xref: /dragonfly/sys/dev/netif/bwn/bwn/if_bwn.c (revision 5e83d98b)
1 /*-
2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  *
16  * NO WARRANTY
17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27  * THE POSSIBILITY OF SUCH DAMAGES.
28  *
29  * $FreeBSD: head/sys/dev/bwn/if_bwn.c 299801 2016-05-14 23:50:44Z adrian $
30  */
31 
32 /*
33  * The Broadcom Wireless LAN controller driver.
34  */
35 
36 #include <opt_wlan.h>
37 #include <opt_bwn.h>
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/kernel.h>
42 #include <sys/malloc.h>
43 #include <sys/module.h>
44 #include <sys/endian.h>
45 #include <sys/errno.h>
46 #include <sys/firmware.h>
47 #include <sys/lock.h>
48 #include <sys/mutex.h>
49 #if !defined(__DragonFly__)
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 #endif
53 #include <sys/bus.h>
54 #include <sys/rman.h>
55 #include <sys/socket.h>
56 #include <sys/sockio.h>
57 
58 #include <net/ethernet.h>
59 #include <net/if.h>
60 #include <net/if_var.h>
61 #include <net/if_arp.h>
62 #include <net/if_dl.h>
63 #include <net/if_llc.h>
64 #include <net/if_media.h>
65 #include <net/if_types.h>
66 
67 #if defined(__DragonFly__)
68 #include <bus/pci/pcivar.h>
69 #include <bus/pci/pcireg.h>
70 #include <dev/netif/bwn/siba/siba_ids.h>
71 #include <dev/netif/bwn/siba/sibareg.h>
72 #include <dev/netif/bwn/siba/sibavar.h>
73 #else
74 #include <dev/pci/pcivar.h>
75 #include <dev/pci/pcireg.h>
76 #include <dev/siba/siba_ids.h>
77 #include <dev/siba/sibareg.h>
78 #include <dev/siba/sibavar.h>
79 #endif
80 
81 #if defined(__DragonFly__)
82 #include <netproto/802_11/ieee80211_var.h>
83 #include <netproto/802_11/ieee80211_radiotap.h>
84 #include <netproto/802_11/ieee80211_regdomain.h>
85 #include <netproto/802_11/ieee80211_phy.h>
86 #include <netproto/802_11/ieee80211_ratectl.h>
87 #else
88 #include <net80211/ieee80211_var.h>
89 #include <net80211/ieee80211_radiotap.h>
90 #include <net80211/ieee80211_regdomain.h>
91 #include <net80211/ieee80211_phy.h>
92 #include <net80211/ieee80211_ratectl.h>
93 #endif
94 
95 #if defined(__DragonFly__)
96 #include "if_bwnreg.h"
97 #include "if_bwnvar.h"
98 #else
99 #include <dev/bwn/if_bwnreg.h>
100 #include <dev/bwn/if_bwnvar.h>
101 #endif
102 
103 #if defined(__DragonFly__)
104 #include "if_bwn_debug.h"
105 #include "if_bwn_misc.h"
106 #include "if_bwn_util.h"
107 #include "if_bwn_phy_common.h"
108 #include "if_bwn_phy_g.h"
109 #include "if_bwn_phy_lp.h"
110 #else
111 #include <dev/bwn/if_bwn_debug.h>
112 #include <dev/bwn/if_bwn_misc.h>
113 #include <dev/bwn/if_bwn_util.h>
114 #include <dev/bwn/if_bwn_phy_common.h>
115 #include <dev/bwn/if_bwn_phy_g.h>
116 #include <dev/bwn/if_bwn_phy_lp.h>
117 #endif
118 
119 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
120     "Broadcom driver parameters");
121 
122 /*
123  * Tunable & sysctl variables.
