xref: /freebsd/sys/dev/bwn/if_bwn.c (revision ee5cf11617a9b7f034d95c639bd4d27d1f09e848)
1 /*-
2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  *
16  * NO WARRANTY
17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27  * THE POSSIBILITY OF SUCH DAMAGES.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 /*
34  * The Broadcom Wireless LAN controller driver.
35  */
36 
37 #include "opt_bwn.h"
38 #include "opt_wlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/malloc.h>
44 #include <sys/module.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/firmware.h>
48 #include <sys/lock.h>
49 #include <sys/mutex.h>
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 #include <sys/bus.h>
53 #include <sys/rman.h>
54 #include <sys/socket.h>
55 #include <sys/sockio.h>
56 
57 #include <net/ethernet.h>
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/if_arp.h>
61 #include <net/if_dl.h>
62 #include <net/if_llc.h>
63 #include <net/if_media.h>
64 #include <net/if_types.h>
65 
66 #include <dev/pci/pcivar.h>
67 #include <dev/pci/pcireg.h>
68 #include <dev/siba/siba_ids.h>
69 #include <dev/siba/sibareg.h>
70 #include <dev/siba/sibavar.h>
71 
72 #include <net80211/ieee80211_var.h>
73 #include <net80211/ieee80211_radiotap.h>
74 #include <net80211/ieee80211_regdomain.h>
75 #include <net80211/ieee80211_phy.h>
76 #include <net80211/ieee80211_ratectl.h>
77 
78 #include <dev/bwn/if_bwnreg.h>
79 #include <dev/bwn/if_bwnvar.h>
80 
81 #include <dev/bwn/if_bwn_debug.h>
82 #include <dev/bwn/if_bwn_misc.h>
83 #include <dev/bwn/if_bwn_util.h>
84 #include <dev/bwn/if_bwn_phy_common.h>
85 #include <dev/bwn/if_bwn_phy_g.h>
86 #include <dev/bwn/if_bwn_phy_lp.h>
87 #include <dev/bwn/if_bwn_phy_n.h>
88 
89 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90     "Broadcom driver parameters");
91 
92 /*
93  * Tunable & sysctl variables.
94  */
95 
96 #ifdef BWN_DEBUG
97 static	int bwn_debug = 0;
98 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99     "Broadcom debugging printfs");
100 #endif
101 
102 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104     "uses Bad Frames Preemption");
105 static int	bwn_bluetooth = 1;
106 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107     "turns on Bluetooth Coexistence");
108 static int	bwn_hwpctl = 0;
109 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110     "uses H/W power control");
111 static int	bwn_msi_disable = 0;		/* MSI disabled  */
112 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113 static int	bwn_usedma = 1;
114 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115     "uses DMA");
116 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117 static int	bwn_wme = 1;
118 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119     "uses WME support");
120 
121 static void	bwn_attach_pre(struct bwn_softc *);
122 static int	bwn_attach_post(struct bwn_softc *);
123 static void	bwn_sprom_bugfixes(device_t);
124 static int	bwn_init(struct bwn_softc *);
125 static void	bwn_parent(struct ieee80211com *);
126 static void	bwn_start(struct bwn_softc *);
127 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128 static int	bwn_attach_core(struct bwn_mac *);
129 static int	bwn_phy_getinfo(struct bwn_mac *, int);
130 static int	bwn_chiptest(struct bwn_mac *);
131 static int	bwn_setup_channels(struct bwn_mac *, int, int);
132 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133 		    uint16_t);
134 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135 		    const struct bwn_channelinfo *, const uint8_t []);
136 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137 		    const struct ieee80211_bpf_params *);
138 static void	bwn_updateslot(struct ieee80211com *);
139 static void	bwn_update_promisc(struct ieee80211com *);
140 static void	bwn_wme_init(struct bwn_mac *);
141 static int	bwn_wme_update(struct ieee80211com *);
142 static void	bwn_wme_clear(struct bwn_softc *);
143 static void	bwn_wme_load(struct bwn_mac *);
144 static void	bwn_wme_loadparams(struct bwn_mac *,
145 		    const struct wmeParams *, uint16_t);
146 static void	bwn_scan_start(struct ieee80211com *);
147 static void	bwn_scan_end(struct ieee80211com *);
148 static void	bwn_set_channel(struct ieee80211com *);
149 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151 		    const uint8_t [IEEE80211_ADDR_LEN],
152 		    const uint8_t [IEEE80211_ADDR_LEN]);
153 static void	bwn_vap_delete(struct ieee80211vap *);
154 static void	bwn_stop(struct bwn_softc *);
155 static int	bwn_core_init(struct bwn_mac *);
156 static void	bwn_core_start(struct bwn_mac *);
157 static void	bwn_core_exit(struct bwn_mac *);
158 static void	bwn_bt_disable(struct bwn_mac *);
159 static int	bwn_chip_init(struct bwn_mac *);
160 static void	bwn_set_txretry(struct bwn_mac *, int, int);
161 static void	bwn_rate_init(struct bwn_mac *);
162 static void	bwn_set_phytxctl(struct bwn_mac *);
163 static void	bwn_spu_setdelay(struct bwn_mac *, int);
164 static void	bwn_bt_enable(struct bwn_mac *);
165 static void	bwn_set_macaddr(struct bwn_mac *);
166 static void	bwn_crypt_init(struct bwn_mac *);
167 static void	bwn_chip_exit(struct bwn_mac *);
168 static int	bwn_fw_fillinfo(struct bwn_mac *);
169 static int	bwn_fw_loaducode(struct bwn_mac *);
170 static int	bwn_gpio_init(struct bwn_mac *);
171 static int	bwn_fw_loadinitvals(struct bwn_mac *);
172 static int	bwn_phy_init(struct bwn_mac *);
173 static void	bwn_set_txantenna(struct bwn_mac *, int);
174 static void	bwn_set_opmode(struct bwn_mac *);
175 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176 static uint8_t	bwn_plcp_getcck(const uint8_t);
177 static uint8_t	bwn_plcp_getofdm(const uint8_t);
178 static void	bwn_pio_init(struct bwn_mac *);
179 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181 		    int);
182 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183 		    struct bwn_pio_rxqueue *, int);
184 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186 		    uint16_t);
187 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190 static void	bwn_pio_handle_txeof(struct bwn_mac *,
191 		    const struct bwn_txstatus *);
192 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195 		    uint16_t);
196 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197 		    uint32_t);
198 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199 		    struct mbuf *);
200 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204 		    uint16_t, uint32_t);
205 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210 		    uint16_t, struct bwn_pio_txpkt **);
211 static void	bwn_dma_init(struct bwn_mac *);
212 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213 static int	bwn_dma_mask2type(uint64_t);
214 static uint64_t	bwn_dma_mask(struct bwn_mac *);
215 static uint16_t	bwn_dma_base(int, int);
216 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218 		    int, struct bwn_dmadesc_generic **,
219 		    struct bwn_dmadesc_meta **);
220 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222 		    int, int);
223 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229 		    int, struct bwn_dmadesc_generic **,
230 		    struct bwn_dmadesc_meta **);
231 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233 		    int, int);
234 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240 static void	bwn_dma_setup(struct bwn_dma_ring *);
241 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245 static void	bwn_dma_rx(struct bwn_dma_ring *);
246 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248 		    struct bwn_dmadesc_meta *);
249 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250 static int	bwn_dma_gettype(struct bwn_mac *);
251 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257 		    int);
258 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259 		    bus_size_t, int);
260 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261 static void	bwn_dma_handle_txeof(struct bwn_mac *,
262 		    const struct bwn_txstatus *);
263 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264 		    struct mbuf *);
265 static int	bwn_dma_getslot(struct bwn_dma_ring *);
266 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267 		    uint8_t);
268 static int	bwn_dma_attach(struct bwn_mac *);
269 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270 		    int, int, int);
271 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272 		    const struct bwn_txstatus *, uint16_t, int *);
273 static void	bwn_dma_free(struct bwn_mac *);
274 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276 		    const char *, struct bwn_fwfile *);
277 static void	bwn_release_firmware(struct bwn_mac *);
278 static void	bwn_do_release_fw(struct bwn_fwfile *);
279 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280 static int	bwn_fwinitvals_write(struct bwn_mac *,
281 		    const struct bwn_fwinitvals *, size_t, size_t);
282 static uint16_t	bwn_ant2phy(int);
283 static void	bwn_mac_write_bssid(struct bwn_mac *);
284 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285 		    const uint8_t *);
286 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287 		    const uint8_t *, size_t, const uint8_t *);
288 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289 		    const uint8_t *);
290 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291 		    const uint8_t *);
292 static void	bwn_phy_exit(struct bwn_mac *);
293 static void	bwn_core_stop(struct bwn_mac *);
294 static int	bwn_switch_band(struct bwn_softc *,
295 		    struct ieee80211_channel *);
296 static void	bwn_phy_reset(struct bwn_mac *);
297 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298 static void	bwn_set_pretbtt(struct bwn_mac *);
299 static int	bwn_intr(void *);
300 static void	bwn_intrtask(void *, int);
301 static void	bwn_restart(struct bwn_mac *, const char *);
302 static void	bwn_intr_ucode_debug(struct bwn_mac *);
303 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304 static void	bwn_intr_atim_end(struct bwn_mac *);
305 static void	bwn_intr_beacon(struct bwn_mac *);
306 static void	bwn_intr_pmq(struct bwn_mac *);
307 static void	bwn_intr_noise(struct bwn_mac *);
308 static void	bwn_intr_txeof(struct bwn_mac *);
309 static void	bwn_hwreset(void *, int);
310 static void	bwn_handle_fwpanic(struct bwn_mac *);
311 static void	bwn_load_beacon0(struct bwn_mac *);
312 static void	bwn_load_beacon1(struct bwn_mac *);
313 static uint32_t	bwn_jssi_read(struct bwn_mac *);
314 static void	bwn_noise_gensample(struct bwn_mac *);
315 static void	bwn_handle_txeof(struct bwn_mac *,
316 		    const struct bwn_txstatus *);
317 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320 		    struct mbuf *);
321 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322 static int	bwn_set_txhdr(struct bwn_mac *,
323 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324 		    uint16_t);
325 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326 		    const uint8_t);
327 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328 static uint8_t	bwn_get_fbrate(uint8_t);
329 static void	bwn_txpwr(void *, int);
330 static void	bwn_tasks(void *);
331 static void	bwn_task_15s(struct bwn_mac *);
332 static void	bwn_task_30s(struct bwn_mac *);
333 static void	bwn_task_60s(struct bwn_mac *);
334 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335 		    uint8_t);
336 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339 		    int, int);
340 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342 static void	bwn_watchdog(void *);
343 static void	bwn_dma_stop(struct bwn_mac *);
344 static void	bwn_pio_stop(struct bwn_mac *);
345 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346 static void	bwn_led_attach(struct bwn_mac *);
347 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348 static void	bwn_led_event(struct bwn_mac *, int);
349 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350 static void	bwn_led_blink_next(void *);
351 static void	bwn_led_blink_end(void *);
352 static void	bwn_rfswitch(void *);
353 static void	bwn_rf_turnon(struct bwn_mac *);
354 static void	bwn_rf_turnoff(struct bwn_mac *);
355 static void	bwn_sysctl_node(struct bwn_softc *);
356 
357 static struct resource_spec bwn_res_spec_legacy[] = {
358 	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359 	{ -1,			0,		0 }
360 };
361 
362 static struct resource_spec bwn_res_spec_msi[] = {
363 	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364 	{ -1,			0,		0 }
365 };
366 
367 static const struct bwn_channelinfo bwn_chantable_bg = {
368 	.channels = {
369 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374 	.nchannels = 14
375 };
376 
377 static const struct bwn_channelinfo bwn_chantable_a = {
378 	.channels = {
379 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391 		{ 6080, 216, 30 } },
392 	.nchannels = 37
393 };
394 
395 #if 0
396 static const struct bwn_channelinfo bwn_chantable_n = {
397 	.channels = {
398 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435 	.nchannels = 110
436 };
437 #endif
438 
439 #define	VENDOR_LED_ACT(vendor)				\
440 {							\
441 	.vid = PCI_VENDOR_##vendor,			\
442 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443 }
444 
445 static const struct {
446 	uint16_t	vid;
447 	uint8_t		led_act[BWN_LED_MAX];
448 } bwn_vendor_led_act[] = {
449 	VENDOR_LED_ACT(COMPAQ),
450 	VENDOR_LED_ACT(ASUSTEK)
451 };
452 
453 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454 	{ BWN_VENDOR_LED_ACT_DEFAULT };
455 
456 #undef VENDOR_LED_ACT
457 
458 static const struct {
459 	int		on_dur;
460 	int		off_dur;
461 } bwn_led_duration[109] = {
462 	[0]	= { 400, 100 },
463 	[2]	= { 150, 75 },
464 	[4]	= { 90, 45 },
465 	[11]	= { 66, 34 },
466 	[12]	= { 53, 26 },
467 	[18]	= { 42, 21 },
468 	[22]	= { 35, 17 },
469 	[24]	= { 32, 16 },
470 	[36]	= { 21, 10 },
471 	[48]	= { 16, 8 },
472 	[72]	= { 11, 5 },
473 	[96]	= { 9, 4 },
474 	[108]	= { 7, 3 }
475 };
476 
477 static const uint16_t bwn_wme_shm_offsets[] = {
478 	[0] = BWN_WME_BESTEFFORT,
479 	[1] = BWN_WME_BACKGROUND,
480 	[2] = BWN_WME_VOICE,
481 	[3] = BWN_WME_VIDEO,
482 };
483 
484 static const struct siba_devid bwn_devs[] = {
485 	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486 	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487 	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488 	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489 	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490 	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491 	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492 	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493 	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494 	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495 };
496 
497 static int
498 bwn_probe(device_t dev)
499 {
500 	int i;
501 
502 	for (i = 0; i < nitems(bwn_devs); i++) {
503 		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504 		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505 		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506 			return (BUS_PROBE_DEFAULT);
507 	}
508 
509 	return (ENXIO);
510 }
511 
512 static int
513 bwn_attach(device_t dev)
514 {
515 	struct bwn_mac *mac;
516 	struct bwn_softc *sc = device_get_softc(dev);
517 	int error, i, msic, reg;
518 
519 	sc->sc_dev = dev;
520 #ifdef BWN_DEBUG
521 	sc->sc_debug = bwn_debug;
522 #endif
523 
524 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525 		bwn_attach_pre(sc);
526 		bwn_sprom_bugfixes(dev);
527 		sc->sc_flags |= BWN_FLAG_ATTACHED;
528 	}
529 
530 	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531 		if (siba_get_pci_device(dev) != 0x4313 &&
532 		    siba_get_pci_device(dev) != 0x431a &&
533 		    siba_get_pci_device(dev) != 0x4321) {
534 			device_printf(sc->sc_dev,
535 			    "skip 802.11 cores\n");
536 			return (ENODEV);
537 		}
538 	}
539 
540 	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541 	mac->mac_sc = sc;
542 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543 	if (bwn_bfp != 0)
544 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545 
546 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549 
550 	error = bwn_attach_core(mac);
551 	if (error)
552 		goto fail0;
553 	bwn_led_attach(mac);
554 
555 	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557 	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558 	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559 	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560 	    mac->mac_phy.rf_rev);
561 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562 		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563 		    mac->mac_method.dma.dmatype);
564 	else
565 		device_printf(sc->sc_dev, "PIO\n");
566 
567 #ifdef	BWN_GPL_PHY
568 	device_printf(sc->sc_dev,
569 	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570 #endif
571 
572 	/*
573 	 * setup PCI resources and interrupt.
574 	 */
575 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576 		msic = pci_msi_count(dev);
577 		if (bootverbose)
578 			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579 	} else
580 		msic = 0;
581 
582 	mac->mac_intr_spec = bwn_res_spec_legacy;
583 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584 		if (pci_alloc_msi(dev, &msic) == 0) {
585 			device_printf(sc->sc_dev,
586 			    "Using %d MSI messages\n", msic);
587 			mac->mac_intr_spec = bwn_res_spec_msi;
588 			mac->mac_msi = 1;
589 		}
590 	}
591 
592 	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593 	    mac->mac_res_irq);
594 	if (error) {
595 		device_printf(sc->sc_dev,
596 		    "couldn't allocate IRQ resources (%d)\n", error);
597 		goto fail1;
598 	}
599 
600 	if (mac->mac_msi == 0)
601 		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602 		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603 		    &mac->mac_intrhand[0]);
604 	else {
605 		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606 			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607 			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608 			    &mac->mac_intrhand[i]);
609 			if (error != 0) {
610 				device_printf(sc->sc_dev,
611 				    "couldn't setup interrupt (%d)\n", error);
612 				break;
613 			}
614 		}
615 	}
616 
617 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618 
619 	/*
620 	 * calls attach-post routine
621 	 */
622 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623 		bwn_attach_post(sc);
624 
625 	return (0);
626 fail1:
627 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628 		pci_release_msi(dev);
629 fail0:
630 	free(mac, M_DEVBUF);
631 	return (error);
632 }
633 
634 static int
635 bwn_is_valid_ether_addr(uint8_t *addr)
636 {
637 	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638 
639 	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640 		return (FALSE);
641 
642 	return (TRUE);
643 }
644 
645 static int
646 bwn_attach_post(struct bwn_softc *sc)
647 {
648 	struct ieee80211com *ic = &sc->sc_ic;
649 
650 	ic->ic_softc = sc;
651 	ic->ic_name = device_get_nameunit(sc->sc_dev);
652 	/* XXX not right but it's not used anywhere important */
653 	ic->ic_phytype = IEEE80211_T_OFDM;
654 	ic->ic_opmode = IEEE80211_M_STA;
655 	ic->ic_caps =
656 		  IEEE80211_C_STA		/* station mode supported */
657 		| IEEE80211_C_MONITOR		/* monitor mode */
658 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660 		| IEEE80211_C_SHSLOT		/* short slot time supported */
661 		| IEEE80211_C_WME		/* WME/WMM supported */
662 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663 #if 0
664 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665 #endif
666 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667 		;
668 
669 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670 
671 	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672 	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673 	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674 	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675 
676 	/* call MI attach routine. */
677 	ieee80211_ifattach(ic);
678 
679 	ic->ic_headroom = sizeof(struct bwn_txhdr);
680 
681 	/* override default methods */
682 	ic->ic_raw_xmit = bwn_raw_xmit;
683 	ic->ic_updateslot = bwn_updateslot;
684 	ic->ic_update_promisc = bwn_update_promisc;
685 	ic->ic_wme.wme_update = bwn_wme_update;
686 	ic->ic_scan_start = bwn_scan_start;
687 	ic->ic_scan_end = bwn_scan_end;
688 	ic->ic_set_channel = bwn_set_channel;
689 	ic->ic_vap_create = bwn_vap_create;
690 	ic->ic_vap_delete = bwn_vap_delete;
691 	ic->ic_transmit = bwn_transmit;
692 	ic->ic_parent = bwn_parent;
693 
694 	ieee80211_radiotap_attach(ic,
695 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696 	    BWN_TX_RADIOTAP_PRESENT,
697 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698 	    BWN_RX_RADIOTAP_PRESENT);
699 
700 	bwn_sysctl_node(sc);
701 
702 	if (bootverbose)
703 		ieee80211_announce(ic);
704 	return (0);
705 }
706 
707 static void
708 bwn_phy_detach(struct bwn_mac *mac)
709 {
710 
711 	if (mac->mac_phy.detach != NULL)
712 		mac->mac_phy.detach(mac);
713 }
714 
715 static int
716 bwn_detach(device_t dev)
717 {
718 	struct bwn_softc *sc = device_get_softc(dev);
719 	struct bwn_mac *mac = sc->sc_curmac;
720 	struct ieee80211com *ic = &sc->sc_ic;
721 	int i;
722 
723 	sc->sc_flags |= BWN_FLAG_INVALID;
724 
725 	if (device_is_attached(sc->sc_dev)) {
726 		BWN_LOCK(sc);
727 		bwn_stop(sc);
728 		BWN_UNLOCK(sc);
729 		bwn_dma_free(mac);
730 		callout_drain(&sc->sc_led_blink_ch);
731 		callout_drain(&sc->sc_rfswitch_ch);
732 		callout_drain(&sc->sc_task_ch);
733 		callout_drain(&sc->sc_watchdog_ch);
734 		bwn_phy_detach(mac);
735 		ieee80211_draintask(ic, &mac->mac_hwreset);
736 		ieee80211_draintask(ic, &mac->mac_txpower);
737 		ieee80211_ifdetach(ic);
738 	}
739 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740 	taskqueue_free(sc->sc_tq);
741 
742 	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743 		if (mac->mac_intrhand[i] != NULL) {
744 			bus_teardown_intr(dev, mac->mac_res_irq[i],
745 			    mac->mac_intrhand[i]);
746 			mac->mac_intrhand[i] = NULL;
747 		}
748 	}
749 	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750 	if (mac->mac_msi != 0)
751 		pci_release_msi(dev);
752 	mbufq_drain(&sc->sc_snd);
753 	BWN_LOCK_DESTROY(sc);
754 	return (0);
755 }
756 
757 static void
758 bwn_attach_pre(struct bwn_softc *sc)
759 {
760 
761 	BWN_LOCK_INIT(sc);
762 	TAILQ_INIT(&sc->sc_maclist);
763 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
764 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
765 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
766 	mbufq_init(&sc->sc_snd, ifqmaxlen);
767 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
768 		taskqueue_thread_enqueue, &sc->sc_tq);
769 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
770 		"%s taskq", device_get_nameunit(sc->sc_dev));
771 }
772 
773 static void
774 bwn_sprom_bugfixes(device_t dev)
775 {
776 #define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
777 	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
778 	 (siba_get_pci_device(dev) == _device) &&			\
779 	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
780 	 (siba_get_pci_subdevice(dev) == _subdevice))
781 
782 	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
783 	    siba_get_pci_subdevice(dev) == 0x4e &&
784 	    siba_get_pci_revid(dev) > 0x40)
785 		siba_sprom_set_bf_lo(dev,
786 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
787 	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
788 	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
789 		siba_sprom_set_bf_lo(dev,
790 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
791 	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
792 		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
793 		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
794 		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
795 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
796 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
797 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
798 		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
799 			siba_sprom_set_bf_lo(dev,
800 			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
801 	}
802 #undef	BWN_ISDEV
803 }
804 
805 static void
806 bwn_parent(struct ieee80211com *ic)
807 {
808 	struct bwn_softc *sc = ic->ic_softc;
809 	int startall = 0;
810 
811 	BWN_LOCK(sc);
812 	if (ic->ic_nrunning > 0) {
813 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
814 			bwn_init(sc);
815 			startall = 1;
816 		} else
817 			bwn_update_promisc(ic);
818 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
819 		bwn_stop(sc);
820 	BWN_UNLOCK(sc);
821 
822 	if (startall)
823 		ieee80211_start_all(ic);
824 }
825 
826 static int
827 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
828 {
829 	struct bwn_softc *sc = ic->ic_softc;
830 	int error;
831 
832 	BWN_LOCK(sc);
833 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
834 		BWN_UNLOCK(sc);
835 		return (ENXIO);
836 	}
837 	error = mbufq_enqueue(&sc->sc_snd, m);
838 	if (error) {
839 		BWN_UNLOCK(sc);
840 		return (error);
841 	}
842 	bwn_start(sc);
843 	BWN_UNLOCK(sc);
844 	return (0);
845 }
846 
847 static void
848 bwn_start(struct bwn_softc *sc)
849 {
850 	struct bwn_mac *mac = sc->sc_curmac;
851 	struct ieee80211_frame *wh;
852 	struct ieee80211_node *ni;
853 	struct ieee80211_key *k;
854 	struct mbuf *m;
855 
856 	BWN_ASSERT_LOCKED(sc);
857 
858 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
859 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
860 		return;
861 
862 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
863 		if (bwn_tx_isfull(sc, m))
864 			break;
865 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
866 		if (ni == NULL) {
867 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
868 			m_freem(m);
869 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
870 			continue;
871 		}
872 		wh = mtod(m, struct ieee80211_frame *);
873 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
874 			k = ieee80211_crypto_encap(ni, m);
875 			if (k == NULL) {
876 				if_inc_counter(ni->ni_vap->iv_ifp,
877 				    IFCOUNTER_OERRORS, 1);
878 				ieee80211_free_node(ni);
879 				m_freem(m);
880 				continue;
881 			}
882 		}
883 		wh = NULL;	/* Catch any invalid use */
884 		if (bwn_tx_start(sc, ni, m) != 0) {
885 			if (ni != NULL) {
886 				if_inc_counter(ni->ni_vap->iv_ifp,
887 				    IFCOUNTER_OERRORS, 1);
888 				ieee80211_free_node(ni);
889 			}
890 			continue;
891 		}
892 		sc->sc_watchdog_timer = 5;
893 	}
894 }
895 
896 static int
897 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
898 {
899 	struct bwn_dma_ring *dr;
900 	struct bwn_mac *mac = sc->sc_curmac;
901 	struct bwn_pio_txqueue *tq;
902 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
903 
904 	BWN_ASSERT_LOCKED(sc);
905 
906 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
907 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
908 		if (dr->dr_stop == 1 ||
909 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
910 			dr->dr_stop = 1;
911 			goto full;
912 		}
913 	} else {
914 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
915 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
916 		    pktlen > (tq->tq_size - tq->tq_used))
917 			goto full;
918 	}
919 	return (0);
920 full:
921 	mbufq_prepend(&sc->sc_snd, m);
922 	return (1);
923 }
924 
925 static int
926 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
927 {
928 	struct bwn_mac *mac = sc->sc_curmac;
929 	int error;
930 
931 	BWN_ASSERT_LOCKED(sc);
932 
933 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
934 		m_freem(m);
935 		return (ENXIO);
936 	}
937 
938 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
939 	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
940 	if (error) {
941 		m_freem(m);
942 		return (error);
943 	}
944 	return (0);
945 }
946 
947 static int
948 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
949 {
950 	struct bwn_pio_txpkt *tp;
951 	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
952 	struct bwn_softc *sc = mac->mac_sc;
953 	struct bwn_txhdr txhdr;
954 	struct mbuf *m_new;
955 	uint32_t ctl32;
956 	int error;
957 	uint16_t ctl16;
958 
959 	BWN_ASSERT_LOCKED(sc);
960 
961 	/* XXX TODO send packets after DTIM */
962 
963 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
964 	tp = TAILQ_FIRST(&tq->tq_pktlist);
965 	tp->tp_ni = ni;
966 	tp->tp_m = m;
967 
968 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
969 	if (error) {
970 		device_printf(sc->sc_dev, "tx fail\n");
971 		return (error);
972 	}
973 
974 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
975 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
976 	tq->tq_free--;
977 
978 	if (siba_get_revid(sc->sc_dev) >= 8) {
979 		/*
980 		 * XXX please removes m_defrag(9)
981 		 */
982 		m_new = m_defrag(m, M_NOWAIT);
983 		if (m_new == NULL) {
984 			device_printf(sc->sc_dev,
985 			    "%s: can't defrag TX buffer\n",
986 			    __func__);
987 			return (ENOBUFS);
988 		}
989 		if (m_new->m_next != NULL)
990 			device_printf(sc->sc_dev,
991 			    "TODO: fragmented packets for PIO\n");
992 		tp->tp_m = m_new;
993 
994 		/* send HEADER */
995 		ctl32 = bwn_pio_write_multi_4(mac, tq,
996 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
997 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
998 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
999 		/* send BODY */
1000 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1001 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1002 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1003 		    ctl32 | BWN_PIO8_TXCTL_EOF);
1004 	} else {
1005 		ctl16 = bwn_pio_write_multi_2(mac, tq,
1006 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1007 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1008 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1009 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1010 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1011 		    ctl16 | BWN_PIO_TXCTL_EOF);
1012 	}
1013 
1014 	return (0);
1015 }
1016 
1017 static struct bwn_pio_txqueue *
1018 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1019 {
1020 
1021 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1022 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1023 
1024 	switch (prio) {
1025 	case 0:
1026 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1027 	case 1:
1028 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1029 	case 2:
1030 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1031 	case 3:
1032 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1033 	}
1034 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1035 	return (NULL);
1036 }
1037 
1038 static int
1039 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1040 {
1041 #define	BWN_GET_TXHDRCACHE(slot)					\
1042 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1043 	struct bwn_dma *dma = &mac->mac_method.dma;
1044 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1045 	struct bwn_dmadesc_generic *desc;
1046 	struct bwn_dmadesc_meta *mt;
1047 	struct bwn_softc *sc = mac->mac_sc;
1048 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1049 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1050 
1051 	BWN_ASSERT_LOCKED(sc);
1052 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1053 
1054 	/* XXX send after DTIM */
1055 
1056 	slot = bwn_dma_getslot(dr);
1057 	dr->getdesc(dr, slot, &desc, &mt);
1058 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1059 	    ("%s:%d: fail", __func__, __LINE__));
1060 
1061 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1062 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1063 	    BWN_DMA_COOKIE(dr, slot));
1064 	if (error)
1065 		goto fail;
1066 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1067 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1068 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1069 	if (error) {
1070 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1071 		    __func__, error);
1072 		goto fail;
1073 	}
1074 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1075 	    BUS_DMASYNC_PREWRITE);
1076 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1077 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1078 	    BUS_DMASYNC_PREWRITE);
1079 
1080 	slot = bwn_dma_getslot(dr);
1081 	dr->getdesc(dr, slot, &desc, &mt);
1082 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1083 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1084 	mt->mt_m = m;
1085 	mt->mt_ni = ni;
1086 
1087 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1088 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1089 	if (error && error != EFBIG) {
1090 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1091 		    __func__, error);
1092 		goto fail;
1093 	}
1094 	if (error) {    /* error == EFBIG */
1095 		struct mbuf *m_new;
1096 
1097 		m_new = m_defrag(m, M_NOWAIT);
1098 		if (m_new == NULL) {
1099 			device_printf(sc->sc_dev,
1100 			    "%s: can't defrag TX buffer\n",
1101 			    __func__);
1102 			error = ENOBUFS;
1103 			goto fail;
1104 		} else {
1105 			m = m_new;
1106 		}
1107 
1108 		mt->mt_m = m;
1109 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1110 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1111 		if (error) {
1112 			device_printf(sc->sc_dev,
1113 			    "%s: can't load TX buffer (2) %d\n",
1114 			    __func__, error);
1115 			goto fail;
1116 		}
1117 	}
1118 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1119 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1120 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1121 	    BUS_DMASYNC_PREWRITE);
1122 
1123 	/* XXX send after DTIM */
1124 
1125 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1126 	return (0);
1127 fail:
1128 	dr->dr_curslot = backup[0];
1129 	dr->dr_usedslot = backup[1];
1130 	return (error);
1131 #undef BWN_GET_TXHDRCACHE
1132 }
1133 
1134 static void
1135 bwn_watchdog(void *arg)
1136 {
1137 	struct bwn_softc *sc = arg;
1138 
1139 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1140 		device_printf(sc->sc_dev, "device timeout\n");
1141 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1142 	}
1143 	callout_schedule(&sc->sc_watchdog_ch, hz);
1144 }
1145 
1146 static int
1147 bwn_attach_core(struct bwn_mac *mac)
1148 {
1149 	struct bwn_softc *sc = mac->mac_sc;
1150 	int error, have_bg = 0, have_a = 0;
1151 
1152 	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1153 	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1154 
1155 	if (bwn_is_bus_siba(mac)) {
1156 		uint32_t high;
1157 
1158 		siba_powerup(sc->sc_dev, 0);
1159 		high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1160 		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1161 		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1162 		if (high & BWN_TGSHIGH_DUALPHY) {
1163 			have_bg = 1;
1164 			have_a = 1;
1165 		}
1166 	} else {
1167 		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1168 		error = ENXIO;
1169 		goto fail;
1170 	}
1171 
1172 	/*
1173 	 * Guess at whether it has A-PHY or G-PHY.
