xref: /freebsd/sys/dev/bwn/if_bwn.c (revision cdf63a700c77204252e3c2e38d7106965559f3c6)
1 /*-
2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  *
16  * NO WARRANTY
17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27  * THE POSSIBILITY OF SUCH DAMAGES.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 /*
34  * The Broadcom Wireless LAN controller driver.
35  */
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/kernel.h>
40 #include <sys/malloc.h>
41 #include <sys/module.h>
42 #include <sys/endian.h>
43 #include <sys/errno.h>
44 #include <sys/firmware.h>
45 #include <sys/lock.h>
46 #include <sys/mutex.h>
47 #include <machine/bus.h>
48 #include <machine/resource.h>
49 #include <sys/bus.h>
50 #include <sys/rman.h>
51 #include <sys/socket.h>
52 #include <sys/sockio.h>
53 
54 #include <net/ethernet.h>
55 #include <net/if.h>
56 #include <net/if_var.h>
57 #include <net/if_arp.h>
58 #include <net/if_dl.h>
59 #include <net/if_llc.h>
60 #include <net/if_media.h>
61 #include <net/if_types.h>
62 
63 #include <dev/pci/pcivar.h>
64 #include <dev/pci/pcireg.h>
65 #include <dev/siba/siba_ids.h>
66 #include <dev/siba/sibareg.h>
67 #include <dev/siba/sibavar.h>
68 
69 #include <net80211/ieee80211_var.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_regdomain.h>
72 #include <net80211/ieee80211_phy.h>
73 #include <net80211/ieee80211_ratectl.h>
74 
75 #include <dev/bwn/if_bwnreg.h>
76 #include <dev/bwn/if_bwnvar.h>
77 
78 #include <dev/bwn/if_bwn_debug.h>
79 #include <dev/bwn/if_bwn_misc.h>
80 #include <dev/bwn/if_bwn_phy_g.h>
81 #include <dev/bwn/if_bwn_phy_lp.h>
82 
83 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
84     "Broadcom driver parameters");
85 
86 /*
87  * Tunable & sysctl variables.
88  */
89 
90 #ifdef BWN_DEBUG
91 static	int bwn_debug = 0;
92 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
93     "Broadcom debugging printfs");
94 #endif
95 
96 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
97 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
98     "uses Bad Frames Preemption");
99 static int	bwn_bluetooth = 1;
100 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
101     "turns on Bluetooth Coexistence");
102 static int	bwn_hwpctl = 0;
103 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
104     "uses H/W power control");
105 static int	bwn_msi_disable = 0;		/* MSI disabled  */
106 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
107 static int	bwn_usedma = 1;
108 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
109     "uses DMA");
110 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
111 static int	bwn_wme = 1;
112 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
113     "uses WME support");
114 
115 static void	bwn_attach_pre(struct bwn_softc *);
116 static int	bwn_attach_post(struct bwn_softc *);
117 static void	bwn_sprom_bugfixes(device_t);
118 static int	bwn_init(struct bwn_softc *);
119 static void	bwn_parent(struct ieee80211com *);
120 static void	bwn_start(struct bwn_softc *);
121 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
122 static int	bwn_attach_core(struct bwn_mac *);
123 static int	bwn_phy_getinfo(struct bwn_mac *, int);
124 static int	bwn_chiptest(struct bwn_mac *);
125 static int	bwn_setup_channels(struct bwn_mac *, int, int);
126 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
127 		    uint16_t);
128 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
129 		    const struct bwn_channelinfo *, int);
130 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
131 		    const struct ieee80211_bpf_params *);
132 static void	bwn_updateslot(struct ieee80211com *);
133 static void	bwn_update_promisc(struct ieee80211com *);
134 static void	bwn_wme_init(struct bwn_mac *);
135 static int	bwn_wme_update(struct ieee80211com *);
136 static void	bwn_wme_clear(struct bwn_softc *);
137 static void	bwn_wme_load(struct bwn_mac *);
138 static void	bwn_wme_loadparams(struct bwn_mac *,
139 		    const struct wmeParams *, uint16_t);
140 static void	bwn_scan_start(struct ieee80211com *);
141 static void	bwn_scan_end(struct ieee80211com *);
142 static void	bwn_set_channel(struct ieee80211com *);
143 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
144 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
145 		    const uint8_t [IEEE80211_ADDR_LEN],
146 		    const uint8_t [IEEE80211_ADDR_LEN]);
147 static void	bwn_vap_delete(struct ieee80211vap *);
148 static void	bwn_stop(struct bwn_softc *);
149 static int	bwn_core_init(struct bwn_mac *);
150 static void	bwn_core_start(struct bwn_mac *);
151 static void	bwn_core_exit(struct bwn_mac *);
152 static void	bwn_bt_disable(struct bwn_mac *);
153 static int	bwn_chip_init(struct bwn_mac *);
154 static void	bwn_set_txretry(struct bwn_mac *, int, int);
155 static void	bwn_rate_init(struct bwn_mac *);
156 static void	bwn_set_phytxctl(struct bwn_mac *);
157 static void	bwn_spu_setdelay(struct bwn_mac *, int);
158 static void	bwn_bt_enable(struct bwn_mac *);
159 static void	bwn_set_macaddr(struct bwn_mac *);
160 static void	bwn_crypt_init(struct bwn_mac *);
161 static void	bwn_chip_exit(struct bwn_mac *);
162 static int	bwn_fw_fillinfo(struct bwn_mac *);
163 static int	bwn_fw_loaducode(struct bwn_mac *);
164 static int	bwn_gpio_init(struct bwn_mac *);
165 static int	bwn_fw_loadinitvals(struct bwn_mac *);
166 static int	bwn_phy_init(struct bwn_mac *);
167 static void	bwn_set_txantenna(struct bwn_mac *, int);
168 static void	bwn_set_opmode(struct bwn_mac *);
169 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
170 static uint8_t	bwn_plcp_getcck(const uint8_t);
171 static uint8_t	bwn_plcp_getofdm(const uint8_t);
172 static void	bwn_pio_init(struct bwn_mac *);
173 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
174 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
175 		    int);
176 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
177 		    struct bwn_pio_rxqueue *, int);
178 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
179 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
180 		    uint16_t);
181 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
182 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
183 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
184 static void	bwn_pio_handle_txeof(struct bwn_mac *,
185 		    const struct bwn_txstatus *);
186 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
187 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
188 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
189 		    uint16_t);
190 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
191 		    uint32_t);
192 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
193 		    struct mbuf *);
194 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
195 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
196 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
197 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
198 		    uint16_t, uint32_t);
199 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
200 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
201 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
202 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
203 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
204 		    uint16_t, struct bwn_pio_txpkt **);
205 static void	bwn_dma_init(struct bwn_mac *);
206 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
207 static int	bwn_dma_mask2type(uint64_t);
208 static uint64_t	bwn_dma_mask(struct bwn_mac *);
209 static uint16_t	bwn_dma_base(int, int);
210 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
211 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
212 		    int, struct bwn_dmadesc_generic **,
213 		    struct bwn_dmadesc_meta **);
214 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
215 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
216 		    int, int);
217 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
218 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
219 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
220 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
221 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
222 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
223 		    int, struct bwn_dmadesc_generic **,
224 		    struct bwn_dmadesc_meta **);
225 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
226 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
227 		    int, int);
228 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
229 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
230 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
231 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
232 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
233 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
234 static void	bwn_dma_setup(struct bwn_dma_ring *);
235 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
236 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
237 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
238 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
239 static void	bwn_dma_rx(struct bwn_dma_ring *);
240 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
241 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
242 		    struct bwn_dmadesc_meta *);
243 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
244 static int	bwn_dma_gettype(struct bwn_mac *);
245 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
246 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
247 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
248 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
249 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
250 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
251 		    int);
252 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
253 		    bus_size_t, int);
254 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
255 static void	bwn_dma_handle_txeof(struct bwn_mac *,
256 		    const struct bwn_txstatus *);
257 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
258 		    struct mbuf *);
259 static int	bwn_dma_getslot(struct bwn_dma_ring *);
260 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
261 		    uint8_t);
262 static int	bwn_dma_attach(struct bwn_mac *);
263 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
264 		    int, int, int);
265 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
266 		    const struct bwn_txstatus *, uint16_t, int *);
267 static void	bwn_dma_free(struct bwn_mac *);
268 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
269 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
270 		    const char *, struct bwn_fwfile *);
271 static void	bwn_release_firmware(struct bwn_mac *);
272 static void	bwn_do_release_fw(struct bwn_fwfile *);
273 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
274 static int	bwn_fwinitvals_write(struct bwn_mac *,
275 		    const struct bwn_fwinitvals *, size_t, size_t);
276 static uint16_t	bwn_ant2phy(int);
277 static void	bwn_mac_write_bssid(struct bwn_mac *);
278 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
279 		    const uint8_t *);
280 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
281 		    const uint8_t *, size_t, const uint8_t *);
282 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
283 		    const uint8_t *);
284 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
285 		    const uint8_t *);
286 static void	bwn_phy_exit(struct bwn_mac *);
287 static void	bwn_core_stop(struct bwn_mac *);
288 static int	bwn_switch_band(struct bwn_softc *,
289 		    struct ieee80211_channel *);
290 static void	bwn_phy_reset(struct bwn_mac *);
291 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
292 static void	bwn_set_pretbtt(struct bwn_mac *);
293 static int	bwn_intr(void *);
294 static void	bwn_intrtask(void *, int);
295 static void	bwn_restart(struct bwn_mac *, const char *);
296 static void	bwn_intr_ucode_debug(struct bwn_mac *);
297 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
298 static void	bwn_intr_atim_end(struct bwn_mac *);
299 static void	bwn_intr_beacon(struct bwn_mac *);
300 static void	bwn_intr_pmq(struct bwn_mac *);
301 static void	bwn_intr_noise(struct bwn_mac *);
302 static void	bwn_intr_txeof(struct bwn_mac *);
303 static void	bwn_hwreset(void *, int);
304 static void	bwn_handle_fwpanic(struct bwn_mac *);
305 static void	bwn_load_beacon0(struct bwn_mac *);
306 static void	bwn_load_beacon1(struct bwn_mac *);
307 static uint32_t	bwn_jssi_read(struct bwn_mac *);
308 static void	bwn_noise_gensample(struct bwn_mac *);
309 static void	bwn_handle_txeof(struct bwn_mac *,
310 		    const struct bwn_txstatus *);
311 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
312 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
313 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
314 		    struct mbuf *);
315 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
316 static int	bwn_set_txhdr(struct bwn_mac *,
317 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
318 		    uint16_t);
319 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
320 		    const uint8_t);
321 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
322 static uint8_t	bwn_get_fbrate(uint8_t);
323 static void	bwn_txpwr(void *, int);
324 static void	bwn_tasks(void *);
325 static void	bwn_task_15s(struct bwn_mac *);
326 static void	bwn_task_30s(struct bwn_mac *);
327 static void	bwn_task_60s(struct bwn_mac *);
328 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
329 		    uint8_t);
330 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
331 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
332 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
333 		    int, int);
334 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
335 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
336 static void	bwn_watchdog(void *);
337 static void	bwn_dma_stop(struct bwn_mac *);
338 static void	bwn_pio_stop(struct bwn_mac *);
339 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
340 static void	bwn_led_attach(struct bwn_mac *);
341 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
342 static void	bwn_led_event(struct bwn_mac *, int);
343 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
344 static void	bwn_led_blink_next(void *);
345 static void	bwn_led_blink_end(void *);
346 static void	bwn_rfswitch(void *);
347 static void	bwn_rf_turnon(struct bwn_mac *);
348 static void	bwn_rf_turnoff(struct bwn_mac *);
349 static void	bwn_sysctl_node(struct bwn_softc *);
350 
351 static struct resource_spec bwn_res_spec_legacy[] = {
352 	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
353 	{ -1,			0,		0 }
354 };
355 
356 static struct resource_spec bwn_res_spec_msi[] = {
357 	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
358 	{ -1,			0,		0 }
359 };
360 
361 static const struct bwn_channelinfo bwn_chantable_bg = {
362 	.channels = {
363 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
364 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
365 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
366 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
367 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
368 	.nchannels = 14
369 };
370 
371 static const struct bwn_channelinfo bwn_chantable_a = {
372 	.channels = {
373 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
374 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
375 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
376 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
377 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
378 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
379 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
380 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
381 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
382 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
383 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
384 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
385 		{ 6080, 216, 30 } },
386 	.nchannels = 37
387 };
388 
389 static const struct bwn_channelinfo bwn_chantable_n = {
390 	.channels = {
391 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
392 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
393 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
394 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
395 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
396 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
397 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
398 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
399 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
400 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
401 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
402 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
403 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
404 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
405 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
406 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
407 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
408 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
409 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
410 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
411 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
412 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
413 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
414 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
415 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
416 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
417 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
418 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
419 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
420 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
421 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
422 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
423 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
424 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
425 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
426 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
427 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
428 	.nchannels = 110
429 };
430 
431 #define	VENDOR_LED_ACT(vendor)				\
432 {							\
433 	.vid = PCI_VENDOR_##vendor,			\
434 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
435 }
436 
437 static const struct {
438 	uint16_t	vid;
439 	uint8_t		led_act[BWN_LED_MAX];
440 } bwn_vendor_led_act[] = {
441 	VENDOR_LED_ACT(COMPAQ),
442 	VENDOR_LED_ACT(ASUSTEK)
443 };
444 
445 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
446 	{ BWN_VENDOR_LED_ACT_DEFAULT };
447 
448 #undef VENDOR_LED_ACT
449 
450 static const struct {
451 	int		on_dur;
452 	int		off_dur;
453 } bwn_led_duration[109] = {
454 	[0]	= { 400, 100 },
455 	[2]	= { 150, 75 },
456 	[4]	= { 90, 45 },
457 	[11]	= { 66, 34 },
458 	[12]	= { 53, 26 },
459 	[18]	= { 42, 21 },
460 	[22]	= { 35, 17 },
461 	[24]	= { 32, 16 },
462 	[36]	= { 21, 10 },
463 	[48]	= { 16, 8 },
464 	[72]	= { 11, 5 },
465 	[96]	= { 9, 4 },
466 	[108]	= { 7, 3 }
467 };
468 
469 static const uint16_t bwn_wme_shm_offsets[] = {
470 	[0] = BWN_WME_BESTEFFORT,
471 	[1] = BWN_WME_BACKGROUND,
472 	[2] = BWN_WME_VOICE,
473 	[3] = BWN_WME_VIDEO,
474 };
475 
476 static const struct siba_devid bwn_devs[] = {
477 	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
478 	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
479 	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
480 	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
481 	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
482 	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
483 	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
484 	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
485 	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
486 };
487 
488 static int
489 bwn_probe(device_t dev)
490 {
491 	int i;
492 
493 	for (i = 0; i < nitems(bwn_devs); i++) {
494 		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
495 		    siba_get_device(dev) == bwn_devs[i].sd_device &&
496 		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
497 			return (BUS_PROBE_DEFAULT);
498 	}
499 
500 	return (ENXIO);
501 }
502 
503 static int
504 bwn_attach(device_t dev)
505 {
506 	struct bwn_mac *mac;
507 	struct bwn_softc *sc = device_get_softc(dev);
508 	int error, i, msic, reg;
509 
510 	sc->sc_dev = dev;
511 #ifdef BWN_DEBUG
512 	sc->sc_debug = bwn_debug;
513 #endif
514 
515 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
516 		bwn_attach_pre(sc);
517 		bwn_sprom_bugfixes(dev);
518 		sc->sc_flags |= BWN_FLAG_ATTACHED;
519 	}
520 
521 	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
522 		if (siba_get_pci_device(dev) != 0x4313 &&
523 		    siba_get_pci_device(dev) != 0x431a &&
524 		    siba_get_pci_device(dev) != 0x4321) {
525 			device_printf(sc->sc_dev,
526 			    "skip 802.11 cores\n");
527 			return (ENODEV);
528 		}
529 	}
530 
531 	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
532 	mac->mac_sc = sc;
533 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
534 	if (bwn_bfp != 0)
535 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
536 
537 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
538 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
539 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
540 
541 	error = bwn_attach_core(mac);
542 	if (error)
543 		goto fail0;
544 	bwn_led_attach(mac);
545 
546 	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
547 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
548 	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
549 	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
550 	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
551 	    mac->mac_phy.rf_rev);
552 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
553 		device_printf(sc->sc_dev, "DMA (%d bits)\n",
554 		    mac->mac_method.dma.dmatype);
555 	else
556 		device_printf(sc->sc_dev, "PIO\n");
557 
558 	/*
559 	 * setup PCI resources and interrupt.
560 	 */
561 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
562 		msic = pci_msi_count(dev);
563 		if (bootverbose)
564 			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
565 	} else
566 		msic = 0;
567 
568 	mac->mac_intr_spec = bwn_res_spec_legacy;
569 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
570 		if (pci_alloc_msi(dev, &msic) == 0) {
571 			device_printf(sc->sc_dev,
572 			    "Using %d MSI messages\n", msic);
573 			mac->mac_intr_spec = bwn_res_spec_msi;
574 			mac->mac_msi = 1;
575 		}
576 	}
577 
578 	error = bus_alloc_resources(dev, mac->mac_intr_spec,
579 	    mac->mac_res_irq);
580 	if (error) {
581 		device_printf(sc->sc_dev,
582 		    "couldn't allocate IRQ resources (%d)\n", error);
583 		goto fail1;
584 	}
585 
586 	if (mac->mac_msi == 0)
587 		error = bus_setup_intr(dev, mac->mac_res_irq[0],
588 		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
589 		    &mac->mac_intrhand[0]);
590 	else {
591 		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
592 			error = bus_setup_intr(dev, mac->mac_res_irq[i],
593 			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
594 			    &mac->mac_intrhand[i]);
595 			if (error != 0) {
596 				device_printf(sc->sc_dev,
597 				    "couldn't setup interrupt (%d)\n", error);
598 				break;
599 			}
600 		}
601 	}
602 
603 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
604 
605 	/*
606 	 * calls attach-post routine
607 	 */
608 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
609 		bwn_attach_post(sc);
610 
611 	return (0);
612 fail1:
613 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
614 		pci_release_msi(dev);
615 fail0:
616 	free(mac, M_DEVBUF);
617 	return (error);
618 }
619 
620 static int
621 bwn_is_valid_ether_addr(uint8_t *addr)
622 {
623 	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
624 
625 	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
626 		return (FALSE);
627 
628 	return (TRUE);
629 }
630 
631 static int
632 bwn_attach_post(struct bwn_softc *sc)
633 {
634 	struct ieee80211com *ic = &sc->sc_ic;
635 
636 	ic->ic_softc = sc;
637 	ic->ic_name = device_get_nameunit(sc->sc_dev);
638 	/* XXX not right but it's not used anywhere important */
639 	ic->ic_phytype = IEEE80211_T_OFDM;
640 	ic->ic_opmode = IEEE80211_M_STA;
641 	ic->ic_caps =
642 		  IEEE80211_C_STA		/* station mode supported */
643 		| IEEE80211_C_MONITOR		/* monitor mode */
644 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
645 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
646 		| IEEE80211_C_SHSLOT		/* short slot time supported */
647 		| IEEE80211_C_WME		/* WME/WMM supported */
648 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
649 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
650 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
651 		;
652 
653 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
654 
655 	IEEE80211_ADDR_COPY(ic->ic_macaddr,
656 	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
657 	    siba_sprom_get_mac_80211a(sc->sc_dev) :
658 	    siba_sprom_get_mac_80211bg(sc->sc_dev));
659 
660 	/* call MI attach routine. */
661 	ieee80211_ifattach(ic);
662 
663 	ic->ic_headroom = sizeof(struct bwn_txhdr);
664 
665 	/* override default methods */
666 	ic->ic_raw_xmit = bwn_raw_xmit;
667 	ic->ic_updateslot = bwn_updateslot;
668 	ic->ic_update_promisc = bwn_update_promisc;
669 	ic->ic_wme.wme_update = bwn_wme_update;
670 	ic->ic_scan_start = bwn_scan_start;
671 	ic->ic_scan_end = bwn_scan_end;
672 	ic->ic_set_channel = bwn_set_channel;
673 	ic->ic_vap_create = bwn_vap_create;
674 	ic->ic_vap_delete = bwn_vap_delete;
675 	ic->ic_transmit = bwn_transmit;
676 	ic->ic_parent = bwn_parent;
677 
678 	ieee80211_radiotap_attach(ic,
679 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
680 	    BWN_TX_RADIOTAP_PRESENT,
681 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
682 	    BWN_RX_RADIOTAP_PRESENT);
683 
684 	bwn_sysctl_node(sc);
685 
686 	if (bootverbose)
687 		ieee80211_announce(ic);
688 	return (0);
689 }
690 
691 static void
692 bwn_phy_detach(struct bwn_mac *mac)
693 {
694 
695 	if (mac->mac_phy.detach != NULL)
696 		mac->mac_phy.detach(mac);
697 }
698 
699 static int
700 bwn_detach(device_t dev)
701 {
702 	struct bwn_softc *sc = device_get_softc(dev);
703 	struct bwn_mac *mac = sc->sc_curmac;
704 	struct ieee80211com *ic = &sc->sc_ic;
705 	int i;
706 
707 	sc->sc_flags |= BWN_FLAG_INVALID;
708 
709 	if (device_is_attached(sc->sc_dev)) {
710 		BWN_LOCK(sc);
711 		bwn_stop(sc);
712 		BWN_UNLOCK(sc);
713 		bwn_dma_free(mac);
714 		callout_drain(&sc->sc_led_blink_ch);
715 		callout_drain(&sc->sc_rfswitch_ch);
716 		callout_drain(&sc->sc_task_ch);
717 		callout_drain(&sc->sc_watchdog_ch);
718 		bwn_phy_detach(mac);
719 		ieee80211_draintask(ic, &mac->mac_hwreset);
720 		ieee80211_draintask(ic, &mac->mac_txpower);
721 		ieee80211_ifdetach(ic);
722 	}
723 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
724 	taskqueue_free(sc->sc_tq);
725 
726 	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
727 		if (mac->mac_intrhand[i] != NULL) {
728 			bus_teardown_intr(dev, mac->mac_res_irq[i],
729 			    mac->mac_intrhand[i]);
730 			mac->mac_intrhand[i] = NULL;
731 		}
732 	}
733 	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
734 	if (mac->mac_msi != 0)
735 		pci_release_msi(dev);
736 	mbufq_drain(&sc->sc_snd);
737 	BWN_LOCK_DESTROY(sc);
738 	return (0);
739 }
740 
741 static void
742 bwn_attach_pre(struct bwn_softc *sc)
743 {
744 
745 	BWN_LOCK_INIT(sc);
746 	TAILQ_INIT(&sc->sc_maclist);
747 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
748 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
749 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
750 	mbufq_init(&sc->sc_snd, ifqmaxlen);
751 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
752 		taskqueue_thread_enqueue, &sc->sc_tq);
753 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
754 		"%s taskq", device_get_nameunit(sc->sc_dev));
755 }
756 
757 static void
758 bwn_sprom_bugfixes(device_t dev)
759 {
760 #define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
761 	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
762 	 (siba_get_pci_device(dev) == _device) &&			\
763 	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
764 	 (siba_get_pci_subdevice(dev) == _subdevice))
765 
766 	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