124  */
125 
126 #ifdef BWN_DEBUG
127 static	int bwn_debug = 0;
128 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RW, &bwn_debug, 0,
129     "Broadcom debugging printfs");
130 #endif
131 
132 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
133 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
134     "uses Bad Frames Preemption");
135 static int	bwn_bluetooth = 1;
136 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
137     "turns on Bluetooth Coexistence");
138 static int	bwn_hwpctl = 0;
139 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
140     "uses H/W power control");
141 #if defined(__DragonFly__)
142 static int	bwn_msi_enable = 1;
143 TUNABLE_INT("hw.bwn.msi.enable", &bwn_msi_enable);
144 #else
145 static int	bwn_msi_disable = 0;		/* MSI disabled  */
146 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
147 #endif
148 static int	bwn_usedma = 1;
149 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
150     "uses DMA");
151 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
152 static int	bwn_wme = 1;
153 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
154     "uses WME support");
155 
156 static void	bwn_attach_pre(struct bwn_softc *);
157 static int	bwn_attach_post(struct bwn_softc *);
158 static void	bwn_sprom_bugfixes(device_t);
159 static int	bwn_init(struct bwn_softc *);
160 static void	bwn_parent(struct ieee80211com *);
161 static void	bwn_start(struct bwn_softc *);
162 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
163 static int	bwn_attach_core(struct bwn_mac *);
164 static int	bwn_phy_getinfo(struct bwn_mac *, int);
165 static int	bwn_chiptest(struct bwn_mac *);
166 static int	bwn_setup_channels(struct bwn_mac *, int, int);
167 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
168 		    uint16_t);
169 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
170 		    const struct bwn_channelinfo *, int);
171 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
172 		    const struct ieee80211_bpf_params *);
173 static void	bwn_updateslot(struct ieee80211com *);
174 static void	bwn_update_promisc(struct ieee80211com *);
175 static void	bwn_wme_init(struct bwn_mac *);
176 static int	bwn_wme_update(struct ieee80211com *);
177 static void	bwn_wme_clear(struct bwn_softc *);
178 static void	bwn_wme_load(struct bwn_mac *);
179 static void	bwn_wme_loadparams(struct bwn_mac *,
180 		    const struct wmeParams *, uint16_t);
181 static void	bwn_scan_start(struct ieee80211com *);
182 static void	bwn_scan_end(struct ieee80211com *);
183 static void	bwn_set_channel(struct ieee80211com *);
184 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
185 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
186 		    const uint8_t [IEEE80211_ADDR_LEN],
187 		    const uint8_t [IEEE80211_ADDR_LEN]);
188 static void	bwn_vap_delete(struct ieee80211vap *);
189 static void	bwn_stop(struct bwn_softc *);
190 static int	bwn_core_init(struct bwn_mac *);
191 static void	bwn_core_start(struct bwn_mac *);
192 static void	bwn_core_exit(struct bwn_mac *);
193 static void	bwn_bt_disable(struct bwn_mac *);
194 static int	bwn_chip_init(struct bwn_mac *);
195 static void	bwn_set_txretry(struct bwn_mac *, int, int);
196 static void	bwn_rate_init(struct bwn_mac *);
197 static void	bwn_set_phytxctl(struct bwn_mac *);
198 static void	bwn_spu_setdelay(struct bwn_mac *, int);
199 static void	bwn_bt_enable(struct bwn_mac *);
200 static void	bwn_set_macaddr(struct bwn_mac *);
201 static void	bwn_crypt_init(struct bwn_mac *);
202 static void	bwn_chip_exit(struct bwn_mac *);
203 static int	bwn_fw_fillinfo(struct bwn_mac *);
204 static int	bwn_fw_loaducode(struct bwn_mac *);
205 static int	bwn_gpio_init(struct bwn_mac *);
206 static int	bwn_fw_loadinitvals(struct bwn_mac *);
207 static int	bwn_phy_init(struct bwn_mac *);
208 static void	bwn_set_txantenna(struct bwn_mac *, int);
209 static void	bwn_set_opmode(struct bwn_mac *);
210 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
211 static uint8_t	bwn_plcp_getcck(const uint8_t);
212 static uint8_t	bwn_plcp_getofdm(const uint8_t);
213 static void	bwn_pio_init(struct bwn_mac *);
214 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
215 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
216 		    int);
217 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
218 		    struct bwn_pio_rxqueue *, int);
219 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
220 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
221 		    uint16_t);
222 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
223 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
224 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
225 static void	bwn_pio_handle_txeof(struct bwn_mac *,
226 		    const struct bwn_txstatus *);
227 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
228 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
229 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
230 		    uint16_t);
231 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
232 		    uint32_t);
233 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
234 		    struct mbuf *);
235 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
236 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
