
6188 	struct ieee80211_frame *wh;
6189 	struct ieee80211_frame *protwh;
6190 	struct ieee80211_frame_cts *cts;
6191 	struct ieee80211_frame_rts *rts;
6192 	const struct ieee80211_txparam *tp = ni->ni_txparms;
6193 	struct ieee80211vap *vap = ni->ni_vap;
6194 	struct ieee80211com *ic = &sc->sc_ic;
6195 	struct mbuf *mprot;
6196 	unsigned int len;
6197 	uint32_t macctl = 0;
6198 	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6199 	uint16_t phyctl = 0;
6200 	uint8_t rate, rate_fb;
6201 	int fill_phy_ctl1 = 0;
6202 
6203 	wh = mtod(m, struct ieee80211_frame *);
6204 	memset(txhdr, 0, sizeof(*txhdr));
6205 
6206 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6207 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6208 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6209 
6210 	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6211 	    || (phy->type == BWN_PHYTYPE_HT))
6212 		fill_phy_ctl1 = 1;
6213 
6214 	/*
6215 	 * Find TX rate
6216 	 */
6217 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6218 		rate = rate_fb = tp->mgmtrate;
6219 	else if (ismcast)
6220 		rate = rate_fb = tp->mcastrate;
6221 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6222 		rate = rate_fb = tp->ucastrate;
6223 	else {
6224 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6225 		rate = ni->ni_txrate;
6226 
6227 		if (rix > 0)
6228 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6229 			    IEEE80211_RATE_VAL;
6230 		else
6231 			rate_fb = rate;
6232 	}
6233 
6234 	sc->sc_tx_rate = rate;
6235 
6236 	/* Note: this maps the select ieee80211 rate to hardware rate */
6237 	rate = bwn_ieeerate2hwrate(sc, rate);
6238 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6239 
6240 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6241 	    bwn_plcp_getcck(rate);
6242 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6243 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6244 
6245 	/* XXX rate/rate_fb is the hardware rate */
6246 	if ((rate_fb == rate) ||
6247 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6248 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6249 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6250 	else
6251 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6252 		    m->m_pkthdr.len, rate, isshort);
6253 
6254 	/* XXX TX encryption */
6255 
6256 	switch (mac->mac_fw.fw_hdr_format) {
6257 	case BWN_FW_HDR_351:
6258 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6259 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6260 		break;
6261 	case BWN_FW_HDR_410:
6262 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6263 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6264 		break;
6265 	case BWN_FW_HDR_598:
6266 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6267 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6268 		break;
6269 	}
6270 
6271 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6272 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6273 
6274 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6275 	    BWN_TX_EFT_FB_CCK;
6276 	txhdr->chan = phy->chan;
6277 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6278 	    BWN_TX_PHY_ENC_CCK;
6279 	/* XXX preamble? obey net80211 */
6280 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6281 	     rate == BWN_CCK_RATE_11MB))
6282 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6283 
6284 	if (! phy->gmode)
6285 		macctl |= BWN_TX_MAC_5GHZ;
6286 
6287 	/* XXX TX antenna selection */
6288 
6289 	switch (bwn_antenna_sanitize(mac, 0)) {
6290 	case 0:
6291 		phyctl |= BWN_TX_PHY_ANT01AUTO;
6292 		break;
6293 	case 1:
6294 		phyctl |= BWN_TX_PHY_ANT0;
6295 		break;
6296 	case 2:
6297 		phyctl |= BWN_TX_PHY_ANT1;
6298 		break;
6299 	case 3:
6300 		phyctl |= BWN_TX_PHY_ANT2;
6301 		break;
6302 	case 4:
6303 		phyctl |= BWN_TX_PHY_ANT3;
6304 		break;
6305 	default:
6306 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6307 	}
6308 
6309 	if (!ismcast)
6310 		macctl |= BWN_TX_MAC_ACK;
6311 
6312 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6313 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6314 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6315 		macctl |= BWN_TX_MAC_LONGFRAME;
6316 
6317 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6318 		/* Note: don't fall back to CCK rates for 5G */
6319 		if (phy->gmode)
6320 			rts_rate = BWN_CCK_RATE_1MB;
6321 		else
6322 			rts_rate = BWN_OFDM_RATE_6MB;
6323 		rts_rate_fb = bwn_get_fbrate(rts_rate);
6324 
6325 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6326 		protdur = ieee80211_compute_duration(ic->ic_rt,
6327 		    m->m_pkthdr.len, rate, isshort) +
6328 		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6329 
6330 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6331 
6332 			switch (mac->mac_fw.fw_hdr_format) {
6333 			case BWN_FW_HDR_351:
6334 				cts = (struct ieee80211_frame_cts *)
6335 				    txhdr->body.r351.rts_frame;
6336 				break;
6337 			case BWN_FW_HDR_410:
6338 				cts = (struct ieee80211_frame_cts *)
6339 				    txhdr->body.r410.rts_frame;
6340 				break;
6341 			case BWN_FW_HDR_598:
6342 				cts = (struct ieee80211_frame_cts *)
6343 				    txhdr->body.r598.rts_frame;
6344 				break;
6345 			}
6346 
6347 			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6348 			    protdur);