1174 	 * This is just used for resetting the core to probe things;
1175 	 * we will re-guess once it's all up and working.
1176 	 */
1177 	bwn_reset_core(mac, have_bg);
1178 
1179 	/*
1180 	 * Get the PHY version.
1181 	 */
1182 	error = bwn_phy_getinfo(mac, have_bg);
1183 	if (error)
1184 		goto fail;
1185 
1186 #if 0
1187 	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1188 	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1189 	    __func__,
1190 	    high,
1191 	    have_a,
1192 	    have_bg,
1193 	    siba_get_pci_device(sc->sc_dev),
1194 	    siba_get_chipid(sc->sc_dev));
1195 #endif
1196 
1197 	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1198 	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1199 	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1200 	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1201 	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1202 		have_a = have_bg = 0;
1203 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1204 			have_a = 1;
1205 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1206 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1207 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1208 			have_bg = 1;
1209 		else
1210 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1211 			    mac->mac_phy.type));
1212 	}
1213 
1214 	/*
1215 	 * XXX The PHY-G support doesn't do 5GHz operation.
1216 	 */
1217 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1218 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1219 		device_printf(sc->sc_dev,
1220 		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1221 		    __func__);
1222 		have_a = 0;
1223 		have_bg = 1;
1224 	}
1225 
1226 	mac->mac_phy.phy_n = NULL;
1227 
1228 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1229 		mac->mac_phy.attach = bwn_phy_g_attach;
1230 		mac->mac_phy.detach = bwn_phy_g_detach;
1231 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1232 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1233 		mac->mac_phy.init = bwn_phy_g_init;
1234 		mac->mac_phy.exit = bwn_phy_g_exit;
1235 		mac->mac_phy.phy_read = bwn_phy_g_read;
1236 		mac->mac_phy.phy_write = bwn_phy_g_write;
1237 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1238 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1239 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1240 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1241 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1242 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1243 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1244 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1245 		mac->mac_phy.set_im = bwn_phy_g_im;
1246 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1247 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1248 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1249 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1250 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1251 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1252 		mac->mac_phy.init = bwn_phy_lp_init;
1253 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1254 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1255 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1256 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1257 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1258 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1259 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1260 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1261 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1262 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1263 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1264 	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1265 		mac->mac_phy.attach = bwn_phy_n_attach;
1266 		mac->mac_phy.detach = bwn_phy_n_detach;
1267 		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1268 		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1269 		mac->mac_phy.init = bwn_phy_n_init;
1270 		mac->mac_phy.exit = bwn_phy_n_exit;
1271 		mac->mac_phy.phy_read = bwn_phy_n_read;
1272 		mac->mac_phy.phy_write = bwn_phy_n_write;
1273 		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1274 		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1275 		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1276 		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1277 		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1278 		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1279 		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1280 		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1281 		mac->mac_phy.set_im = bwn_phy_n_im;
1282 		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1283 		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1284 		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1285 		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1286 	} else {
1287 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1288 		    mac->mac_phy.type);
1289 		error = ENXIO;
1290 		goto fail;
1291 	}
1292 
1293 	mac->mac_phy.gmode = have_bg;
1294 	if (mac->mac_phy.attach != NULL) {
1295 		error = mac->mac_phy.attach(mac);
1296 		if (error) {
1297 			device_printf(sc->sc_dev, "failed\n");
1298 			goto fail;
1299 		}
1300 	}
1301 
1302 	bwn_reset_core(mac, have_bg);
1303 
1304 	error = bwn_chiptest(mac);
1305 	if (error)
1306 		goto fail;
1307 	error = bwn_setup_channels(mac, have_bg, have_a);
1308 	if (error) {
1309 		device_printf(sc->sc_dev, "failed to setup channels\n");
1310 		goto fail;
1311 	}
1312 
1313 	if (sc->sc_curmac == NULL)
1314 		sc->sc_curmac = mac;
1315 
1316 	error = bwn_dma_attach(mac);
1317 	if (error != 0) {
1318 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1319 		goto fail;
1320 	}
1321 
1322 	mac->mac_phy.switch_analog(mac, 0);
1323 
1324 	siba_dev_down(sc->sc_dev, 0);
1325 fail:
1326 	siba_powerdown(sc->sc_dev);
1327 	return (error);
1328 }
1329 
1330 /*
1331  * Reset - SIBA.
1332  *
1333  * XXX TODO: implement BCMA version!
1334  */
1335 void
1336 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1337 {
1338 	struct bwn_softc *sc = mac->mac_sc;
1339 	uint32_t low, ctl;
1340 	uint32_t flags = 0;
1341 
1342 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1343 
1344 	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1345 	if (g_mode)
1346 		flags |= BWN_TGSLOW_SUPPORT_G;
1347 
1348 	/* XXX N-PHY only; and hard-code to 20MHz for now */
1349 	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1350 		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1351 
1352 	siba_dev_up(sc->sc_dev, flags);
1353 	DELAY(2000);
1354 
1355 	/* Take PHY out of reset */
1356 	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1357 	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1358 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1359 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1360 	DELAY(2000);
1361 	low &= ~SIBA_TGSLOW_FGC;
1362 	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1363 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1364 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1365 	DELAY(2000);
1366 
1367 	if (mac->mac_phy.switch_analog != NULL)
1368 		mac->mac_phy.switch_analog(mac, 1);
1369 
1370 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1371 	if (g_mode)
1372 		ctl |= BWN_MACCTL_GMODE;
1373 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1374 }
1375 
1376 static int
1377 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1378 {
1379 	struct bwn_phy *phy = &mac->mac_phy;
1380 	struct bwn_softc *sc = mac->mac_sc;
1381 	uint32_t tmp;
1382 
1383 	/* PHY */
1384 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1385 	phy->gmode = gmode;
1386 	phy->rf_on = 1;
1387 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1388 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1389 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1390 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1391 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1392 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1393 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1394 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1395 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1396 		goto unsupphy;
1397 
1398 	/* RADIO */
1399 	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1400 		if (siba_get_chiprev(sc->sc_dev) == 0)
1401 			tmp = 0x3205017f;
1402 		else if (siba_get_chiprev(sc->sc_dev) == 1)
1403 			tmp = 0x4205017f;
1404 		else
1405 			tmp = 0x5205017f;
1406 	} else {
1407 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1408 		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1409 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1410 		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1411 	}
1412 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1413 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1414 	phy->rf_manuf = (tmp & 0x00000fff);
1415 
1416 	/*
1417 	 * For now, just always do full init (ie, what bwn has traditionally
1418 	 * done)
1419 	 */
1420 	phy->phy_do_full_init = 1;
1421 
1422 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1423 		goto unsupradio;
1424 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1425 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1426 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1427 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1428 	    (phy->type == BWN_PHYTYPE_N &&
1429 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1430 	    (phy->type == BWN_PHYTYPE_LP &&
1431 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1432 		goto unsupradio;
1433 
1434 	return (0);
1435 unsupphy:
1436 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1437 	    "analog %#x)\n",
1438 	    phy->type, phy->rev, phy->analog);
1439 	return (ENXIO);
1440 unsupradio:
1441 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1442 	    "rev %#x)\n",
1443 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1444 	return (ENXIO);
1445 }
1446 
1447 static int
1448 bwn_chiptest(struct bwn_mac *mac)
1449 {
1450 #define	TESTVAL0	0x55aaaa55
1451 #define	TESTVAL1	0xaa5555aa
1452 	struct bwn_softc *sc = mac->mac_sc;
1453 	uint32_t v, backup;
1454 
1455 	BWN_LOCK(sc);
1456 
1457 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1458 
1459 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1460 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1461 		goto error;
1462 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1463 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1464 		goto error;
1465 
1466 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1467 
1468 	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1469 	    (siba_get_revid(sc->sc_dev) <= 10)) {
1470 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1471 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1472 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1473 			goto error;
1474 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1475 			goto error;
1476 	}
1477 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1478 
1479 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1480 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1481 		goto error;
1482 
1483 	BWN_UNLOCK(sc);
1484 	return (0);
1485 error:
1486 	BWN_UNLOCK(sc);
1487 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1488 	return (ENODEV);
1489 }
1490 
1491 static int
1492 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1493 {
1494 	struct bwn_softc *sc = mac->mac_sc;
1495 	struct ieee80211com *ic = &sc->sc_ic;
1496 	uint8_t bands[IEEE80211_MODE_BYTES];
1497 
1498 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1499 	ic->ic_nchans = 0;
1500 
1501 	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1502 	    __func__,
1503 	    have_bg,
1504 	    have_a);
1505 
1506 	if (have_bg) {
1507 		memset(bands, 0, sizeof(bands));
1508 		setbit(bands, IEEE80211_MODE_11B);
1509 		setbit(bands, IEEE80211_MODE_11G);
1510 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1511 		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1512 	}
1513 
1514 	if (have_a) {
1515 		memset(bands, 0, sizeof(bands));
1516 		setbit(bands, IEEE80211_MODE_11A);
1517 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1518 		    &ic->ic_nchans, &bwn_chantable_a, bands);
1519 	}
1520 
1521 	mac->mac_phy.supports_2ghz = have_bg;
1522 	mac->mac_phy.supports_5ghz = have_a;
1523 
1524 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1525 }
1526 
1527 uint32_t
1528 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1529 {
1530 	uint32_t ret;
1531 
1532 	BWN_ASSERT_LOCKED(mac->mac_sc);
1533 
1534 	if (way == BWN_SHARED) {
1535 		KASSERT((offset & 0x0001) == 0,
1536 		    ("%s:%d warn", __func__, __LINE__));
1537 		if (offset & 0x0003) {
1538 			bwn_shm_ctlword(mac, way, offset >> 2);
1539 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1540 			ret <<= 16;
1541 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1542 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1543 			goto out;
1544 		}
1545 		offset >>= 2;
1546 	}
1547 	bwn_shm_ctlword(mac, way, offset);
1548 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1549 out:
1550 	return (ret);
1551 }
1552 
1553 uint16_t
1554 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1555 {
1556 	uint16_t ret;
1557 
1558 	BWN_ASSERT_LOCKED(mac->mac_sc);
1559 
1560 	if (way == BWN_SHARED) {
1561 		KASSERT((offset & 0x0001) == 0,
1562 		    ("%s:%d warn", __func__, __LINE__));
1563 		if (offset & 0x0003) {
1564 			bwn_shm_ctlword(mac, way, offset >> 2);
1565 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1566 			goto out;
1567 		}
1568 		offset >>= 2;
1569 	}
1570 	bwn_shm_ctlword(mac, way, offset);
1571 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1572 out:
1573 
1574 	return (ret);
1575 }
1576 
1577 static void
1578 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1579     uint16_t offset)
1580 {
1581 	uint32_t control;
1582 
1583 	control = way;
1584 	control <<= 16;
1585 	control |= offset;
1586 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1587 }
1588 
1589 void
1590 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1591     uint32_t value)
1592 {
1593 	BWN_ASSERT_LOCKED(mac->mac_sc);
1594 
1595 	if (way == BWN_SHARED) {
1596 		KASSERT((offset & 0x0001) == 0,
1597 		    ("%s:%d warn", __func__, __LINE__));
1598 		if (offset & 0x0003) {
1599 			bwn_shm_ctlword(mac, way, offset >> 2);
1600 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1601 				    (value >> 16) & 0xffff);
1602 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1603 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1604 			return;
1605 		}
1606 		offset >>= 2;
1607 	}
1608 	bwn_shm_ctlword(mac, way, offset);
1609 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1610 }
1611 
1612 void
1613 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1614     uint16_t value)
1615 {
1616 	BWN_ASSERT_LOCKED(mac->mac_sc);
1617 
1618 	if (way == BWN_SHARED) {
1619 		KASSERT((offset & 0x0001) == 0,
1620 		    ("%s:%d warn", __func__, __LINE__));
1621 		if (offset & 0x0003) {
1622 			bwn_shm_ctlword(mac, way, offset >> 2);
1623 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1624 			return;
1625 		}
1626 		offset >>= 2;
1627 	}
1628 	bwn_shm_ctlword(mac, way, offset);
1629 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1630 }
1631 
1632 static void
1633 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1634     const struct bwn_channelinfo *ci, const uint8_t bands[])
1635 {
1636 	int i, error;
1637 
1638 	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1639 		const struct bwn_channel *hc = &ci->channels[i];
1640 
1641 		error = ieee80211_add_channel(chans, maxchans, nchans,
1642 		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1643 	}
1644 }
1645 
1646 static int
1647 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1648 	const struct ieee80211_bpf_params *params)
1649 {
1650 	struct ieee80211com *ic = ni->ni_ic;
1651 	struct bwn_softc *sc = ic->ic_softc;
1652 	struct bwn_mac *mac = sc->sc_curmac;
1653 	int error;
1654 
1655 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1656 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1657 		m_freem(m);
1658 		return (ENETDOWN);
1659 	}
1660 
1661 	BWN_LOCK(sc);
1662 	if (bwn_tx_isfull(sc, m)) {
1663 		m_freem(m);
1664 		BWN_UNLOCK(sc);
1665 		return (ENOBUFS);
1666 	}
1667 
1668 	error = bwn_tx_start(sc, ni, m);
1669 	if (error == 0)
1670 		sc->sc_watchdog_timer = 5;
1671 	BWN_UNLOCK(sc);
1672 	return (error);
1673 }
1674 
1675 /*
1676  * Callback from the 802.11 layer to update the slot time
1677  * based on the current setting.  We use it to notify the
1678  * firmware of ERP changes and the f/w takes care of things
1679  * like slot time and preamble.
1680  */
1681 static void
1682 bwn_updateslot(struct ieee80211com *ic)
1683 {
1684 	struct bwn_softc *sc = ic->ic_softc;
1685 	struct bwn_mac *mac;
1686 
1687 	BWN_LOCK(sc);
1688 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1689 		mac = (struct bwn_mac *)sc->sc_curmac;
1690 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1691 	}
1692 	BWN_UNLOCK(sc);
1693 }
1694 
1695 /*
1696  * Callback from the 802.11 layer after a promiscuous mode change.
1697  * Note this interface does not check the operating mode as this
1698  * is an internal callback and we are expected to honor the current
1699  * state (e.g. this is used for setting the interface in promiscuous
1700  * mode when operating in hostap mode to do ACS).
1701  */
1702 static void
1703 bwn_update_promisc(struct ieee80211com *ic)
1704 {
1705 	struct bwn_softc *sc = ic->ic_softc;
1706 	struct bwn_mac *mac = sc->sc_curmac;
1707 
1708 	BWN_LOCK(sc);
1709 	mac = sc->sc_curmac;
1710 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1711 		if (ic->ic_promisc > 0)
1712 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1713 		else
1714 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1715 		bwn_set_opmode(mac);
1716 	}
1717 	BWN_UNLOCK(sc);
1718 }
1719 
1720 /*
1721  * Callback from the 802.11 layer to update WME parameters.