237 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
238 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
239 		    uint16_t, uint32_t);
240 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
241 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
242 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
243 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
244 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
245 		    uint16_t, struct bwn_pio_txpkt **);
246 static void	bwn_dma_init(struct bwn_mac *);
247 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
248 static int	bwn_dma_mask2type(uint64_t);
249 static uint64_t	bwn_dma_mask(struct bwn_mac *);
250 static uint16_t	bwn_dma_base(int, int);
251 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
252 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
253 		    int, struct bwn_dmadesc_generic **,
254 		    struct bwn_dmadesc_meta **);
255 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
256 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
257 		    int, int);
258 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
259 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
260 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
261 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
262 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
263 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
264 		    int, struct bwn_dmadesc_generic **,
265 		    struct bwn_dmadesc_meta **);
266 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
267 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
268 		    int, int);
269 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
270 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
271 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
272 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
273 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
274 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
275 static void	bwn_dma_setup(struct bwn_dma_ring *);
276 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
277 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
278 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
279 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
280 static void	bwn_dma_rx_handle_overflow(struct bwn_dma_ring *);
281 static void	bwn_dma_rx(struct bwn_dma_ring *);
282 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
283 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
284 		    struct bwn_dmadesc_meta *);
285 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
286 static int	bwn_dma_gettype(struct bwn_mac *);
287 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
288 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
289 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
290 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
291 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
292 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
293 		    int);
294 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
295 		    bus_size_t, int);
296 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
297 static void	bwn_dma_handle_txeof(struct bwn_mac *,
298 		    const struct bwn_txstatus *);
299 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
300 		    struct mbuf *);
301 static int	bwn_dma_getslot(struct bwn_dma_ring *);
302 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
303 		    uint8_t);
304 static int	bwn_dma_attach(struct bwn_mac *);
305 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
306 		    int, int, int);
307 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
308 		    const struct bwn_txstatus *, uint16_t, int *);
309 static void	bwn_dma_free(struct bwn_mac *);
310 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
311 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
312 		    const char *, struct bwn_fwfile *);
313 static void	bwn_release_firmware(struct bwn_mac *);
314 static void	bwn_do_release_fw(struct bwn_fwfile *);
315 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
316 static int	bwn_fwinitvals_write(struct bwn_mac *,
317 		    const struct bwn_fwinitvals *, size_t, size_t);
318 static uint16_t	bwn_ant2phy(int);
319 static void	bwn_mac_write_bssid(struct bwn_mac *);
320 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
321 		    const uint8_t *);
322 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
323 		    const uint8_t *, size_t, const uint8_t *);
324 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
325 		    const uint8_t *);
326 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
327 		    const uint8_t *);
328 static void	bwn_phy_exit(struct bwn_mac *);
329 static void	bwn_core_stop(struct bwn_mac *);
330 static int	bwn_switch_band(struct bwn_softc *,
331 		    struct ieee80211_channel *);
332 static void	bwn_phy_reset(struct bwn_mac *);
333 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
334 static void	bwn_set_pretbtt(struct bwn_mac *);
335 #if defined(__DragonFly__)
336 static void	bwn_intr(void *);
337 #else
338 static int	bwn_intr(void *);
339 #endif
340 static void	bwn_intrtask(void *, int);
341 static void	bwn_restart(struct bwn_mac *, const char *);