6349 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6350 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6351 			    mprot->m_pkthdr.len);
6352 			m_freem(mprot);
6353 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6354 			len = sizeof(struct ieee80211_frame_cts);
6355 		} else {
6356 			switch (mac->mac_fw.fw_hdr_format) {
6357 			case BWN_FW_HDR_351:
6358 				rts = (struct ieee80211_frame_rts *)
6359 				    txhdr->body.r351.rts_frame;
6360 				break;
6361 			case BWN_FW_HDR_410:
6362 				rts = (struct ieee80211_frame_rts *)
6363 				    txhdr->body.r410.rts_frame;
6364 				break;
6365 			case BWN_FW_HDR_598:
6366 				rts = (struct ieee80211_frame_rts *)
6367 				    txhdr->body.r598.rts_frame;
6368 				break;
6369 			}
6370 
6371 			/* XXX rate/rate_fb is the hardware rate */
6372 			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6373 			    isshort);
6374 			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6375 			    wh->i_addr2, protdur);
6376 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6377 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6378 			    mprot->m_pkthdr.len);
6379 			m_freem(mprot);
6380 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6381 			len = sizeof(struct ieee80211_frame_rts);
6382 		}
6383 		len += IEEE80211_CRC_LEN;
6384 
6385 		switch (mac->mac_fw.fw_hdr_format) {
6386 		case BWN_FW_HDR_351:
6387 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6388 			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6389 			break;
6390 		case BWN_FW_HDR_410:
6391 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6392 			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6393 			break;
6394 		case BWN_FW_HDR_598:
6395 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6396 			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6397 			break;
6398 		}
6399 
6400 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6401 		    rts_rate_fb);
6402 
6403 		switch (mac->mac_fw.fw_hdr_format) {
6404 		case BWN_FW_HDR_351:
6405 			protwh = (struct ieee80211_frame *)
6406 			    &txhdr->body.r351.rts_frame;
6407 			break;
6408 		case BWN_FW_HDR_410:
6409 			protwh = (struct ieee80211_frame *)
6410 			    &txhdr->body.r410.rts_frame;
6411 			break;
6412 		case BWN_FW_HDR_598:
6413 			protwh = (struct ieee80211_frame *)
6414 			    &txhdr->body.r598.rts_frame;
6415 			break;
6416 		}
6417 
6418 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6419 
6420 		if (BWN_ISOFDMRATE(rts_rate)) {
6421 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6422 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6423 		} else {
6424 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6425 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6426 		}
6427 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6428 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6429 
6430 		if (fill_phy_ctl1) {
6431 			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6432 			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6433 		}
6434 	}
6435 
6436 	if (fill_phy_ctl1) {
6437 		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6438 		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6439 	}
6440 
6441 	switch (mac->mac_fw.fw_hdr_format) {
6442 	case BWN_FW_HDR_351:
6443 		txhdr->body.r351.cookie = htole16(cookie);
6444 		break;
6445 	case BWN_FW_HDR_410:
6446 		txhdr->body.r410.cookie = htole16(cookie);
6447 		break;
6448 	case BWN_FW_HDR_598:
6449 		txhdr->body.r598.cookie = htole16(cookie);
6450 		break;
6451 	}
6452 
6453 	txhdr->macctl = htole32(macctl);
6454 	txhdr->phyctl = htole16(phyctl);
6455 
6456 	/*
6457 	 * TX radio tap
6458 	 */
6459 	if (ieee80211_radiotap_active_vap(vap)) {
6460 		sc->sc_tx_th.wt_flags = 0;
6461 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6462 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6463 		if (isshort &&
6464 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6465 		     rate == BWN_CCK_RATE_11MB))
6466 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6467 		sc->sc_tx_th.wt_rate = rate;
6468 
6469 		ieee80211_radiotap_tx(vap, m);
6470 	}
6471 
6472 	return (0);
6473 }
6474 
6475 static void
6476 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6477     const uint8_t rate)
6478 {
6479 	uint32_t d, plen;
6480 	uint8_t *raw = plcp->o.raw;
6481 
6482 	if (BWN_ISOFDMRATE(rate)) {
6483 		d = bwn_plcp_getofdm(rate);
6484 		KASSERT(!(octets & 0xf000),
6485 		    ("%s:%d: fail", __func__, __LINE__));
6486 		d |= (octets << 5);
6487 		plcp->o.data = htole32(d);
6488 	} else {
6489 		plen = octets * 16 / rate;
6490 		if ((octets * 16 % rate) > 0) {
6491 			plen++;
6492 			if ((rate == BWN_CCK_RATE_11MB)
6493 			    && ((octets * 8 % 11) < 4)) {
6494 				raw[1] = 0x84;
6495 			} else
6496 				raw[1] = 0x04;
6497 		} else
6498 			raw[1] = 0x04;
6499 		plcp->o.data |= htole32(plen << 16);
6500 		raw[0] = bwn_plcp_getcck(rate);
6501 	}
6502 }
6503 
6504 static uint8_t
6505 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6506 {
6507 	struct bwn_softc *sc = mac->mac_sc;
6508 	uint8_t mask;
6509 
6510 	if (n == 0)
6511 		return (0);
6512 	if (mac->mac_phy.gmode)
6513 		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6514 	else
6515 		mask = siba_sprom_get_ant_a(sc->sc_dev);
6516 	if (!(mask & (1 << (n - 1))))
6517 		return (0);
6518 	return (n);
6519 }
6520 
6521 /*
6522  * Return a fallback rate for the given rate.