767 	    siba_get_pci_subdevice(dev) == 0x4e &&
768 	    siba_get_pci_revid(dev) > 0x40)
769 		siba_sprom_set_bf_lo(dev,
770 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
771 	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
772 	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
773 		siba_sprom_set_bf_lo(dev,
774 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
775 	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
776 		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
777 		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
778 		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
779 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
780 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
781 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
782 		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
783 			siba_sprom_set_bf_lo(dev,
784 			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
785 	}
786 #undef	BWN_ISDEV
787 }
788 
789 static void
790 bwn_parent(struct ieee80211com *ic)
791 {
792 	struct bwn_softc *sc = ic->ic_softc;
793 	int startall = 0;
794 
795 	BWN_LOCK(sc);
796 	if (ic->ic_nrunning > 0) {
797 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
798 			bwn_init(sc);
799 			startall = 1;
800 		} else
801 			bwn_update_promisc(ic);
802 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
803 		bwn_stop(sc);
804 	BWN_UNLOCK(sc);
805 
806 	if (startall)
807 		ieee80211_start_all(ic);
808 }
809 
810 static int
811 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
812 {
813 	struct bwn_softc *sc = ic->ic_softc;
814 	int error;
815 
816 	BWN_LOCK(sc);
817 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
818 		BWN_UNLOCK(sc);
819 		return (ENXIO);
820 	}
821 	error = mbufq_enqueue(&sc->sc_snd, m);
822 	if (error) {
823 		BWN_UNLOCK(sc);
824 		return (error);
825 	}
826 	bwn_start(sc);
827 	BWN_UNLOCK(sc);
828 	return (0);
829 }
830 
831 static void
832 bwn_start(struct bwn_softc *sc)
833 {
834 	struct bwn_mac *mac = sc->sc_curmac;
835 	struct ieee80211_frame *wh;
836 	struct ieee80211_node *ni;
837 	struct ieee80211_key *k;
838 	struct mbuf *m;
839 
840 	BWN_ASSERT_LOCKED(sc);
841 
842 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
843 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
844 		return;
845 
846 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
847 		if (bwn_tx_isfull(sc, m))
848 			break;
849 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
850 		if (ni == NULL) {
851 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
852 			m_freem(m);
853 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
854 			continue;
855 		}
856 		wh = mtod(m, struct ieee80211_frame *);
857 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
858 			k = ieee80211_crypto_encap(ni, m);
859 			if (k == NULL) {
860 				if_inc_counter(ni->ni_vap->iv_ifp,
861 				    IFCOUNTER_OERRORS, 1);
862 				ieee80211_free_node(ni);
863 				m_freem(m);
864 				continue;
865 			}
866 		}
867 		wh = NULL;	/* Catch any invalid use */
868 		if (bwn_tx_start(sc, ni, m) != 0) {
869 			if (ni != NULL) {
870 				if_inc_counter(ni->ni_vap->iv_ifp,
871 				    IFCOUNTER_OERRORS, 1);
872 				ieee80211_free_node(ni);
873 			}
874 			continue;
875 		}
876 		sc->sc_watchdog_timer = 5;
877 	}
878 }
879 
880 static int
881 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
882 {
883 	struct bwn_dma_ring *dr;
884 	struct bwn_mac *mac = sc->sc_curmac;
885 	struct bwn_pio_txqueue *tq;
886 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
887 
888 	BWN_ASSERT_LOCKED(sc);
889 
890 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
891 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
892 		if (dr->dr_stop == 1 ||
893 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
894 			dr->dr_stop = 1;
895 			goto full;
896 		}
897 	} else {
898 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
899 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
900 		    pktlen > (tq->tq_size - tq->tq_used))
901 			goto full;
902 	}
903 	return (0);
904 full:
905 	mbufq_prepend(&sc->sc_snd, m);
906 	return (1);
907 }
908 
909 static int
910 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
911 {
912 	struct bwn_mac *mac = sc->sc_curmac;
913 	int error;
914 
915 	BWN_ASSERT_LOCKED(sc);
916 
917 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
918 		m_freem(m);
919 		return (ENXIO);
920 	}
921 
922 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
923 	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
924 	if (error) {
925 		m_freem(m);
926 		return (error);
927 	}
928 	return (0);
929 }
930 
931 static int
932 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
933 {
934 	struct bwn_pio_txpkt *tp;
935 	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
936 	struct bwn_softc *sc = mac->mac_sc;
937 	struct bwn_txhdr txhdr;
938 	struct mbuf *m_new;
939 	uint32_t ctl32;
940 	int error;
941 	uint16_t ctl16;
942 
943 	BWN_ASSERT_LOCKED(sc);
944 
945 	/* XXX TODO send packets after DTIM */
946 
947 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
948 	tp = TAILQ_FIRST(&tq->tq_pktlist);
949 	tp->tp_ni = ni;
950 	tp->tp_m = m;
951 
952 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
953 	if (error) {
954 		device_printf(sc->sc_dev, "tx fail\n");
955 		return (error);
956 	}
957 
958 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
959 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
960 	tq->tq_free--;
961 
962 	if (siba_get_revid(sc->sc_dev) >= 8) {
963 		/*
964 		 * XXX please removes m_defrag(9)
965 		 */
966 		m_new = m_defrag(m, M_NOWAIT);
967 		if (m_new == NULL) {
968 			device_printf(sc->sc_dev,
969 			    "%s: can't defrag TX buffer\n",
970 			    __func__);
971 			return (ENOBUFS);
972 		}
973 		if (m_new->m_next != NULL)
974 			device_printf(sc->sc_dev,
975 			    "TODO: fragmented packets for PIO\n");
976 		tp->tp_m = m_new;
977 
978 		/* send HEADER */
979 		ctl32 = bwn_pio_write_multi_4(mac, tq,
980 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
981 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
982 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
983 		/* send BODY */
984 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
985 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
986 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
987 		    ctl32 | BWN_PIO8_TXCTL_EOF);
988 	} else {
989 		ctl16 = bwn_pio_write_multi_2(mac, tq,
990 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
991 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
992 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
993 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
994 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
995 		    ctl16 | BWN_PIO_TXCTL_EOF);
996 	}
997 
998 	return (0);
999 }
1000 
1001 static struct bwn_pio_txqueue *
1002 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1003 {
1004 
1005 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1006 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1007 
1008 	switch (prio) {
1009 	case 0:
1010 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1011 	case 1:
1012 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1013 	case 2:
1014 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1015 	case 3:
1016 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1017 	}
1018 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1019 	return (NULL);
1020 }
1021 
1022 static int
1023 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1024 {
1025 #define	BWN_GET_TXHDRCACHE(slot)					\
1026 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1027 	struct bwn_dma *dma = &mac->mac_method.dma;
1028 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1029 	struct bwn_dmadesc_generic *desc;
1030 	struct bwn_dmadesc_meta *mt;
1031 	struct bwn_softc *sc = mac->mac_sc;
1032 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1033 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1034 
1035 	BWN_ASSERT_LOCKED(sc);
1036 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1037 
1038 	/* XXX send after DTIM */
1039 
1040 	slot = bwn_dma_getslot(dr);
1041 	dr->getdesc(dr, slot, &desc, &mt);
1042 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1043 	    ("%s:%d: fail", __func__, __LINE__));
1044 
1045 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1046 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1047 	    BWN_DMA_COOKIE(dr, slot));
1048 	if (error)
1049 		goto fail;
1050 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1051 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1052 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1053 	if (error) {
1054 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1055 		    __func__, error);
1056 		goto fail;
1057 	}
1058 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1059 	    BUS_DMASYNC_PREWRITE);
1060 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1061 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1062 	    BUS_DMASYNC_PREWRITE);
1063 
1064 	slot = bwn_dma_getslot(dr);
1065 	dr->getdesc(dr, slot, &desc, &mt);
1066 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1067 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1068 	mt->mt_m = m;
1069 	mt->mt_ni = ni;
1070 
1071 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1072 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1073 	if (error && error != EFBIG) {
1074 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1075 		    __func__, error);
1076 		goto fail;
1077 	}
1078 	if (error) {    /* error == EFBIG */
1079 		struct mbuf *m_new;
1080 
1081 		m_new = m_defrag(m, M_NOWAIT);
1082 		if (m_new == NULL) {
1083 			device_printf(sc->sc_dev,
1084 			    "%s: can't defrag TX buffer\n",
1085 			    __func__);
1086 			error = ENOBUFS;
1087 			goto fail;
1088 		} else {
1089 			m = m_new;
1090 		}
1091 
1092 		mt->mt_m = m;
1093 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1094 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1095 		if (error) {
1096 			device_printf(sc->sc_dev,
1097 			    "%s: can't load TX buffer (2) %d\n",
1098 			    __func__, error);
1099 			goto fail;
1100 		}
1101 	}
1102 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1103 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1104 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1105 	    BUS_DMASYNC_PREWRITE);
1106 
1107 	/* XXX send after DTIM */
1108 
1109 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1110 	return (0);
1111 fail:
1112 	dr->dr_curslot = backup[0];
1113 	dr->dr_usedslot = backup[1];
1114 	return (error);
1115 #undef BWN_GET_TXHDRCACHE
1116 }
1117 
1118 static void
1119 bwn_watchdog(void *arg)
1120 {
1121 	struct bwn_softc *sc = arg;
1122 
1123 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1124 		device_printf(sc->sc_dev, "device timeout\n");
1125 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1126 	}
1127 	callout_schedule(&sc->sc_watchdog_ch, hz);
1128 }
1129 
1130 static int
1131 bwn_attach_core(struct bwn_mac *mac)
1132 {
1133 	struct bwn_softc *sc = mac->mac_sc;
1134 	int error, have_bg = 0, have_a = 0;
1135 	uint32_t high;
1136 
1137 	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1138 	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1139 
1140 	siba_powerup(sc->sc_dev, 0);
1141 
1142 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1143 	bwn_reset_core(mac,
1144 	    (high & BWN_TGSHIGH_HAVE_2GHZ) ? BWN_TGSLOW_SUPPORT_G : 0);
1145 	error = bwn_phy_getinfo(mac, high);
1146 	if (error)
1147 		goto fail;
1148 
1149 	have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1150 	have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1151 	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1152 	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1153 	    siba_get_pci_device(sc->sc_dev) != 0x4324) {
1154 		have_a = have_bg = 0;
1155 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1156 			have_a = 1;
1157 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1158 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1159 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1160 			have_bg = 1;
1161 		else
1162 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1163 			    mac->mac_phy.type));
1164 	}
1165 	/* XXX turns off PHY A because it's not supported */
1166 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1167 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1168 		have_a = 0;
1169 		have_bg = 1;
1170 	}
1171 
1172 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1173 		mac->mac_phy.attach = bwn_phy_g_attach;
1174 		mac->mac_phy.detach = bwn_phy_g_detach;
1175 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1176 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1177 		mac->mac_phy.init = bwn_phy_g_init;
1178 		mac->mac_phy.exit = bwn_phy_g_exit;
1179 		mac->mac_phy.phy_read = bwn_phy_g_read;
1180 		mac->mac_phy.phy_write = bwn_phy_g_write;
1181 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1182 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1183 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1184 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1185 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1186 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1187 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1188 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1189 		mac->mac_phy.set_im = bwn_phy_g_im;
1190 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1191 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1192 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1193 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1194 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1195 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1196 		mac->mac_phy.init = bwn_phy_lp_init;
1197 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1198 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1199 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1200 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1201 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1202 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1203 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1204 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1205 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1206 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1207 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1208 	} else {
1209 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1210 		    mac->mac_phy.type);
1211 		error = ENXIO;
1212 		goto fail;
1213 	}
1214 
1215 	mac->mac_phy.gmode = have_bg;
1216 	if (mac->mac_phy.attach != NULL) {
1217 		error = mac->mac_phy.attach(mac);
1218 		if (error) {
1219 			device_printf(sc->sc_dev, "failed\n");
1220 			goto fail;
1221 		}
1222 	}
1223 
1224 	bwn_reset_core(mac, have_bg ? BWN_TGSLOW_SUPPORT_G : 0);
1225 
1226 	error = bwn_chiptest(mac);
1227 	if (error)
1228 		goto fail;
1229 	error = bwn_setup_channels(mac, have_bg, have_a);
1230 	if (error) {
1231 		device_printf(sc->sc_dev, "failed to setup channels\n");
1232 		goto fail;
1233 	}
1234 
1235 	if (sc->sc_curmac == NULL)
1236 		sc->sc_curmac = mac;
1237 
1238 	error = bwn_dma_attach(mac);
1239 	if (error != 0) {
1240 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1241 		goto fail;
1242 	}
1243 
1244 	mac->mac_phy.switch_analog(mac, 0);
1245 
1246 	siba_dev_down(sc->sc_dev, 0);
1247 fail:
1248 	siba_powerdown(sc->sc_dev);
1249 	return (error);
1250 }
1251 
1252 void
1253 bwn_reset_core(struct bwn_mac *mac, uint32_t flags)
1254 {
1255 	struct bwn_softc *sc = mac->mac_sc;
1256 	uint32_t low, ctl;
1257 
1258 	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1259 
1260 	siba_dev_up(sc->sc_dev, flags);
1261 	DELAY(2000);
1262 
1263 	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1264 	    ~BWN_TGSLOW_PHYRESET;
1265 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1266 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1267 	DELAY(1000);
1268 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1269 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1270 	DELAY(1000);
1271 
1272 	if (mac->mac_phy.switch_analog != NULL)
1273 		mac->mac_phy.switch_analog(mac, 1);
1274 
1275 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1276 	if (flags & BWN_TGSLOW_SUPPORT_G)
1277 		ctl |= BWN_MACCTL_GMODE;
1278 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1279 }
1280 
1281 static int
1282 bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1283 {
1284 	struct bwn_phy *phy = &mac->mac_phy;
1285 	struct bwn_softc *sc = mac->mac_sc;
1286 	uint32_t tmp;
1287 
1288 	/* PHY */
1289 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1290 	phy->gmode = (tgshigh & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1291 	phy->rf_on = 1;
1292 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1293 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1294 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1295 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1296 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1297 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1298 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1299 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1300 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1301 		goto unsupphy;
1302 
1303 	/* RADIO */
1304 	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1305 		if (siba_get_chiprev(sc->sc_dev) == 0)
1306 			tmp = 0x3205017f;
1307 		else if (siba_get_chiprev(sc->sc_dev) == 1)
1308 			tmp = 0x4205017f;
1309 		else
1310 			tmp = 0x5205017f;
1311 	} else {
1312 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1313 		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1314 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1315 		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1316 	}
1317 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1318 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1319 	phy->rf_manuf = (tmp & 0x00000fff);
1320 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1321 		goto unsupradio;
1322 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1323 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1324 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1325 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1326 	    (phy->type == BWN_PHYTYPE_N &&
1327 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1328 	    (phy->type == BWN_PHYTYPE_LP &&
1329 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1330 		goto unsupradio;
1331 
1332 	return (0);
1333 unsupphy:
1334 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1335 	    "analog %#x)\n",
1336 	    phy->type, phy->rev, phy->analog);
1337 	return (ENXIO);
1338 unsupradio:
1339 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1340 	    "rev %#x)\n",
1341 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1342 	return (ENXIO);
1343 }
1344 
1345 static int
1346 bwn_chiptest(struct bwn_mac *mac)
1347 {
1348 #define	TESTVAL0	0x55aaaa55
1349 #define	TESTVAL1	0xaa5555aa
1350 	struct bwn_softc *sc = mac->mac_sc;
1351 	uint32_t v, backup;
1352 
1353 	BWN_LOCK(sc);
1354 
1355 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1356 
1357 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1358 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1359 		goto error;
1360 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1361 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1362 		goto error;
1363 
1364 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1365 
1366 	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1367 	    (siba_get_revid(sc->sc_dev) <= 10)) {
1368 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1369 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1370 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1371 			goto error;
1372 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1373 			goto error;
1374 	}
1375 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1376 
1377 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1378 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1379 		goto error;
1380 
1381 	BWN_UNLOCK(sc);
1382 	return (0);
1383 error:
1384 	BWN_UNLOCK(sc);
1385 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1386 	return (ENODEV);
1387 }
1388 
1389 #define	IEEE80211_CHAN_HTG	(IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1390 #define	IEEE80211_CHAN_HTA	(IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1391 
1392 static int
1393 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1394 {
1395 	struct bwn_softc *sc = mac->mac_sc;
1396 	struct ieee80211com *ic = &sc->sc_ic;
1397 
1398 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1399 	ic->ic_nchans = 0;
1400 
1401 	if (have_bg)
1402 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1403 		    &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1404 	if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1405 		if (have_a)
1406 			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1407 			    &ic->ic_nchans, &bwn_chantable_n,
1408 			    IEEE80211_CHAN_HTA);
1409 	} else {
1410 		if (have_a)
1411 			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1412 			    &ic->ic_nchans, &bwn_chantable_a,
1413 			    IEEE80211_CHAN_A);
1414 	}
1415 
1416 	mac->mac_phy.supports_2ghz = have_bg;
1417 	mac->mac_phy.supports_5ghz = have_a;
1418 
1419 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1420 }
1421 
1422 uint32_t
1423 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1424 {
1425 	uint32_t ret;
1426 
1427 	BWN_ASSERT_LOCKED(mac->mac_sc);
1428 
1429 	if (way == BWN_SHARED) {
1430 		KASSERT((offset & 0x0001) == 0,
1431 		    ("%s:%d warn", __func__, __LINE__));
1432 		if (offset & 0x0003) {
1433 			bwn_shm_ctlword(mac, way, offset >> 2);
1434 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1435 			ret <<= 16;
1436 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1437 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1438 			goto out;
1439 		}
1440 		offset >>= 2;
1441 	}
1442 	bwn_shm_ctlword(mac, way, offset);
1443 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1444 out:
1445 	return (ret);
1446 }
1447 
1448 uint16_t
1449 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1450 {
1451 	uint16_t ret;
1452 
1453 	BWN_ASSERT_LOCKED(mac->mac_sc);
1454 
1455 	if (way == BWN_SHARED) {
1456 		KASSERT((offset & 0x0001) == 0,
1457 		    ("%s:%d warn", __func__, __LINE__));
1458 		if (offset & 0x0003) {
1459 			bwn_shm_ctlword(mac, way, offset >> 2);
1460 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1461 			goto out;
1462 		}
1463 		offset >>= 2;
1464 	}
1465 	bwn_shm_ctlword(mac, way, offset);
1466 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1467 out:
1468 
1469 	return (ret);
1470 }
1471 
1472 static void
1473 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1474     uint16_t offset)
1475 {
1476 	uint32_t control;
1477 
1478 	control = way;
1479 	control <<= 16;
1480 	control |= offset;
1481 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1482 }
1483 
1484 void
1485 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1486     uint32_t value)
1487 {
1488 	BWN_ASSERT_LOCKED(mac->mac_sc);
1489 
1490 	if (way == BWN_SHARED) {
1491 		KASSERT((offset & 0x0001) == 0,
1492 		    ("%s:%d warn", __func__, __LINE__));
1493 		if (offset & 0x0003) {
1494 			bwn_shm_ctlword(mac, way, offset >> 2);
1495 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1496 				    (value >> 16) & 0xffff);
1497 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1498 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1499 			return;
1500 		}
1501 		offset >>= 2;
1502 	}
1503 	bwn_shm_ctlword(mac, way, offset);
1504 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1505 }
1506 
1507 void
1508 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1509     uint16_t value)
1510 {
1511 	BWN_ASSERT_LOCKED(mac->mac_sc);
1512 
1513 	if (way == BWN_SHARED) {
1514 		KASSERT((offset & 0x0001) == 0,
1515 		    ("%s:%d warn", __func__, __LINE__));
1516 		if (offset & 0x0003) {
1517 			bwn_shm_ctlword(mac, way, offset >> 2);
1518 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1519 			return;
1520 		}
1521 		offset >>= 2;
1522 	}
1523 	bwn_shm_ctlword(mac, way, offset);
1524 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1525 }
1526 
1527 static void
1528 bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1529     int txpow)
1530 {
1531 
1532 	c->ic_freq = freq;
1533 	c->ic_flags = flags;
1534 	c->ic_ieee = ieee;
1535 	c->ic_minpower = 0;
1536 	c->ic_maxpower = 2 * txpow;
1537 	c->ic_maxregpower = txpow;
1538 }
1539 
1540 static void
1541 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1542     const struct bwn_channelinfo *ci, int flags)
1543 {
1544 	struct ieee80211_channel *c;
1545 	int i;
1546 
1547 	c = &chans[*nchans];
1548 
1549 	for (i = 0; i < ci->nchannels; i++) {
1550 		const struct bwn_channel *hc;
1551 
1552 		hc = &ci->channels[i];
1553 		if (*nchans >= maxchans)
1554 			break;
1555 		bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1556 		c++, (*nchans)++;
1557 		if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1558 			/* g channel have a separate b-only entry */
1559 			if (*nchans >= maxchans)
1560 				break;
1561 			c[0] = c[-1];
1562 			c[-1].ic_flags = IEEE80211_CHAN_B;
1563 			c++, (*nchans)++;
1564 		}
1565 		if (flags == IEEE80211_CHAN_HTG) {
1566 			/* HT g channel have a separate g-only entry */
1567 			if (*nchans >= maxchans)
1568 				break;
1569 			c[-1].ic_flags = IEEE80211_CHAN_G;
1570 			c[0] = c[-1];
1571 			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1572 			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1573 			c++, (*nchans)++;
1574 		}
1575 		if (flags == IEEE80211_CHAN_HTA) {
1576 			/* HT a channel have a separate a-only entry */
1577 			if (*nchans >= maxchans)
1578 				break;
1579 			c[-1].ic_flags = IEEE80211_CHAN_A;
1580 			c[0] = c[-1];
1581 			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1582 			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1583 			c++, (*nchans)++;
1584 		}
1585 	}
1586 }
1587 
1588 static int
1589 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1590 	const struct ieee80211_bpf_params *params)
1591 {
1592 	struct ieee80211com *ic = ni->ni_ic;
1593 	struct bwn_softc *sc = ic->ic_softc;
1594 	struct bwn_mac *mac = sc->sc_curmac;
1595 	int error;
1596 
1597 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1598 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1599 		m_freem(m);
1600 		return (ENETDOWN);
1601 	}
1602 
1603 	BWN_LOCK(sc);
1604 	if (bwn_tx_isfull(sc, m)) {
1605 		m_freem(m);
1606 		BWN_UNLOCK(sc);
1607 		return (ENOBUFS);
1608 	}
1609 
1610 	error = bwn_tx_start(sc, ni, m);
1611 	if (error == 0)
1612 		sc->sc_watchdog_timer = 5;
1613 	BWN_UNLOCK(sc);
1614 	return (error);
1615 }
1616 
1617 /*
1618  * Callback from the 802.11 layer to update the slot time
1619  * based on the current setting.  We use it to notify the
1620  * firmware of ERP changes and the f/w takes care of things
1621  * like slot time and preamble.
1622  */
1623 static void
1624 bwn_updateslot(struct ieee80211com *ic)
1625 {
1626 	struct bwn_softc *sc = ic->ic_softc;
1627 	struct bwn_mac *mac;
1628 
1629 	BWN_LOCK(sc);
1630 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1631 		mac = (struct bwn_mac *)sc->sc_curmac;
1632 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1633 	}
1634 	BWN_UNLOCK(sc);
1635 }
1636 
1637 /*
1638  * Callback from the 802.11 layer after a promiscuous mode change.
1639  * Note this interface does not check the operating mode as this
1640  * is an internal callback and we are expected to honor the current
1641  * state (e.g. this is used for setting the interface in promiscuous
1642  * mode when operating in hostap mode to do ACS).
1643  */
1644 static void
1645 bwn_update_promisc(struct ieee80211com *ic)
1646 {
1647 	struct bwn_softc *sc = ic->ic_softc;
1648 	struct bwn_mac *mac = sc->sc_curmac;
1649 
1650 	BWN_LOCK(sc);
1651 	mac = sc->sc_curmac;
1652 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1653 		if (ic->ic_promisc > 0)
1654 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1655 		else
1656 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1657 		bwn_set_opmode(mac);
1658 	}
1659 	BWN_UNLOCK(sc);
1660 }
1661 
1662 /*
1663  * Callback from the 802.11 layer to update WME parameters.