342 static void	bwn_intr_ucode_debug(struct bwn_mac *);
343 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
344 static void	bwn_intr_atim_end(struct bwn_mac *);
345 static void	bwn_intr_beacon(struct bwn_mac *);
346 static void	bwn_intr_pmq(struct bwn_mac *);
347 static void	bwn_intr_noise(struct bwn_mac *);
348 static void	bwn_intr_txeof(struct bwn_mac *);
349 static void	bwn_hwreset(void *, int);
350 static void	bwn_handle_fwpanic(struct bwn_mac *);
351 static void	bwn_load_beacon0(struct bwn_mac *);
352 static void	bwn_load_beacon1(struct bwn_mac *);
353 static uint32_t	bwn_jssi_read(struct bwn_mac *);
354 static void	bwn_noise_gensample(struct bwn_mac *);
355 static void	bwn_handle_txeof(struct bwn_mac *,
356 		    const struct bwn_txstatus *);
357 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
358 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
359 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
360 		    struct mbuf *);
361 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
362 static int	bwn_set_txhdr(struct bwn_mac *,
363 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
364 		    uint16_t);
365 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
366 		    const uint8_t);
367 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
368 static uint8_t	bwn_get_fbrate(uint8_t);
369 static void	bwn_txpwr(void *, int);
370 static void	bwn_tasks(void *);
371 static void	bwn_task_15s(struct bwn_mac *);
372 static void	bwn_task_30s(struct bwn_mac *);
373 static void	bwn_task_60s(struct bwn_mac *);
374 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
375 		    uint8_t);
376 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
377 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
378 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
379 		    int, int);
380 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
381 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
382 static void	bwn_watchdog(void *);
383 static void	bwn_dma_stop(struct bwn_mac *);
384 static void	bwn_pio_stop(struct bwn_mac *);
385 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
386 static void	bwn_led_attach(struct bwn_mac *);
387 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
388 static void	bwn_led_event(struct bwn_mac *, int);
389 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
390 static void	bwn_led_blink_next(void *);
391 static void	bwn_led_blink_end(void *);
392 static void	bwn_rfswitch(void *);
393 static void	bwn_rf_turnon(struct bwn_mac *);
394 static void	bwn_rf_turnoff(struct bwn_mac *);
395 static void	bwn_sysctl_node(struct bwn_softc *);
396 
397 #if !defined(__DragonFly__)
398 static struct resource_spec bwn_res_spec_legacy[] = {
399 	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
400 	{ -1,			0,		0 }
401 };
402 
403 static struct resource_spec bwn_res_spec_msi[] = {
404 	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
405 	{ -1,			0,		0 }
406 };
407 #endif
408 
409 static const struct bwn_channelinfo bwn_chantable_bg = {
410 	.channels = {
411 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
412 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
413 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
414 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
415 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
416 	.nchannels = 14
417 };
418 
419 static const struct bwn_channelinfo bwn_chantable_a = {
420 	.channels = {
421 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
422 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
423 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
424 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
425 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
426 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
427 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
428 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
429 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
430 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
431 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
432 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
433 		{ 6080, 216, 30 } },
434 	.nchannels = 37
435 };
436 
437 #if 0
438 static const struct bwn_channelinfo bwn_chantable_n = {
439 	.channels = {
440 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
441 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
442 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
443 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
444 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
445 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
446 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
447 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
448 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
449 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
450 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
451 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
452 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
453 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
454 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
455 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