6523  *
6524  * Note: Don't fall back from OFDM to CCK.
6525  */
6526 static uint8_t
6527 bwn_get_fbrate(uint8_t bitrate)
6528 {
6529 	switch (bitrate) {
6530 	/* CCK */
6531 	case BWN_CCK_RATE_1MB:
6532 		return (BWN_CCK_RATE_1MB);
6533 	case BWN_CCK_RATE_2MB:
6534 		return (BWN_CCK_RATE_1MB);
6535 	case BWN_CCK_RATE_5MB:
6536 		return (BWN_CCK_RATE_2MB);
6537 	case BWN_CCK_RATE_11MB:
6538 		return (BWN_CCK_RATE_5MB);
6539 
6540 	/* OFDM */
6541 	case BWN_OFDM_RATE_6MB:
6542 		return (BWN_OFDM_RATE_6MB);
6543 	case BWN_OFDM_RATE_9MB:
6544 		return (BWN_OFDM_RATE_6MB);
6545 	case BWN_OFDM_RATE_12MB:
6546 		return (BWN_OFDM_RATE_9MB);
6547 	case BWN_OFDM_RATE_18MB:
6548 		return (BWN_OFDM_RATE_12MB);
6549 	case BWN_OFDM_RATE_24MB:
6550 		return (BWN_OFDM_RATE_18MB);
6551 	case BWN_OFDM_RATE_36MB:
6552 		return (BWN_OFDM_RATE_24MB);
6553 	case BWN_OFDM_RATE_48MB:
6554 		return (BWN_OFDM_RATE_36MB);
6555 	case BWN_OFDM_RATE_54MB:
6556 		return (BWN_OFDM_RATE_48MB);
6557 	}
6558 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6559 	return (0);
6560 }
6561 
6562 static uint32_t
6563 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6564     uint32_t ctl, const void *_data, int len)
6565 {
6566 	struct bwn_softc *sc = mac->mac_sc;
6567 	uint32_t value = 0;
6568 	const uint8_t *data = _data;
6569 
6570 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6571 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6572 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6573 
6574 	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6575 	    tq->tq_base + BWN_PIO8_TXDATA);
6576 	if (len & 3) {
6577 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6578 		    BWN_PIO8_TXCTL_24_31);
6579 		data = &(data[len - 1]);
6580 		switch (len & 3) {
6581 		case 3:
6582 			ctl |= BWN_PIO8_TXCTL_16_23;
6583 			value |= (uint32_t)(*data) << 16;
6584 			data--;
6585 		case 2:
6586 			ctl |= BWN_PIO8_TXCTL_8_15;
6587 			value |= (uint32_t)(*data) << 8;
6588 			data--;
6589 		case 1:
6590 			value |= (uint32_t)(*data);
6591 		}
6592 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6593 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6594 	}
6595 
6596 	return (ctl);
6597 }
6598 
6599 static void
6600 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6601     uint16_t offset, uint32_t value)
6602 {
6603 
6604 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6605 }
6606 
6607 static uint16_t
6608 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6609     uint16_t ctl, const void *_data, int len)
6610 {
6611 	struct bwn_softc *sc = mac->mac_sc;
6612 	const uint8_t *data = _data;
6613 
6614 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6615 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6616 
6617 	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6618 	    tq->tq_base + BWN_PIO_TXDATA);
6619 	if (len & 1) {
6620 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6621 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6622 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6623 	}
6624 
6625 	return (ctl);
6626 }
6627 
6628 static uint16_t
6629 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6630     uint16_t ctl, struct mbuf *m0)
6631 {
6632 	int i, j = 0;
6633 	uint16_t data = 0;
6634 	const uint8_t *buf;
6635 	struct mbuf *m = m0;
6636 
6637 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6638 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6639 
6640 	for (; m != NULL; m = m->m_next) {
6641 		buf = mtod(m, const uint8_t *);
6642 		for (i = 0; i < m->m_len; i++) {
6643 			if (!((j++) % 2))
6644 				data |= buf[i];
6645 			else {
6646 				data |= (buf[i] << 8);
6647 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6648 				data = 0;
6649 			}
6650 		}
6651 	}
6652 	if (m0->m_pkthdr.len % 2) {
6653 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6654 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6655 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6656 	}
6657 
6658 	return (ctl);
6659 }
6660 
6661 static void
6662 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6663 {
6664 
6665 	/* XXX should exit if 5GHz band .. */
6666 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6667 		return;
6668 
6669 	BWN_WRITE_2(mac, 0x684, 510 + time);
6670 	/* Disabled in Linux b43, can adversely effect performance */
6671 #if 0
6672 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6673 #endif
6674 }
6675 
6676 static struct bwn_dma_ring *
6677 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6678 {