1664  */
1665 static int
1666 bwn_wme_update(struct ieee80211com *ic)
1667 {
1668 	struct bwn_softc *sc = ic->ic_softc;
1669 	struct bwn_mac *mac = sc->sc_curmac;
1670 	struct wmeParams *wmep;
1671 	int i;
1672 
1673 	BWN_LOCK(sc);
1674 	mac = sc->sc_curmac;
1675 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1676 		bwn_mac_suspend(mac);
1677 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1678 			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1679 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1680 		}
1681 		bwn_mac_enable(mac);
1682 	}
1683 	BWN_UNLOCK(sc);
1684 	return (0);
1685 }
1686 
1687 static void
1688 bwn_scan_start(struct ieee80211com *ic)
1689 {
1690 	struct bwn_softc *sc = ic->ic_softc;
1691 	struct bwn_mac *mac;
1692 
1693 	BWN_LOCK(sc);
1694 	mac = sc->sc_curmac;
1695 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1696 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1697 		bwn_set_opmode(mac);
1698 		/* disable CFP update during scan */
1699 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1700 	}
1701 	BWN_UNLOCK(sc);
1702 }
1703 
1704 static void
1705 bwn_scan_end(struct ieee80211com *ic)
1706 {
1707 	struct bwn_softc *sc = ic->ic_softc;
1708 	struct bwn_mac *mac;
1709 
1710 	BWN_LOCK(sc);
1711 	mac = sc->sc_curmac;
1712 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1713 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1714 		bwn_set_opmode(mac);
1715 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1716 	}
1717 	BWN_UNLOCK(sc);
1718 }
1719 
1720 static void
1721 bwn_set_channel(struct ieee80211com *ic)
1722 {
1723 	struct bwn_softc *sc = ic->ic_softc;
1724 	struct bwn_mac *mac = sc->sc_curmac;
1725 	struct bwn_phy *phy = &mac->mac_phy;
1726 	int chan, error;
1727 
1728 	BWN_LOCK(sc);
1729 
1730 	error = bwn_switch_band(sc, ic->ic_curchan);
1731 	if (error)
1732 		goto fail;
1733 	bwn_mac_suspend(mac);
1734 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1735 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1736 	if (chan != phy->chan)
1737 		bwn_switch_channel(mac, chan);
1738 
1739 	/* TX power level */
1740 	if (ic->ic_curchan->ic_maxpower != 0 &&
1741 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1742 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1743 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1744 		    BWN_TXPWR_IGNORE_TSSI);
1745 	}
1746 
1747 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1748 	if (phy->set_antenna)
1749 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1750 
1751 	if (sc->sc_rf_enabled != phy->rf_on) {
1752 		if (sc->sc_rf_enabled) {
1753 			bwn_rf_turnon(mac);
1754 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1755 				device_printf(sc->sc_dev,
1756 				    "please turn on the RF switch\n");
1757 		} else
1758 			bwn_rf_turnoff(mac);
1759 	}
1760 
1761 	bwn_mac_enable(mac);
1762 
1763 fail:
1764 	/*
1765 	 * Setup radio tap channel freq and flags
1766 	 */
1767 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1768 		htole16(ic->ic_curchan->ic_freq);
1769 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1770 		htole16(ic->ic_curchan->ic_flags & 0xffff);
1771 
1772 	BWN_UNLOCK(sc);
1773 }
1774 
1775 static struct ieee80211vap *
1776 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1777     enum ieee80211_opmode opmode, int flags,
1778     const uint8_t bssid[IEEE80211_ADDR_LEN],
1779     const uint8_t mac[IEEE80211_ADDR_LEN])
1780 {
1781 	struct ieee80211vap *vap;
1782 	struct bwn_vap *bvp;
1783 
1784 	switch (opmode) {
1785 	case IEEE80211_M_HOSTAP:
1786 	case IEEE80211_M_MBSS:
1787 	case IEEE80211_M_STA:
1788 	case IEEE80211_M_WDS:
1789 	case IEEE80211_M_MONITOR:
1790 	case IEEE80211_M_IBSS:
1791 	case IEEE80211_M_AHDEMO:
1792 		break;
1793 	default:
1794 		return (NULL);
1795 	}
1796 
1797 	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1798 	vap = &bvp->bv_vap;
1799 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1800 	/* override with driver methods */
1801 	bvp->bv_newstate = vap->iv_newstate;
1802 	vap->iv_newstate = bwn_newstate;
1803 
1804 	/* override max aid so sta's cannot assoc when we're out of sta id's */
1805 	vap->iv_max_aid = BWN_STAID_MAX;
1806 
1807 	ieee80211_ratectl_init(vap);
1808 
1809 	/* complete setup */
1810 	ieee80211_vap_attach(vap, ieee80211_media_change,
1811 	    ieee80211_media_status, mac);
1812 	return (vap);
1813 }
1814 
1815 static void
1816 bwn_vap_delete(struct ieee80211vap *vap)
1817 {
1818 	struct bwn_vap *bvp = BWN_VAP(vap);
1819 
1820 	ieee80211_ratectl_deinit(vap);
1821 	ieee80211_vap_detach(vap);
1822 	free(bvp, M_80211_VAP);
1823 }
1824 
1825 static int
1826 bwn_init(struct bwn_softc *sc)
1827 {
1828 	struct bwn_mac *mac;
1829 	int error;
1830 
1831 	BWN_ASSERT_LOCKED(sc);
1832 
1833 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1834 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1835 	sc->sc_filters = 0;
1836 	bwn_wme_clear(sc);
1837 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1838 	sc->sc_rf_enabled = 1;
1839 
1840 	mac = sc->sc_curmac;
1841 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1842 		error = bwn_core_init(mac);
1843 		if (error != 0)
1844 			return (error);
1845 	}
1846 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1847 		bwn_core_start(mac);
1848 
1849 	bwn_set_opmode(mac);
1850 	bwn_set_pretbtt(mac);
1851 	bwn_spu_setdelay(mac, 0);
1852 	bwn_set_macaddr(mac);
1853 
1854 	sc->sc_flags |= BWN_FLAG_RUNNING;
1855 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1856 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1857 
1858 	return (0);
1859 }
1860 
1861 static void
1862 bwn_stop(struct bwn_softc *sc)
1863 {
1864 	struct bwn_mac *mac = sc->sc_curmac;
1865 
1866 	BWN_ASSERT_LOCKED(sc);
1867 
1868 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1869 		/* XXX FIXME opmode not based on VAP */
1870 		bwn_set_opmode(mac);
1871 		bwn_set_macaddr(mac);
1872 	}
1873 
1874 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1875 		bwn_core_stop(mac);
1876 
1877 	callout_stop(&sc->sc_led_blink_ch);
1878 	sc->sc_led_blinking = 0;
1879 
1880 	bwn_core_exit(mac);
1881 	sc->sc_rf_enabled = 0;
1882 
1883 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1884 }
1885 
1886 static void
1887 bwn_wme_clear(struct bwn_softc *sc)
1888 {
1889 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1890 	struct wmeParams *p;
1891 	unsigned int i;
1892 
1893 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1894 	    ("%s:%d: fail", __func__, __LINE__));
1895 
1896 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1897 		p = &(sc->sc_wmeParams[i]);
1898 
1899 		switch (bwn_wme_shm_offsets[i]) {
1900 		case BWN_WME_VOICE:
1901 			p->wmep_txopLimit = 0;
1902 			p->wmep_aifsn = 2;
1903 			/* XXX FIXME: log2(cwmin) */
1904 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1905 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1906 			break;
1907 		case BWN_WME_VIDEO:
1908 			p->wmep_txopLimit = 0;
1909 			p->wmep_aifsn = 2;
1910 			/* XXX FIXME: log2(cwmin) */
1911 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1912 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1913 			break;
1914 		case BWN_WME_BESTEFFORT:
1915 			p->wmep_txopLimit = 0;
1916 			p->wmep_aifsn = 3;
1917 			/* XXX FIXME: log2(cwmin) */
1918 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1919 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1920 			break;
1921 		case BWN_WME_BACKGROUND:
1922 			p->wmep_txopLimit = 0;
1923 			p->wmep_aifsn = 7;
1924 			/* XXX FIXME: log2(cwmin) */
1925 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1926 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1927 			break;
1928 		default:
1929 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1930 		}
1931 	}
1932 }
1933 
1934 static int
1935 bwn_core_init(struct bwn_mac *mac)
1936 {
1937 	struct bwn_softc *sc = mac->mac_sc;
1938 	uint64_t hf;
1939 	int error;
1940 
1941 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
1942 	    ("%s:%d: fail", __func__, __LINE__));
1943 
1944 	siba_powerup(sc->sc_dev, 0);
1945 	if (!siba_dev_isup(sc->sc_dev))
1946 		bwn_reset_core(mac,
1947 		    mac->mac_phy.gmode ? BWN_TGSLOW_SUPPORT_G : 0);
1948 
1949 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
1950 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
1951 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
1952 	BWN_GETTIME(mac->mac_phy.nexttime);
1953 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
1954 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
1955 	mac->mac_stats.link_noise = -95;
1956 	mac->mac_reason_intr = 0;
1957 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
1958 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
1959 #ifdef BWN_DEBUG
1960 	if (sc->sc_debug & BWN_DEBUG_XMIT)
1961 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
1962 #endif
1963 	mac->mac_suspended = 1;
1964 	mac->mac_task_state = 0;
1965 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
1966 
1967 	mac->mac_phy.init_pre(mac);
1968 
1969 	siba_pcicore_intr(sc->sc_dev);
1970 
1971 	siba_fix_imcfglobug(sc->sc_dev);
1972 	bwn_bt_disable(mac);
1973 	if (mac->mac_phy.prepare_hw) {
1974 		error = mac->mac_phy.prepare_hw(mac);
1975 		if (error)
1976 			goto fail0;
1977 	}
1978 	error = bwn_chip_init(mac);
1979 	if (error)
1980 		goto fail0;
1981 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
1982 	    siba_get_revid(sc->sc_dev));
1983 	hf = bwn_hf_read(mac);
1984 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1985 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
1986 		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
1987 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
1988 		if (mac->mac_phy.rev == 1)
1989 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
1990 	}
1991 	if (mac->mac_phy.rf_ver == 0x2050) {
1992 		if (mac->mac_phy.rf_rev < 6)
1993 			hf |= BWN_HF_FORCE_VCO_RECALC;
1994 		if (mac->mac_phy.rf_rev == 6)
1995 			hf |= BWN_HF_4318_TSSI;
1996 	}
1997 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
1998 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
1999 	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2000 	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2001 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2002 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2003 	bwn_hf_write(mac, hf);
2004 
2005 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2006 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2007 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2008 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2009 
2010 	bwn_rate_init(mac);
2011 	bwn_set_phytxctl(mac);
2012 
2013 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2014 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2015 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2016 
2017 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2018 		bwn_pio_init(mac);
2019 	else
2020 		bwn_dma_init(mac);
2021 	bwn_wme_init(mac);
2022 	bwn_spu_setdelay(mac, 1);
2023 	bwn_bt_enable(mac);
2024 
2025 	siba_powerup(sc->sc_dev,
2026 	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2027 	bwn_set_macaddr(mac);
2028 	bwn_crypt_init(mac);
2029 
2030 	/* XXX LED initializatin */
2031 
2032 	mac->mac_status = BWN_MAC_STATUS_INITED;
2033 
2034 	return (error);
2035 
2036 fail0:
2037 	siba_powerdown(sc->sc_dev);
2038 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2039 	    ("%s:%d: fail", __func__, __LINE__));
2040 	return (error);
2041 }
2042 
2043 static void
2044 bwn_core_start(struct bwn_mac *mac)
2045 {
2046 	struct bwn_softc *sc = mac->mac_sc;
2047 	uint32_t tmp;
2048 
2049 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2050 	    ("%s:%d: fail", __func__, __LINE__));
2051 
2052 	if (siba_get_revid(sc->sc_dev) < 5)
2053 		return;
2054 
2055 	while (1) {
2056 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2057 		if (!(tmp & 0x00000001))
2058 			break;
2059 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2060 	}
2061 
2062 	bwn_mac_enable(mac);
2063 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2064 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2065 
2066 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2067 }
2068 
2069 static void
2070 bwn_core_exit(struct bwn_mac *mac)
2071 {
2072 	struct bwn_softc *sc = mac->mac_sc;
2073 	uint32_t macctl;
2074 
2075 	BWN_ASSERT_LOCKED(mac->mac_sc);
2076 
2077 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2078 	    ("%s:%d: fail", __func__, __LINE__));
2079 
2080 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2081 		return;
2082 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2083 
2084 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2085 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2086 	macctl |= BWN_MACCTL_MCODE_JMP0;
2087 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2088 
2089 	bwn_dma_stop(mac);
2090 	bwn_pio_stop(mac);
2091 	bwn_chip_exit(mac);
2092 	mac->mac_phy.switch_analog(mac, 0);
2093 	siba_dev_down(sc->sc_dev, 0);
2094 	siba_powerdown(sc->sc_dev);
2095 }
2096 
2097 static void
2098 bwn_bt_disable(struct bwn_mac *mac)
2099 {
2100 	struct bwn_softc *sc = mac->mac_sc;
2101 
2102 	(void)sc;
2103 	/* XXX do nothing yet */
2104 }
2105 
2106 static int
2107 bwn_chip_init(struct bwn_mac *mac)
2108 {
2109 	struct bwn_softc *sc = mac->mac_sc;
2110 	struct bwn_phy *phy = &mac->mac_phy;
2111 	uint32_t macctl;
2112 	int error;
2113 
2114 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2115 	if (phy->gmode)
2116 		macctl |= BWN_MACCTL_GMODE;
2117 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2118 
2119 	error = bwn_fw_fillinfo(mac);
2120 	if (error)
2121 		return (error);
2122 	error = bwn_fw_loaducode(mac);
2123 	if (error)
2124 		return (error);
2125 
2126 	error = bwn_gpio_init(mac);
2127 	if (error)
2128 		return (error);
2129 
2130 	error = bwn_fw_loadinitvals(mac);
2131 	if (error) {
2132 		siba_gpio_set(sc->sc_dev, 0);
2133 		return (error);
2134 	}
2135 	phy->switch_analog(mac, 1);
2136 	error = bwn_phy_init(mac);
2137 	if (error) {
2138 		siba_gpio_set(sc->sc_dev, 0);
2139 		return (error);
2140 	}
2141 	if (phy->set_im)
2142 		phy->set_im(mac, BWN_IMMODE_NONE);
2143 	if (phy->set_antenna)
2144 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2145 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2146 
2147 	if (phy->type == BWN_PHYTYPE_B)
2148 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2149 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2150 	if (siba_get_revid(sc->sc_dev) < 5)
2151 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2152 
2153 	BWN_WRITE_4(mac, BWN_MACCTL,
2154 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2155 	BWN_WRITE_4(mac, BWN_MACCTL,
2156 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2157 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2158 
2159 	bwn_set_opmode(mac);
2160 	if (siba_get_revid(sc->sc_dev) < 3) {
2161 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2162 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2163 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2164 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2165 	} else {
2166 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2167 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2168 	}
2169 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2170 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2171 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2172 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2173 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2174 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2175 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2176 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
2177 	    siba_read_4(sc->sc_dev, SIBA_TGSLOW) | 0x00100000);
2178 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2179 	return (error);
2180 }
2181 
2182 /* read hostflags */
2183 uint64_t
2184 bwn_hf_read(struct bwn_mac *mac)
2185 {
2186 	uint64_t ret;
2187 
2188 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2189 	ret <<= 16;
2190 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2191 	ret <<= 16;
2192 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2193 	return (ret);
2194 }
2195 
2196 void
2197 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2198 {
2199 
2200 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2201 	    (value & 0x00000000ffffull));
2202 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2203 	    (value & 0x0000ffff0000ull) >> 16);
2204 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2205 	    (value & 0xffff00000000ULL) >> 32);
2206 }
2207 
2208 static void
2209 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2210 {
2211 
2212 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2213 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2214 }
2215 
2216 static void
2217 bwn_rate_init(struct bwn_mac *mac)
2218 {
2219 
2220 	switch (mac->mac_phy.type) {
2221 	case BWN_PHYTYPE_A:
2222 	case BWN_PHYTYPE_G:
2223 	case BWN_PHYTYPE_LP:
2224 	case BWN_PHYTYPE_N:
2225 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2226 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2227 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2228 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2229 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2230 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2231 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2232 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2233 			break;
2234 		/* FALLTHROUGH */
2235 	case BWN_PHYTYPE_B:
2236 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2237 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2238 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2239 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2240 		break;
2241 	default:
2242 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2243 	}
2244 }
2245 
2246 static void
2247 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2248 {
2249 	uint16_t offset;
2250 
2251 	if (ofdm) {
2252 		offset = 0x480;
2253 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2254 	} else {
2255 		offset = 0x4c0;
2256 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2257 	}
2258 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2259 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2260 }
2261 
2262 static uint8_t
2263 bwn_plcp_getcck(const uint8_t bitrate)
2264 {
2265 
2266 	switch (bitrate) {
2267 	case BWN_CCK_RATE_1MB:
2268 		return (0x0a);
2269 	case BWN_CCK_RATE_2MB:
2270 		return (0x14);
2271 	case BWN_CCK_RATE_5MB:
2272 		return (0x37);
2273 	case BWN_CCK_RATE_11MB:
2274 		return (0x6e);
2275 	}
2276 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2277 	return (0);
2278 }
2279 
2280 static uint8_t
2281 bwn_plcp_getofdm(const uint8_t bitrate)
2282 {
2283 
2284 	switch (bitrate) {
2285 	case BWN_OFDM_RATE_6MB:
2286 		return (0xb);
2287 	case BWN_OFDM_RATE_9MB:
2288 		return (0xf);
2289 	case BWN_OFDM_RATE_12MB:
2290 		return (0xa);
2291 	case BWN_OFDM_RATE_18MB:
2292 		return (0xe);
2293 	case BWN_OFDM_RATE_24MB:
2294 		return (0x9);
2295 	case BWN_OFDM_RATE_36MB:
2296 		return (0xd);
2297 	case BWN_OFDM_RATE_48MB:
2298 		return (0x8);
2299 	case BWN_OFDM_RATE_54MB:
2300 		return (0xc);
2301 	}
2302 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2303 	return (0);
2304 }
2305 
2306 static void
2307 bwn_set_phytxctl(struct bwn_mac *mac)
2308 {
2309 	uint16_t ctl;
2310 
2311 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2312 	    BWN_TX_PHY_TXPWR);
2313 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2314 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2315 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2316 }
2317 
2318 static void
2319 bwn_pio_init(struct bwn_mac *mac)
2320 {
2321 	struct bwn_pio *pio = &mac->mac_method.pio;
2322 
2323 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2324 	    & ~BWN_MACCTL_BIGENDIAN);
2325 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2326 
2327 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2328 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2329 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2330 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2331 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2332 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2333 }
2334 
2335 static void
2336 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2337     int index)
2338 {
2339 	struct bwn_pio_txpkt *tp;
2340 	struct bwn_softc *sc = mac->mac_sc;
2341 	unsigned int i;
2342 
2343 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2344 	tq->tq_index = index;
2345 
2346 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2347 	if (siba_get_revid(sc->sc_dev) >= 8)
2348 		tq->tq_size = 1920;
2349 	else {
2350 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2351 		tq->tq_size -= 80;
2352 	}
2353 
2354 	TAILQ_INIT(&tq->tq_pktlist);
2355 	for (i = 0; i < N(tq->tq_pkts); i++) {
2356 		tp = &(tq->tq_pkts[i]);
2357 		tp->tp_index = i;
2358 		tp->tp_queue = tq;
2359 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2360 	}
2361 }
2362 
2363 static uint16_t
2364 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2365 {
2366 	struct bwn_softc *sc = mac->mac_sc;
2367 	static const uint16_t bases[] = {
2368 		BWN_PIO_BASE0,
2369 		BWN_PIO_BASE1,
2370 		BWN_PIO_BASE2,
2371 		BWN_PIO_BASE3,
2372 		BWN_PIO_BASE4,
2373 		BWN_PIO_BASE5,
2374 		BWN_PIO_BASE6,
2375 		BWN_PIO_BASE7,
2376 	};
2377 	static const uint16_t bases_rev11[] = {
2378 		BWN_PIO11_BASE0,
2379 		BWN_PIO11_BASE1,
2380 		BWN_PIO11_BASE2,
2381 		BWN_PIO11_BASE3,
2382 		BWN_PIO11_BASE4,
2383 		BWN_PIO11_BASE5,
2384 	};
2385 
2386 	if (siba_get_revid(sc->sc_dev) >= 11) {
2387 		if (index >= N(bases_rev11))
2388 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2389 		return (bases_rev11[index]);
2390 	}
2391 	if (index >= N(bases))
2392 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2393 	return (bases[index]);
2394 }
2395 
2396 static void
2397 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2398     int index)
2399 {
2400 	struct bwn_softc *sc = mac->mac_sc;
2401 
2402 	prq->prq_mac = mac;
2403 	prq->prq_rev = siba_get_revid(sc->sc_dev);
2404 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2405 	bwn_dma_rxdirectfifo(mac, index, 1);
2406 }
2407 
2408 static void
2409 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2410 {
2411 	if (tq == NULL)
2412 		return;
2413 	bwn_pio_cancel_tx_packets(tq);
2414 }
2415 
2416 static void
2417 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2418 {
2419 
2420 	bwn_destroy_pioqueue_tx(pio);
2421 }
2422 
2423 static uint16_t
2424 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2425     uint16_t offset)
2426 {
2427 
2428 	return (BWN_READ_2(mac, tq->tq_base + offset));
2429 }
2430 
2431 static void
2432 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2433 {
2434 	uint32_t ctl;
2435 	int type;
2436 	uint16_t base;
2437 
2438 	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2439 	base = bwn_dma_base(type, idx);
2440 	if (type == BWN_DMA_64BIT) {
2441 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2442 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2443 		if (enable)
2444 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2445 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2446 	} else {
2447 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2448 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2449 		if (enable)
2450 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2451 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2452 	}
2453 }
2454 
2455 static uint64_t
2456 bwn_dma_mask(struct bwn_mac *mac)
2457 {
2458 	uint32_t tmp;
2459 	uint16_t base;
2460 
2461 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2462 	if (tmp & SIBA_TGSHIGH_DMA64)
2463 		return (BWN_DMA_BIT_MASK(64));
2464 	base = bwn_dma_base(0, 0);
2465 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2466 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2467 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2468 		return (BWN_DMA_BIT_MASK(32));
2469 
2470 	return (BWN_DMA_BIT_MASK(30));
2471 }
2472 
2473 static int
2474 bwn_dma_mask2type(uint64_t dmamask)
2475 {
2476 
2477 	if (dmamask == BWN_DMA_BIT_MASK(30))
2478 		return (BWN_DMA_30BIT);
2479 	if (dmamask == BWN_DMA_BIT_MASK(32))
2480 		return (BWN_DMA_32BIT);
2481 	if (dmamask == BWN_DMA_BIT_MASK(64))
2482 		return (BWN_DMA_64BIT);
2483 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2484 	return (BWN_DMA_30BIT);
2485 }
2486 
2487 static void
2488 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2489 {
2490 	struct bwn_pio_txpkt *tp;
2491 	unsigned int i;
2492 
2493 	for (i = 0; i < N(tq->tq_pkts); i++) {
2494 		tp = &(tq->tq_pkts[i]);
2495 		if (tp->tp_m) {
2496 			m_freem(tp->tp_m);
2497 			tp->tp_m = NULL;
2498 		}
2499 	}
2500 }
2501 
2502 static uint16_t
2503 bwn_dma_base(int type, int controller_idx)
2504 {
2505 	static const uint16_t map64[] = {
2506 		BWN_DMA64_BASE0,
2507 		BWN_DMA64_BASE1,
2508 		BWN_DMA64_BASE2,
2509 		BWN_DMA64_BASE3,
2510 		BWN_DMA64_BASE4,
2511 		BWN_DMA64_BASE5,
2512 	};
2513 	static const uint16_t map32[] = {
2514 		BWN_DMA32_BASE0,
2515 		BWN_DMA32_BASE1,
2516 		BWN_DMA32_BASE2,
2517 		BWN_DMA32_BASE3,
2518 		BWN_DMA32_BASE4,
2519 		BWN_DMA32_BASE5,
2520 	};
2521 
2522 	if (type == BWN_DMA_64BIT) {
2523 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2524 		    ("%s:%d: fail", __func__, __LINE__));
2525 		return (map64[controller_idx]);
2526 	}
2527 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2528 	    ("%s:%d: fail", __func__, __LINE__));
2529 	return (map32[controller_idx]);
2530 }
2531 
2532 static void
2533 bwn_dma_init(struct bwn_mac *mac)
2534 {
2535 	struct bwn_dma *dma = &mac->mac_method.dma;
2536 
2537 	/* setup TX DMA channels. */
2538 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2539 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2540 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2541 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2542 	bwn_dma_setup(dma->mcast);
2543 	/* setup RX DMA channel. */
2544 	bwn_dma_setup(dma->rx);
2545 }
2546 
2547 static struct bwn_dma_ring *
2548 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2549     int for_tx, int type)
2550 {
2551 	struct bwn_dma *dma = &mac->mac_method.dma;
2552 	struct bwn_dma_ring *dr;
2553 	struct bwn_dmadesc_generic *desc;
2554 	struct bwn_dmadesc_meta *mt;
2555 	struct bwn_softc *sc = mac->mac_sc;
2556 	int error, i;
2557 
2558 	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2559 	if (dr == NULL)
2560 		goto out;
2561 	dr->dr_numslots = BWN_RXRING_SLOTS;
2562 	if (for_tx)
2563 		dr->dr_numslots = BWN_TXRING_SLOTS;
2564 
2565 	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2566 	    M_DEVBUF, M_NOWAIT | M_ZERO);
2567 	if (dr->dr_meta == NULL)
2568 		goto fail0;
2569 
2570 	dr->dr_type = type;
2571 	dr->dr_mac = mac;
2572 	dr->dr_base = bwn_dma_base(type, controller_index);
2573 	dr->dr_index = controller_index;
2574 	if (type == BWN_DMA_64BIT) {
2575 		dr->getdesc = bwn_dma_64_getdesc;
2576 		dr->setdesc = bwn_dma_64_setdesc;
2577 		dr->start_transfer = bwn_dma_64_start_transfer;
2578 		dr->suspend = bwn_dma_64_suspend;
2579 		dr->resume = bwn_dma_64_resume;
2580 		dr->get_curslot = bwn_dma_64_get_curslot;
2581 		dr->set_curslot = bwn_dma_64_set_curslot;
2582 	} else {
2583 		dr->getdesc = bwn_dma_32_getdesc;
2584 		dr->setdesc = bwn_dma_32_setdesc;
2585 		dr->start_transfer = bwn_dma_32_start_transfer;
2586 		dr->suspend = bwn_dma_32_suspend;
2587 		dr->resume = bwn_dma_32_resume;
2588 		dr->get_curslot = bwn_dma_32_get_curslot;
2589 		dr->set_curslot = bwn_dma_32_set_curslot;
2590 	}
2591 	if (for_tx) {
2592 		dr->dr_tx = 1;
2593 		dr->dr_curslot = -1;
2594 	} else {
2595 		if (dr->dr_index == 0) {
2596 			dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2597 			dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2598 		} else
2599 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2600 	}
2601 
2602 	error = bwn_dma_allocringmemory(dr);
2603 	if (error)
2604 		goto fail2;
2605 
2606 	if (for_tx) {
2607 		/*
2608 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2609 		 * BWN_TX_SLOTS_PER_FRAME
2610 		 */
2611 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2612 		    ("%s:%d: fail", __func__, __LINE__));
2613 
2614 		dr->dr_txhdr_cache =
2615 		    malloc((dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2616 			BWN_HDRSIZE(mac), M_DEVBUF, M_NOWAIT | M_ZERO);
2617 		KASSERT(dr->dr_txhdr_cache != NULL,
2618 		    ("%s:%d: fail", __func__, __LINE__));
2619 
2620 		/*