1722  */
1723 static int
1724 bwn_wme_update(struct ieee80211com *ic)
1725 {
1726 	struct bwn_softc *sc = ic->ic_softc;
1727 	struct bwn_mac *mac = sc->sc_curmac;
1728 	struct wmeParams *wmep;
1729 	int i;
1730 
1731 	BWN_LOCK(sc);
1732 	mac = sc->sc_curmac;
1733 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1734 		bwn_mac_suspend(mac);
1735 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1736 			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1737 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1738 		}
1739 		bwn_mac_enable(mac);
1740 	}
1741 	BWN_UNLOCK(sc);
1742 	return (0);
1743 }
1744 
1745 static void
1746 bwn_scan_start(struct ieee80211com *ic)
1747 {
1748 	struct bwn_softc *sc = ic->ic_softc;
1749 	struct bwn_mac *mac;
1750 
1751 	BWN_LOCK(sc);
1752 	mac = sc->sc_curmac;
1753 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1754 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1755 		bwn_set_opmode(mac);
1756 		/* disable CFP update during scan */
1757 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1758 	}
1759 	BWN_UNLOCK(sc);
1760 }
1761 
1762 static void
1763 bwn_scan_end(struct ieee80211com *ic)
1764 {
1765 	struct bwn_softc *sc = ic->ic_softc;
1766 	struct bwn_mac *mac;
1767 
1768 	BWN_LOCK(sc);
1769 	mac = sc->sc_curmac;
1770 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1771 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1772 		bwn_set_opmode(mac);
1773 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1774 	}
1775 	BWN_UNLOCK(sc);
1776 }
1777 
1778 static void
1779 bwn_set_channel(struct ieee80211com *ic)
1780 {
1781 	struct bwn_softc *sc = ic->ic_softc;
1782 	struct bwn_mac *mac = sc->sc_curmac;
1783 	struct bwn_phy *phy = &mac->mac_phy;
1784 	int chan, error;
1785 
1786 	BWN_LOCK(sc);
1787 
1788 	error = bwn_switch_band(sc, ic->ic_curchan);
1789 	if (error)
1790 		goto fail;
1791 	bwn_mac_suspend(mac);
1792 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1793 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1794 	if (chan != phy->chan)
1795 		bwn_switch_channel(mac, chan);
1796 
1797 	/* TX power level */
1798 	if (ic->ic_curchan->ic_maxpower != 0 &&
1799 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1800 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1801 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1802 		    BWN_TXPWR_IGNORE_TSSI);
1803 	}
1804 
1805 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1806 	if (phy->set_antenna)
1807 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1808 
1809 	if (sc->sc_rf_enabled != phy->rf_on) {
1810 		if (sc->sc_rf_enabled) {
1811 			bwn_rf_turnon(mac);
1812 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1813 				device_printf(sc->sc_dev,
1814 				    "please turn on the RF switch\n");
1815 		} else
1816 			bwn_rf_turnoff(mac);
1817 	}
1818 
1819 	bwn_mac_enable(mac);
1820 
1821 fail:
1822 	/*
1823 	 * Setup radio tap channel freq and flags
1824 	 */
1825 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1826 		htole16(ic->ic_curchan->ic_freq);
1827 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1828 		htole16(ic->ic_curchan->ic_flags & 0xffff);
1829 
1830 	BWN_UNLOCK(sc);
1831 }
1832 
1833 static struct ieee80211vap *
1834 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1835     enum ieee80211_opmode opmode, int flags,
1836     const uint8_t bssid[IEEE80211_ADDR_LEN],
1837     const uint8_t mac[IEEE80211_ADDR_LEN])
1838 {
1839 	struct ieee80211vap *vap;
1840 	struct bwn_vap *bvp;
1841 
1842 	switch (opmode) {
1843 	case IEEE80211_M_HOSTAP:
1844 	case IEEE80211_M_MBSS:
1845 	case IEEE80211_M_STA:
1846 	case IEEE80211_M_WDS:
1847 	case IEEE80211_M_MONITOR:
1848 	case IEEE80211_M_IBSS:
1849 	case IEEE80211_M_AHDEMO:
1850 		break;
1851 	default:
1852 		return (NULL);
1853 	}
1854 
1855 	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1856 	vap = &bvp->bv_vap;
1857 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1858 	/* override with driver methods */
1859 	bvp->bv_newstate = vap->iv_newstate;
1860 	vap->iv_newstate = bwn_newstate;
1861 
1862 	/* override max aid so sta's cannot assoc when we're out of sta id's */
1863 	vap->iv_max_aid = BWN_STAID_MAX;
1864 
1865 	ieee80211_ratectl_init(vap);
1866 
1867 	/* complete setup */
1868 	ieee80211_vap_attach(vap, ieee80211_media_change,
1869 	    ieee80211_media_status, mac);
1870 	return (vap);
1871 }
1872 
1873 static void
1874 bwn_vap_delete(struct ieee80211vap *vap)
1875 {
1876 	struct bwn_vap *bvp = BWN_VAP(vap);
1877 
1878 	ieee80211_ratectl_deinit(vap);
1879 	ieee80211_vap_detach(vap);
1880 	free(bvp, M_80211_VAP);
1881 }
1882 
1883 static int
1884 bwn_init(struct bwn_softc *sc)
1885 {
1886 	struct bwn_mac *mac;
1887 	int error;
1888 
1889 	BWN_ASSERT_LOCKED(sc);
1890 
1891 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1892 
1893 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1894 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1895 	sc->sc_filters = 0;
1896 	bwn_wme_clear(sc);
1897 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1898 	sc->sc_rf_enabled = 1;
1899 
1900 	mac = sc->sc_curmac;
1901 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1902 		error = bwn_core_init(mac);
1903 		if (error != 0)
1904 			return (error);
1905 	}
1906 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1907 		bwn_core_start(mac);
1908 
1909 	bwn_set_opmode(mac);
1910 	bwn_set_pretbtt(mac);
1911 	bwn_spu_setdelay(mac, 0);
1912 	bwn_set_macaddr(mac);
1913 
1914 	sc->sc_flags |= BWN_FLAG_RUNNING;
1915 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1916 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1917 
1918 	return (0);
1919 }
1920 
1921 static void
1922 bwn_stop(struct bwn_softc *sc)
1923 {
1924 	struct bwn_mac *mac = sc->sc_curmac;
1925 
1926 	BWN_ASSERT_LOCKED(sc);
1927 
1928 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1929 
1930 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1931 		/* XXX FIXME opmode not based on VAP */
1932 		bwn_set_opmode(mac);
1933 		bwn_set_macaddr(mac);
1934 	}
1935 
1936 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1937 		bwn_core_stop(mac);
1938 
1939 	callout_stop(&sc->sc_led_blink_ch);
1940 	sc->sc_led_blinking = 0;
1941 
1942 	bwn_core_exit(mac);
1943 	sc->sc_rf_enabled = 0;
1944 
1945 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1946 }
1947 
1948 static void
1949 bwn_wme_clear(struct bwn_softc *sc)
1950 {
1951 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1952 	struct wmeParams *p;
1953 	unsigned int i;
1954 
1955 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1956 	    ("%s:%d: fail", __func__, __LINE__));
1957 
1958 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1959 		p = &(sc->sc_wmeParams[i]);
1960 
1961 		switch (bwn_wme_shm_offsets[i]) {
1962 		case BWN_WME_VOICE:
1963 			p->wmep_txopLimit = 0;
1964 			p->wmep_aifsn = 2;
1965 			/* XXX FIXME: log2(cwmin) */
1966 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1967 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1968 			break;
1969 		case BWN_WME_VIDEO:
1970 			p->wmep_txopLimit = 0;
1971 			p->wmep_aifsn = 2;
1972 			/* XXX FIXME: log2(cwmin) */
1973 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1974 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1975 			break;
1976 		case BWN_WME_BESTEFFORT:
1977 			p->wmep_txopLimit = 0;
1978 			p->wmep_aifsn = 3;
1979 			/* XXX FIXME: log2(cwmin) */
1980 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1981 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1982 			break;
1983 		case BWN_WME_BACKGROUND:
1984 			p->wmep_txopLimit = 0;
1985 			p->wmep_aifsn = 7;
1986 			/* XXX FIXME: log2(cwmin) */
1987 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1988 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1989 			break;
1990 		default:
1991 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1992 		}
1993 	}
1994 }
1995 
1996 static int
1997 bwn_core_init(struct bwn_mac *mac)
1998 {
1999 	struct bwn_softc *sc = mac->mac_sc;
2000 	uint64_t hf;
2001 	int error;
2002 
2003 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2004 	    ("%s:%d: fail", __func__, __LINE__));
2005 
2006 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2007 
2008 	siba_powerup(sc->sc_dev, 0);
2009 	if (!siba_dev_isup(sc->sc_dev))
2010 		bwn_reset_core(mac, mac->mac_phy.gmode);
2011 
2012 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2013 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2014 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2015 	BWN_GETTIME(mac->mac_phy.nexttime);
2016 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2017 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2018 	mac->mac_stats.link_noise = -95;
2019 	mac->mac_reason_intr = 0;
2020 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2021 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2022 #ifdef BWN_DEBUG
2023 	if (sc->sc_debug & BWN_DEBUG_XMIT)
2024 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2025 #endif
2026 	mac->mac_suspended = 1;
2027 	mac->mac_task_state = 0;
2028 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2029 
2030 	mac->mac_phy.init_pre(mac);
2031 
2032 	siba_pcicore_intr(sc->sc_dev);
2033 
2034 	siba_fix_imcfglobug(sc->sc_dev);
2035 	bwn_bt_disable(mac);
2036 	if (mac->mac_phy.prepare_hw) {
2037 		error = mac->mac_phy.prepare_hw(mac);
2038 		if (error)
2039 			goto fail0;
2040 	}
2041 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2042 	error = bwn_chip_init(mac);
2043 	if (error)
2044 		goto fail0;
2045 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2046 	    siba_get_revid(sc->sc_dev));
2047 	hf = bwn_hf_read(mac);
2048 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2049 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2050 		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2051 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2052 		if (mac->mac_phy.rev == 1)
2053 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2054 	}
2055 	if (mac->mac_phy.rf_ver == 0x2050) {
2056 		if (mac->mac_phy.rf_rev < 6)
2057 			hf |= BWN_HF_FORCE_VCO_RECALC;
2058 		if (mac->mac_phy.rf_rev == 6)
2059 			hf |= BWN_HF_4318_TSSI;
2060 	}
2061 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2062 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2063 	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2064 	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2065 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2066 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2067 	bwn_hf_write(mac, hf);
2068 
2069 	/* Tell the firmware about the MAC capabilities */
2070 	if (siba_get_revid(sc->sc_dev) >= 13) {
2071 		uint32_t cap;
2072 		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2073 		DPRINTF(sc, BWN_DEBUG_RESET,
2074 		    "%s: hw capabilities: 0x%08x\n",
2075 		    __func__, cap);
2076 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2077 		    cap & 0xffff);
2078 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2079 		    (cap >> 16) & 0xffff);
2080 	}
2081 
2082 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2083 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2084 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2085 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2086 
2087 	bwn_rate_init(mac);
2088 	bwn_set_phytxctl(mac);
2089 
2090 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2091 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2092 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2093 
2094 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2095 		bwn_pio_init(mac);
2096 	else
2097 		bwn_dma_init(mac);
2098 	bwn_wme_init(mac);
2099 	bwn_spu_setdelay(mac, 1);
2100 	bwn_bt_enable(mac);
2101 
2102 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2103 	siba_powerup(sc->sc_dev,
2104 	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2105 	bwn_set_macaddr(mac);
2106 	bwn_crypt_init(mac);
2107 
2108 	/* XXX LED initializatin */
2109 
2110 	mac->mac_status = BWN_MAC_STATUS_INITED;
2111 
2112 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2113 	return (error);
2114 
2115 fail0:
2116 	siba_powerdown(sc->sc_dev);
2117 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2118 	    ("%s:%d: fail", __func__, __LINE__));
2119 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2120 	return (error);
2121 }
2122 
2123 static void
2124 bwn_core_start(struct bwn_mac *mac)
2125 {
2126 	struct bwn_softc *sc = mac->mac_sc;
2127 	uint32_t tmp;
2128 
2129 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2130 	    ("%s:%d: fail", __func__, __LINE__));
2131 
2132 	if (siba_get_revid(sc->sc_dev) < 5)
2133 		return;
2134 
2135 	while (1) {
2136 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2137 		if (!(tmp & 0x00000001))
2138 			break;
2139 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2140 	}
2141 
2142 	bwn_mac_enable(mac);
2143 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2144 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2145 
2146 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2147 }
2148 
2149 static void
2150 bwn_core_exit(struct bwn_mac *mac)
2151 {
2152 	struct bwn_softc *sc = mac->mac_sc;
2153 	uint32_t macctl;
2154 
2155 	BWN_ASSERT_LOCKED(mac->mac_sc);
2156 
2157 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2158 	    ("%s:%d: fail", __func__, __LINE__));
2159 
2160 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2161 		return;
2162 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2163 
2164 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2165 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2166 	macctl |= BWN_MACCTL_MCODE_JMP0;
2167 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2168 
2169 	bwn_dma_stop(mac);
2170 	bwn_pio_stop(mac);
2171 	bwn_chip_exit(mac);
2172 	mac->mac_phy.switch_analog(mac, 0);
2173 	siba_dev_down(sc->sc_dev, 0);
2174 	siba_powerdown(sc->sc_dev);
2175 }
2176 
2177 static void
2178 bwn_bt_disable(struct bwn_mac *mac)
2179 {
2180 	struct bwn_softc *sc = mac->mac_sc;
2181 
2182 	(void)sc;
2183 	/* XXX do nothing yet */
2184 }
2185 
2186 static int
2187 bwn_chip_init(struct bwn_mac *mac)
2188 {
2189 	struct bwn_softc *sc = mac->mac_sc;
2190 	struct bwn_phy *phy = &mac->mac_phy;
2191 	uint32_t macctl;
2192 	int error;
2193 
2194 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2195 	if (phy->gmode)
2196 		macctl |= BWN_MACCTL_GMODE;
2197 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2198 
2199 	error = bwn_fw_fillinfo(mac);
2200 	if (error)
2201 		return (error);
2202 	error = bwn_fw_loaducode(mac);
2203 	if (error)
2204 		return (error);
2205 
2206 	error = bwn_gpio_init(mac);
2207 	if (error)
2208 		return (error);
2209 
2210 	error = bwn_fw_loadinitvals(mac);
2211 	if (error) {
2212 		siba_gpio_set(sc->sc_dev, 0);
2213 		return (error);
2214 	}
2215 	phy->switch_analog(mac, 1);
2216 	error = bwn_phy_init(mac);
2217 	if (error) {
2218 		siba_gpio_set(sc->sc_dev, 0);
2219 		return (error);
2220 	}
2221 	if (phy->set_im)
2222 		phy->set_im(mac, BWN_IMMODE_NONE);
2223 	if (phy->set_antenna)
2224 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2225 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2226 
2227 	if (phy->type == BWN_PHYTYPE_B)
2228 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2229 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2230 	if (siba_get_revid(sc->sc_dev) < 5)
2231 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2232 
2233 	BWN_WRITE_4(mac, BWN_MACCTL,
2234 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2235 	BWN_WRITE_4(mac, BWN_MACCTL,
2236 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2237 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2238 
2239 	bwn_set_opmode(mac);
2240 	if (siba_get_revid(sc->sc_dev) < 3) {
2241 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2242 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2243 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2244 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2245 	} else {
2246 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2247 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2248 	}
2249 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2250 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2251 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2252 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2253 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2254 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2255 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2256 
2257 	bwn_mac_phy_clock_set(mac, true);
2258 
2259 	/* SIBA powerup */
2260 	/* XXX TODO: BCMA powerup */
2261 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2262 	return (error);
2263 }
2264 
2265 /* read hostflags */
2266 uint64_t
2267 bwn_hf_read(struct bwn_mac *mac)
2268 {
2269 	uint64_t ret;
2270 
2271 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2272 	ret <<= 16;
2273 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2274 	ret <<= 16;
2275 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2276 	return (ret);
2277 }
2278 
2279 void
2280 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2281 {
2282 
2283 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2284 	    (value & 0x00000000ffffull));
2285 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2286 	    (value & 0x0000ffff0000ull) >> 16);
2287 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2288 	    (value & 0xffff00000000ULL) >> 32);
2289 }
2290 
2291 static void
2292 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2293 {
2294 
2295 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2296 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2297 }
2298 
2299 static void
2300 bwn_rate_init(struct bwn_mac *mac)
2301 {
2302 
2303 	switch (mac->mac_phy.type) {
2304 	case BWN_PHYTYPE_A:
2305 	case BWN_PHYTYPE_G:
2306 	case BWN_PHYTYPE_LP:
2307 	case BWN_PHYTYPE_N:
2308 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2309 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2310 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2311 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2312 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2313 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2314 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2315 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2316 			break;
2317 		/* FALLTHROUGH */
2318 	case BWN_PHYTYPE_B:
2319 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2320 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2321 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2322 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2323 		break;
2324 	default:
2325 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2326 	}
2327 }
2328 
2329 static void
2330 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2331 {
2332 	uint16_t offset;
2333 
2334 	if (ofdm) {
2335 		offset = 0x480;
2336 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2337 	} else {
2338 		offset = 0x4c0;
2339 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2340 	}
2341 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2342 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2343 }
2344 
2345 static uint8_t
2346 bwn_plcp_getcck(const uint8_t bitrate)
2347 {
2348 
2349 	switch (bitrate) {
2350 	case BWN_CCK_RATE_1MB:
2351 		return (0x0a);
2352 	case BWN_CCK_RATE_2MB:
2353 		return (0x14);
2354 	case BWN_CCK_RATE_5MB:
2355 		return (0x37);
2356 	case BWN_CCK_RATE_11MB:
2357 		return (0x6e);
2358 	}
2359 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2360 	return (0);
2361 }
2362 
2363 static uint8_t
2364 bwn_plcp_getofdm(const uint8_t bitrate)
2365 {
2366 
2367 	switch (bitrate) {
2368 	case BWN_OFDM_RATE_6MB:
2369 		return (0xb);
2370 	case BWN_OFDM_RATE_9MB:
2371 		return (0xf);
2372 	case BWN_OFDM_RATE_12MB:
2373 		return (0xa);
2374 	case BWN_OFDM_RATE_18MB:
2375 		return (0xe);
2376 	case BWN_OFDM_RATE_24MB:
2377 		return (0x9);
2378 	case BWN_OFDM_RATE_36MB:
2379 		return (0xd);
2380 	case BWN_OFDM_RATE_48MB:
2381 		return (0x8);
2382 	case BWN_OFDM_RATE_54MB:
2383 		return (0xc);
2384 	}
2385 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2386 	return (0);
2387 }
2388 
2389 static void
2390 bwn_set_phytxctl(struct bwn_mac *mac)
2391 {
2392 	uint16_t ctl;
2393 
2394 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2395 	    BWN_TX_PHY_TXPWR);
2396 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2397 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2398 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2399 }
2400 
2401 static void
2402 bwn_pio_init(struct bwn_mac *mac)
2403 {
2404 	struct bwn_pio *pio = &mac->mac_method.pio;
2405 
2406 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2407 	    & ~BWN_MACCTL_BIGENDIAN);
2408 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2409 
2410 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2411 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2412 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2413 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2414 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2415 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2416 }
2417 
2418 static void
2419 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2420     int index)
2421 {
2422 	struct bwn_pio_txpkt *tp;
2423 	struct bwn_softc *sc = mac->mac_sc;
2424 	unsigned int i;
2425 
2426 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2427 	tq->tq_index = index;
2428 
2429 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2430 	if (siba_get_revid(sc->sc_dev) >= 8)
2431 		tq->tq_size = 1920;
2432 	else {
2433 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2434 		tq->tq_size -= 80;
2435 	}
2436 
2437 	TAILQ_INIT(&tq->tq_pktlist);
2438 	for (i = 0; i < N(tq->tq_pkts); i++) {
2439 		tp = &(tq->tq_pkts[i]);
2440 		tp->tp_index = i;
2441 		tp->tp_queue = tq;
2442 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2443 	}
2444 }
2445 
2446 static uint16_t
2447 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2448 {
2449 	struct bwn_softc *sc = mac->mac_sc;
2450 	static const uint16_t bases[] = {
2451 		BWN_PIO_BASE0,
2452 		BWN_PIO_BASE1,
2453 		BWN_PIO_BASE2,
2454 		BWN_PIO_BASE3,
2455 		BWN_PIO_BASE4,
2456 		BWN_PIO_BASE5,
2457 		BWN_PIO_BASE6,
2458 		BWN_PIO_BASE7,
2459 	};
2460 	static const uint16_t bases_rev11[] = {
2461 		BWN_PIO11_BASE0,
2462 		BWN_PIO11_BASE1,
2463 		BWN_PIO11_BASE2,
2464 		BWN_PIO11_BASE3,
2465 		BWN_PIO11_BASE4,
2466 		BWN_PIO11_BASE5,
2467 	};
2468 
2469 	if (siba_get_revid(sc->sc_dev) >= 11) {
2470 		if (index >= N(bases_rev11))
2471 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2472 		return (bases_rev11[index]);
2473 	}
2474 	if (index >= N(bases))
2475 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2476 	return (bases[index]);
2477 }
2478 
2479 static void
2480 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2481     int index)
2482 {
2483 	struct bwn_softc *sc = mac->mac_sc;
2484 
2485 	prq->prq_mac = mac;
2486 	prq->prq_rev = siba_get_revid(sc->sc_dev);
2487 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2488 	bwn_dma_rxdirectfifo(mac, index, 1);
2489 }
2490 
2491 static void
2492 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2493 {
2494 	if (tq == NULL)
2495 		return;
2496 	bwn_pio_cancel_tx_packets(tq);
2497 }
2498 
2499 static void
2500 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2501 {
2502 
2503 	bwn_destroy_pioqueue_tx(pio);
2504 }
2505 
2506 static uint16_t
2507 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2508     uint16_t offset)
2509 {
2510 
2511 	return (BWN_READ_2(mac, tq->tq_base + offset));
2512 }
2513 
2514 static void
2515 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2516 {
2517 	uint32_t ctl;
2518 	int type;
2519 	uint16_t base;
2520 
2521 	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2522 	base = bwn_dma_base(type, idx);
2523 	if (type == BWN_DMA_64BIT) {
2524 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2525 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2526 		if (enable)
2527 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2528 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2529 	} else {
2530 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2531 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2532 		if (enable)
2533 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2534 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2535 	}
2536 }
2537 
2538 static uint64_t
2539 bwn_dma_mask(struct bwn_mac *mac)
2540 {
2541 	uint32_t tmp;
2542 	uint16_t base;
2543 
2544 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2545 	if (tmp & SIBA_TGSHIGH_DMA64)
2546 		return (BWN_DMA_BIT_MASK(64));
2547 	base = bwn_dma_base(0, 0);
2548 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2549 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2550 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2551 		return (BWN_DMA_BIT_MASK(32));
2552 
2553 	return (BWN_DMA_BIT_MASK(30));
2554 }
2555 
2556 static int
2557 bwn_dma_mask2type(uint64_t dmamask)
2558 {
2559 
2560 	if (dmamask == BWN_DMA_BIT_MASK(30))
2561 		return (BWN_DMA_30BIT);
2562 	if (dmamask == BWN_DMA_BIT_MASK(32))
2563 		return (BWN_DMA_32BIT);
2564 	if (dmamask == BWN_DMA_BIT_MASK(64))
2565 		return (BWN_DMA_64BIT);
2566 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2567 	return (BWN_DMA_30BIT);
2568 }
2569 
2570 static void
2571 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2572 {
2573 	struct bwn_pio_txpkt *tp;
2574 	unsigned int i;
2575 
2576 	for (i = 0; i < N(tq->tq_pkts); i++) {
2577 		tp = &(tq->tq_pkts[i]);
2578 		if (tp->tp_m) {
2579 			m_freem(tp->tp_m);
2580 			tp->tp_m = NULL;
2581 		}
2582 	}
2583 }
2584 
2585 static uint16_t
2586 bwn_dma_base(int type, int controller_idx)
2587 {
2588 	static const uint16_t map64[] = {
2589 		BWN_DMA64_BASE0,
2590 		BWN_DMA64_BASE1,
2591 		BWN_DMA64_BASE2,
2592 		BWN_DMA64_BASE3,
2593 		BWN_DMA64_BASE4,
2594 		BWN_DMA64_BASE5,
2595 	};
2596 	static const uint16_t map32[] = {
2597 		BWN_DMA32_BASE0,
2598 		BWN_DMA32_BASE1,
2599 		BWN_DMA32_BASE2,
2600 		BWN_DMA32_BASE3,
2601 		BWN_DMA32_BASE4,
2602 		BWN_DMA32_BASE5,
2603 	};
2604 
2605 	if (type == BWN_DMA_64BIT) {
2606 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2607 		    ("%s:%d: fail", __func__, __LINE__));
2608 		return (map64[controller_idx]);
2609 	}
2610 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2611 	    ("%s:%d: fail", __func__, __LINE__));
2612 	return (map32[controller_idx]);
2613 }
2614 
2615 static void
2616 bwn_dma_init(struct bwn_mac *mac)
2617 {
2618 	struct bwn_dma *dma = &mac->mac_method.dma;
2619 
2620 	/* setup TX DMA channels. */
2621 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2622 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2623 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2624 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2625 	bwn_dma_setup(dma->mcast);
2626 	/* setup RX DMA channel. */
2627 	bwn_dma_setup(dma->rx);
2628 }
2629 
2630 static struct bwn_dma_ring *
2631 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2632     int for_tx, int type)
2633 {
2634 	struct bwn_dma *dma = &mac->mac_method.dma;
2635 	struct bwn_dma_ring *dr;
2636 	struct bwn_dmadesc_generic *desc;
2637 	struct bwn_dmadesc_meta *mt;
2638 	struct bwn_softc *sc = mac->mac_sc;
2639 	int error, i;
2640 
2641 	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2642 	if (dr == NULL)
2643 		goto out;
2644 	dr->dr_numslots = BWN_RXRING_SLOTS;
2645 	if (for_tx)
2646 		dr->dr_numslots = BWN_TXRING_SLOTS;
2647 
2648 	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2649 	    M_DEVBUF, M_NOWAIT | M_ZERO);
2650 	if (dr->dr_meta == NULL)
2651 		goto fail0;
2652 
2653 	dr->dr_type = type;
2654 	dr->dr_mac = mac;
2655 	dr->dr_base = bwn_dma_base(type, controller_index);
2656 	dr->dr_index = controller_index;
2657 	if (type == BWN_DMA_64BIT) {
2658 		dr->getdesc = bwn_dma_64_getdesc;
2659 		dr->setdesc = bwn_dma_64_setdesc;
2660 		dr->start_transfer = bwn_dma_64_start_transfer;
2661 		dr->suspend = bwn_dma_64_suspend;
2662 		dr->resume = bwn_dma_64_resume;
2663 		dr->get_curslot = bwn_dma_64_get_curslot;
2664 		dr->set_curslot = bwn_dma_64_set_curslot;
2665 	} else {
2666 		dr->getdesc = bwn_dma_32_getdesc;
2667 		dr->setdesc = bwn_dma_32_setdesc;
2668 		dr->start_transfer = bwn_dma_32_start_transfer;
2669 		dr->suspend = bwn_dma_32_suspend;
2670 		dr->resume = bwn_dma_32_resume;
2671 		dr->get_curslot = bwn_dma_32_get_curslot;
2672 		dr->set_curslot = bwn_dma_32_set_curslot;
2673 	}
2674 	if (for_tx) {
2675 		dr->dr_tx = 1;
2676 		dr->dr_curslot = -1;
2677 	} else {
2678 		if (dr->dr_index == 0) {
2679 			switch (mac->mac_fw.fw_hdr_format) {
2680 			case BWN_FW_HDR_351:
2681 			case BWN_FW_HDR_410:
2682 				dr->dr_rx_bufsize =
2683 				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2684 				dr->dr_frameoffset =
2685 				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2686 				break;
2687 			case BWN_FW_HDR_598:
2688 				dr->dr_rx_bufsize =
2689 				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2690 				dr->dr_frameoffset =
2691 				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2692 				break;
2693 			}
2694 		} else
2695 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2696 	}
2697 
2698 	error = bwn_dma_allocringmemory(dr);
2699 	if (error)
2700 		goto fail2;
2701 
2702 	if (for_tx) {
2703 		/*
2704 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2705 		 * BWN_TX_SLOTS_PER_FRAME
2706 		 */
2707 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2708 		    ("%s:%d: fail", __func__, __LINE__));
2709 
2710 		dr->dr_txhdr_cache = contigmalloc(
2711 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2712 		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2713 		    0, BUS_SPACE_MAXADDR, 8, 0);
2714 		if (dr->dr_txhdr_cache == NULL) {
2715 			device_printf(sc->sc_dev,
2716 			    "can't allocate TX header DMA memory\n");
2717 			goto fail1;
2718 		}
2719 
2720 		/*
2721 		 * Create TX ring DMA stuffs
2722 		 */
2723 		error = bus_dma_tag_create(dma->parent_dtag,
2724 				    BWN_ALIGN, 0,
2725 				    BUS_SPACE_MAXADDR,
2726 				    BUS_SPACE_MAXADDR,
2727 				    NULL, NULL,
2728 				    BWN_HDRSIZE(mac),
2729 				    1,