6679 
6680 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6681 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6682 
6683 	switch (prio) {
6684 	case 3:
6685 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6686 	case 2:
6687 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6688 	case 0:
6689 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6690 	case 1:
6691 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6692 	}
6693 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6694 	return (NULL);
6695 }
6696 
6697 static int
6698 bwn_dma_getslot(struct bwn_dma_ring *dr)
6699 {
6700 	int slot;
6701 
6702 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6703 
6704 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6705 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6706 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6707 
6708 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6709 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6710 	dr->dr_curslot = slot;
6711 	dr->dr_usedslot++;
6712 
6713 	return (slot);
6714 }
6715 
6716 static struct bwn_pio_txqueue *
6717 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6718     struct bwn_pio_txpkt **pack)
6719 {
6720 	struct bwn_pio *pio = &mac->mac_method.pio;
6721 	struct bwn_pio_txqueue *tq = NULL;
6722 	unsigned int index;
6723 
6724 	switch (cookie & 0xf000) {
6725 	case 0x1000:
6726 		tq = &pio->wme[WME_AC_BK];
6727 		break;
6728 	case 0x2000:
6729 		tq = &pio->wme[WME_AC_BE];
6730 		break;
6731 	case 0x3000:
6732 		tq = &pio->wme[WME_AC_VI];
6733 		break;
6734 	case 0x4000:
6735 		tq = &pio->wme[WME_AC_VO];
6736 		break;
6737 	case 0x5000:
6738 		tq = &pio->mcast;
6739 		break;
6740 	}
6741 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6742 	if (tq == NULL)
6743 		return (NULL);
6744 	index = (cookie & 0x0fff);
6745 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6746 	if (index >= N(tq->tq_pkts))
6747 		return (NULL);
6748 	*pack = &tq->tq_pkts[index];
6749 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6750 	return (tq);
6751 }
6752 
6753 static void
6754 bwn_txpwr(void *arg, int npending)
6755 {
6756 	struct bwn_mac *mac = arg;
6757 	struct bwn_softc *sc;
6758 
6759 	if (mac == NULL)
6760 		return;
6761 
6762 	sc = mac->mac_sc;
6763 
6764 	BWN_LOCK(sc);
6765 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6766 	    mac->mac_phy.set_txpwr != NULL)
6767 		mac->mac_phy.set_txpwr(mac);
6768 	BWN_UNLOCK(sc);
6769 }
6770 
6771 static void
6772 bwn_task_15s(struct bwn_mac *mac)
6773 {
6774 	uint16_t reg;
6775 
6776 	if (mac->mac_fw.opensource) {
6777 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6778 		if (reg) {
6779 			bwn_restart(mac, "fw watchdog");
6780 			return;
6781 		}
6782 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6783 	}
6784 	if (mac->mac_phy.task_15s)
6785 		mac->mac_phy.task_15s(mac);
6786 
6787 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6788 }
6789 
6790 static void
6791 bwn_task_30s(struct bwn_mac *mac)
6792 {
6793 
6794 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6795 		return;
6796 	mac->mac_noise.noi_running = 1;
6797 	mac->mac_noise.noi_nsamples = 0;
6798 
6799 	bwn_noise_gensample(mac);
6800 }
6801 
6802 static void
6803 bwn_task_60s(struct bwn_mac *mac)
6804 {
6805 
6806 	if (mac->mac_phy.task_60s)
6807 		mac->mac_phy.task_60s(mac);
6808 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6809 }
6810 
6811 static void
6812 bwn_tasks(void *arg)
6813 {
6814 	struct bwn_mac *mac = arg;
6815 	struct bwn_softc *sc = mac->mac_sc;
6816 
6817 	BWN_ASSERT_LOCKED(sc);
6818 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6819 		return;
6820 
6821 	if (mac->mac_task_state % 4 == 0)
6822 		bwn_task_60s(mac);
6823 	if (mac->mac_task_state % 2 == 0)
6824 		bwn_task_30s(mac);
6825 	bwn_task_15s(mac);
6826 
6827 	mac->mac_task_state++;
6828 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6829 }
6830 
6831 static int
6832 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6833 {
6834 	struct bwn_softc *sc = mac->mac_sc;
6835 
6836 	KASSERT(a == 0, ("not support APHY\n"));
6837 
6838 	switch (plcp->o.raw[0] & 0xf) {
6839 	case 0xb:
6840 		return (BWN_OFDM_RATE_6MB);
6841 	case 0xf:
6842 		return (BWN_OFDM_RATE_9MB);
6843 	case 0xa:
6844 		return (BWN_OFDM_RATE_12MB);
6845 	case 0xe:
6846 		return (BWN_OFDM_RATE_18MB);
6847 	case 0x9:
6848 		return (BWN_OFDM_RATE_24MB);
6849 	case 0xd:
6850 		return (BWN_OFDM_RATE_36MB);
6851 	case 0x8:
6852 		return (BWN_OFDM_RATE_48MB);
6853 	case 0xc:
6854 		return (BWN_OFDM_RATE_54MB);
6855 	}
6856 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6857 	    plcp->o.raw[0] & 0xf);
6858 	return (-1);
6859 }
6860 
6861 static int
6862 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6863 {
6864 	struct bwn_softc *sc = mac->mac_sc;
6865 
6866 	switch (plcp->o.raw[0]) {
6867 	case 0x0a:
6868 		return (BWN_CCK_RATE_1MB);
6869 	case 0x14:
6870 		return (BWN_CCK_RATE_2MB);
6871 	case 0x37:
6872 		return (BWN_CCK_RATE_5MB);
6873 	case 0x6e:
6874 		return (BWN_CCK_RATE_11MB);
6875 	}
6876 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6877 	return (-1);
6878 }
6879 
6880 static void
6881 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6882     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6883     int rssi, int noise)
6884 {
6885 	struct bwn_softc *sc = mac->mac_sc;
6886 	const struct ieee80211_frame_min *wh;
6887 	uint64_t tsf;
6888 	uint16_t low_mactime_now;
6889 	uint16_t mt;
6890 
6891 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6892 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6893 
6894 	wh = mtod(m, const struct ieee80211_frame_min *);
6895 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6896 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6897 
6898 	bwn_tsf_read(mac, &tsf);
6899 	low_mactime_now = tsf;
6900 	tsf = tsf & ~0xffffULL;
6901 
6902 	switch (mac->mac_fw.fw_hdr_format) {
6903 	case BWN_FW_HDR_351:
6904 	case BWN_FW_HDR_410:
6905 		mt = le16toh(rxhdr->ps4.r351.mac_time);
6906 		break;
6907 	case BWN_FW_HDR_598:
6908 		mt = le16toh(rxhdr->ps4.r598.mac_time);
6909 		break;
6910 	}
6911 
6912 	tsf += mt;
6913 	if (low_mactime_now < mt)
6914 		tsf -= 0x10000;
6915 
6916 	sc->sc_rx_th.wr_tsf = tsf;
6917 	sc->sc_rx_th.wr_rate = rate;
6918 	sc->sc_rx_th.wr_antsignal = rssi;
6919 	sc->sc_rx_th.wr_antnoise = noise;
6920 }
6921 
6922 static void
6923 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6924 {
6925 	uint32_t low, high;
6926 
6927 	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6928 	    ("%s:%d: fail", __func__, __LINE__));
6929 
6930 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6931 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6932 	*tsf = high;
6933 	*tsf <<= 32;
6934 	*tsf |= low;
6935 }
6936 
6937 static int
6938 bwn_dma_attach(struct bwn_mac *mac)
6939 {
6940 	struct bwn_dma *dma = &mac->mac_method.dma;
6941 	struct bwn_softc *sc = mac->mac_sc;
6942 	bus_addr_t lowaddr = 0;
6943 	int error;
6944 
6945 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6946 		return (0);
6947 
6948 	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6949 
6950 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6951 
6952 	dma->dmatype = bwn_dma_gettype(mac);
6953 	if (dma->dmatype == BWN_DMA_30BIT)
6954 		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6955 	else if (dma->dmatype == BWN_DMA_32BIT)
6956 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6957 	else
6958 		lowaddr = BUS_SPACE_MAXADDR;
6959 
6960 	/*
6961 	 * Create top level DMA tag
6962 	 */
6963 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6964 			       BWN_ALIGN, 0,		/* alignment, bounds */
6965 			       lowaddr,			/* lowaddr */
6966 			       BUS_SPACE_MAXADDR,	/* highaddr */
6967 			       NULL, NULL,		/* filter, filterarg */
6968 			       BUS_SPACE_MAXSIZE,	/* maxsize */
6969 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6970 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6971 			       0,			/* flags */
6972 			       NULL, NULL,		/* lockfunc, lockarg */
6973 			       &dma->parent_dtag);
6974 	if (error) {
6975 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6976 		return (error);
6977 	}
6978 
6979 	/*
6980 	 * Create TX/RX mbuf DMA tag
6981 	 */
6982 	error = bus_dma_tag_create(dma->parent_dtag,
6983 				1,
6984 				0,
6985 				BUS_SPACE_MAXADDR,
6986 				BUS_SPACE_MAXADDR,
6987 				NULL, NULL,
6988 				MCLBYTES,
6989 				1,
6990 				BUS_SPACE_MAXSIZE_32BIT,
6991 				0,
6992 				NULL, NULL,
6993 				&dma->rxbuf_dtag);
6994 	if (error) {
6995 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6996 		goto fail0;
6997 	}
6998 	error = bus_dma_tag_create(dma->parent_dtag,
6999 				1,
7000 				0,
7001 				BUS_SPACE_MAXADDR,
7002 				BUS_SPACE_MAXADDR,
7003 				NULL, NULL,
7004 				MCLBYTES,
7005 				1,
7006 				BUS_SPACE_MAXSIZE_32BIT,
7007 				0,
7008 				NULL, NULL,
7009 				&dma->txbuf_dtag);
7010 	if (error) {