456 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
457 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
458 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
459 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
460 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
461 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
462 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
463 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
464 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
465 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
466 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
467 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
468 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
469 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
470 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
471 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
472 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
473 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
474 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
475 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
476 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
477 	.nchannels = 110
478 };
479 #endif
480 
481 #define	VENDOR_LED_ACT(vendor)				\
482 {							\
483 	.vid = PCI_VENDOR_##vendor,			\
484 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
485 }
486 
487 static const struct {
488 	uint16_t	vid;
489 	uint8_t		led_act[BWN_LED_MAX];
490 } bwn_vendor_led_act[] = {
491 	VENDOR_LED_ACT(COMPAQ),
492 	VENDOR_LED_ACT(ASUSTEK)
493 };
494 
495 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
496 	{ BWN_VENDOR_LED_ACT_DEFAULT };
497 
498 #undef VENDOR_LED_ACT
499 
500 static const struct {
501 	int		on_dur;
502 	int		off_dur;
503 } bwn_led_duration[109] = {
504 	[0]	= { 400, 100 },
505 	[2]	= { 150, 75 },
506 	[4]	= { 90, 45 },
507 	[11]	= { 66, 34 },
508 	[12]	= { 53, 26 },
509 	[18]	= { 42, 21 },
510 	[22]	= { 35, 17 },
511 	[24]	= { 32, 16 },
512 	[36]	= { 21, 10 },
513 	[48]	= { 16, 8 },
514 	[72]	= { 11, 5 },
515 	[96]	= { 9, 4 },
516 	[108]	= { 7, 3 }
517 };
518 
519 static const uint16_t bwn_wme_shm_offsets[] = {
520 	[0] = BWN_WME_BESTEFFORT,
521 	[1] = BWN_WME_BACKGROUND,
522 	[2] = BWN_WME_VOICE,
523 	[3] = BWN_WME_VIDEO,
524 };
525 
526 static const struct siba_devid bwn_devs[] = {
527 	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
528 	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
529 	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
530 	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
531 	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
532 	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
533 	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
534 	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
535 	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
536 	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
537 };
538 
539 static int
540 bwn_probe(device_t dev)
541 {
542 	int i;
543 
544 	for (i = 0; i < N(bwn_devs); i++) {
545 		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
546 		    siba_get_device(dev) == bwn_devs[i].sd_device &&
547 		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
548 			return (BUS_PROBE_DEFAULT);
549 	}
550 
551 	return (ENXIO);
552 }
553 
554 static int
555 bwn_attach(device_t dev)
556 {
557 	struct bwn_mac *mac;
558 	struct bwn_softc *sc = device_get_softc(dev);
559 #if defined(__DragonFly__)
560 	u_int irq_flags;
561 	int error;
562 #else
563 	int error, i, msic, reg;
564 #endif
565 
566 	sc->sc_dev = dev;
567 #ifdef BWN_DEBUG
568 	sc->sc_debug = bwn_debug;
569 #endif
570 
571 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
572 		bwn_attach_pre(sc);
573 		bwn_sprom_bugfixes(dev);
574 		sc->sc_flags |= BWN_FLAG_ATTACHED;
575 	}
576 
577 	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
578 		if (siba_get_pci_device(dev) != 0x4313 &&
579 		    siba_get_pci_device(dev) != 0x431a &&
580 		    siba_get_pci_device(dev) != 0x4321) {
581 			device_printf(sc->sc_dev,
582 			    "skip 802.11 cores\n");
583 			return (ENODEV);
584 		}
585 	}
586 
587 	mac = kmalloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
588 	mac->mac_sc = sc;
589 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
590 	if (bwn_bfp != 0)
591 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
592 
593 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
594 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
595 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
596 
597 	error = bwn_attach_core(mac);
598 	if (error)
599 		goto fail0;
600 	bwn_led_attach(mac);
601 
602 	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
603 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
604 	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
605 	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
606 	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
607 	    mac->mac_phy.rf_rev);
608 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
609 		device_printf(sc->sc_dev, "DMA (%d bits)\n",
610 		    mac->mac_method.dma.dmatype);
611 	else
612 		device_printf(sc->sc_dev, "PIO\n");
613 