2730 				    BUS_SPACE_MAXSIZE_32BIT,
2731 				    0,
2732 				    NULL, NULL,
2733 				    &dr->dr_txring_dtag);
2734 		if (error) {
2735 			device_printf(sc->sc_dev,
2736 			    "can't create TX ring DMA tag: TODO frees\n");
2737 			goto fail2;
2738 		}
2739 
2740 		for (i = 0; i < dr->dr_numslots; i += 2) {
2741 			dr->getdesc(dr, i, &desc, &mt);
2742 
2743 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2744 			mt->mt_m = NULL;
2745 			mt->mt_ni = NULL;
2746 			mt->mt_islast = 0;
2747 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2748 			    &mt->mt_dmap);
2749 			if (error) {
2750 				device_printf(sc->sc_dev,
2751 				     "can't create RX buf DMA map\n");
2752 				goto fail2;
2753 			}
2754 
2755 			dr->getdesc(dr, i + 1, &desc, &mt);
2756 
2757 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2758 			mt->mt_m = NULL;
2759 			mt->mt_ni = NULL;
2760 			mt->mt_islast = 1;
2761 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2762 			    &mt->mt_dmap);
2763 			if (error) {
2764 				device_printf(sc->sc_dev,
2765 				     "can't create RX buf DMA map\n");
2766 				goto fail2;
2767 			}
2768 		}
2769 	} else {
2770 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2771 		    &dr->dr_spare_dmap);
2772 		if (error) {
2773 			device_printf(sc->sc_dev,
2774 			    "can't create RX buf DMA map\n");
2775 			goto out;		/* XXX wrong! */
2776 		}
2777 
2778 		for (i = 0; i < dr->dr_numslots; i++) {
2779 			dr->getdesc(dr, i, &desc, &mt);
2780 
2781 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2782 			    &mt->mt_dmap);
2783 			if (error) {
2784 				device_printf(sc->sc_dev,
2785 				    "can't create RX buf DMA map\n");
2786 				goto out;	/* XXX wrong! */
2787 			}
2788 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2789 			if (error) {
2790 				device_printf(sc->sc_dev,
2791 				    "failed to allocate RX buf\n");
2792 				goto out;	/* XXX wrong! */
2793 			}
2794 		}
2795 
2796 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2797 		    BUS_DMASYNC_PREWRITE);
2798 
2799 		dr->dr_usedslot = dr->dr_numslots;
2800 	}
2801 
2802       out:
2803 	return (dr);
2804 
2805 fail2:
2806 	if (dr->dr_txhdr_cache != NULL) {
2807 		contigfree(dr->dr_txhdr_cache,
2808 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2809 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2810 	}
2811 fail1:
2812 	free(dr->dr_meta, M_DEVBUF);
2813 fail0:
2814 	free(dr, M_DEVBUF);
2815 	return (NULL);
2816 }
2817 
2818 static void
2819 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2820 {
2821 
2822 	if (dr == NULL)
2823 		return;
2824 
2825 	bwn_dma_free_descbufs(*dr);
2826 	bwn_dma_free_ringmemory(*dr);
2827 
2828 	if ((*dr)->dr_txhdr_cache != NULL) {
2829 		contigfree((*dr)->dr_txhdr_cache,
2830 		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2831 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2832 	}
2833 	free((*dr)->dr_meta, M_DEVBUF);
2834 	free(*dr, M_DEVBUF);
2835 
2836 	*dr = NULL;
2837 }
2838 
2839 static void
2840 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2841     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2842 {
2843 	struct bwn_dmadesc32 *desc;
2844 
2845 	*meta = &(dr->dr_meta[slot]);
2846 	desc = dr->dr_ring_descbase;
2847 	desc = &(desc[slot]);
2848 
2849 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2850 }
2851 
2852 static void
2853 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2854     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2855     int start, int end, int irq)
2856 {
2857 	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2858 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2859 	uint32_t addr, addrext, ctl;
2860 	int slot;
2861 
2862 	slot = (int)(&(desc->dma.dma32) - descbase);
2863 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2864 	    ("%s:%d: fail", __func__, __LINE__));
2865 
2866 	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2867 	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2868 	addr |= siba_dma_translation(sc->sc_dev);
2869 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2870 	if (slot == dr->dr_numslots - 1)
2871 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2872 	if (start)
2873 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2874 	if (end)
2875 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2876 	if (irq)
2877 		ctl |= BWN_DMA32_DCTL_IRQ;
2878 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2879 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2880 
2881 	desc->dma.dma32.control = htole32(ctl);
2882 	desc->dma.dma32.address = htole32(addr);
2883 }
2884 
2885 static void
2886 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2887 {
2888 
2889 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2890 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2891 }
2892 
2893 static void
2894 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2895 {
2896 
2897 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2898 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2899 }
2900 
2901 static void
2902 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2903 {
2904 
2905 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2906 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2907 }
2908 
2909 static int
2910 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2911 {
2912 	uint32_t val;
2913 
2914 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2915 	val &= BWN_DMA32_RXDPTR;
2916 
2917 	return (val / sizeof(struct bwn_dmadesc32));
2918 }
2919 
2920 static void
2921 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2922 {
2923 
2924 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2925 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2926 }
2927 
2928 static void
2929 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2930     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2931 {
2932 	struct bwn_dmadesc64 *desc;
2933 
2934 	*meta = &(dr->dr_meta[slot]);
2935 	desc = dr->dr_ring_descbase;
2936 	desc = &(desc[slot]);
2937 
2938 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2939 }
2940 
2941 static void
2942 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2943     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2944     int start, int end, int irq)
2945 {
2946 	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2947 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2948 	int slot;
2949 	uint32_t ctl0 = 0, ctl1 = 0;
2950 	uint32_t addrlo, addrhi;
2951 	uint32_t addrext;
2952 
2953 	slot = (int)(&(desc->dma.dma64) - descbase);
2954 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2955 	    ("%s:%d: fail", __func__, __LINE__));
2956 
2957 	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2958 	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2959 	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2960 	    30;
2961 	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2962 	if (slot == dr->dr_numslots - 1)
2963 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2964 	if (start)
2965 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2966 	if (end)
2967 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2968 	if (irq)
2969 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2970 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2971 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2972 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2973 
2974 	desc->dma.dma64.control0 = htole32(ctl0);
2975 	desc->dma.dma64.control1 = htole32(ctl1);
2976 	desc->dma.dma64.address_low = htole32(addrlo);
2977 	desc->dma.dma64.address_high = htole32(addrhi);
2978 }
2979 
2980 static void
2981 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2982 {
2983 
2984 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2985 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2986 }
2987 
2988 static void
2989 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2990 {
2991 
2992 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2993 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
2994 }
2995 
2996 static void
2997 bwn_dma_64_resume(struct bwn_dma_ring *dr)
2998 {
2999 
3000 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3001 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3002 }
3003 
3004 static int
3005 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3006 {
3007 	uint32_t val;
3008 
3009 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3010 	val &= BWN_DMA64_RXSTATDPTR;
3011 
3012 	return (val / sizeof(struct bwn_dmadesc64));
3013 }
3014 
3015 static void
3016 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3017 {
3018 
3019 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3020 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3021 }
3022 
3023 static int
3024 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3025 {
3026 	struct bwn_mac *mac = dr->dr_mac;
3027 	struct bwn_dma *dma = &mac->mac_method.dma;
3028 	struct bwn_softc *sc = mac->mac_sc;
3029 	int error;
3030 
3031 	error = bus_dma_tag_create(dma->parent_dtag,
3032 			    BWN_ALIGN, 0,
3033 			    BUS_SPACE_MAXADDR,
3034 			    BUS_SPACE_MAXADDR,
3035 			    NULL, NULL,
3036 			    BWN_DMA_RINGMEMSIZE,
3037 			    1,
3038 			    BUS_SPACE_MAXSIZE_32BIT,
3039 			    0,
3040 			    NULL, NULL,
3041 			    &dr->dr_ring_dtag);
3042 	if (error) {
3043 		device_printf(sc->sc_dev,
3044 		    "can't create TX ring DMA tag: TODO frees\n");
3045 		return (-1);
3046 	}
3047 
3048 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3049 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3050 	    &dr->dr_ring_dmap);
3051 	if (error) {
3052 		device_printf(sc->sc_dev,
3053 		    "can't allocate DMA mem: TODO frees\n");
3054 		return (-1);
3055 	}
3056 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3057 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3058 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3059 	if (error) {
3060 		device_printf(sc->sc_dev,
3061 		    "can't load DMA mem: TODO free\n");
3062 		return (-1);
3063 	}
3064 
3065 	return (0);
3066 }
3067 
3068 static void
3069 bwn_dma_setup(struct bwn_dma_ring *dr)
3070 {
3071 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3072 	uint64_t ring64;
3073 	uint32_t addrext, ring32, value;
3074 	uint32_t trans = siba_dma_translation(sc->sc_dev);
3075 
3076 	if (dr->dr_tx) {
3077 		dr->dr_curslot = -1;
3078 
3079 		if (dr->dr_type == BWN_DMA_64BIT) {
3080 			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3081 			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3082 			    >> 30;
3083 			value = BWN_DMA64_TXENABLE;
3084 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3085 			    & BWN_DMA64_TXADDREXT_MASK;
3086 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3087 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3088 			    (ring64 & 0xffffffff));
3089 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3090 			    ((ring64 >> 32) &
3091 			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3092 		} else {
3093 			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3094 			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3095 			value = BWN_DMA32_TXENABLE;
3096 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3097 			    & BWN_DMA32_TXADDREXT_MASK;
3098 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3099 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3100 			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3101 		}
3102 		return;
3103 	}
3104 
3105 	/*
3106 	 * set for RX
3107 	 */
3108 	dr->dr_usedslot = dr->dr_numslots;
3109 
3110 	if (dr->dr_type == BWN_DMA_64BIT) {
3111 		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3112 		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3113 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3114 		value |= BWN_DMA64_RXENABLE;
3115 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3116 		    & BWN_DMA64_RXADDREXT_MASK;
3117 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3118 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3119 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3120 		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3121 		    | (trans << 1));
3122 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3123 		    sizeof(struct bwn_dmadesc64));
3124 	} else {
3125 		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3126 		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3127 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3128 		value |= BWN_DMA32_RXENABLE;
3129 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3130 		    & BWN_DMA32_RXADDREXT_MASK;
3131 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3132 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3133 		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3134 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3135 		    sizeof(struct bwn_dmadesc32));
3136 	}
3137 }
3138 
3139 static void
3140 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3141 {
3142 
3143 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3144 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3145 	    dr->dr_ring_dmap);
3146 }
3147 
3148 static void
3149 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3150 {
3151 
3152 	if (dr->dr_tx) {
3153 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3154 		if (dr->dr_type == BWN_DMA_64BIT) {
3155 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3156 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3157 		} else
3158 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3159 	} else {
3160 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3161 		if (dr->dr_type == BWN_DMA_64BIT) {
3162 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3163 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3164 		} else
3165 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3166 	}
3167 }
3168 
3169 static void
3170 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3171 {
3172 	struct bwn_dmadesc_generic *desc;
3173 	struct bwn_dmadesc_meta *meta;
3174 	struct bwn_mac *mac = dr->dr_mac;
3175 	struct bwn_dma *dma = &mac->mac_method.dma;
3176 	struct bwn_softc *sc = mac->mac_sc;
3177 	int i;
3178 
3179 	if (!dr->dr_usedslot)
3180 		return;
3181 	for (i = 0; i < dr->dr_numslots; i++) {
3182 		dr->getdesc(dr, i, &desc, &meta);
3183 
3184 		if (meta->mt_m == NULL) {
3185 			if (!dr->dr_tx)
3186 				device_printf(sc->sc_dev, "%s: not TX?\n",
3187 				    __func__);
3188 			continue;
3189 		}
3190 		if (dr->dr_tx) {
3191 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3192 				bus_dmamap_unload(dr->dr_txring_dtag,
3193 				    meta->mt_dmap);
3194 			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3195 				bus_dmamap_unload(dma->txbuf_dtag,
3196 				    meta->mt_dmap);
3197 		} else
3198 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3199 		bwn_dma_free_descbuf(dr, meta);
3200 	}
3201 }
3202 
3203 static int
3204 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3205     int type)
3206 {
3207 	struct bwn_softc *sc = mac->mac_sc;
3208 	uint32_t value;
3209 	int i;
3210 	uint16_t offset;
3211 
3212 	for (i = 0; i < 10; i++) {
3213 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3214 		    BWN_DMA32_TXSTATUS;
3215 		value = BWN_READ_4(mac, base + offset);
3216 		if (type == BWN_DMA_64BIT) {
3217 			value &= BWN_DMA64_TXSTAT;
3218 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3219 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3220 			    value == BWN_DMA64_TXSTAT_STOPPED)
3221 				break;
3222 		} else {
3223 			value &= BWN_DMA32_TXSTATE;
3224 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3225 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3226 			    value == BWN_DMA32_TXSTAT_STOPPED)
3227 				break;
3228 		}
3229 		DELAY(1000);
3230 	}
3231 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3232 	BWN_WRITE_4(mac, base + offset, 0);
3233 	for (i = 0; i < 10; i++) {
3234 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3235 						   BWN_DMA32_TXSTATUS;
3236 		value = BWN_READ_4(mac, base + offset);
3237 		if (type == BWN_DMA_64BIT) {
3238 			value &= BWN_DMA64_TXSTAT;
3239 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3240 				i = -1;
3241 				break;
3242 			}
3243 		} else {
3244 			value &= BWN_DMA32_TXSTATE;
3245 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3246 				i = -1;
3247 				break;
3248 			}
3249 		}
3250 		DELAY(1000);
3251 	}
3252 	if (i != -1) {
3253 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3254 		return (ENODEV);
3255 	}
3256 	DELAY(1000);
3257 
3258 	return (0);
3259 }
3260 
3261 static int
3262 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3263     int type)
3264 {
3265 	struct bwn_softc *sc = mac->mac_sc;
3266 	uint32_t value;
3267 	int i;
3268 	uint16_t offset;
3269 
3270 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3271 	BWN_WRITE_4(mac, base + offset, 0);
3272 	for (i = 0; i < 10; i++) {
3273 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3274 		    BWN_DMA32_RXSTATUS;
3275 		value = BWN_READ_4(mac, base + offset);
3276 		if (type == BWN_DMA_64BIT) {
3277 			value &= BWN_DMA64_RXSTAT;
3278 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3279 				i = -1;
3280 				break;
3281 			}
3282 		} else {
3283 			value &= BWN_DMA32_RXSTATE;
3284 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3285 				i = -1;
3286 				break;
3287 			}
3288 		}
3289 		DELAY(1000);
3290 	}
3291 	if (i != -1) {
3292 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3293 		return (ENODEV);
3294 	}
3295 
3296 	return (0);
3297 }
3298 
3299 static void
3300 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3301     struct bwn_dmadesc_meta *meta)
3302 {
3303 
3304 	if (meta->mt_m != NULL) {
3305 		m_freem(meta->mt_m);
3306 		meta->mt_m = NULL;
3307 	}
3308 	if (meta->mt_ni != NULL) {
3309 		ieee80211_free_node(meta->mt_ni);
3310 		meta->mt_ni = NULL;
3311 	}
3312 }
3313 
3314 static void
3315 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3316 {
3317 	struct bwn_rxhdr4 *rxhdr;
3318 	unsigned char *frame;
3319 
3320 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3321 	rxhdr->frame_len = 0;
3322 
3323 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3324 	    sizeof(struct bwn_plcp6) + 2,
3325 	    ("%s:%d: fail", __func__, __LINE__));
3326 	frame = mtod(m, char *) + dr->dr_frameoffset;
3327 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3328 }
3329 
3330 static uint8_t
3331 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3332 {
3333 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3334 
3335 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3336 	    == 0xff);
3337 }
3338 
3339 static void
3340 bwn_wme_init(struct bwn_mac *mac)
3341 {
3342 
3343 	bwn_wme_load(mac);
3344 
3345 	/* enable WME support. */
3346 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3347 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3348 	    BWN_IFSCTL_USE_EDCF);
3349 }
3350 
3351 static void
3352 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3353 {
3354 	struct bwn_softc *sc = mac->mac_sc;
3355 	struct ieee80211com *ic = &sc->sc_ic;
3356 	uint16_t delay;	/* microsec */
3357 
3358 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3359 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3360 		delay = 500;
3361 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3362 		delay = max(delay, (uint16_t)2400);
3363 
3364 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3365 }
3366 
3367 static void
3368 bwn_bt_enable(struct bwn_mac *mac)
3369 {
3370 	struct bwn_softc *sc = mac->mac_sc;
3371 	uint64_t hf;
3372 
3373 	if (bwn_bluetooth == 0)
3374 		return;
3375 	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3376 		return;
3377 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3378 		return;
3379 
3380 	hf = bwn_hf_read(mac);
3381 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3382 		hf |= BWN_HF_BT_COEXISTALT;
3383 	else
3384 		hf |= BWN_HF_BT_COEXIST;
3385 	bwn_hf_write(mac, hf);
3386 }
3387 
3388 static void
3389 bwn_set_macaddr(struct bwn_mac *mac)
3390 {
3391 
3392 	bwn_mac_write_bssid(mac);
3393 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3394 	    mac->mac_sc->sc_ic.ic_macaddr);
3395 }
3396 
3397 static void
3398 bwn_clear_keys(struct bwn_mac *mac)
3399 {
3400 	int i;
3401 
3402 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3403 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3404 		    ("%s:%d: fail", __func__, __LINE__));
3405 
3406 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3407 		    NULL, BWN_SEC_KEYSIZE, NULL);
3408 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3409 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3410 			    NULL, BWN_SEC_KEYSIZE, NULL);
3411 		}
3412 		mac->mac_key[i].keyconf = NULL;
3413 	}
3414 }
3415 
3416 static void
3417 bwn_crypt_init(struct bwn_mac *mac)
3418 {
3419 	struct bwn_softc *sc = mac->mac_sc;
3420 
3421 	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3422 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3423 	    ("%s:%d: fail", __func__, __LINE__));
3424 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3425 	mac->mac_ktp *= 2;
3426 	if (siba_get_revid(sc->sc_dev) >= 5)
3427 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3428 	bwn_clear_keys(mac);
3429 }
3430 
3431 static void
3432 bwn_chip_exit(struct bwn_mac *mac)
3433 {
3434 	struct bwn_softc *sc = mac->mac_sc;
3435 
3436 	bwn_phy_exit(mac);
3437 	siba_gpio_set(sc->sc_dev, 0);
3438 }
3439 
3440 static int
3441 bwn_fw_fillinfo(struct bwn_mac *mac)
3442 {
3443 	int error;
3444 
3445 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3446 	if (error == 0)
3447 		return (0);
3448 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3449 	if (error == 0)
3450 		return (0);
3451 	return (error);
3452 }
3453 
3454 static int
3455 bwn_gpio_init(struct bwn_mac *mac)
3456 {
3457 	struct bwn_softc *sc = mac->mac_sc;
3458 	uint32_t mask = 0x1f, set = 0xf, value;
3459 
3460 	BWN_WRITE_4(mac, BWN_MACCTL,
3461 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3462 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3463 	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3464 
3465 	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3466 		mask |= 0x0060;
3467 		set |= 0x0060;
3468 	}
3469 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3470 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3471 		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3472 		mask |= 0x0200;
3473 		set |= 0x0200;
3474 	}
3475 	if (siba_get_revid(sc->sc_dev) >= 2)
3476 		mask |= 0x0010;
3477 
3478 	value = siba_gpio_get(sc->sc_dev);
3479 	if (value == -1)
3480 		return (0);
3481 	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3482 
3483 	return (0);
3484 }
3485 
3486 static int
3487 bwn_fw_loadinitvals(struct bwn_mac *mac)
3488 {
3489 #define	GETFWOFFSET(fwp, offset)				\
3490 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3491 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3492 	const struct bwn_fwhdr *hdr;
3493 	struct bwn_fw *fw = &mac->mac_fw;
3494 	int error;
3495 
3496 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3497 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3498 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3499 	if (error)
3500 		return (error);
3501 	if (fw->initvals_band.fw) {
3502 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3503 		error = bwn_fwinitvals_write(mac,
3504 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3505 		    be32toh(hdr->size),
3506 		    fw->initvals_band.fw->datasize - hdr_len);
3507 	}
3508 	return (error);
3509 #undef GETFWOFFSET
3510 }
3511 
3512 static int
3513 bwn_phy_init(struct bwn_mac *mac)
3514 {
3515 	struct bwn_softc *sc = mac->mac_sc;
3516 	int error;
3517 
3518 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3519 	mac->mac_phy.rf_onoff(mac, 1);
3520 	error = mac->mac_phy.init(mac);
3521 	if (error) {
3522 		device_printf(sc->sc_dev, "PHY init failed\n");
3523 		goto fail0;
3524 	}
3525 	error = bwn_switch_channel(mac,
3526 	    mac->mac_phy.get_default_chan(mac));
3527 	if (error) {
3528 		device_printf(sc->sc_dev,
3529 		    "failed to switch default channel\n");
3530 		goto fail1;
3531 	}
3532 	return (0);
3533 fail1:
3534 	if (mac->mac_phy.exit)
3535 		mac->mac_phy.exit(mac);
3536 fail0:
3537 	mac->mac_phy.rf_onoff(mac, 0);
3538 
3539 	return (error);
3540 }
3541 
3542 static void
3543 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3544 {
3545 	uint16_t ant;
3546 	uint16_t tmp;
3547 
3548 	ant = bwn_ant2phy(antenna);
3549 
3550 	/* For ACK/CTS */
3551 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3552 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3553 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3554 	/* For Probe Resposes */
3555 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3556 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3557 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3558 }
3559 
3560 static void
3561 bwn_set_opmode(struct bwn_mac *mac)
3562 {
3563 	struct bwn_softc *sc = mac->mac_sc;
3564 	struct ieee80211com *ic = &sc->sc_ic;
3565 	uint32_t ctl;
3566 	uint16_t cfp_pretbtt;
3567 
3568 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3569 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3570 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3571 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3572 	ctl |= BWN_MACCTL_STA;
3573 
3574 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3575 	    ic->ic_opmode == IEEE80211_M_MBSS)
3576 		ctl |= BWN_MACCTL_HOSTAP;
3577 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3578 		ctl &= ~BWN_MACCTL_STA;
3579 	ctl |= sc->sc_filters;
3580 
3581 	if (siba_get_revid(sc->sc_dev) <= 4)
3582 		ctl |= BWN_MACCTL_PROMISC;
3583 
3584 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3585 
3586 	cfp_pretbtt = 2;
3587 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3588 		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3589 		    siba_get_chiprev(sc->sc_dev) == 3)
3590 			cfp_pretbtt = 100;
3591 		else
3592 			cfp_pretbtt = 50;
3593 	}
3594 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3595 }
3596 
3597 static int
3598 bwn_dma_gettype(struct bwn_mac *mac)
3599 {
3600 	uint32_t tmp;
3601 	uint16_t base;
3602 
3603 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3604 	if (tmp & SIBA_TGSHIGH_DMA64)
3605 		return (BWN_DMA_64BIT);
3606 	base = bwn_dma_base(0, 0);
3607 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3608 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3609 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3610 		return (BWN_DMA_32BIT);
3611 
3612 	return (BWN_DMA_30BIT);
3613 }
3614 
3615 static void
3616 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3617 {
3618 	if (!error) {
3619 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3620 		*((bus_addr_t *)arg) = seg->ds_addr;
3621 	}
3622 }
3623 
3624 void
3625 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3626 {
3627 	struct bwn_phy *phy = &mac->mac_phy;
3628 	struct bwn_softc *sc = mac->mac_sc;
3629 	unsigned int i, max_loop;
3630 	uint16_t value;
3631 	uint32_t buffer[5] = {
3632 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3633 	};
3634 
3635 	if (ofdm) {
3636 		max_loop = 0x1e;
3637 		buffer[0] = 0x000201cc;
3638 	} else {
3639 		max_loop = 0xfa;
3640 		buffer[0] = 0x000b846e;
3641 	}
3642 
3643 	BWN_ASSERT_LOCKED(mac->mac_sc);
3644 
3645 	for (i = 0; i < 5; i++)
3646 		bwn_ram_write(mac, i * 4, buffer[i]);
3647 
3648 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3649 	BWN_WRITE_2(mac, 0x07c0,
3650 	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3651 
3652 	value = (ofdm ? 0x41 : 0x40);
3653 	BWN_WRITE_2(mac, 0x050c, value);
3654 
3655 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3656 	    phy->type == BWN_PHYTYPE_LCN)
3657 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3658 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3659 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3660 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3661 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3662 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3663 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3664 
3665 	/* XXX TODO: n phy pa override? */
3666 
3667 	switch (phy->type) {
3668 	case BWN_PHYTYPE_N:
3669 	case BWN_PHYTYPE_LCN:
3670 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3671 		break;
3672 	case BWN_PHYTYPE_LP:
3673 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3674 		break;
3675 	default:
3676 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3677 		break;
3678 	}
3679 
3680 	/* flush */
3681 	BWN_READ_2(mac, 0x0502);
3682 
3683 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3684 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3685 	for (i = 0x00; i < max_loop; i++) {
3686 		value = BWN_READ_2(mac, 0x050e);
3687 		if (value & 0x0080)
3688 			break;
3689 		DELAY(10);
3690 	}
3691 	for (i = 0x00; i < 0x0a; i++) {
3692 		value = BWN_READ_2(mac, 0x050e);
3693 		if (value & 0x0400)
3694 			break;
3695 		DELAY(10);
3696 	}
3697 	for (i = 0x00; i < 0x19; i++) {
3698 		value = BWN_READ_2(mac, 0x0690);
3699 		if (!(value & 0x0100))
3700 			break;
3701 		DELAY(10);
3702 	}
3703 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3704 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3705 }
3706 
3707 void
3708 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3709 {
3710 	uint32_t macctl;
3711 
3712 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3713 
3714 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3715 	if (macctl & BWN_MACCTL_BIGENDIAN)
3716 		printf("TODO: need swap\n");
3717 
3718 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3719 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3720 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3721 }
3722 
3723 void
3724 bwn_mac_suspend(struct bwn_mac *mac)
3725 {
3726 	struct bwn_softc *sc = mac->mac_sc;
3727 	int i;
3728 	uint32_t tmp;
3729 
3730 	KASSERT(mac->mac_suspended >= 0,
3731 	    ("%s:%d: fail", __func__, __LINE__));
3732 
3733 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3734 	    __func__, mac->mac_suspended);
3735 
3736 	if (mac->mac_suspended == 0) {
3737 		bwn_psctl(mac, BWN_PS_AWAKE);
3738 		BWN_WRITE_4(mac, BWN_MACCTL,
3739 			    BWN_READ_4(mac, BWN_MACCTL)