7011 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7012 		goto fail1;
7013 	}
7014 
7015 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7016 	if (!dma->wme[WME_AC_BK])
7017 		goto fail2;
7018 
7019 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7020 	if (!dma->wme[WME_AC_BE])
7021 		goto fail3;
7022 
7023 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7024 	if (!dma->wme[WME_AC_VI])
7025 		goto fail4;
7026 
7027 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7028 	if (!dma->wme[WME_AC_VO])
7029 		goto fail5;
7030 
7031 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7032 	if (!dma->mcast)
7033 		goto fail6;
7034 	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7035 	if (!dma->rx)
7036 		goto fail7;
7037 
7038 	return (error);
7039 
7040 fail7:	bwn_dma_ringfree(&dma->mcast);
7041 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7042 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7043 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7044 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7045 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7046 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7047 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7048 	return (error);
7049 }
7050 
7051 static struct bwn_dma_ring *
7052 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7053     uint16_t cookie, int *slot)
7054 {
7055 	struct bwn_dma *dma = &mac->mac_method.dma;
7056 	struct bwn_dma_ring *dr;
7057 	struct bwn_softc *sc = mac->mac_sc;
7058 
7059 	BWN_ASSERT_LOCKED(mac->mac_sc);
7060 
7061 	switch (cookie & 0xf000) {
7062 	case 0x1000:
7063 		dr = dma->wme[WME_AC_BK];
7064 		break;
7065 	case 0x2000:
7066 		dr = dma->wme[WME_AC_BE];
7067 		break;
7068 	case 0x3000:
7069 		dr = dma->wme[WME_AC_VI];
7070 		break;
7071 	case 0x4000:
7072 		dr = dma->wme[WME_AC_VO];
7073 		break;
7074 	case 0x5000:
7075 		dr = dma->mcast;
7076 		break;
7077 	default:
7078 		dr = NULL;
7079 		KASSERT(0 == 1,
7080 		    ("invalid cookie value %d", cookie & 0xf000));
7081 	}
7082 	*slot = (cookie & 0x0fff);
7083 	if (*slot < 0 || *slot >= dr->dr_numslots) {
7084 		/*
7085 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7086 		 * that it occurs events which have same H/W sequence numbers.
7087 		 * When it's occurred just prints a WARNING msgs and ignores.
7088 		 */
7089 		KASSERT(status->seq == dma->lastseq,
7090 		    ("%s:%d: fail", __func__, __LINE__));
7091 		device_printf(sc->sc_dev,
7092 		    "out of slot ranges (0 < %d < %d)\n", *slot,
7093 		    dr->dr_numslots);
7094 		return (NULL);
7095 	}
7096 	dma->lastseq = status->seq;
7097 	return (dr);
7098 }
7099 
7100 static void
7101 bwn_dma_stop(struct bwn_mac *mac)
7102 {
7103 	struct bwn_dma *dma;
7104 
7105 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7106 		return;
7107 	dma = &mac->mac_method.dma;
7108 
7109 	bwn_dma_ringstop(&dma->rx);
7110 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7111 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7112 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7113 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7114 	bwn_dma_ringstop(&dma->mcast);
7115 }
7116 
7117 static void
7118 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7119 {
7120 
7121 	if (dr == NULL)
7122 		return;
7123 
7124 	bwn_dma_cleanup(*dr);
7125 }
7126 
7127 static void
7128 bwn_pio_stop(struct bwn_mac *mac)
7129 {
7130 	struct bwn_pio *pio;
7131 
7132 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7133 		return;
7134 	pio = &mac->mac_method.pio;
7135 
7136 	bwn_destroy_queue_tx(&pio->mcast);
7137 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7138 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7139 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7140 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7141 }
7142 
7143 static void
7144 bwn_led_attach(struct bwn_mac *mac)
7145 {
7146 	struct bwn_softc *sc = mac->mac_sc;
7147 	const uint8_t *led_act = NULL;
7148 	uint16_t val[BWN_LED_MAX];
7149 	int i;
7150 
7151 	sc->sc_led_idle = (2350 * hz) / 1000;
7152 	sc->sc_led_blink = 1;
7153 
7154 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7155 		if (siba_get_pci_subvendor(sc->sc_dev) ==
7156 		    bwn_vendor_led_act[i].vid) {
7157 			led_act = bwn_vendor_led_act[i].led_act;
7158 			break;
7159 		}
7160 	}
7161 	if (led_act == NULL)
7162 		led_act = bwn_default_led_act;
7163 
7164 	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7165 	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7166 	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7167 	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7168 