614 	/*
615 	 * setup PCI resources and interrupt.
616 	 */
617 #if defined(__DragonFly__)
618 	/* Allocate IRQ resource. */
619 	sc->bwn_irq_rid = 0;
620 	sc->bwn_irq_type = pci_alloc_1intr(sc->sc_dev, bwn_msi_enable,
621 	    &sc->bwn_irq_rid, &irq_flags);
622 	if ((sc->bwn_irq = bus_alloc_resource_any(sc->sc_dev, SYS_RES_IRQ,
623 	    &sc->bwn_irq_rid, irq_flags)) == NULL) {
624 		device_printf(sc->sc_dev, "Cannot allocate interrupt\n");
625 		error = EINVAL;
626 		goto fail1;
627 	}
628 	if ((error = bus_setup_intr(sc->sc_dev, sc->bwn_irq, INTR_MPSAFE,
629 	    bwn_intr, mac, &sc->bwn_intr, &wlan_global_serializer)) != 0) {
630 		device_printf(sc->sc_dev, "Cannot set up interrupt\n");
631 		goto fail1;
632 	}
633 #else
634 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
635 		msic = pci_msi_count(dev);
636 		if (bootverbose)
637 			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
638 	} else
639 		msic = 0;
640 
641 	mac->mac_intr_spec = bwn_res_spec_legacy;
642 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
643 		if (pci_alloc_msi(dev, &msic) == 0) {
644 			device_printf(sc->sc_dev,
645 			    "Using %d MSI messages\n", msic);
646 			mac->mac_intr_spec = bwn_res_spec_msi;
647 			mac->mac_msi = 1;
648 		}
649 	}
650 
651 	error = bus_alloc_resources(dev, mac->mac_intr_spec,
652 	    mac->mac_res_irq);
653 	if (error) {
654 		device_printf(sc->sc_dev,
655 		    "couldn't allocate IRQ resources (%d)\n", error);
656 		goto fail1;
657 	}
658 
659 	if (mac->mac_msi == 0)
660 		error = bus_setup_intr(dev, mac->mac_res_irq[0],
661 		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
662 		    &mac->mac_intrhand[0]);
663 	else {
664 		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
665 			error = bus_setup_intr(dev, mac->mac_res_irq[i],
666 			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
667 			    &mac->mac_intrhand[i]);
668 			if (error != 0) {
669 				device_printf(sc->sc_dev,
670 				    "couldn't setup interrupt (%d)\n", error);
671 				break;
672 			}
673 		}
674 	}
675 #endif
676 
677 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
678 
679 	/*
680 	 * calls attach-post routine
681 	 */
682 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
683 		bwn_attach_post(sc);
684 
685 	return (0);
686 fail1:
687 #if defined(__DragonFly__)
688 	if (sc->bwn_irq_type == PCI_INTR_TYPE_MSI)
689 		pci_release_msi(dev);
690 #else
691 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
692 		pci_release_msi(dev);
693 #endif
694 fail0:
695 	kfree(mac, M_DEVBUF);
696 	return (error);
697 }
698 
699 static int
700 bwn_is_valid_ether_addr(uint8_t *addr)
701 {
702 	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
703 
704 	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
705 		return (FALSE);
706 
707 	return (TRUE);
708 }
709 
710 static int
711 bwn_attach_post(struct bwn_softc *sc)
712 {
713 	struct ieee80211com *ic = &sc->sc_ic;
714 
715 	ic->ic_softc = sc;
716 	ic->ic_name = device_get_nameunit(sc->sc_dev);
717 	/* XXX not right but it's not used anywhere important */
718 	ic->ic_phytype = IEEE80211_T_OFDM;
719 	ic->ic_opmode = IEEE80211_M_STA;
720 	ic->ic_caps =
721 		  IEEE80211_C_STA		/* station mode supported */
722 		| IEEE80211_C_MONITOR		/* monitor mode */
723 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
724 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
725 		| IEEE80211_C_SHSLOT		/* short slot time supported */
726 		| IEEE80211_C_WME		/* WME/WMM supported */
727 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
728 #if 0
729 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
730 #endif
731 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
732 		;
733 
734 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
735 
736 	IEEE80211_ADDR_COPY(ic->ic_macaddr,
737 	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
738 	    siba_sprom_get_mac_80211a(sc->sc_dev) :
739 	    siba_sprom_get_mac_80211bg(sc->sc_dev));
740 
741 	/* call MI attach routine. */
742 	ieee80211_ifattach(ic);
743 
744 	ic->ic_headroom = sizeof(struct bwn_txhdr);
745 
746 	/* override default methods */
747 	ic->ic_raw_xmit = bwn_raw_xmit;
748 	ic->ic_updateslot = bwn_updateslot;
749 	ic->ic_update_promisc = bwn_update_promisc;
750 	ic->ic_wme.wme_update = bwn_wme_update;
751 	ic->ic_scan_start = bwn_scan_start;
752 	ic->ic_scan_end = bwn_scan_end;
753 	ic->ic_set_channel = bwn_set_channel;
754 	ic->ic_vap_create = bwn_vap_create;
755 	ic->ic_vap_delete = bwn_vap_delete;
756 	ic->ic_transmit = bwn_transmit;
757 	ic->ic_parent = bwn_parent;
758 
759 	ieee80211_radiotap_attach(ic,
760 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
761 	    BWN_TX_RADIOTAP_PRESENT,
762 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
763 	    BWN_RX_RADIOTAP_PRESENT);
764 
765 	bwn_sysctl_node(sc);
766 
767 	if (bootverbose)
768 		ieee80211_announce(ic);
769 	return (0);
770 }
771 
772 static void
773 bwn_phy_detach(struct bwn_mac *mac)
774 {
775 
776 	if (mac->mac_phy.detach != NULL)
777 		mac->mac_phy.detach(mac);
778 }
779 
780 static int
781 bwn_detach(device_t dev)
782 {
783 	struct bwn_softc *sc = device_get_softc(dev);
784 	struct bwn_mac *mac = sc->sc_curmac;
785 	struct ieee80211com *ic = &sc->sc_ic;