3740 			    & ~BWN_MACCTL_ON);
3741 		BWN_READ_4(mac, BWN_MACCTL);
3742 		for (i = 35; i; i--) {
3743 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3744 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3745 				goto out;
3746 			DELAY(10);
3747 		}
3748 		for (i = 40; i; i--) {
3749 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3750 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3751 				goto out;
3752 			DELAY(1000);
3753 		}
3754 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3755 	}
3756 out:
3757 	mac->mac_suspended++;
3758 }
3759 
3760 void
3761 bwn_mac_enable(struct bwn_mac *mac)
3762 {
3763 	struct bwn_softc *sc = mac->mac_sc;
3764 	uint16_t state;
3765 
3766 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3767 	    __func__, mac->mac_suspended);
3768 
3769 	state = bwn_shm_read_2(mac, BWN_SHARED,
3770 	    BWN_SHARED_UCODESTAT);
3771 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3772 	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3773 		DPRINTF(sc, BWN_DEBUG_FW,
3774 		    "%s: warn: firmware state (%d)\n",
3775 		    __func__, state);
3776 	}
3777 
3778 	mac->mac_suspended--;
3779 	KASSERT(mac->mac_suspended >= 0,
3780 	    ("%s:%d: fail", __func__, __LINE__));
3781 	if (mac->mac_suspended == 0) {
3782 		BWN_WRITE_4(mac, BWN_MACCTL,
3783 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3784 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3785 		BWN_READ_4(mac, BWN_MACCTL);
3786 		BWN_READ_4(mac, BWN_INTR_REASON);
3787 		bwn_psctl(mac, 0);
3788 	}
3789 }
3790 
3791 void
3792 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3793 {
3794 	struct bwn_softc *sc = mac->mac_sc;
3795 	int i;
3796 	uint16_t ucstat;
3797 
3798 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3799 	    ("%s:%d: fail", __func__, __LINE__));
3800 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3801 	    ("%s:%d: fail", __func__, __LINE__));
3802 
3803 	/* XXX forcibly awake and hwps-off */
3804 
3805 	BWN_WRITE_4(mac, BWN_MACCTL,
3806 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3807 	    ~BWN_MACCTL_HWPS);
3808 	BWN_READ_4(mac, BWN_MACCTL);
3809 	if (siba_get_revid(sc->sc_dev) >= 5) {
3810 		for (i = 0; i < 100; i++) {
3811 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3812 			    BWN_SHARED_UCODESTAT);
3813 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3814 				break;
3815 			DELAY(10);
3816 		}
3817 	}
3818 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3819 	    ucstat);
3820 }
3821 
3822 static int
3823 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3824 {
3825 	struct bwn_softc *sc = mac->mac_sc;
3826 	struct bwn_fw *fw = &mac->mac_fw;
3827 	const uint8_t rev = siba_get_revid(sc->sc_dev);
3828 	const char *filename;
3829 	uint32_t high;
3830 	int error;
3831 
3832 	/* microcode */
3833 	filename = NULL;
3834 	switch (rev) {
3835 	case 42:
3836 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3837 			filename = "ucode42";
3838 		break;
3839 	case 40:
3840 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3841 			filename = "ucode40";
3842 		break;
3843 	case 33:
3844 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3845 			filename = "ucode33_lcn40";
3846 		break;
3847 	case 30:
3848 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3849 			filename = "ucode30_mimo";
3850 		break;
3851 	case 29:
3852 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3853 			filename = "ucode29_mimo";
3854 		break;
3855 	case 26:
3856 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3857 			filename = "ucode26_mimo";
3858 		break;
3859 	case 28:
3860 	case 25:
3861 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3862 			filename = "ucode25_mimo";
3863 		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3864 			filename = "ucode25_lcn";
3865 		break;
3866 	case 24:
3867 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3868 			filename = "ucode24_lcn";
3869 		break;
3870 	case 23:
3871 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3872 			filename = "ucode16_mimo";
3873 		break;
3874 	case 16:
3875 	case 17:
3876 	case 18:
3877 	case 19:
3878 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3879 			filename = "ucode16_mimo";
3880 		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3881 			filename = "ucode16_lp";
3882 		break;
3883 	case 15:
3884 		filename = "ucode15";
3885 		break;
3886 	case 14:
3887 		filename = "ucode14";
3888 		break;
3889 	case 13:
3890 		filename = "ucode13";
3891 		break;
3892 	case 12:
3893 	case 11:
3894 		filename = "ucode11";
3895 		break;
3896 	case 10:
3897 	case 9:
3898 	case 8:
3899 	case 7:
3900 	case 6:
3901 	case 5:
3902 		filename = "ucode5";
3903 		break;
3904 	default:
3905 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3906 		bwn_release_firmware(mac);
3907 		return (EOPNOTSUPP);
3908 	}
3909 
3910 	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3911 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3912 	if (error) {
3913 		bwn_release_firmware(mac);
3914 		return (error);
3915 	}
3916 
3917 	/* PCM */
3918 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3919 	if (rev >= 5 && rev <= 10) {
3920 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3921 		if (error == ENOENT)
3922 			fw->no_pcmfile = 1;
3923 		else if (error) {
3924 			bwn_release_firmware(mac);
3925 			return (error);
3926 		}
3927 	} else if (rev < 11) {
3928 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3929 		return (EOPNOTSUPP);
3930 	}
3931 
3932 	/* initvals */
3933 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3934 	switch (mac->mac_phy.type) {
3935 	case BWN_PHYTYPE_A:
3936 		if (rev < 5 || rev > 10)
3937 			goto fail1;
3938 		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3939 			filename = "a0g1initvals5";
3940 		else
3941 			filename = "a0g0initvals5";
3942 		break;
3943 	case BWN_PHYTYPE_G:
3944 		if (rev >= 5 && rev <= 10)
3945 			filename = "b0g0initvals5";
3946 		else if (rev >= 13)
3947 			filename = "b0g0initvals13";
3948 		else
3949 			goto fail1;
3950 		break;
3951 	case BWN_PHYTYPE_LP:
3952 		if (rev == 13)
3953 			filename = "lp0initvals13";
3954 		else if (rev == 14)
3955 			filename = "lp0initvals14";
3956 		else if (rev >= 15)
3957 			filename = "lp0initvals15";
3958 		else
3959 			goto fail1;
3960 		break;
3961 	case BWN_PHYTYPE_N:
3962 		if (rev == 30)
3963 			filename = "n16initvals30";
3964 		else if (rev == 28 || rev == 25)
3965 			filename = "n0initvals25";
3966 		else if (rev == 24)
3967 			filename = "n0initvals24";
3968 		else if (rev == 23)
3969 			filename = "n0initvals16";
3970 		else if (rev >= 16 && rev <= 18)
3971 			filename = "n0initvals16";
3972 		else if (rev >= 11 && rev <= 12)
3973 			filename = "n0initvals11";
3974 		else
3975 			goto fail1;
3976 		break;
3977 	default:
3978 		goto fail1;
3979 	}
3980 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3981 	if (error) {
3982 		bwn_release_firmware(mac);
3983 		return (error);
3984 	}
3985 
3986 	/* bandswitch initvals */
3987 	switch (mac->mac_phy.type) {
3988 	case BWN_PHYTYPE_A:
3989 		if (rev >= 5 && rev <= 10) {
3990 			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3991 				filename = "a0g1bsinitvals5";
3992 			else
3993 				filename = "a0g0bsinitvals5";
3994 		} else if (rev >= 11)
3995 			filename = NULL;
3996 		else
3997 			goto fail1;
3998 		break;
3999 	case BWN_PHYTYPE_G:
4000 		if (rev >= 5 && rev <= 10)
4001 			filename = "b0g0bsinitvals5";
4002 		else if (rev >= 11)
4003 			filename = NULL;
4004 		else
4005 			goto fail1;
4006 		break;
4007 	case BWN_PHYTYPE_LP:
4008 		if (rev == 13)
4009 			filename = "lp0bsinitvals13";
4010 		else if (rev == 14)
4011 			filename = "lp0bsinitvals14";
4012 		else if (rev >= 15)
4013 			filename = "lp0bsinitvals15";
4014 		else
4015 			goto fail1;
4016 		break;
4017 	case BWN_PHYTYPE_N:
4018 		if (rev == 30)
4019 			filename = "n16bsinitvals30";
4020 		else if (rev == 28 || rev == 25)
4021 			filename = "n0bsinitvals25";
4022 		else if (rev == 24)
4023 			filename = "n0bsinitvals24";
4024 		else if (rev == 23)
4025 			filename = "n0bsinitvals16";
4026 		else if (rev >= 16 && rev <= 18)
4027 			filename = "n0bsinitvals16";
4028 		else if (rev >= 11 && rev <= 12)
4029 			filename = "n0bsinitvals11";
4030 		else
4031 			goto fail1;
4032 		break;
4033 	default:
4034 		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4035 		    mac->mac_phy.type);
4036 		goto fail1;
4037 	}
4038 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4039 	if (error) {
4040 		bwn_release_firmware(mac);
4041 		return (error);
4042 	}
4043 	return (0);
4044 fail1:
4045 	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4046 	    rev, mac->mac_phy.type);
4047 	bwn_release_firmware(mac);
4048 	return (EOPNOTSUPP);
4049 }
4050 
4051 static int
4052 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4053     const char *name, struct bwn_fwfile *bfw)
4054 {
4055 	const struct bwn_fwhdr *hdr;
4056 	struct bwn_softc *sc = mac->mac_sc;
4057 	const struct firmware *fw;
4058 	char namebuf[64];
4059 
4060 	if (name == NULL) {
4061 		bwn_do_release_fw(bfw);
4062 		return (0);
4063 	}
4064 	if (bfw->filename != NULL) {
4065 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4066 			return (0);
4067 		bwn_do_release_fw(bfw);
4068 	}
4069 
4070 	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4071 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4072 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4073 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4074 	fw = firmware_get(namebuf);
4075 	if (fw == NULL) {
4076 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4077 		    namebuf);
4078 		return (ENOENT);
4079 	}
4080 	if (fw->datasize < sizeof(struct bwn_fwhdr))
4081 		goto fail;
4082 	hdr = (const struct bwn_fwhdr *)(fw->data);
4083 	switch (hdr->type) {
4084 	case BWN_FWTYPE_UCODE:
4085 	case BWN_FWTYPE_PCM:
4086 		if (be32toh(hdr->size) !=
4087 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4088 			goto fail;
4089 		/* FALLTHROUGH */
4090 	case BWN_FWTYPE_IV:
4091 		if (hdr->ver != 1)
4092 			goto fail;
4093 		break;
4094 	default:
4095 		goto fail;
4096 	}
4097 	bfw->filename = name;
4098 	bfw->fw = fw;
4099 	bfw->type = type;
4100 	return (0);
4101 fail:
4102 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4103 	if (fw != NULL)
4104 		firmware_put(fw, FIRMWARE_UNLOAD);
4105 	return (EPROTO);
4106 }
4107 
4108 static void
4109 bwn_release_firmware(struct bwn_mac *mac)
4110 {
4111 
4112 	bwn_do_release_fw(&mac->mac_fw.ucode);
4113 	bwn_do_release_fw(&mac->mac_fw.pcm);
4114 	bwn_do_release_fw(&mac->mac_fw.initvals);
4115 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4116 }
4117 
4118 static void
4119 bwn_do_release_fw(struct bwn_fwfile *bfw)
4120 {
4121 
4122 	if (bfw->fw != NULL)
4123 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4124 	bfw->fw = NULL;
4125 	bfw->filename = NULL;
4126 }
4127 
4128 static int
4129 bwn_fw_loaducode(struct bwn_mac *mac)
4130 {
4131 #define	GETFWOFFSET(fwp, offset)	\
4132 	((const uint32_t *)((const char *)fwp.fw->data + offset))
4133 #define	GETFWSIZE(fwp, offset)	\
4134 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4135 	struct bwn_softc *sc = mac->mac_sc;
4136 	const uint32_t *data;
4137 	unsigned int i;
4138 	uint32_t ctl;
4139 	uint16_t date, fwcaps, time;
4140 	int error = 0;
4141 
4142 	ctl = BWN_READ_4(mac, BWN_MACCTL);
4143 	ctl |= BWN_MACCTL_MCODE_JMP0;
4144 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4145 	    __LINE__));
4146 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4147 	for (i = 0; i < 64; i++)
4148 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4149 	for (i = 0; i < 4096; i += 2)
4150 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4151 
4152 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4153 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4154 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4155 	     i++) {
4156 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4157 		DELAY(10);
4158 	}
4159 
4160 	if (mac->mac_fw.pcm.fw) {
4161 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4162 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4163 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4164 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4165 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4166 		    sizeof(struct bwn_fwhdr)); i++) {
4167 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4168 			DELAY(10);
4169 		}
4170 	}
4171 
4172 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4173 	BWN_WRITE_4(mac, BWN_MACCTL,
4174 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4175 	    BWN_MACCTL_MCODE_RUN);
4176 
4177 	for (i = 0; i < 21; i++) {
4178 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4179 			break;
4180 		if (i >= 20) {
4181 			device_printf(sc->sc_dev, "ucode timeout\n");
4182 			error = ENXIO;
4183 			goto error;
4184 		}
4185 		DELAY(50000);
4186 	}
4187 	BWN_READ_4(mac, BWN_INTR_REASON);
4188 
4189 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4190 	if (mac->mac_fw.rev <= 0x128) {
4191 		device_printf(sc->sc_dev, "the firmware is too old\n");
4192 		error = EOPNOTSUPP;
4193 		goto error;
4194 	}
4195 
4196 	/*
4197 	 * Determine firmware header version; needed for TX/RX packet
4198 	 * handling.
4199 	 */
4200 	if (mac->mac_fw.rev >= 598)
4201 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4202 	else if (mac->mac_fw.rev >= 410)
4203 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4204 	else
4205 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4206 
4207 	/*
4208 	 * We don't support rev 598 or later; that requires
4209 	 * another round of changes to the TX/RX descriptor
4210 	 * and status layout.
4211 	 *
4212 	 * So, complain this is the case and exit out, rather
4213 	 * than attaching and then failing.
4214 	 */
4215 #if 0
4216 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4217 		device_printf(sc->sc_dev,
4218 		    "firmware is too new (>=598); not supported\n");
4219 		error = EOPNOTSUPP;
4220 		goto error;
4221 	}
4222 #endif
4223 
4224 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4225 	    BWN_SHARED_UCODE_PATCH);
4226 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4227 	mac->mac_fw.opensource = (date == 0xffff);
4228 	if (bwn_wme != 0)
4229 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4230 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4231 
4232 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4233 	if (mac->mac_fw.opensource == 0) {
4234 		device_printf(sc->sc_dev,
4235 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4236 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4237 		if (mac->mac_fw.no_pcmfile)
4238 			device_printf(sc->sc_dev,
4239 			    "no HW crypto acceleration due to pcm5\n");
4240 	} else {
4241 		mac->mac_fw.patch = time;
4242 		fwcaps = bwn_fwcaps_read(mac);
4243 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4244 			device_printf(sc->sc_dev,
4245 			    "disabling HW crypto acceleration\n");
4246 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4247 		}
4248 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4249 			device_printf(sc->sc_dev, "disabling WME support\n");
4250 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4251 		}
4252 	}
4253 
4254 	if (BWN_ISOLDFMT(mac))
4255 		device_printf(sc->sc_dev, "using old firmware image\n");
4256 
4257 	return (0);
4258 
4259 error:
4260 	BWN_WRITE_4(mac, BWN_MACCTL,
4261 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4262 	    BWN_MACCTL_MCODE_JMP0);
4263 
4264 	return (error);
4265 #undef GETFWSIZE
4266 #undef GETFWOFFSET
4267 }
4268 
4269 /* OpenFirmware only */
4270 static uint16_t
4271 bwn_fwcaps_read(struct bwn_mac *mac)
4272 {
4273 
4274 	KASSERT(mac->mac_fw.opensource == 1,
4275 	    ("%s:%d: fail", __func__, __LINE__));
4276 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4277 }
4278 
4279 static int
4280 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4281     size_t count, size_t array_size)
4282 {
4283 #define	GET_NEXTIV16(iv)						\
4284 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4285 	    sizeof(uint16_t) + sizeof(uint16_t)))
4286 #define	GET_NEXTIV32(iv)						\
4287 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4288 	    sizeof(uint16_t) + sizeof(uint32_t)))
4289 	struct bwn_softc *sc = mac->mac_sc;
4290 	const struct bwn_fwinitvals *iv;
4291 	uint16_t offset;
4292 	size_t i;
4293 	uint8_t bit32;
4294 
4295 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4296 	    ("%s:%d: fail", __func__, __LINE__));
4297 	iv = ivals;
4298 	for (i = 0; i < count; i++) {
4299 		if (array_size < sizeof(iv->offset_size))
4300 			goto fail;
4301 		array_size -= sizeof(iv->offset_size);
4302 		offset = be16toh(iv->offset_size);
4303 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4304 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4305 		if (offset >= 0x1000)
4306 			goto fail;
4307 		if (bit32) {
4308 			if (array_size < sizeof(iv->data.d32))
4309 				goto fail;
4310 			array_size -= sizeof(iv->data.d32);
4311 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4312 			iv = GET_NEXTIV32(iv);
4313 		} else {
4314 
4315 			if (array_size < sizeof(iv->data.d16))
4316 				goto fail;
4317 			array_size -= sizeof(iv->data.d16);
4318 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4319 
4320 			iv = GET_NEXTIV16(iv);
4321 		}
4322 	}
4323 	if (array_size != 0)
4324 		goto fail;
4325 	return (0);
4326 fail:
4327 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4328 	return (EPROTO);
4329 #undef GET_NEXTIV16
4330 #undef GET_NEXTIV32
4331 }
4332 
4333 int
4334 bwn_switch_channel(struct bwn_mac *mac, int chan)
4335 {
4336 	struct bwn_phy *phy = &(mac->mac_phy);
4337 	struct bwn_softc *sc = mac->mac_sc;
4338 	struct ieee80211com *ic = &sc->sc_ic;
4339 	uint16_t channelcookie, savedcookie;
4340 	int error;
4341 
4342 	if (chan == 0xffff)
4343 		chan = phy->get_default_chan(mac);
4344 
4345 	channelcookie = chan;
4346 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4347 		channelcookie |= 0x100;
4348 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4349 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4350 	error = phy->switch_channel(mac, chan);
4351 	if (error)
4352 		goto fail;
4353 
4354 	mac->mac_phy.chan = chan;
4355 	DELAY(8000);
4356 	return (0);
4357 fail:
4358 	device_printf(sc->sc_dev, "failed to switch channel\n");
4359 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4360 	return (error);
4361 }
4362 
4363 static uint16_t
4364 bwn_ant2phy(int antenna)
4365 {
4366 
4367 	switch (antenna) {
4368 	case BWN_ANT0:
4369 		return (BWN_TX_PHY_ANT0);
4370 	case BWN_ANT1:
4371 		return (BWN_TX_PHY_ANT1);
4372 	case BWN_ANT2:
4373 		return (BWN_TX_PHY_ANT2);
4374 	case BWN_ANT3:
4375 		return (BWN_TX_PHY_ANT3);
4376 	case BWN_ANTAUTO:
4377 		return (BWN_TX_PHY_ANT01AUTO);
4378 	}
4379 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4380 	return (0);
4381 }
4382 
4383 static void
4384 bwn_wme_load(struct bwn_mac *mac)
4385 {
4386 	struct bwn_softc *sc = mac->mac_sc;
4387 	int i;
4388 
4389 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4390 	    ("%s:%d: fail", __func__, __LINE__));
4391 
4392 	bwn_mac_suspend(mac);
4393 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4394 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4395 		    bwn_wme_shm_offsets[i]);
4396 	bwn_mac_enable(mac);
4397 }
4398 
4399 static void
4400 bwn_wme_loadparams(struct bwn_mac *mac,
4401     const struct wmeParams *p, uint16_t shm_offset)
4402 {
4403 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4404 	struct bwn_softc *sc = mac->mac_sc;
4405 	uint16_t params[BWN_NR_WMEPARAMS];
4406 	int slot, tmp;
4407 	unsigned int i;
4408 
4409 	slot = BWN_READ_2(mac, BWN_RNG) &
4410 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4411 
4412 	memset(&params, 0, sizeof(params));
4413 
4414 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4415 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4416 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4417 
4418 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4419 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4420 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4421 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4422 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4423 	params[BWN_WMEPARAM_BSLOTS] = slot;
4424 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4425 
4426 	for (i = 0; i < N(params); i++) {
4427 		if (i == BWN_WMEPARAM_STATUS) {
4428 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4429 			    shm_offset + (i * 2));
4430 			tmp |= 0x100;
4431 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4432 			    tmp);
4433 		} else {
4434 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4435 			    params[i]);
4436 		}
4437 	}
4438 }
4439 
4440 static void
4441 bwn_mac_write_bssid(struct bwn_mac *mac)
4442 {
4443 	struct bwn_softc *sc = mac->mac_sc;
4444 	uint32_t tmp;
4445 	int i;
4446 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4447 
4448 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4449 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4450 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4451 	    IEEE80211_ADDR_LEN);
4452 
4453 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4454 		tmp = (uint32_t) (mac_bssid[i + 0]);
4455 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4456 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4457 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4458 		bwn_ram_write(mac, 0x20 + i, tmp);
4459 	}
4460 }
4461 
4462 static void
4463 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4464     const uint8_t *macaddr)
4465 {
4466 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4467 	uint16_t data;
4468 
4469 	if (!mac)
4470 		macaddr = zero;
4471 
4472 	offset |= 0x0020;
4473 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4474 
4475 	data = macaddr[0];
4476 	data |= macaddr[1] << 8;
4477 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4478 	data = macaddr[2];
4479 	data |= macaddr[3] << 8;
4480 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4481 	data = macaddr[4];
4482 	data |= macaddr[5] << 8;
4483 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4484 }
4485 
4486 static void
4487 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4488     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4489 {
4490 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4491 	uint8_t per_sta_keys_start = 8;
4492 
4493 	if (BWN_SEC_NEWAPI(mac))
4494 		per_sta_keys_start = 4;
4495 
4496 	KASSERT(index < mac->mac_max_nr_keys,
4497 	    ("%s:%d: fail", __func__, __LINE__));
4498 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4499 	    ("%s:%d: fail", __func__, __LINE__));
4500 
4501 	if (index >= per_sta_keys_start)
4502 		bwn_key_macwrite(mac, index, NULL);
4503 	if (key)
4504 		memcpy(buf, key, key_len);
4505 	bwn_key_write(mac, index, algorithm, buf);
4506 	if (index >= per_sta_keys_start)
4507 		bwn_key_macwrite(mac, index, mac_addr);
4508 
4509 	mac->mac_key[index].algorithm = algorithm;
4510 }
4511 
4512 static void
4513 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4514 {
4515 	struct bwn_softc *sc = mac->mac_sc;
4516 	uint32_t addrtmp[2] = { 0, 0 };
4517 	uint8_t start = 8;
4518 
4519 	if (BWN_SEC_NEWAPI(mac))
4520 		start = 4;
4521 
4522 	KASSERT(index >= start,
4523 	    ("%s:%d: fail", __func__, __LINE__));
4524 	index -= start;
4525 
4526 	if (addr) {
4527 		addrtmp[0] = addr[0];
4528 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4529 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4530 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4531 		addrtmp[1] = addr[4];
4532 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4533 	}
4534 
4535 	if (siba_get_revid(sc->sc_dev) >= 5) {
4536 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4537 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4538 	} else {
4539 		if (index >= 8) {
4540 			bwn_shm_write_4(mac, BWN_SHARED,
4541 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4542 			bwn_shm_write_2(mac, BWN_SHARED,
4543 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4544 		}
4545 	}
4546 }
4547 
4548 static void
4549 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4550     const uint8_t *key)
4551 {
4552 	unsigned int i;
4553 	uint32_t offset;
4554 	uint16_t kidx, value;
4555 
4556 	kidx = BWN_SEC_KEY2FW(mac, index);
4557 	bwn_shm_write_2(mac, BWN_SHARED,
4558 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4559 
4560 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4561 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4562 		value = key[i];
4563 		value |= (uint16_t)(key[i + 1]) << 8;
4564 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4565 	}
4566 }
4567 
4568 static void
4569 bwn_phy_exit(struct bwn_mac *mac)
4570 {
4571 
4572 	mac->mac_phy.rf_onoff(mac, 0);
4573 	if (mac->mac_phy.exit != NULL)
4574 		mac->mac_phy.exit(mac);
4575 }
4576 
4577 static void
4578 bwn_dma_free(struct bwn_mac *mac)
4579 {
4580 	struct bwn_dma *dma;
4581 
4582 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4583 		return;
4584 	dma = &mac->mac_method.dma;
4585 
4586 	bwn_dma_ringfree(&dma->rx);
4587 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4588 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4589 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4590 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4591 	bwn_dma_ringfree(&dma->mcast);
4592 }
4593 
4594 static void
4595 bwn_core_stop(struct bwn_mac *mac)
4596 {
4597 	struct bwn_softc *sc = mac->mac_sc;
4598 
4599 	BWN_ASSERT_LOCKED(sc);
4600 
4601 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4602 		return;
4603 
4604 	callout_stop(&sc->sc_rfswitch_ch);
4605 	callout_stop(&sc->sc_task_ch);
4606 	callout_stop(&sc->sc_watchdog_ch);
4607 	sc->sc_watchdog_timer = 0;
4608 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4609 	BWN_READ_4(mac, BWN_INTR_MASK);
4610 	bwn_mac_suspend(mac);
4611 
4612 	mac->mac_status = BWN_MAC_STATUS_INITED;
4613 }
4614 
4615 static int
4616 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4617 {
4618 	struct bwn_mac *up_dev = NULL;
4619 	struct bwn_mac *down_dev;
4620 	struct bwn_mac *mac;
4621 	int err, status;
4622 	uint8_t gmode;
4623 
4624 	BWN_ASSERT_LOCKED(sc);
4625 
4626 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4627 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4628 		    mac->mac_phy.supports_2ghz) {
4629 			up_dev = mac;
4630 			gmode = 1;
4631 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4632 		    mac->mac_phy.supports_5ghz) {
4633 			up_dev = mac;
4634 			gmode = 0;
4635 		} else {
4636 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4637 			return (EINVAL);
4638 		}
4639 		if (up_dev != NULL)
4640 			break;
4641 	}
4642 	if (up_dev == NULL) {
4643 		device_printf(sc->sc_dev, "Could not find a device\n");
4644 		return (ENODEV);
4645 	}
4646 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4647 		return (0);
4648 
4649 	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4650 	    "switching to %s-GHz band\n",
4651 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4652 
4653 	down_dev = sc->sc_curmac;
4654 	status = down_dev->mac_status;
4655 	if (status >= BWN_MAC_STATUS_STARTED)
4656 		bwn_core_stop(down_dev);
4657 	if (status >= BWN_MAC_STATUS_INITED)
4658 		bwn_core_exit(down_dev);
4659 
4660 	if (down_dev != up_dev)
4661 		bwn_phy_reset(down_dev);
4662 
4663 	up_dev->mac_phy.gmode = gmode;
4664 	if (status >= BWN_MAC_STATUS_INITED) {
4665 		err = bwn_core_init(up_dev);
4666 		if (err) {
4667 			device_printf(sc->sc_dev,
4668 			    "fatal: failed to initialize for %s-GHz\n",
4669 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4670 			goto fail;
4671 		}
4672 	}
4673 	if (status >= BWN_MAC_STATUS_STARTED)
4674 		bwn_core_start(up_dev);
4675 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4676 	sc->sc_curmac = up_dev;
4677 
4678 	return (0);
4679 fail:
4680 	sc->sc_curmac = NULL;
4681 	return (err);
4682 }
4683 
4684 static void
4685 bwn_rf_turnon(struct bwn_mac *mac)
4686 {
4687 
4688 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4689 
4690 	bwn_mac_suspend(mac);
4691 	mac->mac_phy.rf_onoff(mac, 1);
4692 	mac->mac_phy.rf_on = 1;
4693 	bwn_mac_enable(mac);
4694 }
4695 
4696 static void
4697 bwn_rf_turnoff(struct bwn_mac *mac)
4698 {
4699 
4700 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4701 
4702 	bwn_mac_suspend(mac);
4703 	mac->mac_phy.rf_onoff(mac, 0);
4704 	mac->mac_phy.rf_on = 0;
4705 	bwn_mac_enable(mac);
4706 }
4707 
4708 /*
4709  * SSB PHY reset.
4710  */
4711 static void
4712 bwn_phy_reset_siba(struct bwn_mac *mac)
4713 {
4714 	struct bwn_softc *sc = mac->mac_sc;
4715 
4716 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4717 	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4718 	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4719 	DELAY(1000);
4720 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4721 	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4722 	DELAY(1000);
4723 }
4724 
4725 static void
4726 bwn_phy_reset(struct bwn_mac *mac)
4727 {
4728 
4729 	if (bwn_is_bus_siba(mac)) {
4730 		bwn_phy_reset_siba(mac);
4731 	} else {
4732 		BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4733 	}
4734 }
4735 
4736 static int
4737 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4738 {
4739 	struct bwn_vap *bvp = BWN_VAP(vap);
4740 	struct ieee80211com *ic= vap->iv_ic;
4741 	enum ieee80211_state ostate = vap->iv_state;
4742 	struct bwn_softc *sc = ic->ic_softc;
4743 	struct bwn_mac *mac = sc->sc_curmac;
4744 	int error;
4745 
4746 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4747 	    ieee80211_state_name[vap->iv_state],
4748 	    ieee80211_state_name[nstate]);
4749 
4750 	error = bvp->bv_newstate(vap, nstate, arg);
4751 	if (error != 0)
4752 		return (error);
4753 
4754 	BWN_LOCK(sc);
4755 
4756 	bwn_led_newstate(mac, nstate);
4757 
4758 	/*
4759 	 * Clear the BSSID when we stop a STA
4760 	 */
4761 	if (vap->iv_opmode == IEEE80211_M_STA) {
4762 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4763 			/*
4764 			 * Clear out the BSSID.  If we reassociate to
4765 			 * the same AP, this will reinialize things
4766 			 * correctly...