7169 	for (i = 0; i < BWN_LED_MAX; ++i) {
7170 		struct bwn_led *led = &sc->sc_leds[i];
7171 
7172 		if (val[i] == 0xff) {
7173 			led->led_act = led_act[i];
7174 		} else {
7175 			if (val[i] & BWN_LED_ACT_LOW)
7176 				led->led_flags |= BWN_LED_F_ACTLOW;
7177 			led->led_act = val[i] & BWN_LED_ACT_MASK;
7178 		}
7179 		led->led_mask = (1 << i);
7180 
7181 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7182 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7183 		    led->led_act == BWN_LED_ACT_BLINK) {
7184 			led->led_flags |= BWN_LED_F_BLINK;
7185 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7186 				led->led_flags |= BWN_LED_F_POLLABLE;
7187 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7188 				led->led_flags |= BWN_LED_F_SLOW;
7189 
7190 			if (sc->sc_blink_led == NULL) {
7191 				sc->sc_blink_led = led;
7192 				if (led->led_flags & BWN_LED_F_SLOW)
7193 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7194 			}
7195 		}
7196 
7197 		DPRINTF(sc, BWN_DEBUG_LED,
7198 		    "%dth led, act %d, lowact %d\n", i,
7199 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7200 	}
7201 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7202 }
7203 
7204 static __inline uint16_t
7205 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7206 {
7207 
7208 	if (led->led_flags & BWN_LED_F_ACTLOW)
7209 		on = !on;
7210 	if (on)
7211 		val |= led->led_mask;
7212 	else
7213 		val &= ~led->led_mask;
7214 	return val;
7215 }
7216 
7217 static void
7218 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7219 {
7220 	struct bwn_softc *sc = mac->mac_sc;
7221 	struct ieee80211com *ic = &sc->sc_ic;
7222 	uint16_t val;
7223 	int i;
7224 
7225 	if (nstate == IEEE80211_S_INIT) {
7226 		callout_stop(&sc->sc_led_blink_ch);
7227 		sc->sc_led_blinking = 0;
7228 	}
7229 
7230 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7231 		return;
7232 
7233 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7234 	for (i = 0; i < BWN_LED_MAX; ++i) {
7235 		struct bwn_led *led = &sc->sc_leds[i];
7236 		int on;
7237 
7238 		if (led->led_act == BWN_LED_ACT_UNKN ||
7239 		    led->led_act == BWN_LED_ACT_NULL)
7240 			continue;
7241 
7242 		if ((led->led_flags & BWN_LED_F_BLINK) &&
7243 		    nstate != IEEE80211_S_INIT)
7244 			continue;
7245 
7246 		switch (led->led_act) {
7247 		case BWN_LED_ACT_ON:    /* Always on */
7248 			on = 1;
7249 			break;
7250 		case BWN_LED_ACT_OFF:   /* Always off */
7251 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7252 			on = 0;
7253 			break;
7254 		default:
7255 			on = 1;
7256 			switch (nstate) {
7257 			case IEEE80211_S_INIT:
7258 				on = 0;
7259 				break;
7260 			case IEEE80211_S_RUN:
7261 				if (led->led_act == BWN_LED_ACT_11G &&
7262 				    ic->ic_curmode != IEEE80211_MODE_11G)
7263 					on = 0;
7264 				break;
7265 			default:
7266 				if (led->led_act == BWN_LED_ACT_ASSOC)
7267 					on = 0;
7268 				break;
7269 			}
7270 			break;
7271 		}
7272 
7273 		val = bwn_led_onoff(led, val, on);
7274 	}
7275 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7276 }
7277 
7278 static void
7279 bwn_led_event(struct bwn_mac *mac, int event)
7280 {
7281 	struct bwn_softc *sc = mac->mac_sc;
7282 	struct bwn_led *led = sc->sc_blink_led;
7283 	int rate;
7284 
7285 	if (event == BWN_LED_EVENT_POLL) {
7286 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7287 			return;
7288 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7289 			return;
7290 	}
7291 
7292 	sc->sc_led_ticks = ticks;
7293 	if (sc->sc_led_blinking)
7294 		return;
7295 
7296 	switch (event) {
7297 	case BWN_LED_EVENT_RX:
7298 		rate = sc->sc_rx_rate;
7299 		break;
7300 	case BWN_LED_EVENT_TX:
7301 		rate = sc->sc_tx_rate;
7302 		break;
7303 	case BWN_LED_EVENT_POLL:
7304 		rate = 0;
7305 		break;
7306 	default:
7307 		panic("unknown LED event %d\n", event);
7308 		break;
7309 	}
7310 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7311 	    bwn_led_duration[rate].off_dur);
7312 }
7313 
7314 static void
7315 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7316 {
7317 	struct bwn_softc *sc = mac->mac_sc;
7318 	struct bwn_led *led = sc->sc_blink_led;
7319 	uint16_t val;
7320 
7321 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7322 	val = bwn_led_onoff(led, val, 1);
7323 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7324 
7325 	if (led->led_flags & BWN_LED_F_SLOW) {
7326 		BWN_LED_SLOWDOWN(on_dur);