786 #if !defined(__DragonFly__)
787 	int i;
788 #endif
789 
790 	sc->sc_flags |= BWN_FLAG_INVALID;
791 
792 	if (device_is_attached(sc->sc_dev)) {
793 		BWN_LOCK(sc);
794 		bwn_stop(sc);
795 		BWN_UNLOCK(sc);
796 		bwn_dma_free(mac);
797 		callout_drain(&sc->sc_led_blink_ch);
798 		callout_drain(&sc->sc_rfswitch_ch);
799 		callout_drain(&sc->sc_task_ch);
800 		callout_drain(&sc->sc_watchdog_ch);
801 		bwn_phy_detach(mac);
802 		ieee80211_draintask(ic, &mac->mac_hwreset);
803 		ieee80211_draintask(ic, &mac->mac_txpower);
804 		ieee80211_ifdetach(ic);
805 	}
806 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
807 	taskqueue_free(sc->sc_tq);
808 
809 #if defined(__DragonFly__)
810 	if (sc->bwn_intr)
811 		bus_teardown_intr(dev, sc->bwn_irq, sc->bwn_intr);
812 	if (sc->bwn_irq != NULL) {
813 		bus_release_resource(dev, SYS_RES_IRQ, sc->bwn_irq_rid,
814 		    sc->bwn_irq);
815 	}
816 
817 	if (sc->bwn_irq_type == PCI_INTR_TYPE_MSI)
818 		pci_release_msi(dev);
819 #else
820 	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
821 		if (mac->mac_intrhand[i] != NULL) {
822 			bus_teardown_intr(dev, mac->mac_res_irq[i],
823 			    mac->mac_intrhand[i]);
824 			mac->mac_intrhand[i] = NULL;
825 		}
826 	}
827 	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
828 	if (mac->mac_msi != 0)
829 		pci_release_msi(dev);
830 #endif
831 	mbufq_drain(&sc->sc_snd);
832 	BWN_LOCK_DESTROY(sc);
833 	return (0);
834 }
835 
836 static void
837 bwn_attach_pre(struct bwn_softc *sc)
838 {
839 
840 	BWN_LOCK_INIT(sc);
841 	TAILQ_INIT(&sc->sc_maclist);
842 #if defined(__DragonFly__)
843 	callout_init_lk(&sc->sc_rfswitch_ch, &sc->sc_lk);
844 	callout_init_lk(&sc->sc_task_ch, &sc->sc_lk);
845 	callout_init_lk(&sc->sc_watchdog_ch, &sc->sc_lk);
846 #else
847 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
848 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
849 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
850 #endif
851 	mbufq_init(&sc->sc_snd, ifqmaxlen);
852 #if defined(__DragonFly__)
853 	sc->sc_tq = taskqueue_create("bwn_taskq", M_WAITOK,
854 	    taskqueue_thread_enqueue, &sc->sc_tq);
855 	taskqueue_start_threads(&sc->sc_tq, 1, TDPRI_KERN_DAEMON,
856 	    -1, "%s taskq", device_get_nameunit(sc->sc_dev));
857 #else
858 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
859 		taskqueue_thread_enqueue, &sc->sc_tq);
860 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
861 		"%s taskq", device_get_nameunit(sc->sc_dev));
862 #endif
863 }
864 
865 static void
866 bwn_sprom_bugfixes(device_t dev)
867 {
868 #define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
869 	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
870 	 (siba_get_pci_device(dev) == _device) &&			\
871 	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
872 	 (siba_get_pci_subdevice(dev) == _subdevice))
873 
874 	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
875 	    siba_get_pci_subdevice(dev) == 0x4e &&
876 	    siba_get_pci_revid(dev) > 0x40)
877 		siba_sprom_set_bf_lo(dev,
878 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
879 	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
880 	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
881 		siba_sprom_set_bf_lo(dev,
882 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
883 	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
884 		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
885 		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
886 		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
887 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
888 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
889 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
890 		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
891 			siba_sprom_set_bf_lo(dev,
892 			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
893 	}
894 #undef	BWN_ISDEV
895 }
896 
897 static void
898 bwn_parent(struct ieee80211com *ic)
899 {
900 	struct bwn_softc *sc = ic->ic_softc;
901 	int startall = 0;
902 
903 	BWN_LOCK(sc);
904 	if (ic->ic_nrunning > 0) {
905 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
906 			bwn_init(sc);
907 			startall = 1;
908 		} else
909 			bwn_update_promisc(ic);
910 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
911 		bwn_stop(sc);
912 	BWN_UNLOCK(sc);
913 
914 	if (startall)
915 		ieee80211_start_all(ic);
916 }
917 
918 static int
919 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
920 {
921 	struct bwn_softc *sc = ic->ic_softc;
922 	int error;
923 
924 	BWN_LOCK(sc);
925 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
926 		BWN_UNLOCK(sc);
927 		return (ENXIO);
928 	}
929 	error = mbufq_enqueue(&sc->sc_snd, m);
930 	if (error) {
931 		BWN_UNLOCK(sc);
932 		return (error);
933 	}
934 	bwn_start(sc);
935 	BWN_UNLOCK(sc);
936 	return (0);
937 }
938 
939 static void
940 bwn_start(struct bwn_softc *sc)
941 {
942 	struct bwn_mac *mac = sc->sc_curmac;
943 	struct ieee80211_frame *wh;
944 	struct ieee80211_node *ni;
945 	struct ieee80211_key *k;
946 	struct mbuf *m;
947 
948 	BWN_ASSERT_LOCKED(sc);
949 
950 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
951 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
952 		return;