4767 			 */
4768 			if (ic->ic_opmode == IEEE80211_M_STA &&
4769 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4770 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4771 				bwn_set_macaddr(mac);
4772 			}
4773 		}
4774 	}
4775 
4776 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4777 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4778 		/* XXX nothing to do? */
4779 	} else if (nstate == IEEE80211_S_RUN) {
4780 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4781 		bwn_set_opmode(mac);
4782 		bwn_set_pretbtt(mac);
4783 		bwn_spu_setdelay(mac, 0);
4784 		bwn_set_macaddr(mac);
4785 	}
4786 
4787 	BWN_UNLOCK(sc);
4788 
4789 	return (error);
4790 }
4791 
4792 static void
4793 bwn_set_pretbtt(struct bwn_mac *mac)
4794 {
4795 	struct bwn_softc *sc = mac->mac_sc;
4796 	struct ieee80211com *ic = &sc->sc_ic;
4797 	uint16_t pretbtt;
4798 
4799 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4800 		pretbtt = 2;
4801 	else
4802 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4803 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4804 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4805 }
4806 
4807 static int
4808 bwn_intr(void *arg)
4809 {
4810 	struct bwn_mac *mac = arg;
4811 	struct bwn_softc *sc = mac->mac_sc;
4812 	uint32_t reason;
4813 
4814 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4815 	    (sc->sc_flags & BWN_FLAG_INVALID))
4816 		return (FILTER_STRAY);
4817 
4818 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4819 
4820 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4821 	if (reason == 0xffffffff)	/* shared IRQ */
4822 		return (FILTER_STRAY);
4823 	reason &= mac->mac_intr_mask;
4824 	if (reason == 0)
4825 		return (FILTER_HANDLED);
4826 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4827 
4828 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4829 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4830 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4831 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4832 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4833 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4834 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4835 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4836 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4837 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4838 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4839 
4840 	/* Disable interrupts. */
4841 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4842 
4843 	mac->mac_reason_intr = reason;
4844 
4845 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4846 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4847 
4848 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4849 	return (FILTER_HANDLED);
4850 }
4851 
4852 static void
4853 bwn_intrtask(void *arg, int npending)
4854 {
4855 	struct bwn_mac *mac = arg;
4856 	struct bwn_softc *sc = mac->mac_sc;
4857 	uint32_t merged = 0;
4858 	int i, tx = 0, rx = 0;
4859 
4860 	BWN_LOCK(sc);
4861 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4862 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4863 		BWN_UNLOCK(sc);
4864 		return;
4865 	}
4866 
4867 	for (i = 0; i < N(mac->mac_reason); i++)
4868 		merged |= mac->mac_reason[i];
4869 
4870 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4871 		device_printf(sc->sc_dev, "MAC trans error\n");
4872 
4873 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4874 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4875 		mac->mac_phy.txerrors--;
4876 		if (mac->mac_phy.txerrors == 0) {
4877 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4878 			bwn_restart(mac, "PHY TX errors");
4879 		}
4880 	}
4881 
4882 	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4883 		if (merged & BWN_DMAINTR_FATALMASK) {
4884 			device_printf(sc->sc_dev,
4885 			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4886 			    mac->mac_reason[0], mac->mac_reason[1],
4887 			    mac->mac_reason[2], mac->mac_reason[3],
4888 			    mac->mac_reason[4], mac->mac_reason[5]);
4889 			bwn_restart(mac, "DMA error");
4890 			BWN_UNLOCK(sc);
4891 			return;
4892 		}
4893 		if (merged & BWN_DMAINTR_NONFATALMASK) {
4894 			device_printf(sc->sc_dev,
4895 			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4896 			    mac->mac_reason[0], mac->mac_reason[1],
4897 			    mac->mac_reason[2], mac->mac_reason[3],
4898 			    mac->mac_reason[4], mac->mac_reason[5]);
4899 		}
4900 	}
4901 
4902 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4903 		bwn_intr_ucode_debug(mac);
4904 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4905 		bwn_intr_tbtt_indication(mac);
4906 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4907 		bwn_intr_atim_end(mac);
4908 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4909 		bwn_intr_beacon(mac);
4910 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4911 		bwn_intr_pmq(mac);
4912 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4913 		bwn_intr_noise(mac);
4914 
4915 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4916 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4917 			bwn_dma_rx(mac->mac_method.dma.rx);
4918 			rx = 1;
4919 		}
4920 	} else
4921 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4922 
4923 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4924 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4925 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4926 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4927 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4928 
4929 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4930 		bwn_intr_txeof(mac);
4931 		tx = 1;
4932 	}
4933 
4934 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4935 
4936 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4937 		int evt = BWN_LED_EVENT_NONE;
4938 
4939 		if (tx && rx) {
4940 			if (sc->sc_rx_rate > sc->sc_tx_rate)
4941 				evt = BWN_LED_EVENT_RX;
4942 			else
4943 				evt = BWN_LED_EVENT_TX;
4944 		} else if (tx) {
4945 			evt = BWN_LED_EVENT_TX;
4946 		} else if (rx) {
4947 			evt = BWN_LED_EVENT_RX;
4948 		} else if (rx == 0) {
4949 			evt = BWN_LED_EVENT_POLL;
4950 		}
4951 
4952 		if (evt != BWN_LED_EVENT_NONE)
4953 			bwn_led_event(mac, evt);
4954        }
4955 
4956 	if (mbufq_first(&sc->sc_snd) != NULL)
4957 		bwn_start(sc);
4958 
4959 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4960 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4961 
4962 	BWN_UNLOCK(sc);
4963 }
4964 
4965 static void
4966 bwn_restart(struct bwn_mac *mac, const char *msg)
4967 {
4968 	struct bwn_softc *sc = mac->mac_sc;
4969 	struct ieee80211com *ic = &sc->sc_ic;
4970 
4971 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4972 		return;
4973 
4974 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4975 	ieee80211_runtask(ic, &mac->mac_hwreset);
4976 }
4977 
4978 static void
4979 bwn_intr_ucode_debug(struct bwn_mac *mac)
4980 {
4981 	struct bwn_softc *sc = mac->mac_sc;
4982 	uint16_t reason;
4983 
4984 	if (mac->mac_fw.opensource == 0)
4985 		return;
4986 
4987 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4988 	switch (reason) {
4989 	case BWN_DEBUGINTR_PANIC:
4990 		bwn_handle_fwpanic(mac);
4991 		break;
4992 	case BWN_DEBUGINTR_DUMP_SHM:
4993 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
4994 		break;
4995 	case BWN_DEBUGINTR_DUMP_REGS:
4996 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
4997 		break;
4998 	case BWN_DEBUGINTR_MARKER:
4999 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5000 		break;
5001 	default:
5002 		device_printf(sc->sc_dev,
5003 		    "ucode debug unknown reason: %#x\n", reason);
5004 	}
5005 
5006 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5007 	    BWN_DEBUGINTR_ACK);
5008 }
5009 
5010 static void
5011 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5012 {
5013 	struct bwn_softc *sc = mac->mac_sc;
5014 	struct ieee80211com *ic = &sc->sc_ic;
5015 
5016 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5017 		bwn_psctl(mac, 0);
5018 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5019 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5020 }
5021 
5022 static void
5023 bwn_intr_atim_end(struct bwn_mac *mac)
5024 {
5025 
5026 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5027 		BWN_WRITE_4(mac, BWN_MACCMD,
5028 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5029 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5030 	}
5031 }
5032 
5033 static void
5034 bwn_intr_beacon(struct bwn_mac *mac)
5035 {
5036 	struct bwn_softc *sc = mac->mac_sc;
5037 	struct ieee80211com *ic = &sc->sc_ic;
5038 	uint32_t cmd, beacon0, beacon1;
5039 
5040 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5041 	    ic->ic_opmode == IEEE80211_M_MBSS)
5042 		return;
5043 
5044 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5045 
5046 	cmd = BWN_READ_4(mac, BWN_MACCMD);
5047 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5048 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5049 
5050 	if (beacon0 && beacon1) {
5051 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5052 		mac->mac_intr_mask |= BWN_INTR_BEACON;
5053 		return;
5054 	}
5055 
5056 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5057 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5058 		bwn_load_beacon0(mac);
5059 		bwn_load_beacon1(mac);
5060 		cmd = BWN_READ_4(mac, BWN_MACCMD);
5061 		cmd |= BWN_MACCMD_BEACON0_VALID;
5062 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5063 	} else {
5064 		if (!beacon0) {
5065 			bwn_load_beacon0(mac);
5066 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5067 			cmd |= BWN_MACCMD_BEACON0_VALID;
5068 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5069 		} else if (!beacon1) {
5070 			bwn_load_beacon1(mac);
5071 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5072 			cmd |= BWN_MACCMD_BEACON1_VALID;
5073 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5074 		}
5075 	}
5076 }
5077 
5078 static void
5079 bwn_intr_pmq(struct bwn_mac *mac)
5080 {
5081 	uint32_t tmp;
5082 
5083 	while (1) {
5084 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5085 		if (!(tmp & 0x00000008))
5086 			break;
5087 	}
5088 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5089 }
5090 
5091 static void
5092 bwn_intr_noise(struct bwn_mac *mac)
5093 {
5094 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5095 	uint16_t tmp;
5096 	uint8_t noise[4];
5097 	uint8_t i, j;
5098 	int32_t average;
5099 
5100 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5101 		return;
5102 
5103 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5104 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5105 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5106 	    noise[3] == 0x7f)
5107 		goto new;
5108 
5109 	KASSERT(mac->mac_noise.noi_nsamples < 8,
5110 	    ("%s:%d: fail", __func__, __LINE__));
5111 	i = mac->mac_noise.noi_nsamples;
5112 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5113 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5114 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5115 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5116 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5117 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5118 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5119 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5120 	mac->mac_noise.noi_nsamples++;
5121 	if (mac->mac_noise.noi_nsamples == 8) {
5122 		average = 0;
5123 		for (i = 0; i < 8; i++) {
5124 			for (j = 0; j < 4; j++)
5125 				average += mac->mac_noise.noi_samples[i][j];
5126 		}
5127 		average = (((average / 32) * 125) + 64) / 128;
5128 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5129 		if (tmp >= 8)
5130 			average += 2;
5131 		else
5132 			average -= 25;
5133 		average -= (tmp == 8) ? 72 : 48;
5134 
5135 		mac->mac_stats.link_noise = average;
5136 		mac->mac_noise.noi_running = 0;
5137 		return;
5138 	}
5139 new:
5140 	bwn_noise_gensample(mac);
5141 }
5142 
5143 static int
5144 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5145 {
5146 	struct bwn_mac *mac = prq->prq_mac;
5147 	struct bwn_softc *sc = mac->mac_sc;
5148 	unsigned int i;
5149 
5150 	BWN_ASSERT_LOCKED(sc);
5151 
5152 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5153 		return (0);
5154 
5155 	for (i = 0; i < 5000; i++) {
5156 		if (bwn_pio_rxeof(prq) == 0)
5157 			break;
5158 	}
5159 	if (i >= 5000)
5160 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5161 	return ((i > 0) ? 1 : 0);
5162 }
5163 
5164 static void
5165 bwn_dma_rx(struct bwn_dma_ring *dr)
5166 {
5167 	int slot, curslot;
5168 
5169 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5170 	curslot = dr->get_curslot(dr);
5171 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5172 	    ("%s:%d: fail", __func__, __LINE__));
5173 
5174 	slot = dr->dr_curslot;
5175 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5176 		bwn_dma_rxeof(dr, &slot);
5177 
5178 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5179 	    BUS_DMASYNC_PREWRITE);
5180 
5181 	dr->set_curslot(dr, slot);
5182 	dr->dr_curslot = slot;
5183 }
5184 
5185 static void
5186 bwn_intr_txeof(struct bwn_mac *mac)
5187 {
5188 	struct bwn_txstatus stat;
5189 	uint32_t stat0, stat1;
5190 	uint16_t tmp;
5191 
5192 	BWN_ASSERT_LOCKED(mac->mac_sc);
5193 
5194 	while (1) {
5195 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5196 		if (!(stat0 & 0x00000001))
5197 			break;
5198 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5199 
5200 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5201 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5202 		    __func__,
5203 		    stat0,
5204 		    stat1);
5205 
5206 		stat.cookie = (stat0 >> 16);
5207 		stat.seq = (stat1 & 0x0000ffff);
5208 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5209 		tmp = (stat0 & 0x0000ffff);
5210 		stat.framecnt = ((tmp & 0xf000) >> 12);
5211 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5212 		stat.sreason = ((tmp & 0x001c) >> 2);
5213 		stat.pm = (tmp & 0x0080) ? 1 : 0;
5214 		stat.im = (tmp & 0x0040) ? 1 : 0;
5215 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5216 		stat.ack = (tmp & 0x0002) ? 1 : 0;
5217 
5218 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5219 		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5220 		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5221 		    __func__,
5222 		    stat.cookie,
5223 		    stat.seq,
5224 		    stat.phy_stat,
5225 		    stat.framecnt,
5226 		    stat.rtscnt,
5227 		    stat.sreason,
5228 		    stat.pm,
5229 		    stat.im,
5230 		    stat.ampdu,
5231 		    stat.ack);
5232 
5233 		bwn_handle_txeof(mac, &stat);
5234 	}
5235 }
5236 
5237 static void
5238 bwn_hwreset(void *arg, int npending)
5239 {
5240 	struct bwn_mac *mac = arg;
5241 	struct bwn_softc *sc = mac->mac_sc;
5242 	int error = 0;
5243 	int prev_status;
5244 
5245 	BWN_LOCK(sc);
5246 
5247 	prev_status = mac->mac_status;
5248 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5249 		bwn_core_stop(mac);
5250 	if (prev_status >= BWN_MAC_STATUS_INITED)
5251 		bwn_core_exit(mac);
5252 
5253 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5254 		error = bwn_core_init(mac);
5255 		if (error)
5256 			goto out;
5257 	}
5258 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5259 		bwn_core_start(mac);
5260 out:
5261 	if (error) {
5262 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5263 		sc->sc_curmac = NULL;
5264 	}
5265 	BWN_UNLOCK(sc);
5266 }
5267 
5268 static void
5269 bwn_handle_fwpanic(struct bwn_mac *mac)
5270 {
5271 	struct bwn_softc *sc = mac->mac_sc;
5272 	uint16_t reason;
5273 
5274 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5275 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5276 
5277 	if (reason == BWN_FWPANIC_RESTART)
5278 		bwn_restart(mac, "ucode panic");
5279 }
5280 
5281 static void
5282 bwn_load_beacon0(struct bwn_mac *mac)
5283 {
5284 
5285 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5286 }
5287 
5288 static void
5289 bwn_load_beacon1(struct bwn_mac *mac)
5290 {
5291 
5292 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5293 }
5294 
5295 static uint32_t
5296 bwn_jssi_read(struct bwn_mac *mac)
5297 {
5298 	uint32_t val = 0;
5299 
5300 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5301 	val <<= 16;
5302 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5303 
5304 	return (val);
5305 }
5306 
5307 static void
5308 bwn_noise_gensample(struct bwn_mac *mac)
5309 {
5310 	uint32_t jssi = 0x7f7f7f7f;
5311 
5312 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5313 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5314 	BWN_WRITE_4(mac, BWN_MACCMD,
5315 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5316 }
5317 
5318 static int
5319 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5320 {
5321 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5322 
5323 	return (dr->dr_numslots - dr->dr_usedslot);
5324 }
5325 
5326 static int
5327 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5328 {
5329 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5330 
5331 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5332 	    ("%s:%d: fail", __func__, __LINE__));
5333 	if (slot == dr->dr_numslots - 1)
5334 		return (0);
5335 	return (slot + 1);
5336 }
5337 
5338 static void
5339 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5340 {
5341 	struct bwn_mac *mac = dr->dr_mac;
5342 	struct bwn_softc *sc = mac->mac_sc;
5343 	struct bwn_dma *dma = &mac->mac_method.dma;
5344 	struct bwn_dmadesc_generic *desc;
5345 	struct bwn_dmadesc_meta *meta;
5346 	struct bwn_rxhdr4 *rxhdr;
5347 	struct mbuf *m;
5348 	uint32_t macstat;
5349 	int32_t tmp;
5350 	int cnt = 0;
5351 	uint16_t len;
5352 
5353 	dr->getdesc(dr, *slot, &desc, &meta);
5354 
5355 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5356 	m = meta->mt_m;
5357 
5358 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5359 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5360 		return;
5361 	}
5362 
5363 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5364 	len = le16toh(rxhdr->frame_len);
5365 	if (len <= 0) {
5366 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5367 		return;
5368 	}
5369 	if (bwn_dma_check_redzone(dr, m)) {
5370 		device_printf(sc->sc_dev, "redzone error.\n");
5371 		bwn_dma_set_redzone(dr, m);
5372 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5373 		    BUS_DMASYNC_PREWRITE);
5374 		return;
5375 	}
5376 	if (len > dr->dr_rx_bufsize) {
5377 		tmp = len;
5378 		while (1) {
5379 			dr->getdesc(dr, *slot, &desc, &meta);
5380 			bwn_dma_set_redzone(dr, meta->mt_m);
5381 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5382 			    BUS_DMASYNC_PREWRITE);
5383 			*slot = bwn_dma_nextslot(dr, *slot);
5384 			cnt++;
5385 			tmp -= dr->dr_rx_bufsize;
5386 			if (tmp <= 0)
5387 				break;
5388 		}
5389 		device_printf(sc->sc_dev, "too small buffer "
5390 		       "(len %u buffer %u dropped %d)\n",
5391 		       len, dr->dr_rx_bufsize, cnt);
5392 		return;
5393 	}
5394 
5395 	switch (mac->mac_fw.fw_hdr_format) {
5396 	case BWN_FW_HDR_351:
5397 	case BWN_FW_HDR_410:
5398 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5399 		break;
5400 	case BWN_FW_HDR_598:
5401 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5402 		break;
5403 	}
5404 
5405 	if (macstat & BWN_RX_MAC_FCSERR) {
5406 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5407 			device_printf(sc->sc_dev, "RX drop\n");
5408 			return;
5409 		}
5410 	}
5411 
5412 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5413 	m_adj(m, dr->dr_frameoffset);
5414 
5415 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5416 }
5417 
5418 static void
5419 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5420 {
5421 	struct bwn_softc *sc = mac->mac_sc;
5422 	struct bwn_stats *stats = &mac->mac_stats;
5423 
5424 	BWN_ASSERT_LOCKED(mac->mac_sc);
5425 
5426 	if (status->im)
5427 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5428 	if (status->ampdu)
5429 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5430 	if (status->rtscnt) {
5431 		if (status->rtscnt == 0xf)
5432 			stats->rtsfail++;
5433 		else
5434 			stats->rts++;
5435 	}
5436 
5437 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5438 		bwn_dma_handle_txeof(mac, status);
5439 	} else {
5440 		bwn_pio_handle_txeof(mac, status);
5441 	}
5442 
5443 	bwn_phy_txpower_check(mac, 0);
5444 }
5445 
5446 static uint8_t
5447 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5448 {
5449 	struct bwn_mac *mac = prq->prq_mac;
5450 	struct bwn_softc *sc = mac->mac_sc;
5451 	struct bwn_rxhdr4 rxhdr;
5452 	struct mbuf *m;
5453 	uint32_t ctl32, macstat, v32;
5454 	unsigned int i, padding;
5455 	uint16_t ctl16, len, totlen, v16;
5456 	unsigned char *mp;
5457 	char *data;
5458 
5459 	memset(&rxhdr, 0, sizeof(rxhdr));
5460 
5461 	if (prq->prq_rev >= 8) {
5462 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5463 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5464 			return (0);
5465 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5466 		    BWN_PIO8_RXCTL_FRAMEREADY);
5467 		for (i = 0; i < 10; i++) {
5468 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5469 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5470 				goto ready;
5471 			DELAY(10);
5472 		}
5473 	} else {
5474 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5475 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5476 			return (0);
5477 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5478 		    BWN_PIO_RXCTL_FRAMEREADY);
5479 		for (i = 0; i < 10; i++) {
5480 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5481 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5482 				goto ready;
5483 			DELAY(10);
5484 		}
5485 	}
5486 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5487 	return (1);
5488 ready:
5489 	if (prq->prq_rev >= 8)
5490 		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5491 		    prq->prq_base + BWN_PIO8_RXDATA);
5492 	else
5493 		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5494 		    prq->prq_base + BWN_PIO_RXDATA);
5495 	len = le16toh(rxhdr.frame_len);
5496 	if (len > 0x700) {
5497 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5498 		goto error;
5499 	}
5500 	if (len == 0) {
5501 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5502 		goto error;
5503 	}
5504 
5505 	switch (mac->mac_fw.fw_hdr_format) {
5506 	case BWN_FW_HDR_351:
5507 	case BWN_FW_HDR_410:
5508 		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5509 		break;
5510 	case BWN_FW_HDR_598:
5511 		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5512 		break;
5513 	}
5514 
5515 	if (macstat & BWN_RX_MAC_FCSERR) {
5516 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5517 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5518 			goto error;
5519 		}
5520 	}
5521 
5522 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5523 	totlen = len + padding;
5524 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5525 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5526 	if (m == NULL) {
5527 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5528 		goto error;
5529 	}
5530 	mp = mtod(m, unsigned char *);
5531 	if (prq->prq_rev >= 8) {
5532 		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5533 		    prq->prq_base + BWN_PIO8_RXDATA);
5534 		if (totlen & 3) {
5535 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5536 			data = &(mp[totlen - 1]);
5537 			switch (totlen & 3) {
5538 			case 3:
5539 				*data = (v32 >> 16);
5540 				data--;
5541 			case 2:
5542 				*data = (v32 >> 8);
5543 				data--;
5544 			case 1:
5545 				*data = v32;
5546 			}
5547 		}
5548 	} else {
5549 		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5550 		    prq->prq_base + BWN_PIO_RXDATA);
5551 		if (totlen & 1) {
5552 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5553 			mp[totlen - 1] = v16;
5554 		}
5555 	}
5556 
5557 	m->m_len = m->m_pkthdr.len = totlen;
5558 
5559 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5560 
5561 	return (1);
5562 error:
5563 	if (prq->prq_rev >= 8)
5564 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5565 		    BWN_PIO8_RXCTL_DATAREADY);
5566 	else
5567 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5568 	return (1);
5569 }
5570 
5571 static int
5572 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5573     struct bwn_dmadesc_meta *meta, int init)
5574 {
5575 	struct bwn_mac *mac = dr->dr_mac;
5576 	struct bwn_dma *dma = &mac->mac_method.dma;
5577 	struct bwn_rxhdr4 *hdr;
5578 	bus_dmamap_t map;
5579 	bus_addr_t paddr;
5580 	struct mbuf *m;
5581 	int error;
5582 
5583 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5584 	if (m == NULL) {
5585 		error = ENOBUFS;
5586 
5587 		/*
5588 		 * If the NIC is up and running, we need to:
5589 		 * - Clear RX buffer's header.
5590 		 * - Restore RX descriptor settings.
5591 		 */
5592 		if (init)
5593 			return (error);
5594 		else
5595 			goto back;
5596 	}
5597 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5598 
5599 	bwn_dma_set_redzone(dr, m);
5600 
5601 	/*
5602 	 * Try to load RX buf into temporary DMA map
5603 	 */
5604 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5605 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5606 	if (error) {
5607 		m_freem(m);
5608 
5609 		/*
5610 		 * See the comment above
5611 		 */
5612 		if (init)
5613 			return (error);
5614 		else
5615 			goto back;
5616 	}
5617 
5618 	if (!init)
5619 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5620 	meta->mt_m = m;
5621 	meta->mt_paddr = paddr;
5622 
5623 	/*
5624 	 * Swap RX buf's DMA map with the loaded temporary one
5625 	 */
5626 	map = meta->mt_dmap;
5627 	meta->mt_dmap = dr->dr_spare_dmap;
5628 	dr->dr_spare_dmap = map;
5629 
5630 back:
5631 	/*
5632 	 * Clear RX buf header
5633 	 */
5634 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5635 	bzero(hdr, sizeof(*hdr));
5636 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5637 	    BUS_DMASYNC_PREWRITE);
5638 
5639 	/*
5640 	 * Setup RX buf descriptor
5641 	 */
5642 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5643 	    sizeof(*hdr), 0, 0, 0);
5644 	return (error);
5645 }
5646 
5647 static void
5648 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5649 		 bus_size_t mapsz __unused, int error)
5650 {
5651 
5652 	if (!error) {
5653 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5654 		*((bus_addr_t *)arg) = seg->ds_addr;
5655 	}
5656 }
5657 
5658 static int
5659 bwn_hwrate2ieeerate(int rate)
5660 {
5661 
5662 	switch (rate) {
5663 	case BWN_CCK_RATE_1MB:
5664 		return (2);
5665 	case BWN_CCK_RATE_2MB:
5666 		return (4);
5667 	case BWN_CCK_RATE_5MB:
5668 		return (11);
5669 	case BWN_CCK_RATE_11MB:
5670 		return (22);
5671 	case BWN_OFDM_RATE_6MB:
5672 		return (12);
5673 	case BWN_OFDM_RATE_9MB:
5674 		return (18);
5675 	case BWN_OFDM_RATE_12MB:
5676 		return (24);
5677 	case BWN_OFDM_RATE_18MB:
5678 		return (36);
5679 	case BWN_OFDM_RATE_24MB:
5680 		return (48);
5681 	case BWN_OFDM_RATE_36MB:
5682 		return (72);
5683 	case BWN_OFDM_RATE_48MB:
5684 		return (96);
5685 	case BWN_OFDM_RATE_54MB:
5686 		return (108);
5687 	default:
5688 		printf("Ooops\n");
5689 		return (0);
5690 	}
5691 }
5692 
5693 /*
5694  * Post process the RX provided RSSI.
5695  *
5696  * Valid for A, B, G, LP PHYs.