2621 		 * Create TX ring DMA stuffs
2622 		 */
2623 		error = bus_dma_tag_create(dma->parent_dtag,
2624 				    BWN_ALIGN, 0,
2625 				    BUS_SPACE_MAXADDR,
2626 				    BUS_SPACE_MAXADDR,
2627 				    NULL, NULL,
2628 				    BWN_HDRSIZE(mac),
2629 				    1,
2630 				    BUS_SPACE_MAXSIZE_32BIT,
2631 				    0,
2632 				    NULL, NULL,
2633 				    &dr->dr_txring_dtag);
2634 		if (error) {
2635 			device_printf(sc->sc_dev,
2636 			    "can't create TX ring DMA tag: TODO frees\n");
2637 			goto fail1;
2638 		}
2639 
2640 		for (i = 0; i < dr->dr_numslots; i += 2) {
2641 			dr->getdesc(dr, i, &desc, &mt);
2642 
2643 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2644 			mt->mt_m = NULL;
2645 			mt->mt_ni = NULL;
2646 			mt->mt_islast = 0;
2647 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2648 			    &mt->mt_dmap);
2649 			if (error) {
2650 				device_printf(sc->sc_dev,
2651 				     "can't create RX buf DMA map\n");
2652 				goto fail1;
2653 			}
2654 
2655 			dr->getdesc(dr, i + 1, &desc, &mt);
2656 
2657 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2658 			mt->mt_m = NULL;
2659 			mt->mt_ni = NULL;
2660 			mt->mt_islast = 1;
2661 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2662 			    &mt->mt_dmap);
2663 			if (error) {
2664 				device_printf(sc->sc_dev,
2665 				     "can't create RX buf DMA map\n");
2666 				goto fail1;
2667 			}
2668 		}
2669 	} else {
2670 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2671 		    &dr->dr_spare_dmap);
2672 		if (error) {
2673 			device_printf(sc->sc_dev,
2674 			    "can't create RX buf DMA map\n");
2675 			goto out;		/* XXX wrong! */
2676 		}
2677 
2678 		for (i = 0; i < dr->dr_numslots; i++) {
2679 			dr->getdesc(dr, i, &desc, &mt);
2680 
2681 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2682 			    &mt->mt_dmap);
2683 			if (error) {
2684 				device_printf(sc->sc_dev,
2685 				    "can't create RX buf DMA map\n");
2686 				goto out;	/* XXX wrong! */
2687 			}
2688 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2689 			if (error) {
2690 				device_printf(sc->sc_dev,
2691 				    "failed to allocate RX buf\n");
2692 				goto out;	/* XXX wrong! */
2693 			}
2694 		}
2695 
2696 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2697 		    BUS_DMASYNC_PREWRITE);
2698 
2699 		dr->dr_usedslot = dr->dr_numslots;
2700 	}
2701 
2702       out:
2703 	return (dr);
2704 
2705 fail2:
2706 	free(dr->dr_txhdr_cache, M_DEVBUF);
2707 fail1:
2708 	free(dr->dr_meta, M_DEVBUF);
2709 fail0:
2710 	free(dr, M_DEVBUF);
2711 	return (NULL);
2712 }
2713 
2714 static void
2715 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2716 {
2717 
2718 	if (dr == NULL)
2719 		return;
2720 
2721 	bwn_dma_free_descbufs(*dr);
2722 	bwn_dma_free_ringmemory(*dr);
2723 
2724 	free((*dr)->dr_txhdr_cache, M_DEVBUF);
2725 	free((*dr)->dr_meta, M_DEVBUF);
2726 	free(*dr, M_DEVBUF);
2727 
2728 	*dr = NULL;
2729 }
2730 
2731 static void
2732 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2733     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2734 {
2735 	struct bwn_dmadesc32 *desc;
2736 
2737 	*meta = &(dr->dr_meta[slot]);
2738 	desc = dr->dr_ring_descbase;
2739 	desc = &(desc[slot]);
2740 
2741 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2742 }
2743 
2744 static void
2745 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2746     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2747     int start, int end, int irq)
2748 {
2749 	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2750 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2751 	uint32_t addr, addrext, ctl;
2752 	int slot;
2753 
2754 	slot = (int)(&(desc->dma.dma32) - descbase);
2755 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2756 	    ("%s:%d: fail", __func__, __LINE__));
2757 
2758 	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2759 	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2760 	addr |= siba_dma_translation(sc->sc_dev);
2761 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2762 	if (slot == dr->dr_numslots - 1)
2763 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2764 	if (start)
2765 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2766 	if (end)
2767 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2768 	if (irq)
2769 		ctl |= BWN_DMA32_DCTL_IRQ;
2770 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2771 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2772 
2773 	desc->dma.dma32.control = htole32(ctl);
2774 	desc->dma.dma32.address = htole32(addr);
2775 }
2776 
2777 static void
2778 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2779 {
2780 
2781 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2782 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2783 }
2784 
2785 static void
2786 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2787 {
2788 
2789 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2790 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2791 }
2792 
2793 static void
2794 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2795 {
2796 
2797 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2798 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2799 }
2800 
2801 static int
2802 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2803 {
2804 	uint32_t val;
2805 
2806 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2807 	val &= BWN_DMA32_RXDPTR;
2808 
2809 	return (val / sizeof(struct bwn_dmadesc32));
2810 }
2811 
2812 static void
2813 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2814 {
2815 
2816 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2817 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2818 }
2819 
2820 static void
2821 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2822     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2823 {
2824 	struct bwn_dmadesc64 *desc;
2825 
2826 	*meta = &(dr->dr_meta[slot]);
2827 	desc = dr->dr_ring_descbase;
2828 	desc = &(desc[slot]);
2829 
2830 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2831 }
2832 
2833 static void
2834 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2835     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2836     int start, int end, int irq)
2837 {
2838 	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2839 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2840 	int slot;
2841 	uint32_t ctl0 = 0, ctl1 = 0;
2842 	uint32_t addrlo, addrhi;
2843 	uint32_t addrext;
2844 
2845 	slot = (int)(&(desc->dma.dma64) - descbase);
2846 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2847 	    ("%s:%d: fail", __func__, __LINE__));
2848 
2849 	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2850 	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2851 	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2852 	    30;
2853 	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2854 	if (slot == dr->dr_numslots - 1)
2855 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2856 	if (start)
2857 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2858 	if (end)
2859 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2860 	if (irq)
2861 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2862 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2863 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2864 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2865 
2866 	desc->dma.dma64.control0 = htole32(ctl0);
2867 	desc->dma.dma64.control1 = htole32(ctl1);
2868 	desc->dma.dma64.address_low = htole32(addrlo);
2869 	desc->dma.dma64.address_high = htole32(addrhi);
2870 }
2871 
2872 static void
2873 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2874 {
2875 
2876 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2877 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2878 }
2879 
2880 static void
2881 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2882 {
2883 
2884 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2885 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2886 }
2887 
2888 static void
2889 bwn_dma_64_resume(struct bwn_dma_ring *dr)
2890 {
2891 
2892 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2893 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
2894 }
2895 
2896 static int
2897 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
2898 {
2899 	uint32_t val;
2900 
2901 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
2902 	val &= BWN_DMA64_RXSTATDPTR;
2903 
2904 	return (val / sizeof(struct bwn_dmadesc64));
2905 }
2906 
2907 static void
2908 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
2909 {
2910 
2911 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
2912 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2913 }
2914 
2915 static int
2916 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
2917 {
2918 	struct bwn_mac *mac = dr->dr_mac;
2919 	struct bwn_dma *dma = &mac->mac_method.dma;
2920 	struct bwn_softc *sc = mac->mac_sc;
2921 	int error;
2922 
2923 	error = bus_dma_tag_create(dma->parent_dtag,
2924 			    BWN_ALIGN, 0,
2925 			    BUS_SPACE_MAXADDR,
2926 			    BUS_SPACE_MAXADDR,
2927 			    NULL, NULL,
2928 			    BWN_DMA_RINGMEMSIZE,
2929 			    1,
2930 			    BUS_SPACE_MAXSIZE_32BIT,
2931 			    0,
2932 			    NULL, NULL,
2933 			    &dr->dr_ring_dtag);
2934 	if (error) {
2935 		device_printf(sc->sc_dev,
2936 		    "can't create TX ring DMA tag: TODO frees\n");
2937 		return (-1);
2938 	}
2939 
2940 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
2941 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
2942 	    &dr->dr_ring_dmap);
2943 	if (error) {
2944 		device_printf(sc->sc_dev,
2945 		    "can't allocate DMA mem: TODO frees\n");
2946 		return (-1);
2947 	}
2948 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
2949 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
2950 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
2951 	if (error) {
2952 		device_printf(sc->sc_dev,
2953 		    "can't load DMA mem: TODO free\n");
2954 		return (-1);
2955 	}
2956 
2957 	return (0);
2958 }
2959 
2960 static void
2961 bwn_dma_setup(struct bwn_dma_ring *dr)
2962 {
2963 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2964 	uint64_t ring64;
2965 	uint32_t addrext, ring32, value;
2966 	uint32_t trans = siba_dma_translation(sc->sc_dev);
2967 
2968 	if (dr->dr_tx) {
2969 		dr->dr_curslot = -1;
2970 
2971 		if (dr->dr_type == BWN_DMA_64BIT) {
2972 			ring64 = (uint64_t)(dr->dr_ring_dmabase);
2973 			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
2974 			    >> 30;
2975 			value = BWN_DMA64_TXENABLE;
2976 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
2977 			    & BWN_DMA64_TXADDREXT_MASK;
2978 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
2979 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
2980 			    (ring64 & 0xffffffff));
2981 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
2982 			    ((ring64 >> 32) &
2983 			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
2984 		} else {
2985 			ring32 = (uint32_t)(dr->dr_ring_dmabase);
2986 			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
2987 			value = BWN_DMA32_TXENABLE;
2988 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
2989 			    & BWN_DMA32_TXADDREXT_MASK;
2990 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
2991 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
2992 			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
2993 		}
2994 		return;
2995 	}
2996 
2997 	/*
2998 	 * set for RX
2999 	 */
3000 	dr->dr_usedslot = dr->dr_numslots;
3001 
3002 	if (dr->dr_type == BWN_DMA_64BIT) {
3003 		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3004 		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3005 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3006 		value |= BWN_DMA64_RXENABLE;
3007 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3008 		    & BWN_DMA64_RXADDREXT_MASK;
3009 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3010 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3011 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3012 		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3013 		    | (trans << 1));
3014 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3015 		    sizeof(struct bwn_dmadesc64));
3016 	} else {
3017 		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3018 		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3019 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3020 		value |= BWN_DMA32_RXENABLE;
3021 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3022 		    & BWN_DMA32_RXADDREXT_MASK;
3023 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3024 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3025 		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3026 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3027 		    sizeof(struct bwn_dmadesc32));
3028 	}
3029 }
3030 
3031 static void
3032 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3033 {
3034 
3035 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3036 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3037 	    dr->dr_ring_dmap);
3038 }
3039 
3040 static void
3041 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3042 {
3043 
3044 	if (dr->dr_tx) {
3045 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3046 		if (dr->dr_type == BWN_DMA_64BIT) {
3047 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3048 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3049 		} else
3050 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3051 	} else {
3052 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3053 		if (dr->dr_type == BWN_DMA_64BIT) {
3054 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3055 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3056 		} else
3057 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3058 	}
3059 }
3060 
3061 static void
3062 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3063 {
3064 	struct bwn_dmadesc_generic *desc;
3065 	struct bwn_dmadesc_meta *meta;
3066 	struct bwn_mac *mac = dr->dr_mac;
3067 	struct bwn_dma *dma = &mac->mac_method.dma;
3068 	struct bwn_softc *sc = mac->mac_sc;
3069 	int i;
3070 
3071 	if (!dr->dr_usedslot)
3072 		return;
3073 	for (i = 0; i < dr->dr_numslots; i++) {
3074 		dr->getdesc(dr, i, &desc, &meta);
3075 
3076 		if (meta->mt_m == NULL) {
3077 			if (!dr->dr_tx)
3078 				device_printf(sc->sc_dev, "%s: not TX?\n",
3079 				    __func__);
3080 			continue;
3081 		}
3082 		if (dr->dr_tx) {
3083 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3084 				bus_dmamap_unload(dr->dr_txring_dtag,
3085 				    meta->mt_dmap);
3086 			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3087 				bus_dmamap_unload(dma->txbuf_dtag,
3088 				    meta->mt_dmap);
3089 		} else
3090 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3091 		bwn_dma_free_descbuf(dr, meta);
3092 	}
3093 }
3094 
3095 static int
3096 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3097     int type)
3098 {
3099 	struct bwn_softc *sc = mac->mac_sc;
3100 	uint32_t value;
3101 	int i;
3102 	uint16_t offset;
3103 
3104 	for (i = 0; i < 10; i++) {
3105 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3106 		    BWN_DMA32_TXSTATUS;
3107 		value = BWN_READ_4(mac, base + offset);
3108 		if (type == BWN_DMA_64BIT) {
3109 			value &= BWN_DMA64_TXSTAT;
3110 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3111 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3112 			    value == BWN_DMA64_TXSTAT_STOPPED)
3113 				break;
3114 		} else {
3115 			value &= BWN_DMA32_TXSTATE;
3116 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3117 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3118 			    value == BWN_DMA32_TXSTAT_STOPPED)
3119 				break;
3120 		}
3121 		DELAY(1000);
3122 	}
3123 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3124 	BWN_WRITE_4(mac, base + offset, 0);
3125 	for (i = 0; i < 10; i++) {
3126 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3127 						   BWN_DMA32_TXSTATUS;
3128 		value = BWN_READ_4(mac, base + offset);
3129 		if (type == BWN_DMA_64BIT) {
3130 			value &= BWN_DMA64_TXSTAT;
3131 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3132 				i = -1;
3133 				break;
3134 			}
3135 		} else {
3136 			value &= BWN_DMA32_TXSTATE;
3137 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3138 				i = -1;
3139 				break;
3140 			}
3141 		}
3142 		DELAY(1000);
3143 	}
3144 	if (i != -1) {
3145 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3146 		return (ENODEV);
3147 	}
3148 	DELAY(1000);
3149 
3150 	return (0);
3151 }
3152 
3153 static int
3154 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3155     int type)
3156 {
3157 	struct bwn_softc *sc = mac->mac_sc;
3158 	uint32_t value;
3159 	int i;
3160 	uint16_t offset;
3161 
3162 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3163 	BWN_WRITE_4(mac, base + offset, 0);
3164 	for (i = 0; i < 10; i++) {
3165 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3166 		    BWN_DMA32_RXSTATUS;
3167 		value = BWN_READ_4(mac, base + offset);
3168 		if (type == BWN_DMA_64BIT) {
3169 			value &= BWN_DMA64_RXSTAT;
3170 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3171 				i = -1;
3172 				break;
3173 			}
3174 		} else {
3175 			value &= BWN_DMA32_RXSTATE;
3176 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3177 				i = -1;
3178 				break;
3179 			}
3180 		}
3181 		DELAY(1000);
3182 	}
3183 	if (i != -1) {
3184 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3185 		return (ENODEV);
3186 	}
3187 
3188 	return (0);
3189 }
3190 
3191 static void
3192 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3193     struct bwn_dmadesc_meta *meta)
3194 {
3195 
3196 	if (meta->mt_m != NULL) {
3197 		m_freem(meta->mt_m);
3198 		meta->mt_m = NULL;
3199 	}
3200 	if (meta->mt_ni != NULL) {
3201 		ieee80211_free_node(meta->mt_ni);
3202 		meta->mt_ni = NULL;
3203 	}
3204 }
3205 
3206 static void
3207 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3208 {
3209 	struct bwn_rxhdr4 *rxhdr;
3210 	unsigned char *frame;
3211 
3212 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3213 	rxhdr->frame_len = 0;
3214 
3215 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3216 	    sizeof(struct bwn_plcp6) + 2,
3217 	    ("%s:%d: fail", __func__, __LINE__));
3218 	frame = mtod(m, char *) + dr->dr_frameoffset;
3219 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3220 }
3221 
3222 static uint8_t
3223 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3224 {
3225 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3226 
3227 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3228 	    == 0xff);
3229 }
3230 
3231 static void
3232 bwn_wme_init(struct bwn_mac *mac)
3233 {
3234 
3235 	bwn_wme_load(mac);
3236 
3237 	/* enable WME support. */
3238 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3239 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3240 	    BWN_IFSCTL_USE_EDCF);
3241 }
3242 
3243 static void
3244 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3245 {
3246 	struct bwn_softc *sc = mac->mac_sc;
3247 	struct ieee80211com *ic = &sc->sc_ic;
3248 	uint16_t delay;	/* microsec */
3249 
3250 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3251 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3252 		delay = 500;
3253 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3254 		delay = max(delay, (uint16_t)2400);
3255 
3256 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3257 }
3258 
3259 static void
3260 bwn_bt_enable(struct bwn_mac *mac)
3261 {
3262 	struct bwn_softc *sc = mac->mac_sc;
3263 	uint64_t hf;
3264 
3265 	if (bwn_bluetooth == 0)
3266 		return;
3267 	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3268 		return;
3269 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3270 		return;
3271 
3272 	hf = bwn_hf_read(mac);
3273 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3274 		hf |= BWN_HF_BT_COEXISTALT;
3275 	else
3276 		hf |= BWN_HF_BT_COEXIST;
3277 	bwn_hf_write(mac, hf);
3278 }
3279 
3280 static void
3281 bwn_set_macaddr(struct bwn_mac *mac)
3282 {
3283 
3284 	bwn_mac_write_bssid(mac);
3285 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3286 	    mac->mac_sc->sc_ic.ic_macaddr);
3287 }
3288 
3289 static void
3290 bwn_clear_keys(struct bwn_mac *mac)
3291 {
3292 	int i;
3293 
3294 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3295 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3296 		    ("%s:%d: fail", __func__, __LINE__));
3297 
3298 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3299 		    NULL, BWN_SEC_KEYSIZE, NULL);
3300 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3301 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3302 			    NULL, BWN_SEC_KEYSIZE, NULL);
3303 		}
3304 		mac->mac_key[i].keyconf = NULL;
3305 	}
3306 }
3307 
3308 static void
3309 bwn_crypt_init(struct bwn_mac *mac)
3310 {
3311 	struct bwn_softc *sc = mac->mac_sc;
3312 
3313 	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3314 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3315 	    ("%s:%d: fail", __func__, __LINE__));
3316 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3317 	mac->mac_ktp *= 2;
3318 	if (siba_get_revid(sc->sc_dev) >= 5)
3319 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3320 	bwn_clear_keys(mac);
3321 }
3322 
3323 static void
3324 bwn_chip_exit(struct bwn_mac *mac)
3325 {
3326 	struct bwn_softc *sc = mac->mac_sc;
3327 
3328 	bwn_phy_exit(mac);
3329 	siba_gpio_set(sc->sc_dev, 0);
3330 }
3331 
3332 static int
3333 bwn_fw_fillinfo(struct bwn_mac *mac)
3334 {
3335 	int error;
3336 
3337 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3338 	if (error == 0)
3339 		return (0);
3340 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3341 	if (error == 0)
3342 		return (0);
3343 	return (error);
3344 }
3345 
3346 static int
3347 bwn_gpio_init(struct bwn_mac *mac)
3348 {
3349 	struct bwn_softc *sc = mac->mac_sc;
3350 	uint32_t mask = 0x1f, set = 0xf, value;
3351 
3352 	BWN_WRITE_4(mac, BWN_MACCTL,
3353 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3354 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3355 	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3356 
3357 	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3358 		mask |= 0x0060;
3359 		set |= 0x0060;
3360 	}
3361 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3362 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3363 		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3364 		mask |= 0x0200;
3365 		set |= 0x0200;
3366 	}
3367 	if (siba_get_revid(sc->sc_dev) >= 2)
3368 		mask |= 0x0010;
3369 
3370 	value = siba_gpio_get(sc->sc_dev);
3371 	if (value == -1)
3372 		return (0);
3373 	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3374 
3375 	return (0);
3376 }
3377 
3378 static int
3379 bwn_fw_loadinitvals(struct bwn_mac *mac)
3380 {
3381 #define	GETFWOFFSET(fwp, offset)				\
3382 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3383 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3384 	const struct bwn_fwhdr *hdr;
3385 	struct bwn_fw *fw = &mac->mac_fw;
3386 	int error;
3387 
3388 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3389 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3390 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3391 	if (error)
3392 		return (error);
3393 	if (fw->initvals_band.fw) {
3394 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3395 		error = bwn_fwinitvals_write(mac,
3396 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3397 		    be32toh(hdr->size),
3398 		    fw->initvals_band.fw->datasize - hdr_len);
3399 	}
3400 	return (error);
3401 #undef GETFWOFFSET
3402 }
3403 
3404 static int
3405 bwn_phy_init(struct bwn_mac *mac)
3406 {
3407 	struct bwn_softc *sc = mac->mac_sc;
3408 	int error;
3409 
3410 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3411 	mac->mac_phy.rf_onoff(mac, 1);
3412 	error = mac->mac_phy.init(mac);
3413 	if (error) {
3414 		device_printf(sc->sc_dev, "PHY init failed\n");
3415 		goto fail0;
3416 	}
3417 	error = bwn_switch_channel(mac,
3418 	    mac->mac_phy.get_default_chan(mac));
3419 	if (error) {
3420 		device_printf(sc->sc_dev,
3421 		    "failed to switch default channel\n");
3422 		goto fail1;
3423 	}
3424 	return (0);
3425 fail1:
3426 	if (mac->mac_phy.exit)
3427 		mac->mac_phy.exit(mac);
3428 fail0:
3429 	mac->mac_phy.rf_onoff(mac, 0);
3430 
3431 	return (error);
3432 }
3433 
3434 static void
3435 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3436 {
3437 	uint16_t ant;
3438 	uint16_t tmp;
3439 
3440 	ant = bwn_ant2phy(antenna);
3441 
3442 	/* For ACK/CTS */
3443 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3444 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3445 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3446 	/* For Probe Resposes */
3447 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3448 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3449 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3450 }
3451 
3452 static void
3453 bwn_set_opmode(struct bwn_mac *mac)
3454 {
3455 	struct bwn_softc *sc = mac->mac_sc;
3456 	struct ieee80211com *ic = &sc->sc_ic;
3457 	uint32_t ctl;
3458 	uint16_t cfp_pretbtt;
3459 
3460 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3461 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3462 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3463 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3464 	ctl |= BWN_MACCTL_STA;
3465 
3466 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3467 	    ic->ic_opmode == IEEE80211_M_MBSS)
3468 		ctl |= BWN_MACCTL_HOSTAP;
3469 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3470 		ctl &= ~BWN_MACCTL_STA;
3471 	ctl |= sc->sc_filters;
3472 
3473 	if (siba_get_revid(sc->sc_dev) <= 4)
3474 		ctl |= BWN_MACCTL_PROMISC;
3475 
3476 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3477 
3478 	cfp_pretbtt = 2;
3479 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3480 		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3481 		    siba_get_chiprev(sc->sc_dev) == 3)
3482 			cfp_pretbtt = 100;
3483 		else
3484 			cfp_pretbtt = 50;
3485 	}
3486 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3487 }
3488 
3489 static int
3490 bwn_dma_gettype(struct bwn_mac *mac)
3491 {
3492 	uint32_t tmp;
3493 	uint16_t base;
3494 
3495 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3496 	if (tmp & SIBA_TGSHIGH_DMA64)
3497 		return (BWN_DMA_64BIT);
3498 	base = bwn_dma_base(0, 0);
3499 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3500 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3501 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3502 		return (BWN_DMA_32BIT);
3503 
3504 	return (BWN_DMA_30BIT);
3505 }
3506 
3507 static void
3508 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3509 {
3510 	if (!error) {
3511 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3512 		*((bus_addr_t *)arg) = seg->ds_addr;
3513 	}
3514 }
3515 
3516 void
3517 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3518 {
3519 	struct bwn_phy *phy = &mac->mac_phy;
3520 	struct bwn_softc *sc = mac->mac_sc;
3521 	unsigned int i, max_loop;
3522 	uint16_t value;
3523 	uint32_t buffer[5] = {
3524 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3525 	};
3526 
3527 	if (ofdm) {
3528 		max_loop = 0x1e;
3529 		buffer[0] = 0x000201cc;
3530 	} else {
3531 		max_loop = 0xfa;
3532 		buffer[0] = 0x000b846e;
3533 	}
3534 
3535 	BWN_ASSERT_LOCKED(mac->mac_sc);
3536 
3537 	for (i = 0; i < 5; i++)
3538 		bwn_ram_write(mac, i * 4, buffer[i]);
3539 
3540 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3541 	BWN_WRITE_2(mac, 0x07c0,
3542 	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3543 
3544 	value = (ofdm ? 0x41 : 0x40);
3545 	BWN_WRITE_2(mac, 0x050c, value);
3546 
3547 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3548 	    phy->type == BWN_PHYTYPE_LCN)
3549 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3550 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3551 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3552 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3553 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3554 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3555 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3556 
3557 	/* XXX TODO: n phy pa override? */
3558 
3559 	switch (phy->type) {
3560 	case BWN_PHYTYPE_N:
3561 	case BWN_PHYTYPE_LCN:
3562 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3563 		break;
3564 	case BWN_PHYTYPE_LP:
3565 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3566 		break;
3567 	default:
3568 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3569 		break;
3570 	}
3571 
3572 	/* flush */
3573 	BWN_READ_2(mac, 0x0502);
3574 
3575 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3576 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3577 	for (i = 0x00; i < max_loop; i++) {