7327 		BWN_LED_SLOWDOWN(off_dur);
7328 	}
7329 
7330 	sc->sc_led_blinking = 1;
7331 	sc->sc_led_blink_offdur = off_dur;
7332 
7333 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7334 }
7335 
7336 static void
7337 bwn_led_blink_next(void *arg)
7338 {
7339 	struct bwn_mac *mac = arg;
7340 	struct bwn_softc *sc = mac->mac_sc;
7341 	uint16_t val;
7342 
7343 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7344 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7345 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7346 
7347 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7348 	    bwn_led_blink_end, mac);
7349 }
7350 
7351 static void
7352 bwn_led_blink_end(void *arg)
7353 {
7354 	struct bwn_mac *mac = arg;
7355 	struct bwn_softc *sc = mac->mac_sc;
7356 
7357 	sc->sc_led_blinking = 0;
7358 }
7359 
7360 static int
7361 bwn_suspend(device_t dev)
7362 {
7363 	struct bwn_softc *sc = device_get_softc(dev);
7364 
7365 	BWN_LOCK(sc);
7366 	bwn_stop(sc);
7367 	BWN_UNLOCK(sc);
7368 	return (0);
7369 }
7370 
7371 static int
7372 bwn_resume(device_t dev)
7373 {
7374 	struct bwn_softc *sc = device_get_softc(dev);
7375 	int error = EDOOFUS;
7376 
7377 	BWN_LOCK(sc);
7378 	if (sc->sc_ic.ic_nrunning > 0)
7379 		error = bwn_init(sc);
7380 	BWN_UNLOCK(sc);
7381 	if (error == 0)
7382 		ieee80211_start_all(&sc->sc_ic);
7383 	return (0);
7384 }
7385 
7386 static void
7387 bwn_rfswitch(void *arg)
7388 {
7389 	struct bwn_softc *sc = arg;
7390 	struct bwn_mac *mac = sc->sc_curmac;
7391 	int cur = 0, prev = 0;
7392 
7393 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7394 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7395 
7396 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7397 	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7398 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7399 			& BWN_RF_HWENABLED_HI_MASK))
7400 			cur = 1;
7401 	} else {
7402 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7403 		    & BWN_RF_HWENABLED_LO_MASK)
7404 			cur = 1;
7405 	}
7406 
7407 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7408 		prev = 1;
7409 
7410 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7411 	    __func__, cur, prev);
7412 
7413 	if (cur != prev) {
7414 		if (cur)
7415 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7416 		else
7417 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7418 
7419 		device_printf(sc->sc_dev,
7420 		    "status of RF switch is changed to %s\n",
7421 		    cur ? "ON" : "OFF");
7422 		if (cur != mac->mac_phy.rf_on) {
7423 			if (cur)
7424 				bwn_rf_turnon(mac);
7425 			else
7426 				bwn_rf_turnoff(mac);
7427 		}
7428 	}
7429 
7430 	callout_schedule(&sc->sc_rfswitch_ch, hz);
7431 }
7432 
7433 static void
7434 bwn_sysctl_node(struct bwn_softc *sc)
7435 {
7436 	device_t dev = sc->sc_dev;
7437 	struct bwn_mac *mac;
7438 	struct bwn_stats *stats;
7439 
7440 	/* XXX assume that count of MAC is only 1. */
7441 
7442 	if ((mac = sc->sc_curmac) == NULL)
7443 		return;
7444 	stats = &mac->mac_stats;
7445 
7446 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7447 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7448 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7449 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7450 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7451 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7452 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7453 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7455 
7456 #ifdef BWN_DEBUG
7457 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7458 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7459 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7460 #endif
7461 }
7462 
7463 static device_method_t bwn_methods[] = {
7464 	/* Device interface */
7465 	DEVMETHOD(device_probe,		bwn_probe),
7466 	DEVMETHOD(device_attach,	bwn_attach),
7467 	DEVMETHOD(device_detach,	bwn_detach),
7468 	DEVMETHOD(device_suspend,	bwn_suspend),
7469 	DEVMETHOD(device_resume,	bwn_resume),
7470 	DEVMETHOD_END
7471 };
7472 static driver_t bwn_driver = {
7473 	"bwn",
7474 	bwn_methods,
7475 	sizeof(struct bwn_softc)
7476 };
7477 static devclass_t bwn_devclass;
7478 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7479 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7480 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7481 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7482 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7483 MODULE_VERSION(bwn, 1);
7484