5697  */
5698 static int8_t
5699 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5700     int ofdm, int adjust_2053, int adjust_2050)
5701 {
5702 	struct bwn_phy *phy = &mac->mac_phy;
5703 	struct bwn_phy_g *gphy = &phy->phy_g;
5704 	int tmp;
5705 
5706 	switch (phy->rf_ver) {
5707 	case 0x2050:
5708 		if (ofdm) {
5709 			tmp = in_rssi;
5710 			if (tmp > 127)
5711 				tmp -= 256;
5712 			tmp = tmp * 73 / 64;
5713 			if (adjust_2050)
5714 				tmp += 25;
5715 			else
5716 				tmp -= 3;
5717 		} else {
5718 			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5719 			    & BWN_BFL_RSSI) {
5720 				if (in_rssi > 63)
5721 					in_rssi = 63;
5722 				tmp = gphy->pg_nrssi_lt[in_rssi];
5723 				tmp = (31 - tmp) * -131 / 128 - 57;
5724 			} else {
5725 				tmp = in_rssi;
5726 				tmp = (31 - tmp) * -149 / 128 - 68;
5727 			}
5728 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5729 				tmp += 25;
5730 		}
5731 		break;
5732 	case 0x2060:
5733 		if (in_rssi > 127)
5734 			tmp = in_rssi - 256;
5735 		else
5736 			tmp = in_rssi;
5737 		break;
5738 	default:
5739 		tmp = in_rssi;
5740 		tmp = (tmp - 11) * 103 / 64;
5741 		if (adjust_2053)
5742 			tmp -= 109;
5743 		else
5744 			tmp -= 83;
5745 	}
5746 
5747 	return (tmp);
5748 }
5749 
5750 static void
5751 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5752 {
5753 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5754 	struct bwn_plcp6 *plcp;
5755 	struct bwn_softc *sc = mac->mac_sc;
5756 	struct ieee80211_frame_min *wh;
5757 	struct ieee80211_node *ni;
5758 	struct ieee80211com *ic = &sc->sc_ic;
5759 	uint32_t macstat;
5760 	int padding, rate, rssi = 0, noise = 0, type;
5761 	uint16_t phytype, phystat0, phystat3, chanstat;
5762 	unsigned char *mp = mtod(m, unsigned char *);
5763 	static int rx_mac_dec_rpt = 0;
5764 
5765 	BWN_ASSERT_LOCKED(sc);
5766 
5767 	phystat0 = le16toh(rxhdr->phy_status0);
5768 
5769 	/*
5770 	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5771 	 * used for LP-PHY.
5772 	 */
5773 	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5774 
5775 	switch (mac->mac_fw.fw_hdr_format) {
5776 	case BWN_FW_HDR_351:
5777 	case BWN_FW_HDR_410:
5778 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5779 		chanstat = le16toh(rxhdr->ps4.r351.channel);
5780 		break;
5781 	case BWN_FW_HDR_598:
5782 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5783 		chanstat = le16toh(rxhdr->ps4.r598.channel);
5784 		break;
5785 	}
5786 
5787 
5788 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5789 
5790 	if (macstat & BWN_RX_MAC_FCSERR)
5791 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5792 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5793 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5794 	if (macstat & BWN_RX_MAC_DECERR)
5795 		goto drop;
5796 
5797 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5798 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5799 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5800 		    m->m_pkthdr.len);
5801 		goto drop;
5802 	}
5803 	plcp = (struct bwn_plcp6 *)(mp + padding);
5804 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5805 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5806 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5807 		    m->m_pkthdr.len);
5808 		goto drop;
5809 	}
5810 	wh = mtod(m, struct ieee80211_frame_min *);
5811 
5812 	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5813 		device_printf(sc->sc_dev,
5814 		    "RX decryption attempted (old %d keyidx %#x)\n",
5815 		    BWN_ISOLDFMT(mac),
5816 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5817 
5818 	if (phystat0 & BWN_RX_PHYST0_OFDM)
5819 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5820 		    phytype == BWN_PHYTYPE_A);
5821 	else
5822 		rate = bwn_plcp_get_cckrate(mac, plcp);
5823 	if (rate == -1) {
5824 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5825 			goto drop;
5826 	}
5827 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5828 
5829 	/* rssi/noise */
5830 	switch (phytype) {
5831 	case BWN_PHYTYPE_A:
5832 	case BWN_PHYTYPE_B:
5833 	case BWN_PHYTYPE_G:
5834 	case BWN_PHYTYPE_LP:
5835 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5836 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5837 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5838 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5839 		break;
5840 	case BWN_PHYTYPE_N:
5841 		/* Broadcom has code for min/avg, but always used max */
5842 		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5843 			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5844 		else
5845 			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5846 #if 0
5847 		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5848 		    "%s: power0=%d, power1=%d, power2=%d\n",
5849 		    __func__,
5850 		    rxhdr->phy.n.power0,
5851 		    rxhdr->phy.n.power1,
5852 		    rxhdr->ps2.n.power2);
5853 #endif
5854 		break;
5855 	default:
5856 		/* XXX TODO: implement rssi for other PHYs */
5857 		break;
5858 	}
5859 
5860 	/*
5861 	 * RSSI here is absolute, not relative to the noise floor.
5862 	 */
5863 	noise = mac->mac_stats.link_noise;
5864 	rssi = rssi - noise;
5865 
5866 	/* RX radio tap */
5867 	if (ieee80211_radiotap_active(ic))
5868 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5869 	m_adj(m, -IEEE80211_CRC_LEN);
5870 
5871 	BWN_UNLOCK(sc);
5872 
5873 	ni = ieee80211_find_rxnode(ic, wh);
5874 	if (ni != NULL) {
5875 		type = ieee80211_input(ni, m, rssi, noise);
5876 		ieee80211_free_node(ni);
5877 	} else
5878 		type = ieee80211_input_all(ic, m, rssi, noise);
5879 
5880 	BWN_LOCK(sc);
5881 	return;
5882 drop:
5883 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5884 }
5885 
5886 static void
5887 bwn_dma_handle_txeof(struct bwn_mac *mac,
5888     const struct bwn_txstatus *status)
5889 {
5890 	struct bwn_dma *dma = &mac->mac_method.dma;
5891 	struct bwn_dma_ring *dr;
5892 	struct bwn_dmadesc_generic *desc;
5893 	struct bwn_dmadesc_meta *meta;
5894 	struct bwn_softc *sc = mac->mac_sc;
5895 	int slot;
5896 	int retrycnt = 0;
5897 
5898 	BWN_ASSERT_LOCKED(sc);
5899 
5900 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5901 	if (dr == NULL) {
5902 		device_printf(sc->sc_dev, "failed to parse cookie\n");
5903 		return;
5904 	}
5905 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5906 
5907 	while (1) {
5908 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5909 		    ("%s:%d: fail", __func__, __LINE__));
5910 		dr->getdesc(dr, slot, &desc, &meta);
5911 
5912 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5913 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5914 		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5915 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5916 
5917 		if (meta->mt_islast) {
5918 			KASSERT(meta->mt_m != NULL,
5919 			    ("%s:%d: fail", __func__, __LINE__));
5920 
5921 			/*
5922 			 * If we don't get an ACK, then we should log the
5923 			 * full framecnt.  That may be 0 if it's a PHY
5924 			 * failure, so ensure that gets logged as some
5925 			 * retry attempt.
5926 			 */
5927 			if (status->ack) {
5928 				retrycnt = status->framecnt - 1;
5929 			} else {
5930 				retrycnt = status->framecnt;
5931 				if (retrycnt == 0)
5932 					retrycnt = 1;
5933 			}
5934 			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5935 			    status->ack ?
5936 			      IEEE80211_RATECTL_TX_SUCCESS :
5937 			      IEEE80211_RATECTL_TX_FAILURE,
5938 			    &retrycnt, 0);
5939 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5940 			meta->mt_ni = NULL;
5941 			meta->mt_m = NULL;
5942 		} else
5943 			KASSERT(meta->mt_m == NULL,
5944 			    ("%s:%d: fail", __func__, __LINE__));
5945 
5946 		dr->dr_usedslot--;
5947 		if (meta->mt_islast)
5948 			break;
5949 		slot = bwn_dma_nextslot(dr, slot);
5950 	}
5951 	sc->sc_watchdog_timer = 0;
5952 	if (dr->dr_stop) {
5953 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5954 		    ("%s:%d: fail", __func__, __LINE__));
5955 		dr->dr_stop = 0;
5956 	}
5957 }
5958 
5959 static void
5960 bwn_pio_handle_txeof(struct bwn_mac *mac,
5961     const struct bwn_txstatus *status)
5962 {
5963 	struct bwn_pio_txqueue *tq;
5964 	struct bwn_pio_txpkt *tp = NULL;
5965 	struct bwn_softc *sc = mac->mac_sc;
5966 	int retrycnt = 0;
5967 
5968 	BWN_ASSERT_LOCKED(sc);
5969 
5970 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5971 	if (tq == NULL)
5972 		return;
5973 
5974 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5975 	tq->tq_free++;
5976 
5977 	if (tp->tp_ni != NULL) {
5978 		/*
5979 		 * Do any tx complete callback.  Note this must
5980 		 * be done before releasing the node reference.
5981 		 */
5982 
5983 		/*
5984 		 * If we don't get an ACK, then we should log the
5985 		 * full framecnt.  That may be 0 if it's a PHY
5986 		 * failure, so ensure that gets logged as some
5987 		 * retry attempt.
5988 		 */
5989 		if (status->ack) {
5990 			retrycnt = status->framecnt - 1;
5991 		} else {
5992 			retrycnt = status->framecnt;
5993 			if (retrycnt == 0)
5994 				retrycnt = 1;
5995 		}
5996 		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
5997 		    status->ack ?
5998 		      IEEE80211_RATECTL_TX_SUCCESS :
5999 		      IEEE80211_RATECTL_TX_FAILURE,
6000 		    &retrycnt, 0);
6001 
6002 		if (tp->tp_m->m_flags & M_TXCB)
6003 			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6004 		ieee80211_free_node(tp->tp_ni);
6005 		tp->tp_ni = NULL;
6006 	}
6007 	m_freem(tp->tp_m);
6008 	tp->tp_m = NULL;
6009 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6010 
6011 	sc->sc_watchdog_timer = 0;
6012 }
6013 
6014 static void
6015 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6016 {
6017 	struct bwn_softc *sc = mac->mac_sc;
6018 	struct bwn_phy *phy = &mac->mac_phy;
6019 	struct ieee80211com *ic = &sc->sc_ic;
6020 	unsigned long now;
6021 	bwn_txpwr_result_t result;
6022 
6023 	BWN_GETTIME(now);
6024 
6025 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6026 		return;
6027 	phy->nexttime = now + 2 * 1000;
6028 
6029 	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6030 	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6031 		return;
6032 
6033 	if (phy->recalc_txpwr != NULL) {
6034 		result = phy->recalc_txpwr(mac,
6035 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6036 		if (result == BWN_TXPWR_RES_DONE)
6037 			return;
6038 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6039 		    ("%s: fail", __func__));
6040 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6041 
6042 		ieee80211_runtask(ic, &mac->mac_txpower);
6043 	}
6044 }
6045 
6046 static uint16_t
6047 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6048 {
6049 
6050 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6051 }
6052 
6053 static uint32_t
6054 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6055 {
6056 
6057 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6058 }
6059 
6060 static void
6061 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6062 {
6063 
6064 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6065 }
6066 
6067 static void
6068 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6069 {
6070 
6071 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6072 }
6073 
6074 static int
6075 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6076 {
6077 
6078 	switch (rate) {
6079 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6080 	case 12:
6081 		return (BWN_OFDM_RATE_6MB);
6082 	case 18:
6083 		return (BWN_OFDM_RATE_9MB);
6084 	case 24:
6085 		return (BWN_OFDM_RATE_12MB);
6086 	case 36:
6087 		return (BWN_OFDM_RATE_18MB);
6088 	case 48:
6089 		return (BWN_OFDM_RATE_24MB);
6090 	case 72:
6091 		return (BWN_OFDM_RATE_36MB);
6092 	case 96:
6093 		return (BWN_OFDM_RATE_48MB);
6094 	case 108:
6095 		return (BWN_OFDM_RATE_54MB);
6096 	/* CCK rates (NB: not IEEE std, device-specific) */
6097 	case 2:
6098 		return (BWN_CCK_RATE_1MB);
6099 	case 4:
6100 		return (BWN_CCK_RATE_2MB);
6101 	case 11:
6102 		return (BWN_CCK_RATE_5MB);
6103 	case 22:
6104 		return (BWN_CCK_RATE_11MB);
6105 	}
6106 
6107 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6108 	return (BWN_CCK_RATE_1MB);
6109 }
6110 
6111 static uint16_t
6112 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6113 {
6114 	struct bwn_phy *phy = &mac->mac_phy;
6115 	uint16_t control = 0;
6116 	uint16_t bw;
6117 
6118 	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6119 	bw = BWN_TXH_PHY1_BW_20;
6120 
6121 	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6122 		control = bw;
6123 	} else {
6124 		control = bw;
6125 		/* Figure out coding rate and modulation */
6126 		/* XXX TODO: table-ize, for MCS transmit */
6127 		/* Note: this is BWN_*_RATE values */
6128 		switch (bitrate) {
6129 		case BWN_CCK_RATE_1MB:
6130 			control |= 0;
6131 			break;
6132 		case BWN_CCK_RATE_2MB:
6133 			control |= 1;
6134 			break;
6135 		case BWN_CCK_RATE_5MB:
6136 			control |= 2;
6137 			break;
6138 		case BWN_CCK_RATE_11MB:
6139 			control |= 3;
6140 			break;
6141 		case BWN_OFDM_RATE_6MB:
6142 			control |= BWN_TXH_PHY1_CRATE_1_2;
6143 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6144 			break;
6145 		case BWN_OFDM_RATE_9MB:
6146 			control |= BWN_TXH_PHY1_CRATE_3_4;
6147 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6148 			break;
6149 		case BWN_OFDM_RATE_12MB:
6150 			control |= BWN_TXH_PHY1_CRATE_1_2;
6151 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6152 			break;
6153 		case BWN_OFDM_RATE_18MB:
6154 			control |= BWN_TXH_PHY1_CRATE_3_4;
6155 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6156 			break;
6157 		case BWN_OFDM_RATE_24MB:
6158 			control |= BWN_TXH_PHY1_CRATE_1_2;
6159 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6160 			break;
6161 		case BWN_OFDM_RATE_36MB:
6162 			control |= BWN_TXH_PHY1_CRATE_3_4;
6163 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6164 			break;
6165 		case BWN_OFDM_RATE_48MB:
6166 			control |= BWN_TXH_PHY1_CRATE_1_2;
6167 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6168 			break;
6169 		case BWN_OFDM_RATE_54MB:
6170 			control |= BWN_TXH_PHY1_CRATE_3_4;
6171 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6172 			break;
6173 		default:
6174 			break;
6175 		}
6176 		control |= BWN_TXH_PHY1_MODE_SISO;
6177 	}
6178 
6179 	return control;
6180 }
6181 
6182 static int
6183 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6184     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6185 {
6186 	const struct bwn_phy *phy = &mac->mac_phy;
6187 	struct bwn_softc *sc = mac->mac_sc;
6188 	struct ieee80211_frame *wh;
6189 	struct ieee80211_frame *protwh;
6190 	struct ieee80211_frame_cts *cts;
6191 	struct ieee80211_frame_rts *rts;
6192 	const struct ieee80211_txparam *tp;
6193 	struct ieee80211vap *vap = ni->ni_vap;
6194 	struct ieee80211com *ic = &sc->sc_ic;
6195 	struct mbuf *mprot;
6196 	unsigned int len;
6197 	uint32_t macctl = 0;
6198 	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6199 	uint16_t phyctl = 0;
6200 	uint8_t rate, rate_fb;
6201 	int fill_phy_ctl1 = 0;
6202 
6203 	wh = mtod(m, struct ieee80211_frame *);
6204 	memset(txhdr, 0, sizeof(*txhdr));
6205 
6206 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6207 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6208 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6209 
6210 	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6211 	    || (phy->type == BWN_PHYTYPE_HT))
6212 		fill_phy_ctl1 = 1;
6213 
6214 	/*
6215 	 * Find TX rate
6216 	 */
6217 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6218 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6219 		rate = rate_fb = tp->mgmtrate;
6220 	else if (ismcast)
6221 		rate = rate_fb = tp->mcastrate;
6222 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6223 		rate = rate_fb = tp->ucastrate;
6224 	else {
6225 		/* XXX TODO: don't fall back to CCK rates for OFDM */
6226 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6227 		rate = ni->ni_txrate;
6228 
6229 		if (rix > 0)
6230 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6231 			    IEEE80211_RATE_VAL;
6232 		else
6233 			rate_fb = rate;
6234 	}
6235 
6236 	sc->sc_tx_rate = rate;
6237 
6238 	/* Note: this maps the select ieee80211 rate to hardware rate */
6239 	rate = bwn_ieeerate2hwrate(sc, rate);
6240 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6241 
6242 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6243 	    bwn_plcp_getcck(rate);
6244 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6245 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6246 
6247 	/* XXX rate/rate_fb is the hardware rate */
6248 	if ((rate_fb == rate) ||
6249 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6250 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6251 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6252 	else
6253 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6254 		    m->m_pkthdr.len, rate, isshort);
6255 
6256 	/* XXX TX encryption */
6257 
6258 	switch (mac->mac_fw.fw_hdr_format) {
6259 	case BWN_FW_HDR_351:
6260 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6261 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6262 		break;
6263 	case BWN_FW_HDR_410:
6264 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6265 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6266 		break;
6267 	case BWN_FW_HDR_598:
6268 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6269 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6270 		break;
6271 	}
6272 
6273 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6274 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6275 
6276 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6277 	    BWN_TX_EFT_FB_CCK;
6278 	txhdr->chan = phy->chan;
6279 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6280 	    BWN_TX_PHY_ENC_CCK;
6281 	/* XXX preamble? obey net80211 */
6282 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6283 	     rate == BWN_CCK_RATE_11MB))
6284 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6285 
6286 	if (! phy->gmode)
6287 		macctl |= BWN_TX_MAC_5GHZ;
6288 
6289 	/* XXX TX antenna selection */
6290 
6291 	switch (bwn_antenna_sanitize(mac, 0)) {
6292 	case 0:
6293 		phyctl |= BWN_TX_PHY_ANT01AUTO;
6294 		break;
6295 	case 1:
6296 		phyctl |= BWN_TX_PHY_ANT0;
6297 		break;
6298 	case 2:
6299 		phyctl |= BWN_TX_PHY_ANT1;
6300 		break;
6301 	case 3:
6302 		phyctl |= BWN_TX_PHY_ANT2;
6303 		break;
6304 	case 4:
6305 		phyctl |= BWN_TX_PHY_ANT3;
6306 		break;
6307 	default:
6308 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6309 	}
6310 
6311 	if (!ismcast)
6312 		macctl |= BWN_TX_MAC_ACK;
6313 
6314 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6315 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6316 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6317 		macctl |= BWN_TX_MAC_LONGFRAME;
6318 
6319 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6320 		/* XXX RTS rate is always 1MB??? */
6321 		/* XXX TODO: don't fall back to CCK rates for OFDM */
6322 		rts_rate = BWN_CCK_RATE_1MB;
6323 		rts_rate_fb = bwn_get_fbrate(rts_rate);
6324 
6325 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6326 		protdur = ieee80211_compute_duration(ic->ic_rt,
6327 		    m->m_pkthdr.len, rate, isshort) +
6328 		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6329 
6330 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6331 
6332 			switch (mac->mac_fw.fw_hdr_format) {
6333 			case BWN_FW_HDR_351:
6334 				cts = (struct ieee80211_frame_cts *)
6335 				    txhdr->body.r351.rts_frame;
6336 				break;
6337 			case BWN_FW_HDR_410:
6338 				cts = (struct ieee80211_frame_cts *)
6339 				    txhdr->body.r410.rts_frame;
6340 				break;
6341 			case BWN_FW_HDR_598:
6342 				cts = (struct ieee80211_frame_cts *)
6343 				    txhdr->body.r598.rts_frame;
6344 				break;
6345 			}
6346 
6347 			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6348 			    protdur);
6349 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6350 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6351 			    mprot->m_pkthdr.len);
6352 			m_freem(mprot);
6353 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6354 			len = sizeof(struct ieee80211_frame_cts);
6355 		} else {
6356 			switch (mac->mac_fw.fw_hdr_format) {
6357 			case BWN_FW_HDR_351:
6358 				rts = (struct ieee80211_frame_rts *)
6359 				    txhdr->body.r351.rts_frame;
6360 				break;
6361 			case BWN_FW_HDR_410:
6362 				rts = (struct ieee80211_frame_rts *)
6363 				    txhdr->body.r410.rts_frame;
6364 				break;
6365 			case BWN_FW_HDR_598:
6366 				rts = (struct ieee80211_frame_rts *)
6367 				    txhdr->body.r598.rts_frame;
6368 				break;
6369 			}
6370 
6371 			/* XXX rate/rate_fb is the hardware rate */
6372 			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6373 			    isshort);
6374 			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6375 			    wh->i_addr2, protdur);
6376 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6377 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6378 			    mprot->m_pkthdr.len);
6379 			m_freem(mprot);
6380 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6381 			len = sizeof(struct ieee80211_frame_rts);
6382 		}
6383 		len += IEEE80211_CRC_LEN;
6384 
6385 		switch (mac->mac_fw.fw_hdr_format) {
6386 		case BWN_FW_HDR_351:
6387 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6388 			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6389 			break;
6390 		case BWN_FW_HDR_410:
6391 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6392 			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6393 			break;
6394 		case BWN_FW_HDR_598:
6395 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6396 			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6397 			break;
6398 		}
6399 
6400 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6401 		    rts_rate_fb);
6402 
6403 		switch (mac->mac_fw.fw_hdr_format) {
6404 		case BWN_FW_HDR_351:
6405 			protwh = (struct ieee80211_frame *)
6406 			    &txhdr->body.r351.rts_frame;
6407 			break;
6408 		case BWN_FW_HDR_410:
6409 			protwh = (struct ieee80211_frame *)
6410 			    &txhdr->body.r410.rts_frame;
6411 			break;
6412 		case BWN_FW_HDR_598:
6413 			protwh = (struct ieee80211_frame *)
6414 			    &txhdr->body.r598.rts_frame;
6415 			break;
6416 		}
6417 
6418 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6419 
6420 		if (BWN_ISOFDMRATE(rts_rate)) {
6421 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6422 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6423 		} else {
6424 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6425 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6426 		}
6427 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6428 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6429 
6430 		if (fill_phy_ctl1) {
6431 			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6432 			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6433 		}
6434 	}
6435 
6436 	if (fill_phy_ctl1) {
6437 		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6438 		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6439 	}
6440 
6441 	switch (mac->mac_fw.fw_hdr_format) {
6442 	case BWN_FW_HDR_351:
6443 		txhdr->body.r351.cookie = htole16(cookie);
6444 		break;
6445 	case BWN_FW_HDR_410:
6446 		txhdr->body.r410.cookie = htole16(cookie);
6447 		break;
6448 	case BWN_FW_HDR_598:
6449 		txhdr->body.r598.cookie = htole16(cookie);
6450 		break;
6451 	}
6452 
6453 	txhdr->macctl = htole32(macctl);
6454 	txhdr->phyctl = htole16(phyctl);
6455 
6456 	/*
6457 	 * TX radio tap
6458 	 */
6459 	if (ieee80211_radiotap_active_vap(vap)) {
6460 		sc->sc_tx_th.wt_flags = 0;
6461 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6462 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6463 		if (isshort &&
6464 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6465 		     rate == BWN_CCK_RATE_11MB))
6466 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6467 		sc->sc_tx_th.wt_rate = rate;
6468 
6469 		ieee80211_radiotap_tx(vap, m);
6470 	}
6471 
6472 	return (0);
6473 }
6474 
6475 static void
6476 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6477     const uint8_t rate)
6478 {
6479 	uint32_t d, plen;
6480 	uint8_t *raw = plcp->o.raw;
6481 
6482 	if (BWN_ISOFDMRATE(rate)) {
6483 		d = bwn_plcp_getofdm(rate);
6484 		KASSERT(!(octets & 0xf000),
6485 		    ("%s:%d: fail", __func__, __LINE__));
6486 		d |= (octets << 5);
6487 		plcp->o.data = htole32(d);
6488 	} else {
6489 		plen = octets * 16 / rate;
6490 		if ((octets * 16 % rate) > 0) {
6491 			plen++;
6492 			if ((rate == BWN_CCK_RATE_11MB)
6493 			    && ((octets * 8 % 11) < 4)) {
6494 				raw[1] = 0x84;
6495 			} else
6496 				raw[1] = 0x04;
6497 		} else
6498 			raw[1] = 0x04;
6499 		plcp->o.data |= htole32(plen << 16);
6500 		raw[0] = bwn_plcp_getcck(rate);
6501 	}
6502 }
6503 
6504 static uint8_t
6505 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6506 {
6507 	struct bwn_softc *sc = mac->mac_sc;
6508 	uint8_t mask;
6509 
6510 	if (n == 0)
6511 		return (0);
6512 	if (mac->mac_phy.gmode)
6513 		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6514 	else
6515 		mask = siba_sprom_get_ant_a(sc->sc_dev);
6516 	if (!(mask & (1 << (n - 1))))
6517 		return (0);
6518 	return (n);
6519 }
6520 
6521 /*
6522  * Return a fallback rate for the given rate.
6523  *
6524  * Note: Don't fall back from OFDM to CCK.