3578 		value = BWN_READ_2(mac, 0x050e);
3579 		if (value & 0x0080)
3580 			break;
3581 		DELAY(10);
3582 	}
3583 	for (i = 0x00; i < 0x0a; i++) {
3584 		value = BWN_READ_2(mac, 0x050e);
3585 		if (value & 0x0400)
3586 			break;
3587 		DELAY(10);
3588 	}
3589 	for (i = 0x00; i < 0x19; i++) {
3590 		value = BWN_READ_2(mac, 0x0690);
3591 		if (!(value & 0x0100))
3592 			break;
3593 		DELAY(10);
3594 	}
3595 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3596 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3597 }
3598 
3599 void
3600 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3601 {
3602 	uint32_t macctl;
3603 
3604 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3605 
3606 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3607 	if (macctl & BWN_MACCTL_BIGENDIAN)
3608 		printf("TODO: need swap\n");
3609 
3610 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3611 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3612 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3613 }
3614 
3615 void
3616 bwn_mac_suspend(struct bwn_mac *mac)
3617 {
3618 	struct bwn_softc *sc = mac->mac_sc;
3619 	int i;
3620 	uint32_t tmp;
3621 
3622 	KASSERT(mac->mac_suspended >= 0,
3623 	    ("%s:%d: fail", __func__, __LINE__));
3624 
3625 	if (mac->mac_suspended == 0) {
3626 		bwn_psctl(mac, BWN_PS_AWAKE);
3627 		BWN_WRITE_4(mac, BWN_MACCTL,
3628 			    BWN_READ_4(mac, BWN_MACCTL)
3629 			    & ~BWN_MACCTL_ON);
3630 		BWN_READ_4(mac, BWN_MACCTL);
3631 		for (i = 35; i; i--) {
3632 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3633 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3634 				goto out;
3635 			DELAY(10);
3636 		}
3637 		for (i = 40; i; i--) {
3638 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3639 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3640 				goto out;
3641 			DELAY(1000);
3642 		}
3643 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3644 	}
3645 out:
3646 	mac->mac_suspended++;
3647 }
3648 
3649 void
3650 bwn_mac_enable(struct bwn_mac *mac)
3651 {
3652 	struct bwn_softc *sc = mac->mac_sc;
3653 	uint16_t state;
3654 
3655 	state = bwn_shm_read_2(mac, BWN_SHARED,
3656 	    BWN_SHARED_UCODESTAT);
3657 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3658 	    state != BWN_SHARED_UCODESTAT_SLEEP)
3659 		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3660 
3661 	mac->mac_suspended--;
3662 	KASSERT(mac->mac_suspended >= 0,
3663 	    ("%s:%d: fail", __func__, __LINE__));
3664 	if (mac->mac_suspended == 0) {
3665 		BWN_WRITE_4(mac, BWN_MACCTL,
3666 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3667 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3668 		BWN_READ_4(mac, BWN_MACCTL);
3669 		BWN_READ_4(mac, BWN_INTR_REASON);
3670 		bwn_psctl(mac, 0);
3671 	}
3672 }
3673 
3674 void
3675 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3676 {
3677 	struct bwn_softc *sc = mac->mac_sc;
3678 	int i;
3679 	uint16_t ucstat;
3680 
3681 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3682 	    ("%s:%d: fail", __func__, __LINE__));
3683 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3684 	    ("%s:%d: fail", __func__, __LINE__));
3685 
3686 	/* XXX forcibly awake and hwps-off */
3687 
3688 	BWN_WRITE_4(mac, BWN_MACCTL,
3689 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3690 	    ~BWN_MACCTL_HWPS);
3691 	BWN_READ_4(mac, BWN_MACCTL);
3692 	if (siba_get_revid(sc->sc_dev) >= 5) {
3693 		for (i = 0; i < 100; i++) {
3694 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3695 			    BWN_SHARED_UCODESTAT);
3696 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3697 				break;
3698 			DELAY(10);
3699 		}
3700 	}
3701 }
3702 
3703 static int
3704 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3705 {
3706 	struct bwn_softc *sc = mac->mac_sc;
3707 	struct bwn_fw *fw = &mac->mac_fw;
3708 	const uint8_t rev = siba_get_revid(sc->sc_dev);
3709 	const char *filename;
3710 	uint32_t high;
3711 	int error;
3712 
3713 	/* microcode */
3714 	if (rev >= 5 && rev <= 10)
3715 		filename = "ucode5";
3716 	else if (rev >= 11 && rev <= 12)
3717 		filename = "ucode11";
3718 	else if (rev == 13)
3719 		filename = "ucode13";
3720 	else if (rev == 14)
3721 		filename = "ucode14";
3722 	else if (rev >= 15)
3723 		filename = "ucode15";
3724 	else {
3725 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3726 		bwn_release_firmware(mac);
3727 		return (EOPNOTSUPP);
3728 	}
3729 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3730 	if (error) {
3731 		bwn_release_firmware(mac);
3732 		return (error);
3733 	}
3734 
3735 	/* PCM */
3736 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3737 	if (rev >= 5 && rev <= 10) {
3738 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3739 		if (error == ENOENT)
3740 			fw->no_pcmfile = 1;
3741 		else if (error) {
3742 			bwn_release_firmware(mac);
3743 			return (error);
3744 		}
3745 	} else if (rev < 11) {
3746 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3747 		return (EOPNOTSUPP);
3748 	}
3749 
3750 	/* initvals */
3751 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3752 	switch (mac->mac_phy.type) {
3753 	case BWN_PHYTYPE_A:
3754 		if (rev < 5 || rev > 10)
3755 			goto fail1;
3756 		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3757 			filename = "a0g1initvals5";
3758 		else
3759 			filename = "a0g0initvals5";
3760 		break;
3761 	case BWN_PHYTYPE_G:
3762 		if (rev >= 5 && rev <= 10)
3763 			filename = "b0g0initvals5";
3764 		else if (rev >= 13)
3765 			filename = "b0g0initvals13";
3766 		else
3767 			goto fail1;
3768 		break;
3769 	case BWN_PHYTYPE_LP:
3770 		if (rev == 13)
3771 			filename = "lp0initvals13";
3772 		else if (rev == 14)
3773 			filename = "lp0initvals14";
3774 		else if (rev >= 15)
3775 			filename = "lp0initvals15";
3776 		else
3777 			goto fail1;
3778 		break;
3779 	case BWN_PHYTYPE_N:
3780 		if (rev >= 11 && rev <= 12)
3781 			filename = "n0initvals11";
3782 		else
3783 			goto fail1;
3784 		break;
3785 	default:
3786 		goto fail1;
3787 	}
3788 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3789 	if (error) {
3790 		bwn_release_firmware(mac);
3791 		return (error);
3792 	}
3793 
3794 	/* bandswitch initvals */
3795 	switch (mac->mac_phy.type) {
3796 	case BWN_PHYTYPE_A:
3797 		if (rev >= 5 && rev <= 10) {
3798 			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3799 				filename = "a0g1bsinitvals5";
3800 			else
3801 				filename = "a0g0bsinitvals5";
3802 		} else if (rev >= 11)
3803 			filename = NULL;
3804 		else
3805 			goto fail1;
3806 		break;
3807 	case BWN_PHYTYPE_G:
3808 		if (rev >= 5 && rev <= 10)
3809 			filename = "b0g0bsinitvals5";
3810 		else if (rev >= 11)
3811 			filename = NULL;
3812 		else
3813 			goto fail1;
3814 		break;
3815 	case BWN_PHYTYPE_LP:
3816 		if (rev == 13)
3817 			filename = "lp0bsinitvals13";
3818 		else if (rev == 14)
3819 			filename = "lp0bsinitvals14";
3820 		else if (rev >= 15)
3821 			filename = "lp0bsinitvals15";
3822 		else
3823 			goto fail1;
3824 		break;
3825 	case BWN_PHYTYPE_N:
3826 		if (rev >= 11 && rev <= 12)
3827 			filename = "n0bsinitvals11";
3828 		else
3829 			goto fail1;
3830 		break;
3831 	default:
3832 		goto fail1;
3833 	}
3834 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
3835 	if (error) {
3836 		bwn_release_firmware(mac);
3837 		return (error);
3838 	}
3839 	return (0);
3840 fail1:
3841 	device_printf(sc->sc_dev, "no INITVALS for rev %d\n", rev);
3842 	bwn_release_firmware(mac);
3843 	return (EOPNOTSUPP);
3844 }
3845 
3846 static int
3847 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
3848     const char *name, struct bwn_fwfile *bfw)
3849 {
3850 	const struct bwn_fwhdr *hdr;
3851 	struct bwn_softc *sc = mac->mac_sc;
3852 	const struct firmware *fw;
3853 	char namebuf[64];
3854 
3855 	if (name == NULL) {
3856 		bwn_do_release_fw(bfw);
3857 		return (0);
3858 	}
3859 	if (bfw->filename != NULL) {
3860 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
3861 			return (0);
3862 		bwn_do_release_fw(bfw);
3863 	}
3864 
3865 	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
3866 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
3867 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
3868 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
3869 	fw = firmware_get(namebuf);
3870 	if (fw == NULL) {
3871 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
3872 		    namebuf);
3873 		return (ENOENT);
3874 	}
3875 	if (fw->datasize < sizeof(struct bwn_fwhdr))
3876 		goto fail;
3877 	hdr = (const struct bwn_fwhdr *)(fw->data);
3878 	switch (hdr->type) {
3879 	case BWN_FWTYPE_UCODE:
3880 	case BWN_FWTYPE_PCM:
3881 		if (be32toh(hdr->size) !=
3882 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
3883 			goto fail;
3884 		/* FALLTHROUGH */
3885 	case BWN_FWTYPE_IV:
3886 		if (hdr->ver != 1)
3887 			goto fail;
3888 		break;
3889 	default:
3890 		goto fail;
3891 	}
3892 	bfw->filename = name;
3893 	bfw->fw = fw;
3894 	bfw->type = type;
3895 	return (0);
3896 fail:
3897 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
3898 	if (fw != NULL)
3899 		firmware_put(fw, FIRMWARE_UNLOAD);
3900 	return (EPROTO);
3901 }
3902 
3903 static void
3904 bwn_release_firmware(struct bwn_mac *mac)
3905 {
3906 
3907 	bwn_do_release_fw(&mac->mac_fw.ucode);
3908 	bwn_do_release_fw(&mac->mac_fw.pcm);
3909 	bwn_do_release_fw(&mac->mac_fw.initvals);
3910 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
3911 }
3912 
3913 static void
3914 bwn_do_release_fw(struct bwn_fwfile *bfw)
3915 {
3916 
3917 	if (bfw->fw != NULL)
3918 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
3919 	bfw->fw = NULL;
3920 	bfw->filename = NULL;
3921 }
3922 
3923 static int
3924 bwn_fw_loaducode(struct bwn_mac *mac)
3925 {
3926 #define	GETFWOFFSET(fwp, offset)	\
3927 	((const uint32_t *)((const char *)fwp.fw->data + offset))
3928 #define	GETFWSIZE(fwp, offset)	\
3929 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
3930 	struct bwn_softc *sc = mac->mac_sc;
3931 	const uint32_t *data;
3932 	unsigned int i;
3933 	uint32_t ctl;
3934 	uint16_t date, fwcaps, time;
3935 	int error = 0;
3936 
3937 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3938 	ctl |= BWN_MACCTL_MCODE_JMP0;
3939 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
3940 	    __LINE__));
3941 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3942 	for (i = 0; i < 64; i++)
3943 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
3944 	for (i = 0; i < 4096; i += 2)
3945 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
3946 
3947 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3948 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
3949 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
3950 	     i++) {
3951 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3952 		DELAY(10);
3953 	}
3954 
3955 	if (mac->mac_fw.pcm.fw) {
3956 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
3957 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
3958 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
3959 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
3960 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
3961 		    sizeof(struct bwn_fwhdr)); i++) {
3962 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
3963 			DELAY(10);
3964 		}
3965 	}
3966 
3967 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
3968 	BWN_WRITE_4(mac, BWN_MACCTL,
3969 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
3970 	    BWN_MACCTL_MCODE_RUN);
3971 
3972 	for (i = 0; i < 21; i++) {
3973 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
3974 			break;
3975 		if (i >= 20) {
3976 			device_printf(sc->sc_dev, "ucode timeout\n");
3977 			error = ENXIO;
3978 			goto error;
3979 		}
3980 		DELAY(50000);
3981 	}
3982 	BWN_READ_4(mac, BWN_INTR_REASON);
3983 
3984 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
3985 	if (mac->mac_fw.rev <= 0x128) {
3986 		device_printf(sc->sc_dev, "the firmware is too old\n");
3987 		error = EOPNOTSUPP;
3988 		goto error;
3989 	}
3990 
3991 	/*
3992 	 * Determine firmware header version; needed for TX/RX packet
3993 	 * handling.
3994 	 */
3995 	if (mac->mac_fw.rev >= 598)
3996 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
3997 	else if (mac->mac_fw.rev >= 410)
3998 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
3999 	else
4000 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4001 
4002 	/*
4003 	 * We don't support rev 598 or later; that requires
4004 	 * another round of changes to the TX/RX descriptor
4005 	 * and status layout.
4006 	 *
4007 	 * So, complain this is the case and exit out, rather
4008 	 * than attaching and then failing.
4009 	 */
4010 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4011 		device_printf(sc->sc_dev,
4012 		    "firmware is too new (>=598); not supported\n");
4013 		error = EOPNOTSUPP;
4014 		goto error;
4015 	}
4016 
4017 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4018 	    BWN_SHARED_UCODE_PATCH);
4019 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4020 	mac->mac_fw.opensource = (date == 0xffff);
4021 	if (bwn_wme != 0)
4022 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4023 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4024 
4025 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4026 	if (mac->mac_fw.opensource == 0) {
4027 		device_printf(sc->sc_dev,
4028 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4029 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4030 		if (mac->mac_fw.no_pcmfile)
4031 			device_printf(sc->sc_dev,
4032 			    "no HW crypto acceleration due to pcm5\n");
4033 	} else {
4034 		mac->mac_fw.patch = time;
4035 		fwcaps = bwn_fwcaps_read(mac);
4036 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4037 			device_printf(sc->sc_dev,
4038 			    "disabling HW crypto acceleration\n");
4039 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4040 		}
4041 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4042 			device_printf(sc->sc_dev, "disabling WME support\n");
4043 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4044 		}
4045 	}
4046 
4047 	if (BWN_ISOLDFMT(mac))
4048 		device_printf(sc->sc_dev, "using old firmware image\n");
4049 
4050 	return (0);
4051 
4052 error:
4053 	BWN_WRITE_4(mac, BWN_MACCTL,
4054 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4055 	    BWN_MACCTL_MCODE_JMP0);
4056 
4057 	return (error);
4058 #undef GETFWSIZE
4059 #undef GETFWOFFSET
4060 }
4061 
4062 /* OpenFirmware only */
4063 static uint16_t
4064 bwn_fwcaps_read(struct bwn_mac *mac)
4065 {
4066 
4067 	KASSERT(mac->mac_fw.opensource == 1,
4068 	    ("%s:%d: fail", __func__, __LINE__));
4069 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4070 }
4071 
4072 static int
4073 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4074     size_t count, size_t array_size)
4075 {
4076 #define	GET_NEXTIV16(iv)						\
4077 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4078 	    sizeof(uint16_t) + sizeof(uint16_t)))
4079 #define	GET_NEXTIV32(iv)						\
4080 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4081 	    sizeof(uint16_t) + sizeof(uint32_t)))
4082 	struct bwn_softc *sc = mac->mac_sc;
4083 	const struct bwn_fwinitvals *iv;
4084 	uint16_t offset;
4085 	size_t i;
4086 	uint8_t bit32;
4087 
4088 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4089 	    ("%s:%d: fail", __func__, __LINE__));
4090 	iv = ivals;
4091 	for (i = 0; i < count; i++) {
4092 		if (array_size < sizeof(iv->offset_size))
4093 			goto fail;
4094 		array_size -= sizeof(iv->offset_size);
4095 		offset = be16toh(iv->offset_size);
4096 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4097 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4098 		if (offset >= 0x1000)
4099 			goto fail;
4100 		if (bit32) {
4101 			if (array_size < sizeof(iv->data.d32))
4102 				goto fail;
4103 			array_size -= sizeof(iv->data.d32);
4104 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4105 			iv = GET_NEXTIV32(iv);
4106 		} else {
4107 
4108 			if (array_size < sizeof(iv->data.d16))
4109 				goto fail;
4110 			array_size -= sizeof(iv->data.d16);
4111 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4112 
4113 			iv = GET_NEXTIV16(iv);
4114 		}
4115 	}
4116 	if (array_size != 0)
4117 		goto fail;
4118 	return (0);
4119 fail:
4120 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4121 	return (EPROTO);
4122 #undef GET_NEXTIV16
4123 #undef GET_NEXTIV32
4124 }
4125 
4126 int
4127 bwn_switch_channel(struct bwn_mac *mac, int chan)
4128 {
4129 	struct bwn_phy *phy = &(mac->mac_phy);
4130 	struct bwn_softc *sc = mac->mac_sc;
4131 	struct ieee80211com *ic = &sc->sc_ic;
4132 	uint16_t channelcookie, savedcookie;
4133 	int error;
4134 
4135 	if (chan == 0xffff)
4136 		chan = phy->get_default_chan(mac);
4137 
4138 	channelcookie = chan;
4139 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4140 		channelcookie |= 0x100;
4141 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4142 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4143 	error = phy->switch_channel(mac, chan);
4144 	if (error)
4145 		goto fail;
4146 
4147 	mac->mac_phy.chan = chan;
4148 	DELAY(8000);
4149 	return (0);
4150 fail:
4151 	device_printf(sc->sc_dev, "failed to switch channel\n");
4152 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4153 	return (error);
4154 }
4155 
4156 static uint16_t
4157 bwn_ant2phy(int antenna)
4158 {
4159 
4160 	switch (antenna) {
4161 	case BWN_ANT0:
4162 		return (BWN_TX_PHY_ANT0);
4163 	case BWN_ANT1:
4164 		return (BWN_TX_PHY_ANT1);
4165 	case BWN_ANT2:
4166 		return (BWN_TX_PHY_ANT2);
4167 	case BWN_ANT3:
4168 		return (BWN_TX_PHY_ANT3);
4169 	case BWN_ANTAUTO:
4170 		return (BWN_TX_PHY_ANT01AUTO);
4171 	}
4172 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4173 	return (0);
4174 }
4175 
4176 static void
4177 bwn_wme_load(struct bwn_mac *mac)
4178 {
4179 	struct bwn_softc *sc = mac->mac_sc;
4180 	int i;
4181 
4182 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4183 	    ("%s:%d: fail", __func__, __LINE__));
4184 
4185 	bwn_mac_suspend(mac);
4186 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4187 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4188 		    bwn_wme_shm_offsets[i]);
4189 	bwn_mac_enable(mac);
4190 }
4191 
4192 static void
4193 bwn_wme_loadparams(struct bwn_mac *mac,
4194     const struct wmeParams *p, uint16_t shm_offset)
4195 {
4196 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4197 	struct bwn_softc *sc = mac->mac_sc;
4198 	uint16_t params[BWN_NR_WMEPARAMS];
4199 	int slot, tmp;
4200 	unsigned int i;
4201 
4202 	slot = BWN_READ_2(mac, BWN_RNG) &
4203 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4204 
4205 	memset(&params, 0, sizeof(params));
4206 
4207 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4208 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4209 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4210 
4211 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4212 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4213 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4214 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4215 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4216 	params[BWN_WMEPARAM_BSLOTS] = slot;
4217 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4218 
4219 	for (i = 0; i < N(params); i++) {
4220 		if (i == BWN_WMEPARAM_STATUS) {
4221 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4222 			    shm_offset + (i * 2));
4223 			tmp |= 0x100;
4224 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4225 			    tmp);
4226 		} else {
4227 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4228 			    params[i]);
4229 		}
4230 	}
4231 }
4232 
4233 static void
4234 bwn_mac_write_bssid(struct bwn_mac *mac)
4235 {
4236 	struct bwn_softc *sc = mac->mac_sc;
4237 	uint32_t tmp;
4238 	int i;
4239 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4240 
4241 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4242 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4243 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4244 	    IEEE80211_ADDR_LEN);
4245 
4246 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4247 		tmp = (uint32_t) (mac_bssid[i + 0]);
4248 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4249 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4250 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4251 		bwn_ram_write(mac, 0x20 + i, tmp);
4252 	}
4253 }
4254 
4255 static void
4256 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4257     const uint8_t *macaddr)
4258 {
4259 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4260 	uint16_t data;
4261 
4262 	if (!mac)
4263 		macaddr = zero;
4264 
4265 	offset |= 0x0020;
4266 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4267 
4268 	data = macaddr[0];
4269 	data |= macaddr[1] << 8;
4270 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4271 	data = macaddr[2];
4272 	data |= macaddr[3] << 8;
4273 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4274 	data = macaddr[4];
4275 	data |= macaddr[5] << 8;
4276 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4277 }
4278 
4279 static void
4280 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4281     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4282 {
4283 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4284 	uint8_t per_sta_keys_start = 8;
4285 
4286 	if (BWN_SEC_NEWAPI(mac))
4287 		per_sta_keys_start = 4;
4288 
4289 	KASSERT(index < mac->mac_max_nr_keys,
4290 	    ("%s:%d: fail", __func__, __LINE__));
4291 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4292 	    ("%s:%d: fail", __func__, __LINE__));
4293 
4294 	if (index >= per_sta_keys_start)
4295 		bwn_key_macwrite(mac, index, NULL);
4296 	if (key)
4297 		memcpy(buf, key, key_len);
4298 	bwn_key_write(mac, index, algorithm, buf);
4299 	if (index >= per_sta_keys_start)
4300 		bwn_key_macwrite(mac, index, mac_addr);
4301 
4302 	mac->mac_key[index].algorithm = algorithm;
4303 }
4304 
4305 static void
4306 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4307 {
4308 	struct bwn_softc *sc = mac->mac_sc;
4309 	uint32_t addrtmp[2] = { 0, 0 };
4310 	uint8_t start = 8;
4311 
4312 	if (BWN_SEC_NEWAPI(mac))
4313 		start = 4;
4314 
4315 	KASSERT(index >= start,
4316 	    ("%s:%d: fail", __func__, __LINE__));
4317 	index -= start;
4318 
4319 	if (addr) {
4320 		addrtmp[0] = addr[0];
4321 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4322 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4323 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4324 		addrtmp[1] = addr[4];
4325 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4326 	}
4327 
4328 	if (siba_get_revid(sc->sc_dev) >= 5) {
4329 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4330 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4331 	} else {
4332 		if (index >= 8) {
4333 			bwn_shm_write_4(mac, BWN_SHARED,
4334 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4335 			bwn_shm_write_2(mac, BWN_SHARED,
4336 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4337 		}
4338 	}
4339 }
4340 
4341 static void
4342 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4343     const uint8_t *key)
4344 {
4345 	unsigned int i;
4346 	uint32_t offset;
4347 	uint16_t kidx, value;
4348 
4349 	kidx = BWN_SEC_KEY2FW(mac, index);
4350 	bwn_shm_write_2(mac, BWN_SHARED,
4351 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4352 
4353 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4354 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4355 		value = key[i];
4356 		value |= (uint16_t)(key[i + 1]) << 8;
4357 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4358 	}
4359 }
4360 
4361 static void
4362 bwn_phy_exit(struct bwn_mac *mac)
4363 {
4364 
4365 	mac->mac_phy.rf_onoff(mac, 0);
4366 	if (mac->mac_phy.exit != NULL)
4367 		mac->mac_phy.exit(mac);
4368 }
4369 
4370 static void
4371 bwn_dma_free(struct bwn_mac *mac)
4372 {
4373 	struct bwn_dma *dma;
4374 
4375 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4376 		return;
4377 	dma = &mac->mac_method.dma;
4378 
4379 	bwn_dma_ringfree(&dma->rx);
4380 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4381 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4382 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4383 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4384 	bwn_dma_ringfree(&dma->mcast);
4385 }
4386 
4387 static void
4388 bwn_core_stop(struct bwn_mac *mac)
4389 {
4390 	struct bwn_softc *sc = mac->mac_sc;
4391 
4392 	BWN_ASSERT_LOCKED(sc);
4393 
4394 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4395 		return;
4396 
4397 	callout_stop(&sc->sc_rfswitch_ch);
4398 	callout_stop(&sc->sc_task_ch);
4399 	callout_stop(&sc->sc_watchdog_ch);
4400 	sc->sc_watchdog_timer = 0;
4401 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4402 	BWN_READ_4(mac, BWN_INTR_MASK);
4403 	bwn_mac_suspend(mac);
4404 
4405 	mac->mac_status = BWN_MAC_STATUS_INITED;
4406 }
4407 
4408 static int
4409 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4410 {
4411 	struct bwn_mac *up_dev = NULL;
4412 	struct bwn_mac *down_dev;
4413 	struct bwn_mac *mac;
4414 	int err, status;
4415 	uint8_t gmode;
4416 
4417 	BWN_ASSERT_LOCKED(sc);
4418 
4419 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4420 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4421 		    mac->mac_phy.supports_2ghz) {
4422 			up_dev = mac;
4423 			gmode = 1;
4424 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4425 		    mac->mac_phy.supports_5ghz) {
4426 			up_dev = mac;
4427 			gmode = 0;
4428 		} else {
4429 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4430 			return (EINVAL);
4431 		}
4432 		if (up_dev != NULL)
4433 			break;
4434 	}
4435 	if (up_dev == NULL) {
4436 		device_printf(sc->sc_dev, "Could not find a device\n");
4437 		return (ENODEV);
4438 	}
4439 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4440 		return (0);
4441 
4442 	device_printf(sc->sc_dev, "switching to %s-GHz band\n",
4443 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4444 
4445 	down_dev = sc->sc_curmac;
4446 	status = down_dev->mac_status;
4447 	if (status >= BWN_MAC_STATUS_STARTED)
4448 		bwn_core_stop(down_dev);
4449 	if (status >= BWN_MAC_STATUS_INITED)
4450 		bwn_core_exit(down_dev);
4451 
4452 	if (down_dev != up_dev)
4453 		bwn_phy_reset(down_dev);
4454 
4455 	up_dev->mac_phy.gmode = gmode;
4456 	if (status >= BWN_MAC_STATUS_INITED) {
4457 		err = bwn_core_init(up_dev);
4458 		if (err) {
4459 			device_printf(sc->sc_dev,
4460 			    "fatal: failed to initialize for %s-GHz\n",
4461 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4462 			goto fail;
4463 		}
4464 	}
4465 	if (status >= BWN_MAC_STATUS_STARTED)
4466 		bwn_core_start(up_dev);
4467 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4468 	sc->sc_curmac = up_dev;
4469 
4470 	return (0);
4471 fail:
4472 	sc->sc_curmac = NULL;
4473 	return (err);
4474 }
4475 
4476 static void
4477 bwn_rf_turnon(struct bwn_mac *mac)
4478 {
4479 
4480 	bwn_mac_suspend(mac);
4481 	mac->mac_phy.rf_onoff(mac, 1);
4482 	mac->mac_phy.rf_on = 1;
4483 	bwn_mac_enable(mac);
4484 }
4485 
4486 static void
4487 bwn_rf_turnoff(struct bwn_mac *mac)
4488 {
4489 
4490 	bwn_mac_suspend(mac);
4491 	mac->mac_phy.rf_onoff(mac, 0);
4492 	mac->mac_phy.rf_on = 0;
4493 	bwn_mac_enable(mac);
4494 }
4495 
4496 static void
4497 bwn_phy_reset(struct bwn_mac *mac)
4498 {
4499 	struct bwn_softc *sc = mac->mac_sc;
4500 
4501 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4502 	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4503 	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4504 	DELAY(1000);
4505 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4506 	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC) |
4507 	    BWN_TGSLOW_PHYRESET);
4508 	DELAY(1000);
4509 }
4510 
4511 static int
4512 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4513 {
4514 	struct bwn_vap *bvp = BWN_VAP(vap);
4515 	struct ieee80211com *ic= vap->iv_ic;
4516 	enum ieee80211_state ostate = vap->iv_state;
4517 	struct bwn_softc *sc = ic->ic_softc;
4518 	struct bwn_mac *mac = sc->sc_curmac;
4519 	int error;
4520 
4521 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4522 	    ieee80211_state_name[vap->iv_state],
4523 	    ieee80211_state_name[nstate]);
4524 
4525 	error = bvp->bv_newstate(vap, nstate, arg);
4526 	if (error != 0)
4527 		return (error);
4528 
4529 	BWN_LOCK(sc);
4530 
4531 	bwn_led_newstate(mac, nstate);
4532 
4533 	/*
4534 	 * Clear the BSSID when we stop a STA
4535 	 */
4536 	if (vap->iv_opmode == IEEE80211_M_STA) {
4537 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4538 			/*
4539 			 * Clear out the BSSID.  If we reassociate to
4540 			 * the same AP, this will reinialize things
4541 			 * correctly...