6525  */
6526 static uint8_t
6527 bwn_get_fbrate(uint8_t bitrate)
6528 {
6529 	switch (bitrate) {
6530 	/* CCK */
6531 	case BWN_CCK_RATE_1MB:
6532 		return (BWN_CCK_RATE_1MB);
6533 	case BWN_CCK_RATE_2MB:
6534 		return (BWN_CCK_RATE_1MB);
6535 	case BWN_CCK_RATE_5MB:
6536 		return (BWN_CCK_RATE_2MB);
6537 	case BWN_CCK_RATE_11MB:
6538 		return (BWN_CCK_RATE_5MB);
6539 
6540 	/* OFDM */
6541 	case BWN_OFDM_RATE_6MB:
6542 		return (BWN_OFDM_RATE_6MB);
6543 	case BWN_OFDM_RATE_9MB:
6544 		return (BWN_OFDM_RATE_6MB);
6545 	case BWN_OFDM_RATE_12MB:
6546 		return (BWN_OFDM_RATE_9MB);
6547 	case BWN_OFDM_RATE_18MB:
6548 		return (BWN_OFDM_RATE_12MB);
6549 	case BWN_OFDM_RATE_24MB:
6550 		return (BWN_OFDM_RATE_18MB);
6551 	case BWN_OFDM_RATE_36MB:
6552 		return (BWN_OFDM_RATE_24MB);
6553 	case BWN_OFDM_RATE_48MB:
6554 		return (BWN_OFDM_RATE_36MB);
6555 	case BWN_OFDM_RATE_54MB:
6556 		return (BWN_OFDM_RATE_48MB);
6557 	}
6558 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6559 	return (0);
6560 }
6561 
6562 static uint32_t
6563 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6564     uint32_t ctl, const void *_data, int len)
6565 {
6566 	struct bwn_softc *sc = mac->mac_sc;
6567 	uint32_t value = 0;
6568 	const uint8_t *data = _data;
6569 
6570 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6571 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6572 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6573 
6574 	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6575 	    tq->tq_base + BWN_PIO8_TXDATA);
6576 	if (len & 3) {
6577 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6578 		    BWN_PIO8_TXCTL_24_31);
6579 		data = &(data[len - 1]);
6580 		switch (len & 3) {
6581 		case 3:
6582 			ctl |= BWN_PIO8_TXCTL_16_23;
6583 			value |= (uint32_t)(*data) << 16;
6584 			data--;
6585 		case 2:
6586 			ctl |= BWN_PIO8_TXCTL_8_15;
6587 			value |= (uint32_t)(*data) << 8;
6588 			data--;
6589 		case 1:
6590 			value |= (uint32_t)(*data);
6591 		}
6592 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6593 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6594 	}
6595 
6596 	return (ctl);
6597 }
6598 
6599 static void
6600 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6601     uint16_t offset, uint32_t value)
6602 {
6603 
6604 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6605 }
6606 
6607 static uint16_t
6608 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6609     uint16_t ctl, const void *_data, int len)
6610 {
6611 	struct bwn_softc *sc = mac->mac_sc;
6612 	const uint8_t *data = _data;
6613 
6614 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6615 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6616 
6617 	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6618 	    tq->tq_base + BWN_PIO_TXDATA);
6619 	if (len & 1) {
6620 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6621 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6622 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6623 	}
6624 
6625 	return (ctl);
6626 }
6627 
6628 static uint16_t
6629 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6630     uint16_t ctl, struct mbuf *m0)
6631 {
6632 	int i, j = 0;
6633 	uint16_t data = 0;
6634 	const uint8_t *buf;
6635 	struct mbuf *m = m0;
6636 
6637 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6638 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6639 
6640 	for (; m != NULL; m = m->m_next) {
6641 		buf = mtod(m, const uint8_t *);
6642 		for (i = 0; i < m->m_len; i++) {
6643 			if (!((j++) % 2))
6644 				data |= buf[i];
6645 			else {
6646 				data |= (buf[i] << 8);
6647 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6648 				data = 0;
6649 			}
6650 		}
6651 	}
6652 	if (m0->m_pkthdr.len % 2) {
6653 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6654 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6655 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6656 	}
6657 
6658 	return (ctl);
6659 }
6660 
6661 static void
6662 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6663 {
6664 
6665 	/* XXX should exit if 5GHz band .. */
6666 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6667 		return;
6668 
6669 	BWN_WRITE_2(mac, 0x684, 510 + time);
6670 	/* Disabled in Linux b43, can adversely effect performance */
6671 #if 0
6672 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6673 #endif
6674 }
6675 
6676 static struct bwn_dma_ring *
6677 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6678 {
6679 
6680 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6681 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6682 
6683 	switch (prio) {
6684 	case 3:
6685 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6686 	case 2:
6687 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6688 	case 0:
6689 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6690 	case 1:
6691 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6692 	}
6693 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6694 	return (NULL);
6695 }
6696 
6697 static int
6698 bwn_dma_getslot(struct bwn_dma_ring *dr)
6699 {
6700 	int slot;
6701 
6702 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6703 
6704 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6705 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6706 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6707 
6708 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6709 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6710 	dr->dr_curslot = slot;
6711 	dr->dr_usedslot++;
6712 
6713 	return (slot);
6714 }
6715 
6716 static struct bwn_pio_txqueue *
6717 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6718     struct bwn_pio_txpkt **pack)
6719 {
6720 	struct bwn_pio *pio = &mac->mac_method.pio;
6721 	struct bwn_pio_txqueue *tq = NULL;
6722 	unsigned int index;
6723 
6724 	switch (cookie & 0xf000) {
6725 	case 0x1000:
6726 		tq = &pio->wme[WME_AC_BK];
6727 		break;
6728 	case 0x2000:
6729 		tq = &pio->wme[WME_AC_BE];
6730 		break;
6731 	case 0x3000:
6732 		tq = &pio->wme[WME_AC_VI];
6733 		break;
6734 	case 0x4000:
6735 		tq = &pio->wme[WME_AC_VO];
6736 		break;
6737 	case 0x5000:
6738 		tq = &pio->mcast;
6739 		break;
6740 	}
6741 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6742 	if (tq == NULL)
6743 		return (NULL);
6744 	index = (cookie & 0x0fff);
6745 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6746 	if (index >= N(tq->tq_pkts))
6747 		return (NULL);
6748 	*pack = &tq->tq_pkts[index];
6749 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6750 	return (tq);
6751 }
6752 
6753 static void
6754 bwn_txpwr(void *arg, int npending)
6755 {
6756 	struct bwn_mac *mac = arg;
6757 	struct bwn_softc *sc = mac->mac_sc;
6758 
6759 	BWN_LOCK(sc);
6760 	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6761 	    mac->mac_phy.set_txpwr != NULL)
6762 		mac->mac_phy.set_txpwr(mac);
6763 	BWN_UNLOCK(sc);
6764 }
6765 
6766 static void
6767 bwn_task_15s(struct bwn_mac *mac)
6768 {
6769 	uint16_t reg;
6770 
6771 	if (mac->mac_fw.opensource) {
6772 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6773 		if (reg) {
6774 			bwn_restart(mac, "fw watchdog");
6775 			return;
6776 		}
6777 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6778 	}
6779 	if (mac->mac_phy.task_15s)
6780 		mac->mac_phy.task_15s(mac);
6781 
6782 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6783 }
6784 
6785 static void
6786 bwn_task_30s(struct bwn_mac *mac)
6787 {
6788 
6789 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6790 		return;
6791 	mac->mac_noise.noi_running = 1;
6792 	mac->mac_noise.noi_nsamples = 0;
6793 
6794 	bwn_noise_gensample(mac);
6795 }
6796 
6797 static void
6798 bwn_task_60s(struct bwn_mac *mac)
6799 {
6800 
6801 	if (mac->mac_phy.task_60s)
6802 		mac->mac_phy.task_60s(mac);
6803 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6804 }
6805 
6806 static void
6807 bwn_tasks(void *arg)
6808 {
6809 	struct bwn_mac *mac = arg;
6810 	struct bwn_softc *sc = mac->mac_sc;
6811 
6812 	BWN_ASSERT_LOCKED(sc);
6813 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6814 		return;
6815 
6816 	if (mac->mac_task_state % 4 == 0)
6817 		bwn_task_60s(mac);
6818 	if (mac->mac_task_state % 2 == 0)
6819 		bwn_task_30s(mac);
6820 	bwn_task_15s(mac);
6821 
6822 	mac->mac_task_state++;
6823 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6824 }
6825 
6826 static int
6827 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6828 {
6829 	struct bwn_softc *sc = mac->mac_sc;
6830 
6831 	KASSERT(a == 0, ("not support APHY\n"));
6832 
6833 	switch (plcp->o.raw[0] & 0xf) {
6834 	case 0xb:
6835 		return (BWN_OFDM_RATE_6MB);
6836 	case 0xf:
6837 		return (BWN_OFDM_RATE_9MB);
6838 	case 0xa:
6839 		return (BWN_OFDM_RATE_12MB);
6840 	case 0xe:
6841 		return (BWN_OFDM_RATE_18MB);
6842 	case 0x9:
6843 		return (BWN_OFDM_RATE_24MB);
6844 	case 0xd:
6845 		return (BWN_OFDM_RATE_36MB);
6846 	case 0x8:
6847 		return (BWN_OFDM_RATE_48MB);
6848 	case 0xc:
6849 		return (BWN_OFDM_RATE_54MB);
6850 	}
6851 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6852 	    plcp->o.raw[0] & 0xf);
6853 	return (-1);
6854 }
6855 
6856 static int
6857 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6858 {
6859 	struct bwn_softc *sc = mac->mac_sc;
6860 
6861 	switch (plcp->o.raw[0]) {
6862 	case 0x0a:
6863 		return (BWN_CCK_RATE_1MB);
6864 	case 0x14:
6865 		return (BWN_CCK_RATE_2MB);
6866 	case 0x37:
6867 		return (BWN_CCK_RATE_5MB);
6868 	case 0x6e:
6869 		return (BWN_CCK_RATE_11MB);
6870 	}
6871 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6872 	return (-1);
6873 }
6874 
6875 static void
6876 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6877     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6878     int rssi, int noise)
6879 {
6880 	struct bwn_softc *sc = mac->mac_sc;
6881 	const struct ieee80211_frame_min *wh;
6882 	uint64_t tsf;
6883 	uint16_t low_mactime_now;
6884 	uint16_t mt;
6885 
6886 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6887 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6888 
6889 	wh = mtod(m, const struct ieee80211_frame_min *);
6890 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6891 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6892 
6893 	bwn_tsf_read(mac, &tsf);
6894 	low_mactime_now = tsf;
6895 	tsf = tsf & ~0xffffULL;
6896 
6897 	switch (mac->mac_fw.fw_hdr_format) {
6898 	case BWN_FW_HDR_351:
6899 	case BWN_FW_HDR_410:
6900 		mt = le16toh(rxhdr->ps4.r351.mac_time);
6901 		break;
6902 	case BWN_FW_HDR_598:
6903 		mt = le16toh(rxhdr->ps4.r598.mac_time);
6904 		break;
6905 	}
6906 
6907 	tsf += mt;
6908 	if (low_mactime_now < mt)
6909 		tsf -= 0x10000;
6910 
6911 	sc->sc_rx_th.wr_tsf = tsf;
6912 	sc->sc_rx_th.wr_rate = rate;
6913 	sc->sc_rx_th.wr_antsignal = rssi;
6914 	sc->sc_rx_th.wr_antnoise = noise;
6915 }
6916 
6917 static void
6918 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6919 {
6920 	uint32_t low, high;
6921 
6922 	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6923 	    ("%s:%d: fail", __func__, __LINE__));
6924 
6925 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6926 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6927 	*tsf = high;
6928 	*tsf <<= 32;
6929 	*tsf |= low;
6930 }
6931 
6932 static int
6933 bwn_dma_attach(struct bwn_mac *mac)
6934 {
6935 	struct bwn_dma *dma = &mac->mac_method.dma;
6936 	struct bwn_softc *sc = mac->mac_sc;
6937 	bus_addr_t lowaddr = 0;
6938 	int error;
6939 
6940 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6941 		return (0);
6942 
6943 	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6944 
6945 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6946 
6947 	dma->dmatype = bwn_dma_gettype(mac);
6948 	if (dma->dmatype == BWN_DMA_30BIT)
6949 		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6950 	else if (dma->dmatype == BWN_DMA_32BIT)
6951 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6952 	else
6953 		lowaddr = BUS_SPACE_MAXADDR;
6954 
6955 	/*
6956 	 * Create top level DMA tag
6957 	 */
6958 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6959 			       BWN_ALIGN, 0,		/* alignment, bounds */
6960 			       lowaddr,			/* lowaddr */
6961 			       BUS_SPACE_MAXADDR,	/* highaddr */
6962 			       NULL, NULL,		/* filter, filterarg */
6963 			       BUS_SPACE_MAXSIZE,	/* maxsize */
6964 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6965 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6966 			       0,			/* flags */
6967 			       NULL, NULL,		/* lockfunc, lockarg */
6968 			       &dma->parent_dtag);
6969 	if (error) {
6970 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6971 		return (error);
6972 	}
6973 
6974 	/*
6975 	 * Create TX/RX mbuf DMA tag
6976 	 */
6977 	error = bus_dma_tag_create(dma->parent_dtag,
6978 				1,
6979 				0,
6980 				BUS_SPACE_MAXADDR,
6981 				BUS_SPACE_MAXADDR,
6982 				NULL, NULL,
6983 				MCLBYTES,
6984 				1,
6985 				BUS_SPACE_MAXSIZE_32BIT,
6986 				0,
6987 				NULL, NULL,
6988 				&dma->rxbuf_dtag);
6989 	if (error) {
6990 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6991 		goto fail0;
6992 	}
6993 	error = bus_dma_tag_create(dma->parent_dtag,
6994 				1,
6995 				0,
6996 				BUS_SPACE_MAXADDR,
6997 				BUS_SPACE_MAXADDR,
6998 				NULL, NULL,
6999 				MCLBYTES,
7000 				1,
7001 				BUS_SPACE_MAXSIZE_32BIT,
7002 				0,
7003 				NULL, NULL,
7004 				&dma->txbuf_dtag);
7005 	if (error) {
7006 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7007 		goto fail1;
7008 	}
7009 
7010 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7011 	if (!dma->wme[WME_AC_BK])
7012 		goto fail2;
7013 
7014 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7015 	if (!dma->wme[WME_AC_BE])
7016 		goto fail3;
7017 
7018 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7019 	if (!dma->wme[WME_AC_VI])
7020 		goto fail4;
7021 
7022 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7023 	if (!dma->wme[WME_AC_VO])
7024 		goto fail5;
7025 
7026 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7027 	if (!dma->mcast)
7028 		goto fail6;
7029 	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7030 	if (!dma->rx)
7031 		goto fail7;
7032 
7033 	return (error);
7034 
7035 fail7:	bwn_dma_ringfree(&dma->mcast);
7036 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7037 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7038 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7039 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7040 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7041 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7042 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7043 	return (error);
7044 }
7045 
7046 static struct bwn_dma_ring *
7047 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7048     uint16_t cookie, int *slot)
7049 {
7050 	struct bwn_dma *dma = &mac->mac_method.dma;
7051 	struct bwn_dma_ring *dr;
7052 	struct bwn_softc *sc = mac->mac_sc;
7053 
7054 	BWN_ASSERT_LOCKED(mac->mac_sc);
7055 
7056 	switch (cookie & 0xf000) {
7057 	case 0x1000:
7058 		dr = dma->wme[WME_AC_BK];
7059 		break;
7060 	case 0x2000:
7061 		dr = dma->wme[WME_AC_BE];
7062 		break;
7063 	case 0x3000:
7064 		dr = dma->wme[WME_AC_VI];
7065 		break;
7066 	case 0x4000:
7067 		dr = dma->wme[WME_AC_VO];
7068 		break;
7069 	case 0x5000:
7070 		dr = dma->mcast;
7071 		break;
7072 	default:
7073 		dr = NULL;
7074 		KASSERT(0 == 1,
7075 		    ("invalid cookie value %d", cookie & 0xf000));
7076 	}
7077 	*slot = (cookie & 0x0fff);
7078 	if (*slot < 0 || *slot >= dr->dr_numslots) {
7079 		/*
7080 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7081 		 * that it occurs events which have same H/W sequence numbers.
7082 		 * When it's occurred just prints a WARNING msgs and ignores.
7083 		 */
7084 		KASSERT(status->seq == dma->lastseq,
7085 		    ("%s:%d: fail", __func__, __LINE__));
7086 		device_printf(sc->sc_dev,
7087 		    "out of slot ranges (0 < %d < %d)\n", *slot,
7088 		    dr->dr_numslots);
7089 		return (NULL);
7090 	}
7091 	dma->lastseq = status->seq;
7092 	return (dr);
7093 }
7094 
7095 static void
7096 bwn_dma_stop(struct bwn_mac *mac)
7097 {
7098 	struct bwn_dma *dma;
7099 
7100 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7101 		return;
7102 	dma = &mac->mac_method.dma;
7103 
7104 	bwn_dma_ringstop(&dma->rx);
7105 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7106 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7107 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7108 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7109 	bwn_dma_ringstop(&dma->mcast);
7110 }
7111 
7112 static void
7113 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7114 {
7115 
7116 	if (dr == NULL)
7117 		return;
7118 
7119 	bwn_dma_cleanup(*dr);
7120 }
7121 
7122 static void
7123 bwn_pio_stop(struct bwn_mac *mac)
7124 {
7125 	struct bwn_pio *pio;
7126 
7127 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7128 		return;
7129 	pio = &mac->mac_method.pio;
7130 
7131 	bwn_destroy_queue_tx(&pio->mcast);
7132 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7133 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7134 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7135 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7136 }
7137 
7138 static void
7139 bwn_led_attach(struct bwn_mac *mac)
7140 {
7141 	struct bwn_softc *sc = mac->mac_sc;
7142 	const uint8_t *led_act = NULL;
7143 	uint16_t val[BWN_LED_MAX];
7144 	int i;
7145 
7146 	sc->sc_led_idle = (2350 * hz) / 1000;
7147 	sc->sc_led_blink = 1;
7148 
7149 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7150 		if (siba_get_pci_subvendor(sc->sc_dev) ==
7151 		    bwn_vendor_led_act[i].vid) {
7152 			led_act = bwn_vendor_led_act[i].led_act;
7153 			break;
7154 		}
7155 	}
7156 	if (led_act == NULL)
7157 		led_act = bwn_default_led_act;
7158 
7159 	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7160 	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7161 	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7162 	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7163 
7164 	for (i = 0; i < BWN_LED_MAX; ++i) {
7165 		struct bwn_led *led = &sc->sc_leds[i];
7166 
7167 		if (val[i] == 0xff) {
7168 			led->led_act = led_act[i];
7169 		} else {
7170 			if (val[i] & BWN_LED_ACT_LOW)
7171 				led->led_flags |= BWN_LED_F_ACTLOW;
7172 			led->led_act = val[i] & BWN_LED_ACT_MASK;
7173 		}
7174 		led->led_mask = (1 << i);
7175 
7176 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7177 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7178 		    led->led_act == BWN_LED_ACT_BLINK) {
7179 			led->led_flags |= BWN_LED_F_BLINK;
7180 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7181 				led->led_flags |= BWN_LED_F_POLLABLE;
7182 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7183 				led->led_flags |= BWN_LED_F_SLOW;
7184 
7185 			if (sc->sc_blink_led == NULL) {
7186 				sc->sc_blink_led = led;
7187 				if (led->led_flags & BWN_LED_F_SLOW)
7188 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7189 			}
7190 		}
7191 
7192 		DPRINTF(sc, BWN_DEBUG_LED,
7193 		    "%dth led, act %d, lowact %d\n", i,
7194 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7195 	}
7196 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7197 }
7198 
7199 static __inline uint16_t
7200 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7201 {
7202 
7203 	if (led->led_flags & BWN_LED_F_ACTLOW)
7204 		on = !on;
7205 	if (on)
7206 		val |= led->led_mask;
7207 	else
7208 		val &= ~led->led_mask;
7209 	return val;
7210 }
7211 
7212 static void
7213 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7214 {
7215 	struct bwn_softc *sc = mac->mac_sc;
7216 	struct ieee80211com *ic = &sc->sc_ic;
7217 	uint16_t val;
7218 	int i;
7219 
7220 	if (nstate == IEEE80211_S_INIT) {
7221 		callout_stop(&sc->sc_led_blink_ch);
7222 		sc->sc_led_blinking = 0;
7223 	}
7224 
7225 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7226 		return;
7227 
7228 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7229 	for (i = 0; i < BWN_LED_MAX; ++i) {
7230 		struct bwn_led *led = &sc->sc_leds[i];
7231 		int on;
7232 
7233 		if (led->led_act == BWN_LED_ACT_UNKN ||
7234 		    led->led_act == BWN_LED_ACT_NULL)
7235 			continue;
7236 
7237 		if ((led->led_flags & BWN_LED_F_BLINK) &&
7238 		    nstate != IEEE80211_S_INIT)
7239 			continue;
7240 
7241 		switch (led->led_act) {
7242 		case BWN_LED_ACT_ON:    /* Always on */
7243 			on = 1;
7244 			break;
7245 		case BWN_LED_ACT_OFF:   /* Always off */
7246 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7247 			on = 0;
7248 			break;
7249 		default:
7250 			on = 1;
7251 			switch (nstate) {
7252 			case IEEE80211_S_INIT:
7253 				on = 0;
7254 				break;
7255 			case IEEE80211_S_RUN:
7256 				if (led->led_act == BWN_LED_ACT_11G &&
7257 				    ic->ic_curmode != IEEE80211_MODE_11G)
7258 					on = 0;
7259 				break;
7260 			default:
7261 				if (led->led_act == BWN_LED_ACT_ASSOC)
7262 					on = 0;
7263 				break;
7264 			}
7265 			break;
7266 		}
7267 
7268 		val = bwn_led_onoff(led, val, on);
7269 	}
7270 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7271 }
7272 
7273 static void
7274 bwn_led_event(struct bwn_mac *mac, int event)
7275 {
7276 	struct bwn_softc *sc = mac->mac_sc;
7277 	struct bwn_led *led = sc->sc_blink_led;
7278 	int rate;
7279 
7280 	if (event == BWN_LED_EVENT_POLL) {
7281 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7282 			return;
7283 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7284 			return;
7285 	}
7286 
7287 	sc->sc_led_ticks = ticks;
7288 	if (sc->sc_led_blinking)
7289 		return;
7290 
7291 	switch (event) {
7292 	case BWN_LED_EVENT_RX:
7293 		rate = sc->sc_rx_rate;
7294 		break;
7295 	case BWN_LED_EVENT_TX:
7296 		rate = sc->sc_tx_rate;
7297 		break;
7298 	case BWN_LED_EVENT_POLL:
7299 		rate = 0;
7300 		break;
7301 	default:
7302 		panic("unknown LED event %d\n", event);
7303 		break;
7304 	}
7305 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7306 	    bwn_led_duration[rate].off_dur);
7307 }
7308 
7309 static void
7310 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7311 {
7312 	struct bwn_softc *sc = mac->mac_sc;
7313 	struct bwn_led *led = sc->sc_blink_led;
7314 	uint16_t val;
7315 
7316 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7317 	val = bwn_led_onoff(led, val, 1);
7318 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7319 
7320 	if (led->led_flags & BWN_LED_F_SLOW) {
7321 		BWN_LED_SLOWDOWN(on_dur);
7322 		BWN_LED_SLOWDOWN(off_dur);
7323 	}
7324 
7325 	sc->sc_led_blinking = 1;
7326 	sc->sc_led_blink_offdur = off_dur;
7327 
7328 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7329 }
7330 
7331 static void
7332 bwn_led_blink_next(void *arg)
7333 {
7334 	struct bwn_mac *mac = arg;
7335 	struct bwn_softc *sc = mac->mac_sc;
7336 	uint16_t val;
7337 
7338 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7339 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7340 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7341 
7342 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7343 	    bwn_led_blink_end, mac);
7344 }
7345 
7346 static void
7347 bwn_led_blink_end(void *arg)
7348 {
7349 	struct bwn_mac *mac = arg;
7350 	struct bwn_softc *sc = mac->mac_sc;
7351 
7352 	sc->sc_led_blinking = 0;
7353 }
7354 
7355 static int
7356 bwn_suspend(device_t dev)
7357 {
7358 	struct bwn_softc *sc = device_get_softc(dev);
7359 
7360 	BWN_LOCK(sc);
7361 	bwn_stop(sc);
7362 	BWN_UNLOCK(sc);
7363 	return (0);
7364 }
7365 
7366 static int
7367 bwn_resume(device_t dev)
7368 {
7369 	struct bwn_softc *sc = device_get_softc(dev);
7370 	int error = EDOOFUS;
7371 
7372 	BWN_LOCK(sc);
7373 	if (sc->sc_ic.ic_nrunning > 0)
7374 		error = bwn_init(sc);
7375 	BWN_UNLOCK(sc);
7376 	if (error == 0)
7377 		ieee80211_start_all(&sc->sc_ic);
7378 	return (0);
7379 }
7380 
7381 static void
7382 bwn_rfswitch(void *arg)
7383 {
7384 	struct bwn_softc *sc = arg;
7385 	struct bwn_mac *mac = sc->sc_curmac;
7386 	int cur = 0, prev = 0;
7387 
7388 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7389 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7390 
7391 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7392 	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7393 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7394 			& BWN_RF_HWENABLED_HI_MASK))
7395 			cur = 1;
7396 	} else {
7397 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7398 		    & BWN_RF_HWENABLED_LO_MASK)
7399 			cur = 1;
7400 	}
7401 
7402 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7403 		prev = 1;
7404 
7405 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7406 	    __func__, cur, prev);
7407 
7408 	if (cur != prev) {
7409 		if (cur)
7410 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7411 		else
7412 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7413 
7414 		device_printf(sc->sc_dev,
7415 		    "status of RF switch is changed to %s\n",
7416 		    cur ? "ON" : "OFF");
7417 		if (cur != mac->mac_phy.rf_on) {
7418 			if (cur)
7419 				bwn_rf_turnon(mac);
7420 			else
7421 				bwn_rf_turnoff(mac);
7422 		}
7423 	}
7424 
7425 	callout_schedule(&sc->sc_rfswitch_ch, hz);
7426 }
7427 
7428 static void
7429 bwn_sysctl_node(struct bwn_softc *sc)
7430 {
7431 	device_t dev = sc->sc_dev;
7432 	struct bwn_mac *mac;
7433 	struct bwn_stats *stats;
7434 
7435 	/* XXX assume that count of MAC is only 1. */
7436 
7437 	if ((mac = sc->sc_curmac) == NULL)
7438 		return;
7439 	stats = &mac->mac_stats;
7440 
7441 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7442 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7443 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7444 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7445 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7446 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7447 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7448 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7449 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7450 
7451 #ifdef BWN_DEBUG
7452 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7453 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7455 #endif
7456 }
7457 
7458 static device_method_t bwn_methods[] = {
7459 	/* Device interface */
7460 	DEVMETHOD(device_probe,		bwn_probe),
7461 	DEVMETHOD(device_attach,	bwn_attach),
7462 	DEVMETHOD(device_detach,	bwn_detach),
7463 	DEVMETHOD(device_suspend,	bwn_suspend),
7464 	DEVMETHOD(device_resume,	bwn_resume),
7465 	DEVMETHOD_END
7466 };
7467 static driver_t bwn_driver = {
7468 	"bwn",
7469 	bwn_methods,
7470 	sizeof(struct bwn_softc)
7471 };
7472 static devclass_t bwn_devclass;
7473 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7474 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7475 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7476 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7477 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7478 MODULE_VERSION(bwn, 1);
7479