4542 			 */
4543 			if (ic->ic_opmode == IEEE80211_M_STA &&
4544 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4545 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4546 				bwn_set_macaddr(mac);
4547 			}
4548 		}
4549 	}
4550 
4551 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4552 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4553 		/* XXX nothing to do? */
4554 	} else if (nstate == IEEE80211_S_RUN) {
4555 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4556 		bwn_set_opmode(mac);
4557 		bwn_set_pretbtt(mac);
4558 		bwn_spu_setdelay(mac, 0);
4559 		bwn_set_macaddr(mac);
4560 	}
4561 
4562 	BWN_UNLOCK(sc);
4563 
4564 	return (error);
4565 }
4566 
4567 static void
4568 bwn_set_pretbtt(struct bwn_mac *mac)
4569 {
4570 	struct bwn_softc *sc = mac->mac_sc;
4571 	struct ieee80211com *ic = &sc->sc_ic;
4572 	uint16_t pretbtt;
4573 
4574 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4575 		pretbtt = 2;
4576 	else
4577 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4578 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4579 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4580 }
4581 
4582 static int
4583 bwn_intr(void *arg)
4584 {
4585 	struct bwn_mac *mac = arg;
4586 	struct bwn_softc *sc = mac->mac_sc;
4587 	uint32_t reason;
4588 
4589 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4590 	    (sc->sc_flags & BWN_FLAG_INVALID))
4591 		return (FILTER_STRAY);
4592 
4593 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4594 	if (reason == 0xffffffff)	/* shared IRQ */
4595 		return (FILTER_STRAY);
4596 	reason &= mac->mac_intr_mask;
4597 	if (reason == 0)
4598 		return (FILTER_HANDLED);
4599 
4600 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4601 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4602 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4603 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4604 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4605 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4606 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4607 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4608 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4609 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4610 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4611 
4612 	/* Disable interrupts. */
4613 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4614 
4615 	mac->mac_reason_intr = reason;
4616 
4617 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4618 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4619 
4620 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4621 	return (FILTER_HANDLED);
4622 }
4623 
4624 static void
4625 bwn_intrtask(void *arg, int npending)
4626 {
4627 	struct bwn_mac *mac = arg;
4628 	struct bwn_softc *sc = mac->mac_sc;
4629 	uint32_t merged = 0;
4630 	int i, tx = 0, rx = 0;
4631 
4632 	BWN_LOCK(sc);
4633 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4634 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4635 		BWN_UNLOCK(sc);
4636 		return;
4637 	}
4638 
4639 	for (i = 0; i < N(mac->mac_reason); i++)
4640 		merged |= mac->mac_reason[i];
4641 
4642 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4643 		device_printf(sc->sc_dev, "MAC trans error\n");
4644 
4645 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4646 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4647 		mac->mac_phy.txerrors--;
4648 		if (mac->mac_phy.txerrors == 0) {
4649 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4650 			bwn_restart(mac, "PHY TX errors");
4651 		}
4652 	}
4653 
4654 	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4655 		if (merged & BWN_DMAINTR_FATALMASK) {
4656 			device_printf(sc->sc_dev,
4657 			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4658 			    mac->mac_reason[0], mac->mac_reason[1],
4659 			    mac->mac_reason[2], mac->mac_reason[3],
4660 			    mac->mac_reason[4], mac->mac_reason[5]);
4661 			bwn_restart(mac, "DMA error");
4662 			BWN_UNLOCK(sc);
4663 			return;
4664 		}
4665 		if (merged & BWN_DMAINTR_NONFATALMASK) {
4666 			device_printf(sc->sc_dev,
4667 			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4668 			    mac->mac_reason[0], mac->mac_reason[1],
4669 			    mac->mac_reason[2], mac->mac_reason[3],
4670 			    mac->mac_reason[4], mac->mac_reason[5]);
4671 		}
4672 	}
4673 
4674 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4675 		bwn_intr_ucode_debug(mac);
4676 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4677 		bwn_intr_tbtt_indication(mac);
4678 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4679 		bwn_intr_atim_end(mac);
4680 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4681 		bwn_intr_beacon(mac);
4682 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4683 		bwn_intr_pmq(mac);
4684 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4685 		bwn_intr_noise(mac);
4686 
4687 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4688 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4689 			bwn_dma_rx(mac->mac_method.dma.rx);
4690 			rx = 1;
4691 		}
4692 	} else
4693 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4694 
4695 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4696 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4697 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4698 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4699 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4700 
4701 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4702 		bwn_intr_txeof(mac);
4703 		tx = 1;
4704 	}
4705 
4706 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4707 
4708 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4709 		int evt = BWN_LED_EVENT_NONE;
4710 
4711 		if (tx && rx) {
4712 			if (sc->sc_rx_rate > sc->sc_tx_rate)
4713 				evt = BWN_LED_EVENT_RX;
4714 			else
4715 				evt = BWN_LED_EVENT_TX;
4716 		} else if (tx) {
4717 			evt = BWN_LED_EVENT_TX;
4718 		} else if (rx) {
4719 			evt = BWN_LED_EVENT_RX;
4720 		} else if (rx == 0) {
4721 			evt = BWN_LED_EVENT_POLL;
4722 		}
4723 
4724 		if (evt != BWN_LED_EVENT_NONE)
4725 			bwn_led_event(mac, evt);
4726        }
4727 
4728 	if (mbufq_first(&sc->sc_snd) != NULL)
4729 		bwn_start(sc);
4730 
4731 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4732 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4733 
4734 	BWN_UNLOCK(sc);
4735 }
4736 
4737 static void
4738 bwn_restart(struct bwn_mac *mac, const char *msg)
4739 {
4740 	struct bwn_softc *sc = mac->mac_sc;
4741 	struct ieee80211com *ic = &sc->sc_ic;
4742 
4743 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4744 		return;
4745 
4746 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4747 	ieee80211_runtask(ic, &mac->mac_hwreset);
4748 }
4749 
4750 static void
4751 bwn_intr_ucode_debug(struct bwn_mac *mac)
4752 {
4753 	struct bwn_softc *sc = mac->mac_sc;
4754 	uint16_t reason;
4755 
4756 	if (mac->mac_fw.opensource == 0)
4757 		return;
4758 
4759 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4760 	switch (reason) {
4761 	case BWN_DEBUGINTR_PANIC:
4762 		bwn_handle_fwpanic(mac);
4763 		break;
4764 	case BWN_DEBUGINTR_DUMP_SHM:
4765 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4766 		break;
4767 	case BWN_DEBUGINTR_DUMP_REGS:
4768 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4769 		break;
4770 	case BWN_DEBUGINTR_MARKER:
4771 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
4772 		break;
4773 	default:
4774 		device_printf(sc->sc_dev,
4775 		    "ucode debug unknown reason: %#x\n", reason);
4776 	}
4777 
4778 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
4779 	    BWN_DEBUGINTR_ACK);
4780 }
4781 
4782 static void
4783 bwn_intr_tbtt_indication(struct bwn_mac *mac)
4784 {
4785 	struct bwn_softc *sc = mac->mac_sc;
4786 	struct ieee80211com *ic = &sc->sc_ic;
4787 
4788 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
4789 		bwn_psctl(mac, 0);
4790 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4791 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
4792 }
4793 
4794 static void
4795 bwn_intr_atim_end(struct bwn_mac *mac)
4796 {
4797 
4798 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
4799 		BWN_WRITE_4(mac, BWN_MACCMD,
4800 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
4801 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
4802 	}
4803 }
4804 
4805 static void
4806 bwn_intr_beacon(struct bwn_mac *mac)
4807 {
4808 	struct bwn_softc *sc = mac->mac_sc;
4809 	struct ieee80211com *ic = &sc->sc_ic;
4810 	uint32_t cmd, beacon0, beacon1;
4811 
4812 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
4813 	    ic->ic_opmode == IEEE80211_M_MBSS)
4814 		return;
4815 
4816 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
4817 
4818 	cmd = BWN_READ_4(mac, BWN_MACCMD);
4819 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
4820 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
4821 
4822 	if (beacon0 && beacon1) {
4823 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
4824 		mac->mac_intr_mask |= BWN_INTR_BEACON;
4825 		return;
4826 	}
4827 
4828 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
4829 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
4830 		bwn_load_beacon0(mac);
4831 		bwn_load_beacon1(mac);
4832 		cmd = BWN_READ_4(mac, BWN_MACCMD);
4833 		cmd |= BWN_MACCMD_BEACON0_VALID;
4834 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4835 	} else {
4836 		if (!beacon0) {
4837 			bwn_load_beacon0(mac);
4838 			cmd = BWN_READ_4(mac, BWN_MACCMD);
4839 			cmd |= BWN_MACCMD_BEACON0_VALID;
4840 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4841 		} else if (!beacon1) {
4842 			bwn_load_beacon1(mac);
4843 			cmd = BWN_READ_4(mac, BWN_MACCMD);
4844 			cmd |= BWN_MACCMD_BEACON1_VALID;
4845 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
4846 		}
4847 	}
4848 }
4849 
4850 static void
4851 bwn_intr_pmq(struct bwn_mac *mac)
4852 {
4853 	uint32_t tmp;
4854 
4855 	while (1) {
4856 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
4857 		if (!(tmp & 0x00000008))
4858 			break;
4859 	}
4860 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
4861 }
4862 
4863 static void
4864 bwn_intr_noise(struct bwn_mac *mac)
4865 {
4866 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
4867 	uint16_t tmp;
4868 	uint8_t noise[4];
4869 	uint8_t i, j;
4870 	int32_t average;
4871 
4872 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
4873 		return;
4874 
4875 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
4876 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
4877 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
4878 	    noise[3] == 0x7f)
4879 		goto new;
4880 
4881 	KASSERT(mac->mac_noise.noi_nsamples < 8,
4882 	    ("%s:%d: fail", __func__, __LINE__));
4883 	i = mac->mac_noise.noi_nsamples;
4884 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
4885 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
4886 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
4887 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
4888 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
4889 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
4890 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
4891 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
4892 	mac->mac_noise.noi_nsamples++;
4893 	if (mac->mac_noise.noi_nsamples == 8) {
4894 		average = 0;
4895 		for (i = 0; i < 8; i++) {
4896 			for (j = 0; j < 4; j++)
4897 				average += mac->mac_noise.noi_samples[i][j];
4898 		}
4899 		average = (((average / 32) * 125) + 64) / 128;
4900 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
4901 		if (tmp >= 8)
4902 			average += 2;
4903 		else
4904 			average -= 25;
4905 		average -= (tmp == 8) ? 72 : 48;
4906 
4907 		mac->mac_stats.link_noise = average;
4908 		mac->mac_noise.noi_running = 0;
4909 		return;
4910 	}
4911 new:
4912 	bwn_noise_gensample(mac);
4913 }
4914 
4915 static int
4916 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
4917 {
4918 	struct bwn_mac *mac = prq->prq_mac;
4919 	struct bwn_softc *sc = mac->mac_sc;
4920 	unsigned int i;
4921 
4922 	BWN_ASSERT_LOCKED(sc);
4923 
4924 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4925 		return (0);
4926 
4927 	for (i = 0; i < 5000; i++) {
4928 		if (bwn_pio_rxeof(prq) == 0)
4929 			break;
4930 	}
4931 	if (i >= 5000)
4932 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
4933 	return ((i > 0) ? 1 : 0);
4934 }
4935 
4936 static void
4937 bwn_dma_rx(struct bwn_dma_ring *dr)
4938 {
4939 	int slot, curslot;
4940 
4941 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
4942 	curslot = dr->get_curslot(dr);
4943 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
4944 	    ("%s:%d: fail", __func__, __LINE__));
4945 
4946 	slot = dr->dr_curslot;
4947 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
4948 		bwn_dma_rxeof(dr, &slot);
4949 
4950 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
4951 	    BUS_DMASYNC_PREWRITE);
4952 
4953 	dr->set_curslot(dr, slot);
4954 	dr->dr_curslot = slot;
4955 }
4956 
4957 static void
4958 bwn_intr_txeof(struct bwn_mac *mac)
4959 {
4960 	struct bwn_txstatus stat;
4961 	uint32_t stat0, stat1;
4962 	uint16_t tmp;
4963 
4964 	BWN_ASSERT_LOCKED(mac->mac_sc);
4965 
4966 	while (1) {
4967 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
4968 		if (!(stat0 & 0x00000001))
4969 			break;
4970 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
4971 
4972 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
4973 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
4974 		    __func__,
4975 		    stat0,
4976 		    stat1);
4977 
4978 		stat.cookie = (stat0 >> 16);
4979 		stat.seq = (stat1 & 0x0000ffff);
4980 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
4981 		tmp = (stat0 & 0x0000ffff);
4982 		stat.framecnt = ((tmp & 0xf000) >> 12);
4983 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
4984 		stat.sreason = ((tmp & 0x001c) >> 2);
4985 		stat.pm = (tmp & 0x0080) ? 1 : 0;
4986 		stat.im = (tmp & 0x0040) ? 1 : 0;
4987 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
4988 		stat.ack = (tmp & 0x0002) ? 1 : 0;
4989 
4990 		bwn_handle_txeof(mac, &stat);
4991 	}
4992 }
4993 
4994 static void
4995 bwn_hwreset(void *arg, int npending)
4996 {
4997 	struct bwn_mac *mac = arg;
4998 	struct bwn_softc *sc = mac->mac_sc;
4999 	int error = 0;
5000 	int prev_status;
5001 
5002 	BWN_LOCK(sc);
5003 
5004 	prev_status = mac->mac_status;
5005 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5006 		bwn_core_stop(mac);
5007 	if (prev_status >= BWN_MAC_STATUS_INITED)
5008 		bwn_core_exit(mac);
5009 
5010 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5011 		error = bwn_core_init(mac);
5012 		if (error)
5013 			goto out;
5014 	}
5015 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5016 		bwn_core_start(mac);
5017 out:
5018 	if (error) {
5019 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5020 		sc->sc_curmac = NULL;
5021 	}
5022 	BWN_UNLOCK(sc);
5023 }
5024 
5025 static void
5026 bwn_handle_fwpanic(struct bwn_mac *mac)
5027 {
5028 	struct bwn_softc *sc = mac->mac_sc;
5029 	uint16_t reason;
5030 
5031 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5032 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5033 
5034 	if (reason == BWN_FWPANIC_RESTART)
5035 		bwn_restart(mac, "ucode panic");
5036 }
5037 
5038 static void
5039 bwn_load_beacon0(struct bwn_mac *mac)
5040 {
5041 
5042 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5043 }
5044 
5045 static void
5046 bwn_load_beacon1(struct bwn_mac *mac)
5047 {
5048 
5049 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5050 }
5051 
5052 static uint32_t
5053 bwn_jssi_read(struct bwn_mac *mac)
5054 {
5055 	uint32_t val = 0;
5056 
5057 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5058 	val <<= 16;
5059 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5060 
5061 	return (val);
5062 }
5063 
5064 static void
5065 bwn_noise_gensample(struct bwn_mac *mac)
5066 {
5067 	uint32_t jssi = 0x7f7f7f7f;
5068 
5069 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5070 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5071 	BWN_WRITE_4(mac, BWN_MACCMD,
5072 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5073 }
5074 
5075 static int
5076 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5077 {
5078 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5079 
5080 	return (dr->dr_numslots - dr->dr_usedslot);
5081 }
5082 
5083 static int
5084 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5085 {
5086 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5087 
5088 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5089 	    ("%s:%d: fail", __func__, __LINE__));
5090 	if (slot == dr->dr_numslots - 1)
5091 		return (0);
5092 	return (slot + 1);
5093 }
5094 
5095 static void
5096 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5097 {
5098 	struct bwn_mac *mac = dr->dr_mac;
5099 	struct bwn_softc *sc = mac->mac_sc;
5100 	struct bwn_dma *dma = &mac->mac_method.dma;
5101 	struct bwn_dmadesc_generic *desc;
5102 	struct bwn_dmadesc_meta *meta;
5103 	struct bwn_rxhdr4 *rxhdr;
5104 	struct mbuf *m;
5105 	uint32_t macstat;
5106 	int32_t tmp;
5107 	int cnt = 0;
5108 	uint16_t len;
5109 
5110 	dr->getdesc(dr, *slot, &desc, &meta);
5111 
5112 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5113 	m = meta->mt_m;
5114 
5115 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5116 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5117 		return;
5118 	}
5119 
5120 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5121 	len = le16toh(rxhdr->frame_len);
5122 	if (len <= 0) {
5123 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5124 		return;
5125 	}
5126 	if (bwn_dma_check_redzone(dr, m)) {
5127 		device_printf(sc->sc_dev, "redzone error.\n");
5128 		bwn_dma_set_redzone(dr, m);
5129 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5130 		    BUS_DMASYNC_PREWRITE);
5131 		return;
5132 	}
5133 	if (len > dr->dr_rx_bufsize) {
5134 		tmp = len;
5135 		while (1) {
5136 			dr->getdesc(dr, *slot, &desc, &meta);
5137 			bwn_dma_set_redzone(dr, meta->mt_m);
5138 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5139 			    BUS_DMASYNC_PREWRITE);
5140 			*slot = bwn_dma_nextslot(dr, *slot);
5141 			cnt++;
5142 			tmp -= dr->dr_rx_bufsize;
5143 			if (tmp <= 0)
5144 				break;
5145 		}
5146 		device_printf(sc->sc_dev, "too small buffer "
5147 		       "(len %u buffer %u dropped %d)\n",
5148 		       len, dr->dr_rx_bufsize, cnt);
5149 		return;
5150 	}
5151 	macstat = le32toh(rxhdr->mac_status);
5152 	if (macstat & BWN_RX_MAC_FCSERR) {
5153 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5154 			device_printf(sc->sc_dev, "RX drop\n");
5155 			return;
5156 		}
5157 	}
5158 
5159 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5160 	m_adj(m, dr->dr_frameoffset);
5161 
5162 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5163 }
5164 
5165 static void
5166 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5167 {
5168 	struct bwn_softc *sc = mac->mac_sc;
5169 	struct bwn_stats *stats = &mac->mac_stats;
5170 
5171 	BWN_ASSERT_LOCKED(mac->mac_sc);
5172 
5173 	if (status->im)
5174 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5175 	if (status->ampdu)
5176 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5177 	if (status->rtscnt) {
5178 		if (status->rtscnt == 0xf)
5179 			stats->rtsfail++;
5180 		else
5181 			stats->rts++;
5182 	}
5183 
5184 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5185 		bwn_dma_handle_txeof(mac, status);
5186 	} else {
5187 		bwn_pio_handle_txeof(mac, status);
5188 	}
5189 
5190 	bwn_phy_txpower_check(mac, 0);
5191 }
5192 
5193 static uint8_t
5194 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5195 {
5196 	struct bwn_mac *mac = prq->prq_mac;
5197 	struct bwn_softc *sc = mac->mac_sc;
5198 	struct bwn_rxhdr4 rxhdr;
5199 	struct mbuf *m;
5200 	uint32_t ctl32, macstat, v32;
5201 	unsigned int i, padding;
5202 	uint16_t ctl16, len, totlen, v16;
5203 	unsigned char *mp;
5204 	char *data;
5205 
5206 	memset(&rxhdr, 0, sizeof(rxhdr));
5207 
5208 	if (prq->prq_rev >= 8) {
5209 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5210 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5211 			return (0);
5212 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5213 		    BWN_PIO8_RXCTL_FRAMEREADY);
5214 		for (i = 0; i < 10; i++) {
5215 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5216 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5217 				goto ready;
5218 			DELAY(10);
5219 		}
5220 	} else {
5221 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5222 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5223 			return (0);
5224 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5225 		    BWN_PIO_RXCTL_FRAMEREADY);
5226 		for (i = 0; i < 10; i++) {
5227 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5228 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5229 				goto ready;
5230 			DELAY(10);
5231 		}
5232 	}
5233 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5234 	return (1);
5235 ready:
5236 	if (prq->prq_rev >= 8)
5237 		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5238 		    prq->prq_base + BWN_PIO8_RXDATA);
5239 	else
5240 		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5241 		    prq->prq_base + BWN_PIO_RXDATA);
5242 	len = le16toh(rxhdr.frame_len);
5243 	if (len > 0x700) {
5244 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5245 		goto error;
5246 	}
5247 	if (len == 0) {
5248 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5249 		goto error;
5250 	}
5251 
5252 	macstat = le32toh(rxhdr.mac_status);
5253 	if (macstat & BWN_RX_MAC_FCSERR) {
5254 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5255 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5256 			goto error;
5257 		}
5258 	}
5259 
5260 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5261 	totlen = len + padding;
5262 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5263 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5264 	if (m == NULL) {
5265 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5266 		goto error;
5267 	}
5268 	mp = mtod(m, unsigned char *);
5269 	if (prq->prq_rev >= 8) {
5270 		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5271 		    prq->prq_base + BWN_PIO8_RXDATA);
5272 		if (totlen & 3) {
5273 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5274 			data = &(mp[totlen - 1]);
5275 			switch (totlen & 3) {
5276 			case 3:
5277 				*data = (v32 >> 16);
5278 				data--;
5279 			case 2:
5280 				*data = (v32 >> 8);
5281 				data--;
5282 			case 1:
5283 				*data = v32;
5284 			}
5285 		}
5286 	} else {
5287 		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5288 		    prq->prq_base + BWN_PIO_RXDATA);
5289 		if (totlen & 1) {
5290 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5291 			mp[totlen - 1] = v16;
5292 		}
5293 	}
5294 
5295 	m->m_len = m->m_pkthdr.len = totlen;
5296 
5297 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5298 
5299 	return (1);
5300 error:
5301 	if (prq->prq_rev >= 8)
5302 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5303 		    BWN_PIO8_RXCTL_DATAREADY);
5304 	else
5305 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5306 	return (1);
5307 }
5308 
5309 static int
5310 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5311     struct bwn_dmadesc_meta *meta, int init)
5312 {
5313 	struct bwn_mac *mac = dr->dr_mac;
5314 	struct bwn_dma *dma = &mac->mac_method.dma;
5315 	struct bwn_rxhdr4 *hdr;
5316 	bus_dmamap_t map;
5317 	bus_addr_t paddr;
5318 	struct mbuf *m;
5319 	int error;
5320 
5321 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5322 	if (m == NULL) {
5323 		error = ENOBUFS;
5324 
5325 		/*
5326 		 * If the NIC is up and running, we need to:
5327 		 * - Clear RX buffer's header.
5328 		 * - Restore RX descriptor settings.
5329 		 */
5330 		if (init)
5331 			return (error);
5332 		else
5333 			goto back;
5334 	}
5335 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5336 
5337 	bwn_dma_set_redzone(dr, m);
5338 
5339 	/*
5340 	 * Try to load RX buf into temporary DMA map
5341 	 */
5342 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5343 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5344 	if (error) {
5345 		m_freem(m);
5346 
5347 		/*
5348 		 * See the comment above
5349 		 */
5350 		if (init)
5351 			return (error);
5352 		else
5353 			goto back;
5354 	}
5355 
5356 	if (!init)
5357 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5358 	meta->mt_m = m;
5359 	meta->mt_paddr = paddr;
5360 
5361 	/*
5362 	 * Swap RX buf's DMA map with the loaded temporary one
5363 	 */
5364 	map = meta->mt_dmap;
5365 	meta->mt_dmap = dr->dr_spare_dmap;
5366 	dr->dr_spare_dmap = map;
5367 
5368 back:
5369 	/*
5370 	 * Clear RX buf header
5371 	 */
5372 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5373 	bzero(hdr, sizeof(*hdr));
5374 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5375 	    BUS_DMASYNC_PREWRITE);
5376 
5377 	/*
5378 	 * Setup RX buf descriptor
5379 	 */
5380 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5381 	    sizeof(*hdr), 0, 0, 0);
5382 	return (error);
5383 }
5384 
5385 static void
5386 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5387 		 bus_size_t mapsz __unused, int error)
5388 {
5389 
5390 	if (!error) {
5391 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5392 		*((bus_addr_t *)arg) = seg->ds_addr;
5393 	}
5394 }
5395 
5396 static int
5397 bwn_hwrate2ieeerate(int rate)
5398 {
5399 
5400 	switch (rate) {
5401 	case BWN_CCK_RATE_1MB:
5402 		return (2);
5403 	case BWN_CCK_RATE_2MB:
5404 		return (4);
5405 	case BWN_CCK_RATE_5MB:
5406 		return (11);
5407 	case BWN_CCK_RATE_11MB:
5408 		return (22);
5409 	case BWN_OFDM_RATE_6MB:
5410 		return (12);
5411 	case BWN_OFDM_RATE_9MB:
5412 		return (18);
5413 	case BWN_OFDM_RATE_12MB:
5414 		return (24);
5415 	case BWN_OFDM_RATE_18MB:
5416 		return (36);
5417 	case BWN_OFDM_RATE_24MB:
5418 		return (48);
5419 	case BWN_OFDM_RATE_36MB:
5420 		return (72);
5421 	case BWN_OFDM_RATE_48MB:
5422 		return (96);
5423 	case BWN_OFDM_RATE_54MB:
5424 		return (108);
5425 	default:
5426 		printf("Ooops\n");
5427 		return (0);
5428 	}
5429 }
5430 
5431 /*
5432  * Post process the RX provided RSSI.
5433  *
5434  * Valid for A, B, G, LP PHYs.
5435  */
5436 static int8_t
5437 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5438     int ofdm, int adjust_2053, int adjust_2050)
5439 {
5440 	struct bwn_phy *phy = &mac->mac_phy;
5441 	struct bwn_phy_g *gphy = &phy->phy_g;
5442 	int tmp;
5443 
5444 	switch (phy->rf_ver) {
5445 	case 0x2050:
5446 		if (ofdm) {
5447 			tmp = in_rssi;
5448 			if (tmp > 127)
5449 				tmp -= 256;
5450 			tmp = tmp * 73 / 64;
5451 			if (adjust_2050)
5452 				tmp += 25;
5453 			else
5454 				tmp -= 3;
5455 		} else {
5456 			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5457 			    & BWN_BFL_RSSI) {
5458 				if (in_rssi > 63)
5459 					in_rssi = 63;
5460 				tmp = gphy->pg_nrssi_lt[in_rssi];
5461 				tmp = (31 - tmp) * -131 / 128 - 57;
5462 			} else {
5463 				tmp = in_rssi;
5464 				tmp = (31 - tmp) * -149 / 128 - 68;
5465 			}
5466 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5467 				tmp += 25;
5468 		}
5469 		break;
5470 	case 0x2060:
5471 		if (in_rssi > 127)
5472 			tmp = in_rssi - 256;
5473 		else
5474 			tmp = in_rssi;
5475 		break;
5476 	default:
5477 		tmp = in_rssi;
5478 		tmp = (tmp - 11) * 103 / 64;
5479 		if (adjust_2053)
5480 			tmp -= 109;
5481 		else
5482 			tmp -= 83;
5483 	}
5484 
5485 	return (tmp);
5486 }
5487 
5488 static void
5489 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5490 {
5491 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5492 	struct bwn_plcp6 *plcp;
5493 	struct bwn_softc *sc = mac->mac_sc;
5494 	struct ieee80211_frame_min *wh;
5495 	struct ieee80211_node *ni;
5496 	struct ieee80211com *ic = &sc->sc_ic;
5497 	uint32_t macstat;
5498 	int padding, rate, rssi = 0, noise = 0, type;
5499 	uint16_t phytype, phystat0, phystat3, chanstat;
5500 	unsigned char *mp = mtod(m, unsigned char *);
5501 	static int rx_mac_dec_rpt = 0;
5502 
5503 	BWN_ASSERT_LOCKED(sc);
5504 
5505 	phystat0 = le16toh(rxhdr->phy_status0);
5506 	phystat3 = le16toh(rxhdr->phy_status3);
5507 
5508 	/* XXX Note: mactime, macstat, chanstat need fixing for fw 598 */
5509 	macstat = le32toh(rxhdr->mac_status);
5510 	chanstat = le16toh(rxhdr->channel);
5511 
5512 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5513 
5514 	if (macstat & BWN_RX_MAC_FCSERR)
5515 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5516 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5517 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5518 	if (macstat & BWN_RX_MAC_DECERR)
5519 		goto drop;
5520 
5521 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5522 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5523 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5524 		    m->m_pkthdr.len);
5525 		goto drop;
5526 	}
5527 	plcp = (struct bwn_plcp6 *)(mp + padding);
5528 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5529 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5530 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5531 		    m->m_pkthdr.len);
5532 		goto drop;
5533 	}
5534 	wh = mtod(m, struct ieee80211_frame_min *);
5535 
5536 	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5537 		device_printf(sc->sc_dev,
5538 		    "RX decryption attempted (old %d keyidx %#x)\n",
5539 		    BWN_ISOLDFMT(mac),
5540 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5541 
5542 	if (phystat0 & BWN_RX_PHYST0_OFDM)
5543 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5544 		    phytype == BWN_PHYTYPE_A);
5545 	else
5546 		rate = bwn_plcp_get_cckrate(mac, plcp);
5547 	if (rate == -1) {
5548 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5549 			goto drop;
5550 	}
5551 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5552 
5553 	/* rssi/noise */
5554 	switch (phytype) {
5555 	case BWN_PHYTYPE_A:
5556 	case BWN_PHYTYPE_B:
5557 	case BWN_PHYTYPE_G:
5558 	case BWN_PHYTYPE_LP:
5559 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5560 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5561 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5562 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5563 		break;
5564 	default:
5565 		/* XXX TODO: implement rssi for other PHYs */
5566 		break;
5567 	}
5568 
5569 	noise = mac->mac_stats.link_noise;
5570 
5571 	/* RX radio tap */
5572 	if (ieee80211_radiotap_active(ic))
5573 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5574 	m_adj(m, -IEEE80211_CRC_LEN);
5575 
5576 	BWN_UNLOCK(sc);
5577 
5578 	ni = ieee80211_find_rxnode(ic, wh);
5579 	if (ni != NULL) {
5580 		type = ieee80211_input(ni, m, rssi, noise);
5581 		ieee80211_free_node(ni);
5582 	} else
5583 		type = ieee80211_input_all(ic, m, rssi, noise);
5584 
5585 	BWN_LOCK(sc);
5586 	return;
5587 drop:
5588 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5589 }
5590 
5591 static void
5592 bwn_dma_handle_txeof(struct bwn_mac *mac,
5593     const struct bwn_txstatus *status)
5594 {
5595 	struct bwn_dma *dma = &mac->mac_method.dma;
5596 	struct bwn_dma_ring *dr;
5597 	struct bwn_dmadesc_generic *desc;
5598 	struct bwn_dmadesc_meta *meta;
5599 	struct bwn_softc *sc = mac->mac_sc;
5600 	int slot;
5601 	int retrycnt = 0;
5602 
5603 	BWN_ASSERT_LOCKED(sc);
5604 
5605 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5606 	if (dr == NULL) {
5607 		device_printf(sc->sc_dev, "failed to parse cookie\n");
5608 		return;
5609 	}
5610 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5611 
5612 	while (1) {
5613 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5614 		    ("%s:%d: fail", __func__, __LINE__));
5615 		dr->getdesc(dr, slot, &desc, &meta);
5616 
5617 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5618 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5619 		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5620 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5621 
5622 		if (meta->mt_islast) {
5623 			KASSERT(meta->mt_m != NULL,
5624 			    ("%s:%d: fail", __func__, __LINE__));
5625 
5626 			/* Just count full frame retries for now */
5627 			retrycnt = status->framecnt - 1;
5628 			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5629 			    status->ack ?
5630 			      IEEE80211_RATECTL_TX_SUCCESS :
5631 			      IEEE80211_RATECTL_TX_FAILURE,
5632 			    &retrycnt, 0);
5633 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5634 			meta->mt_ni = NULL;
5635 			meta->mt_m = NULL;
5636 		} else
5637 			KASSERT(meta->mt_m == NULL,
5638 			    ("%s:%d: fail", __func__, __LINE__));
5639 
5640 		dr->dr_usedslot--;
5641 		if (meta->mt_islast)
5642 			break;
5643 		slot = bwn_dma_nextslot(dr, slot);
5644 	}
5645 	sc->sc_watchdog_timer = 0;
5646 	if (dr->dr_stop) {
5647 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5648 		    ("%s:%d: fail", __func__, __LINE__));
5649 		dr->dr_stop = 0;
5650 	}
5651 }
5652 
5653 static void
5654 bwn_pio_handle_txeof(struct bwn_mac *mac,
5655     const struct bwn_txstatus *status)
5656 {
5657 	struct bwn_pio_txqueue *tq;
5658 	struct bwn_pio_txpkt *tp = NULL;
5659 	struct bwn_softc *sc = mac->mac_sc;
5660 	int retrycnt = 0;
5661 
5662 	BWN_ASSERT_LOCKED(sc);
5663 
5664 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5665 	if (tq == NULL)
5666 		return;
5667 
5668 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5669 	tq->tq_free++;
5670 
5671 	if (tp->tp_ni != NULL) {
5672 		/*
5673 		 * Do any tx complete callback.  Note this must
5674 		 * be done before releasing the node reference.
5675 		 */
5676 
5677 		/* Just count full frame retries for now */
5678 		retrycnt = status->framecnt - 1;
5679 		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5680 		    status->ack ?
5681 		      IEEE80211_RATECTL_TX_SUCCESS :
5682 		      IEEE80211_RATECTL_TX_FAILURE,
5683 		    &retrycnt, 0);
5684 
5685 		if (tp->tp_m->m_flags & M_TXCB)
5686 			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
5687 		ieee80211_free_node(tp->tp_ni);
5688 		tp->tp_ni = NULL;
5689 	}
5690 	m_freem(tp->tp_m);
5691 	tp->tp_m = NULL;
5692 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
5693 
5694 	sc->sc_watchdog_timer = 0;
5695 }
5696 
5697 static void
5698 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
5699 {
5700 	struct bwn_softc *sc = mac->mac_sc;
5701 	struct bwn_phy *phy = &mac->mac_phy;
5702 	struct ieee80211com *ic = &sc->sc_ic;
5703 	unsigned long now;
5704 	int result;
5705 
5706 	BWN_GETTIME(now);
5707 
5708 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
5709 		return;
5710 	phy->nexttime = now + 2 * 1000;
5711 
5712 	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
5713 	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
5714 		return;
5715 
5716 	if (phy->recalc_txpwr != NULL) {
5717 		result = phy->recalc_txpwr(mac,
5718 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
5719 		if (result == BWN_TXPWR_RES_DONE)
5720 			return;
5721 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
5722 		    ("%s: fail", __func__));
5723 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
5724 
5725 		ieee80211_runtask(ic, &mac->mac_txpower);
5726 	}
5727 }
5728 
5729 static uint16_t
5730 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
5731 {
5732 
5733 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
5734 }
5735 
5736 static uint32_t
5737 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
5738 {
5739 
5740 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
5741 }
5742 
5743 static void
5744 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
5745 {
5746 
5747 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
5748 }
5749 
5750 static void
5751 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
5752 {
5753 
5754 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
5755 }
5756 
5757 static int
5758 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
5759 {
5760 
5761 	switch (rate) {
5762 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
5763 	case 12:
5764 		return (BWN_OFDM_RATE_6MB);
5765 	case 18:
5766 		return (BWN_OFDM_RATE_9MB);
5767 	case 24:
5768 		return (BWN_OFDM_RATE_12MB);
5769 	case 36:
5770 		return (BWN_OFDM_RATE_18MB);
5771 	case 48:
5772 		return (BWN_OFDM_RATE_24MB);
5773 	case 72:
5774 		return (BWN_OFDM_RATE_36MB);
5775 	case 96:
5776 		return (BWN_OFDM_RATE_48MB);
5777 	case 108:
5778 		return (BWN_OFDM_RATE_54MB);
5779 	/* CCK rates (NB: not IEEE std, device-specific) */
5780 	case 2:
5781 		return (BWN_CCK_RATE_1MB);
5782 	case 4:
5783 		return (BWN_CCK_RATE_2MB);
5784 	case 11:
5785 		return (BWN_CCK_RATE_5MB);
5786 	case 22:
5787 		return (BWN_CCK_RATE_11MB);
5788 	}
5789 
5790 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
5791 	return (BWN_CCK_RATE_1MB);
5792 }
5793 
5794 static int
5795 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
5796     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
5797 {
5798 	const struct bwn_phy *phy = &mac->mac_phy;
5799 	struct bwn_softc *sc = mac->mac_sc;
5800 	struct ieee80211_frame *wh;
5801 	struct ieee80211_frame *protwh;
5802 	struct ieee80211_frame_cts *cts;
5803 	struct ieee80211_frame_rts *rts;
5804 	const struct ieee80211_txparam *tp;
5805 	struct ieee80211vap *vap = ni->ni_vap;
5806 	struct ieee80211com *ic = &sc->sc_ic;
5807 	struct mbuf *mprot;
5808 	unsigned int len;
5809 	uint32_t macctl = 0;
5810 	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
5811 	uint16_t phyctl = 0;
5812 	uint8_t rate, rate_fb;
5813 
5814 	wh = mtod(m, struct ieee80211_frame *);
5815 	memset(txhdr, 0, sizeof(*txhdr));
5816 
5817 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
5818 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
5819 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
5820 
5821 	/*
5822 	 * Find TX rate
5823 	 */
5824 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
5825 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
5826 		rate = rate_fb = tp->mgmtrate;
5827 	else if (ismcast)
5828 		rate = rate_fb = tp->mcastrate;
5829 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
5830 		rate = rate_fb = tp->ucastrate;
5831 	else {
5832 		/* XXX TODO: don't fall back to CCK rates for OFDM */
5833 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
5834 		rate = ni->ni_txrate;
5835 
5836 		if (rix > 0)
5837 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
5838 			    IEEE80211_RATE_VAL;
5839 		else
5840 			rate_fb = rate;
5841 	}
5842 
5843 	sc->sc_tx_rate = rate;
5844 
5845 	/* Note: this maps the select ieee80211 rate to hardware rate */
5846 	rate = bwn_ieeerate2hwrate(sc, rate);
5847 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
5848 
5849 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
5850 	    bwn_plcp_getcck(rate);
5851 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
5852 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
5853 
5854 	/* XXX rate/rate_fb is the hardware rate */
5855 	if ((rate_fb == rate) ||
5856 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
5857 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
5858 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
5859 	else
5860 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
5861 		    m->m_pkthdr.len, rate, isshort);
5862 
5863 	/* XXX TX encryption */
5864 	bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
5865 	    (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
5866 	    (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
5867 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
5868 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
5869 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
5870 
5871 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
5872 	    BWN_TX_EFT_FB_CCK;
5873 	txhdr->chan = phy->chan;
5874 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
5875 	    BWN_TX_PHY_ENC_CCK;
5876 	/* XXX preamble? obey net80211 */
5877 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5878 	     rate == BWN_CCK_RATE_11MB))
5879 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
5880 
5881 	/* XXX TX antenna selection */
5882 
5883 	switch (bwn_antenna_sanitize(mac, 0)) {
5884 	case 0:
5885 		phyctl |= BWN_TX_PHY_ANT01AUTO;
5886 		break;
5887 	case 1:
5888 		phyctl |= BWN_TX_PHY_ANT0;
5889 		break;
5890 	case 2:
5891 		phyctl |= BWN_TX_PHY_ANT1;
5892 		break;
5893 	case 3:
5894 		phyctl |= BWN_TX_PHY_ANT2;
5895 		break;
5896 	case 4:
5897 		phyctl |= BWN_TX_PHY_ANT3;
5898 		break;
5899 	default:
5900 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5901 	}
5902 
5903 	if (!ismcast)
5904 		macctl |= BWN_TX_MAC_ACK;
5905 
5906 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
5907 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
5908 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
5909 		macctl |= BWN_TX_MAC_LONGFRAME;
5910 
5911 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
5912 		/* XXX RTS rate is always 1MB??? */
5913 		/* XXX TODO: don't fall back to CCK rates for OFDM */
5914 		rts_rate = BWN_CCK_RATE_1MB;
5915 		rts_rate_fb = bwn_get_fbrate(rts_rate);
5916 
5917 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
5918 		protdur = ieee80211_compute_duration(ic->ic_rt,
5919 		    m->m_pkthdr.len, rate, isshort) +
5920 		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
5921 
5922 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
5923 			cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
5924 			    (txhdr->body.old.rts_frame) :
5925 			    (txhdr->body.new.rts_frame));
5926 			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
5927 			    protdur);
5928 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5929 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
5930 			    mprot->m_pkthdr.len);
5931 			m_freem(mprot);
5932 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
5933 			len = sizeof(struct ieee80211_frame_cts);
5934 		} else {
5935 			rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
5936 			    (txhdr->body.old.rts_frame) :
5937 			    (txhdr->body.new.rts_frame));
5938 			/* XXX rate/rate_fb is the hardware rate */
5939 			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
5940 			    isshort);
5941 			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
5942 			    wh->i_addr2, protdur);
5943 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
5944 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
5945 			    mprot->m_pkthdr.len);
5946 			m_freem(mprot);
5947 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
5948 			len = sizeof(struct ieee80211_frame_rts);
5949 		}
5950 		len += IEEE80211_CRC_LEN;
5951 		bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
5952 		    &txhdr->body.old.rts_plcp :
5953 		    &txhdr->body.new.rts_plcp), len, rts_rate);
5954 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
5955 		    rts_rate_fb);
5956 
5957 		protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
5958 		    (&txhdr->body.old.rts_frame) :
5959 		    (&txhdr->body.new.rts_frame));
5960 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
5961 
5962 		if (BWN_ISOFDMRATE(rts_rate)) {
5963 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
5964 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
5965 		} else {
5966 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
5967 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
5968 		}
5969 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
5970 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
5971 	}
5972 
5973 	if (BWN_ISOLDFMT(mac))
5974 		txhdr->body.old.cookie = htole16(cookie);
5975 	else
5976 		txhdr->body.new.cookie = htole16(cookie);
5977 
5978 	txhdr->macctl = htole32(macctl);
5979 	txhdr->phyctl = htole16(phyctl);
5980 
5981 	/*
5982 	 * TX radio tap
5983 	 */
5984 	if (ieee80211_radiotap_active_vap(vap)) {
5985 		sc->sc_tx_th.wt_flags = 0;
5986 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
5987 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5988 		if (isshort &&
5989 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
5990 		     rate == BWN_CCK_RATE_11MB))
5991 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
5992 		sc->sc_tx_th.wt_rate = rate;
5993 
5994 		ieee80211_radiotap_tx(vap, m);
5995 	}
5996 
5997 	return (0);
5998 }
5999 
6000 static void
6001 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6002     const uint8_t rate)
6003 {
6004 	uint32_t d, plen;
6005 	uint8_t *raw = plcp->o.raw;
6006 
6007 	if (BWN_ISOFDMRATE(rate)) {
6008 		d = bwn_plcp_getofdm(rate);
6009 		KASSERT(!(octets & 0xf000),
6010 		    ("%s:%d: fail", __func__, __LINE__));
6011 		d |= (octets << 5);
6012 		plcp->o.data = htole32(d);
6013 	} else {
6014 		plen = octets * 16 / rate;
6015 		if ((octets * 16 % rate) > 0) {
6016 			plen++;
6017 			if ((rate == BWN_CCK_RATE_11MB)
6018 			    && ((octets * 8 % 11) < 4)) {
6019 				raw[1] = 0x84;
6020 			} else
6021 				raw[1] = 0x04;
6022 		} else
6023 			raw[1] = 0x04;
6024 		plcp->o.data |= htole32(plen << 16);
6025 		raw[0] = bwn_plcp_getcck(rate);
6026 	}
6027 }
6028 
6029 static uint8_t
6030 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6031 {
6032 	struct bwn_softc *sc = mac->mac_sc;
6033 	uint8_t mask;
6034 
6035 	if (n == 0)
6036 		return (0);
6037 	if (mac->mac_phy.gmode)
6038 		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6039 	else
6040 		mask = siba_sprom_get_ant_a(sc->sc_dev);
6041 	if (!(mask & (1 << (n - 1))))
6042 		return (0);
6043 	return (n);
6044 }
6045 
6046 /*
6047  * Return a fallback rate for the given rate.
6048  *
6049  * Note: Don't fall back from OFDM to CCK.
6050  */
6051 static uint8_t
6052 bwn_get_fbrate(uint8_t bitrate)
6053 {
6054 	switch (bitrate) {
6055 	/* CCK */
6056 	case BWN_CCK_RATE_1MB:
6057 		return (BWN_CCK_RATE_1MB);
6058 	case BWN_CCK_RATE_2MB:
6059 		return (BWN_CCK_RATE_1MB);
6060 	case BWN_CCK_RATE_5MB:
6061 		return (BWN_CCK_RATE_2MB);
6062 	case BWN_CCK_RATE_11MB:
6063 		return (BWN_CCK_RATE_5MB);
6064 
6065 	/* OFDM */
6066 	case BWN_OFDM_RATE_6MB:
6067 		return (BWN_OFDM_RATE_6MB);
6068 	case BWN_OFDM_RATE_9MB:
6069 		return (BWN_OFDM_RATE_6MB);
6070 	case BWN_OFDM_RATE_12MB:
6071 		return (BWN_OFDM_RATE_9MB);
6072 	case BWN_OFDM_RATE_18MB:
6073 		return (BWN_OFDM_RATE_12MB);
6074 	case BWN_OFDM_RATE_24MB:
6075 		return (BWN_OFDM_RATE_18MB);
6076 	case BWN_OFDM_RATE_36MB:
6077 		return (BWN_OFDM_RATE_24MB);
6078 	case BWN_OFDM_RATE_48MB:
6079 		return (BWN_OFDM_RATE_36MB);
6080 	case BWN_OFDM_RATE_54MB:
6081 		return (BWN_OFDM_RATE_48MB);
6082 	}
6083 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6084 	return (0);
6085 }
6086 
6087 static uint32_t
6088 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6089     uint32_t ctl, const void *_data, int len)
6090 {
6091 	struct bwn_softc *sc = mac->mac_sc;
6092 	uint32_t value = 0;
6093 	const uint8_t *data = _data;
6094 
6095 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6096 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6097 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6098 
6099 	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6100 	    tq->tq_base + BWN_PIO8_TXDATA);
6101 	if (len & 3) {
6102 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6103 		    BWN_PIO8_TXCTL_24_31);
6104 		data = &(data[len - 1]);
6105 		switch (len & 3) {
6106 		case 3:
6107 			ctl |= BWN_PIO8_TXCTL_16_23;
6108 			value |= (uint32_t)(*data) << 16;
6109 			data--;
6110 		case 2:
6111 			ctl |= BWN_PIO8_TXCTL_8_15;
6112 			value |= (uint32_t)(*data) << 8;
6113 			data--;
6114 		case 1:
6115 			value |= (uint32_t)(*data);
6116 		}
6117 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6118 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6119 	}
6120 
6121 	return (ctl);
6122 }
6123 
6124 static void
6125 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6126     uint16_t offset, uint32_t value)
6127 {
6128 
6129 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6130 }
6131 
6132 static uint16_t
6133 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6134     uint16_t ctl, const void *_data, int len)
6135 {
6136 	struct bwn_softc *sc = mac->mac_sc;
6137 	const uint8_t *data = _data;
6138 
6139 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6140 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6141 
6142 	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6143 	    tq->tq_base + BWN_PIO_TXDATA);
6144 	if (len & 1) {
6145 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6146 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6147 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6148 	}
6149 
6150 	return (ctl);
6151 }
6152 
6153 static uint16_t
6154 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6155     uint16_t ctl, struct mbuf *m0)
6156 {
6157 	int i, j = 0;
6158 	uint16_t data = 0;
6159 	const uint8_t *buf;
6160 	struct mbuf *m = m0;
6161 
6162 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6163 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6164 
6165 	for (; m != NULL; m = m->m_next) {
6166 		buf = mtod(m, const uint8_t *);
6167 		for (i = 0; i < m->m_len; i++) {
6168 			if (!((j++) % 2))
6169 				data |= buf[i];
6170 			else {
6171 				data |= (buf[i] << 8);
6172 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6173 				data = 0;
6174 			}
6175 		}
6176 	}
6177 	if (m0->m_pkthdr.len % 2) {
6178 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6179 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6180 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6181 	}
6182 
6183 	return (ctl);
6184 }
6185 
6186 static void
6187 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6188 {
6189 
6190 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6191 		return;
6192 	BWN_WRITE_2(mac, 0x684, 510 + time);
6193 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6194 }
6195 
6196 static struct bwn_dma_ring *
6197 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6198 {
6199 
6200 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6201 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6202 
6203 	switch (prio) {
6204 	case 3:
6205 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6206 	case 2:
6207 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6208 	case 0:
6209 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6210 	case 1:
6211 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6212 	}
6213 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6214 	return (NULL);
6215 }
6216 
6217 static int
6218 bwn_dma_getslot(struct bwn_dma_ring *dr)
6219 {
6220 	int slot;
6221 
6222 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6223 
6224 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6225 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6226 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6227 
6228 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6229 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6230 	dr->dr_curslot = slot;
6231 	dr->dr_usedslot++;
6232 
6233 	return (slot);
6234 }
6235 
6236 static struct bwn_pio_txqueue *
6237 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6238     struct bwn_pio_txpkt **pack)
6239 {
6240 	struct bwn_pio *pio = &mac->mac_method.pio;
6241 	struct bwn_pio_txqueue *tq = NULL;
6242 	unsigned int index;
6243 
6244 	switch (cookie & 0xf000) {
6245 	case 0x1000:
6246 		tq = &pio->wme[WME_AC_BK];
6247 		break;
6248 	case 0x2000:
6249 		tq = &pio->wme[WME_AC_BE];
6250 		break;
6251 	case 0x3000:
6252 		tq = &pio->wme[WME_AC_VI];
6253 		break;
6254 	case 0x4000:
6255 		tq = &pio->wme[WME_AC_VO];
6256 		break;
6257 	case 0x5000:
6258 		tq = &pio->mcast;
6259 		break;
6260 	}
6261 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6262 	if (tq == NULL)
6263 		return (NULL);
6264 	index = (cookie & 0x0fff);
6265 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6266 	if (index >= N(tq->tq_pkts))
6267 		return (NULL);
6268 	*pack = &tq->tq_pkts[index];
6269 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6270 	return (tq);
6271 }
6272 
6273 static void
6274 bwn_txpwr(void *arg, int npending)
6275 {
6276 	struct bwn_mac *mac = arg;
6277 	struct bwn_softc *sc = mac->mac_sc;
6278 
6279 	BWN_LOCK(sc);
6280 	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6281 	    mac->mac_phy.set_txpwr != NULL)
6282 		mac->mac_phy.set_txpwr(mac);
6283 	BWN_UNLOCK(sc);
6284 }
6285 
6286 static void
6287 bwn_task_15s(struct bwn_mac *mac)
6288 {
6289 	uint16_t reg;
6290 
6291 	if (mac->mac_fw.opensource) {
6292 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6293 		if (reg) {
6294 			bwn_restart(mac, "fw watchdog");
6295 			return;
6296 		}
6297 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6298 	}
6299 	if (mac->mac_phy.task_15s)
6300 		mac->mac_phy.task_15s(mac);
6301 
6302 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6303 }
6304 
6305 static void
6306 bwn_task_30s(struct bwn_mac *mac)
6307 {
6308 
6309 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6310 		return;
6311 	mac->mac_noise.noi_running = 1;
6312 	mac->mac_noise.noi_nsamples = 0;
6313 
6314 	bwn_noise_gensample(mac);
6315 }
6316 
6317 static void
6318 bwn_task_60s(struct bwn_mac *mac)
6319 {
6320 
6321 	if (mac->mac_phy.task_60s)
6322 		mac->mac_phy.task_60s(mac);
6323 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6324 }
6325 
6326 static void
6327 bwn_tasks(void *arg)
6328 {
6329 	struct bwn_mac *mac = arg;
6330 	struct bwn_softc *sc = mac->mac_sc;
6331 
6332 	BWN_ASSERT_LOCKED(sc);
6333 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6334 		return;
6335 
6336 	if (mac->mac_task_state % 4 == 0)
6337 		bwn_task_60s(mac);
6338 	if (mac->mac_task_state % 2 == 0)
6339 		bwn_task_30s(mac);
6340 	bwn_task_15s(mac);
6341 
6342 	mac->mac_task_state++;
6343 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6344 }
6345 
6346 static int
6347 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6348 {
6349 	struct bwn_softc *sc = mac->mac_sc;
6350 
6351 	KASSERT(a == 0, ("not support APHY\n"));
6352 
6353 	switch (plcp->o.raw[0] & 0xf) {
6354 	case 0xb:
6355 		return (BWN_OFDM_RATE_6MB);
6356 	case 0xf:
6357 		return (BWN_OFDM_RATE_9MB);
6358 	case 0xa:
6359 		return (BWN_OFDM_RATE_12MB);
6360 	case 0xe:
6361 		return (BWN_OFDM_RATE_18MB);
6362 	case 0x9:
6363 		return (BWN_OFDM_RATE_24MB);
6364 	case 0xd:
6365 		return (BWN_OFDM_RATE_36MB);
6366 	case 0x8:
6367 		return (BWN_OFDM_RATE_48MB);
6368 	case 0xc:
6369 		return (BWN_OFDM_RATE_54MB);
6370 	}
6371 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6372 	    plcp->o.raw[0] & 0xf);
6373 	return (-1);
6374 }
6375 
6376 static int
6377 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6378 {
6379 	struct bwn_softc *sc = mac->mac_sc;
6380 
6381 	switch (plcp->o.raw[0]) {
6382 	case 0x0a:
6383 		return (BWN_CCK_RATE_1MB);
6384 	case 0x14:
6385 		return (BWN_CCK_RATE_2MB);
6386 	case 0x37:
6387 		return (BWN_CCK_RATE_5MB);
6388 	case 0x6e:
6389 		return (BWN_CCK_RATE_11MB);
6390 	}
6391 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6392 	return (-1);
6393 }
6394 
6395 static void
6396 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6397     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6398     int rssi, int noise)
6399 {
6400 	struct bwn_softc *sc = mac->mac_sc;
6401 	const struct ieee80211_frame_min *wh;
6402 	uint64_t tsf;
6403 	uint16_t low_mactime_now;
6404 
6405 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6406 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6407 
6408 	wh = mtod(m, const struct ieee80211_frame_min *);
6409 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6410 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6411 
6412 	bwn_tsf_read(mac, &tsf);
6413 	low_mactime_now = tsf;
6414 	tsf = tsf & ~0xffffULL;
6415 	tsf += le16toh(rxhdr->mac_time);
6416 	if (low_mactime_now < le16toh(rxhdr->mac_time))
6417 		tsf -= 0x10000;
6418 
6419 	sc->sc_rx_th.wr_tsf = tsf;
6420 	sc->sc_rx_th.wr_rate = rate;
6421 	sc->sc_rx_th.wr_antsignal = rssi;
6422 	sc->sc_rx_th.wr_antnoise = noise;
6423 }
6424 
6425 static void
6426 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6427 {
6428 	uint32_t low, high;
6429 
6430 	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6431 	    ("%s:%d: fail", __func__, __LINE__));
6432 
6433 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6434 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6435 	*tsf = high;
6436 	*tsf <<= 32;
6437 	*tsf |= low;
6438 }
6439 
6440 static int
6441 bwn_dma_attach(struct bwn_mac *mac)
6442 {
6443 	struct bwn_dma *dma = &mac->mac_method.dma;
6444 	struct bwn_softc *sc = mac->mac_sc;
6445 	bus_addr_t lowaddr = 0;
6446 	int error;
6447 
6448 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6449 		return (0);
6450 
6451 	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6452 
6453 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6454 
6455 	dma->dmatype = bwn_dma_gettype(mac);
6456 	if (dma->dmatype == BWN_DMA_30BIT)
6457 		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6458 	else if (dma->dmatype == BWN_DMA_32BIT)
6459 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6460 	else
6461 		lowaddr = BUS_SPACE_MAXADDR;
6462 
6463 	/*
6464 	 * Create top level DMA tag
6465 	 */
6466 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6467 			       BWN_ALIGN, 0,		/* alignment, bounds */
6468 			       lowaddr,			/* lowaddr */
6469 			       BUS_SPACE_MAXADDR,	/* highaddr */
6470 			       NULL, NULL,		/* filter, filterarg */
6471 			       BUS_SPACE_MAXSIZE,	/* maxsize */
6472 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6473 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6474 			       0,			/* flags */
6475 			       NULL, NULL,		/* lockfunc, lockarg */
6476 			       &dma->parent_dtag);
6477 	if (error) {
6478 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6479 		return (error);
6480 	}
6481 
6482 	/*
6483 	 * Create TX/RX mbuf DMA tag
6484 	 */
6485 	error = bus_dma_tag_create(dma->parent_dtag,
6486 				1,
6487 				0,
6488 				BUS_SPACE_MAXADDR,
6489 				BUS_SPACE_MAXADDR,
6490 				NULL, NULL,
6491 				MCLBYTES,
6492 				1,
6493 				BUS_SPACE_MAXSIZE_32BIT,
6494 				0,
6495 				NULL, NULL,
6496 				&dma->rxbuf_dtag);
6497 	if (error) {
6498 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6499 		goto fail0;
6500 	}
6501 	error = bus_dma_tag_create(dma->parent_dtag,
6502 				1,
6503 				0,
6504 				BUS_SPACE_MAXADDR,
6505 				BUS_SPACE_MAXADDR,
6506 				NULL, NULL,
6507 				MCLBYTES,
6508 				1,
6509 				BUS_SPACE_MAXSIZE_32BIT,
6510 				0,
6511 				NULL, NULL,
6512 				&dma->txbuf_dtag);
6513 	if (error) {
6514 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6515 		goto fail1;
6516 	}
6517 
6518 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
6519 	if (!dma->wme[WME_AC_BK])
6520 		goto fail2;
6521 
6522 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
6523 	if (!dma->wme[WME_AC_BE])
6524 		goto fail3;
6525 
6526 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
6527 	if (!dma->wme[WME_AC_VI])
6528 		goto fail4;
6529 
6530 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
6531 	if (!dma->wme[WME_AC_VO])
6532 		goto fail5;
6533 
6534 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
6535 	if (!dma->mcast)
6536 		goto fail6;
6537 	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
6538 	if (!dma->rx)
6539 		goto fail7;
6540 
6541 	return (error);
6542 
6543 fail7:	bwn_dma_ringfree(&dma->mcast);
6544 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
6545 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
6546 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
6547 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
6548 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
6549 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
6550 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
6551 	return (error);
6552 }
6553 
6554 static struct bwn_dma_ring *
6555 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
6556     uint16_t cookie, int *slot)
6557 {
6558 	struct bwn_dma *dma = &mac->mac_method.dma;
6559 	struct bwn_dma_ring *dr;
6560 	struct bwn_softc *sc = mac->mac_sc;
6561 
6562 	BWN_ASSERT_LOCKED(mac->mac_sc);
6563 
6564 	switch (cookie & 0xf000) {
6565 	case 0x1000:
6566 		dr = dma->wme[WME_AC_BK];
6567 		break;
6568 	case 0x2000:
6569 		dr = dma->wme[WME_AC_BE];
6570 		break;
6571 	case 0x3000:
6572 		dr = dma->wme[WME_AC_VI];
6573 		break;
6574 	case 0x4000:
6575 		dr = dma->wme[WME_AC_VO];
6576 		break;
6577 	case 0x5000:
6578 		dr = dma->mcast;
6579 		break;
6580 	default:
6581 		dr = NULL;
6582 		KASSERT(0 == 1,
6583 		    ("invalid cookie value %d", cookie & 0xf000));
6584 	}
6585 	*slot = (cookie & 0x0fff);
6586 	if (*slot < 0 || *slot >= dr->dr_numslots) {
6587 		/*
6588 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
6589 		 * that it occurs events which have same H/W sequence numbers.
6590 		 * When it's occurred just prints a WARNING msgs and ignores.
6591 		 */
6592 		KASSERT(status->seq == dma->lastseq,
6593 		    ("%s:%d: fail", __func__, __LINE__));
6594 		device_printf(sc->sc_dev,
6595 		    "out of slot ranges (0 < %d < %d)\n", *slot,
6596 		    dr->dr_numslots);
6597 		return (NULL);
6598 	}
6599 	dma->lastseq = status->seq;
6600 	return (dr);
6601 }
6602 
6603 static void
6604 bwn_dma_stop(struct bwn_mac *mac)
6605 {
6606 	struct bwn_dma *dma;
6607 
6608 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
6609 		return;
6610 	dma = &mac->mac_method.dma;
6611 
6612 	bwn_dma_ringstop(&dma->rx);
6613 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
6614 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
6615 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
6616 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
6617 	bwn_dma_ringstop(&dma->mcast);
6618 }
6619 
6620 static void
6621 bwn_dma_ringstop(struct bwn_dma_ring **dr)
6622 {
6623 
6624 	if (dr == NULL)
6625 		return;
6626 
6627 	bwn_dma_cleanup(*dr);
6628 }
6629 
6630 static void
6631 bwn_pio_stop(struct bwn_mac *mac)
6632 {
6633 	struct bwn_pio *pio;
6634 
6635 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
6636 		return;
6637 	pio = &mac->mac_method.pio;
6638 
6639 	bwn_destroy_queue_tx(&pio->mcast);
6640 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
6641 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
6642 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
6643 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
6644 }
6645 
6646 static void
6647 bwn_led_attach(struct bwn_mac *mac)
6648 {
6649 	struct bwn_softc *sc = mac->mac_sc;
6650 	const uint8_t *led_act = NULL;
6651 	uint16_t val[BWN_LED_MAX];
6652 	int i;
6653 
6654 	sc->sc_led_idle = (2350 * hz) / 1000;
6655 	sc->sc_led_blink = 1;
6656 
6657 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
6658 		if (siba_get_pci_subvendor(sc->sc_dev) ==
6659 		    bwn_vendor_led_act[i].vid) {
6660 			led_act = bwn_vendor_led_act[i].led_act;
6661 			break;
6662 		}
6663 	}
6664 	if (led_act == NULL)
6665 		led_act = bwn_default_led_act;
6666 
6667 	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
6668 	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
6669 	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
6670 	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
6671 
6672 	for (i = 0; i < BWN_LED_MAX; ++i) {
6673 		struct bwn_led *led = &sc->sc_leds[i];
6674 
6675 		if (val[i] == 0xff) {
6676 			led->led_act = led_act[i];
6677 		} else {
6678 			if (val[i] & BWN_LED_ACT_LOW)
6679 				led->led_flags |= BWN_LED_F_ACTLOW;
6680 			led->led_act = val[i] & BWN_LED_ACT_MASK;
6681 		}
6682 		led->led_mask = (1 << i);
6683 
6684 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
6685 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
6686 		    led->led_act == BWN_LED_ACT_BLINK) {
6687 			led->led_flags |= BWN_LED_F_BLINK;
6688 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
6689 				led->led_flags |= BWN_LED_F_POLLABLE;
6690 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
6691 				led->led_flags |= BWN_LED_F_SLOW;
6692 
6693 			if (sc->sc_blink_led == NULL) {
6694 				sc->sc_blink_led = led;
6695 				if (led->led_flags & BWN_LED_F_SLOW)
6696 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
6697 			}
6698 		}
6699 
6700 		DPRINTF(sc, BWN_DEBUG_LED,
6701 		    "%dth led, act %d, lowact %d\n", i,
6702 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
6703 	}
6704 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
6705 }
6706 
6707 static __inline uint16_t
6708 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
6709 {
6710 
6711 	if (led->led_flags & BWN_LED_F_ACTLOW)
6712 		on = !on;
6713 	if (on)
6714 		val |= led->led_mask;
6715 	else
6716 		val &= ~led->led_mask;
6717 	return val;
6718 }
6719 
6720 static void
6721 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
6722 {
6723 	struct bwn_softc *sc = mac->mac_sc;
6724 	struct ieee80211com *ic = &sc->sc_ic;
6725 	uint16_t val;
6726 	int i;
6727 
6728 	if (nstate == IEEE80211_S_INIT) {
6729 		callout_stop(&sc->sc_led_blink_ch);
6730 		sc->sc_led_blinking = 0;
6731 	}
6732 
6733 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
6734 		return;
6735 
6736 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6737 	for (i = 0; i < BWN_LED_MAX; ++i) {
6738 		struct bwn_led *led = &sc->sc_leds[i];
6739 		int on;
6740 
6741 		if (led->led_act == BWN_LED_ACT_UNKN ||
6742 		    led->led_act == BWN_LED_ACT_NULL)
6743 			continue;
6744 
6745 		if ((led->led_flags & BWN_LED_F_BLINK) &&
6746 		    nstate != IEEE80211_S_INIT)
6747 			continue;
6748 
6749 		switch (led->led_act) {
6750 		case BWN_LED_ACT_ON:    /* Always on */
6751 			on = 1;
6752 			break;
6753 		case BWN_LED_ACT_OFF:   /* Always off */
6754 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
6755 			on = 0;
6756 			break;
6757 		default:
6758 			on = 1;
6759 			switch (nstate) {
6760 			case IEEE80211_S_INIT:
6761 				on = 0;
6762 				break;
6763 			case IEEE80211_S_RUN:
6764 				if (led->led_act == BWN_LED_ACT_11G &&
6765 				    ic->ic_curmode != IEEE80211_MODE_11G)
6766 					on = 0;
6767 				break;
6768 			default:
6769 				if (led->led_act == BWN_LED_ACT_ASSOC)
6770 					on = 0;
6771 				break;
6772 			}
6773 			break;
6774 		}
6775 
6776 		val = bwn_led_onoff(led, val, on);
6777 	}
6778 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6779 }
6780 
6781 static void
6782 bwn_led_event(struct bwn_mac *mac, int event)
6783 {
6784 	struct bwn_softc *sc = mac->mac_sc;
6785 	struct bwn_led *led = sc->sc_blink_led;
6786 	int rate;
6787 
6788 	if (event == BWN_LED_EVENT_POLL) {
6789 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
6790 			return;
6791 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6792 			return;
6793 	}
6794 
6795 	sc->sc_led_ticks = ticks;
6796 	if (sc->sc_led_blinking)
6797 		return;
6798 
6799 	switch (event) {
6800 	case BWN_LED_EVENT_RX:
6801 		rate = sc->sc_rx_rate;
6802 		break;
6803 	case BWN_LED_EVENT_TX:
6804 		rate = sc->sc_tx_rate;
6805 		break;
6806 	case BWN_LED_EVENT_POLL:
6807 		rate = 0;
6808 		break;
6809 	default:
6810 		panic("unknown LED event %d\n", event);
6811 		break;
6812 	}
6813 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
6814 	    bwn_led_duration[rate].off_dur);
6815 }
6816 
6817 static void
6818 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
6819 {
6820 	struct bwn_softc *sc = mac->mac_sc;
6821 	struct bwn_led *led = sc->sc_blink_led;
6822 	uint16_t val;
6823 
6824 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6825 	val = bwn_led_onoff(led, val, 1);
6826 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6827 
6828 	if (led->led_flags & BWN_LED_F_SLOW) {
6829 		BWN_LED_SLOWDOWN(on_dur);
6830 		BWN_LED_SLOWDOWN(off_dur);
6831 	}
6832 
6833 	sc->sc_led_blinking = 1;
6834 	sc->sc_led_blink_offdur = off_dur;
6835 
6836 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
6837 }
6838 
6839 static void
6840 bwn_led_blink_next(void *arg)
6841 {
6842 	struct bwn_mac *mac = arg;
6843 	struct bwn_softc *sc = mac->mac_sc;
6844 	uint16_t val;
6845 
6846 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
6847 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
6848 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
6849 
6850 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
6851 	    bwn_led_blink_end, mac);
6852 }
6853 
6854 static void
6855 bwn_led_blink_end(void *arg)
6856 {
6857 	struct bwn_mac *mac = arg;
6858 	struct bwn_softc *sc = mac->mac_sc;
6859 
6860 	sc->sc_led_blinking = 0;
6861 }
6862 
6863 static int
6864 bwn_suspend(device_t dev)
6865 {
6866 	struct bwn_softc *sc = device_get_softc(dev);
6867 
6868 	BWN_LOCK(sc);
6869 	bwn_stop(sc);
6870 	BWN_UNLOCK(sc);
6871 	return (0);
6872 }
6873 
6874 static int
6875 bwn_resume(device_t dev)
6876 {
6877 	struct bwn_softc *sc = device_get_softc(dev);
6878 	int error = EDOOFUS;
6879 
6880 	BWN_LOCK(sc);
6881 	if (sc->sc_ic.ic_nrunning > 0)
6882 		error = bwn_init(sc);
6883 	BWN_UNLOCK(sc);
6884 	if (error == 0)
6885 		ieee80211_start_all(&sc->sc_ic);
6886 	return (0);
6887 }
6888 
6889 static void
6890 bwn_rfswitch(void *arg)
6891 {
6892 	struct bwn_softc *sc = arg;
6893 	struct bwn_mac *mac = sc->sc_curmac;
6894 	int cur = 0, prev = 0;
6895 
6896 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
6897 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
6898 
6899 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP) {
6900 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
6901 			& BWN_RF_HWENABLED_HI_MASK))
6902 			cur = 1;
6903 	} else {
6904 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
6905 		    & BWN_RF_HWENABLED_LO_MASK)
6906 			cur = 1;
6907 	}
6908 
6909 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
6910 		prev = 1;
6911 
6912 	if (cur != prev) {
6913 		if (cur)
6914 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
6915 		else
6916 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
6917 
6918 		device_printf(sc->sc_dev,
6919 		    "status of RF switch is changed to %s\n",
6920 		    cur ? "ON" : "OFF");
6921 		if (cur != mac->mac_phy.rf_on) {
6922 			if (cur)
6923 				bwn_rf_turnon(mac);
6924 			else
6925 				bwn_rf_turnoff(mac);
6926 		}
6927 	}
6928 
6929 	callout_schedule(&sc->sc_rfswitch_ch, hz);
6930 }
6931 
6932 static void
6933 bwn_sysctl_node(struct bwn_softc *sc)
6934 {
6935 	device_t dev = sc->sc_dev;
6936 	struct bwn_mac *mac;
6937 	struct bwn_stats *stats;
6938 
6939 	/* XXX assume that count of MAC is only 1. */
6940 
6941 	if ((mac = sc->sc_curmac) == NULL)
6942 		return;
6943 	stats = &mac->mac_stats;
6944 
6945 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6946 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6947 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
6948 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6949 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6950 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
6951 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
6952 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6953 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
6954 
6955 #ifdef BWN_DEBUG
6956 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
6957 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
6958 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
6959 #endif
6960 }
6961 
6962 static device_method_t bwn_methods[] = {
6963 	/* Device interface */
6964 	DEVMETHOD(device_probe,		bwn_probe),
6965 	DEVMETHOD(device_attach,	bwn_attach),
6966 	DEVMETHOD(device_detach,	bwn_detach),
6967 	DEVMETHOD(device_suspend,	bwn_suspend),
6968 	DEVMETHOD(device_resume,	bwn_resume),
6969 	DEVMETHOD_END
6970 };
6971 static driver_t bwn_driver = {
6972 	"bwn",
6973 	bwn_methods,
6974 	sizeof(struct bwn_softc)
6975 };
6976 static devclass_t bwn_devclass;
6977 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
6978 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
6979 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
6980 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
6981 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
6982 MODULE_VERSION(bwn, 1);
6983