953 
954 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
955 		if (bwn_tx_isfull(sc, m))
956 			break;
957 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
958 		if (ni == NULL) {
959 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
960 			m_freem(m);
961 #if defined(__DragonFly__)
962 			++sc->sc_ic.ic_oerrors;
963 #else
964 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
965 #endif
966 			continue;
967 		}
968 		wh = mtod(m, struct ieee80211_frame *);
969 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
970 			k = ieee80211_crypto_encap(ni, m);
971 			if (k == NULL) {
972 				if_inc_counter(ni->ni_vap->iv_ifp,
973 				    IFCOUNTER_OERRORS, 1);
974 				ieee80211_free_node(ni);
975 				m_freem(m);
976 				continue;
977 			}
978 		}
979 		wh = NULL;	/* Catch any invalid use */
980 		if (bwn_tx_start(sc, ni, m) != 0) {
981 			if (ni != NULL) {
982 				if_inc_counter(ni->ni_vap->iv_ifp,
983 				    IFCOUNTER_OERRORS, 1);
984 				ieee80211_free_node(ni);
985 			}
986 			continue;
987 		}
988 		sc->sc_watchdog_timer = 5;
989 	}
990 }
991 
992 static int
993 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
994 {
995 	struct bwn_dma_ring *dr;
996 	struct bwn_mac *mac = sc->sc_curmac;
997 	struct bwn_pio_txqueue *tq;
998 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
999 
1000 	BWN_ASSERT_LOCKED(sc);
1001 
1002 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1003 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
1004 		if (dr->dr_stop == 1 ||
1005 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1006 			dr->dr_stop = 1;
1007 			goto full;
1008 		}
1009 	} else {
1010 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
1011 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1012 		    pktlen > (tq->tq_size - tq->tq_used))
1013 			goto full;
1014 	}
1015 	return (0);
1016 full:
1017 	mbufq_prepend(&sc->sc_snd, m);
1018 	return (1);
1019 }
1020 
1021 static int
1022 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1023 {
1024 	struct bwn_mac *mac = sc->sc_curmac;
1025 	int error;
1026 
1027 	BWN_ASSERT_LOCKED(sc);
1028 
1029 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1030 		m_freem(m);
1031 		return (ENXIO);
1032 	}
1033 
1034 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1035 	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
1036 	if (error) {
1037 		m_freem(m);
1038 		return (error);
1039 	}
1040 	return (0);
1041 }
1042 
1043 static int
1044 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1045 {
1046 	struct bwn_pio_txpkt *tp;
1047 	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
1048 	struct bwn_softc *sc = mac->mac_sc;
1049 	struct bwn_txhdr txhdr;
1050 	struct mbuf *m_new;
1051 	uint32_t ctl32;
1052 	int error;
1053 	uint16_t ctl16;
1054 
1055 	BWN_ASSERT_LOCKED(sc);
1056 
1057 	/* XXX TODO send packets after DTIM */
1058 
1059 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1060 	tp = TAILQ_FIRST(&tq->tq_pktlist);
1061 	tp->tp_ni = ni;
1062 	tp->tp_m = m;
1063 
1064 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1065 	if (error) {
1066 		device_printf(sc->sc_dev, "tx fail\n");
1067 		return (error);
1068 	}
1069 
1070 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1071 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1072 	tq->tq_free--;
1073 
1074 	if (siba_get_revid(sc->sc_dev) >= 8) {
1075 		/*
1076 		 * XXX please removes m_defrag(9)
1077 		 */
1078 		m_new = m_defrag(m, M_NOWAIT);
1079 		if (m_new == NULL) {
1080 			device_printf(sc->sc_dev,
1081 			    "%s: can't defrag TX buffer\n",
1082 			    __func__);
1083 			return (ENOBUFS);
1084 		}
1085 		if (m_new->m_next != NULL)
1086 			device_printf(sc->sc_dev,
1087 			    "TODO: fragmented packets for PIO\n");
1088 		tp->tp_m = m_new;
1089 
1090 		/* send HEADER */
1091 		ctl32 = bwn_pio_write_multi_4(mac, tq,
1092 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1093 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1094 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1095 		/* send BODY */
1096 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1097 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1098 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1099 		    ctl32 | BWN_PIO8_TXCTL_EOF);
1100 	} else {
1101 		ctl16 = bwn_pio_write_multi_2(mac, tq,
1102 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1103 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1104 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1105 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1106 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1107 		    ctl16 | BWN_PIO_TXCTL_EOF);
1108 	}
1109 
1110 	return (0);
1111 }
1112 
1113 static struct bwn_pio_txqueue *
1114 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1115 {
1116 
1117 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1118 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1119 
1120 	switch (prio) {
1121 	case 0:
1122 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1123 	case 1:
1124 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1125 	case 2:
1126 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1127 	case 3:
1128 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1129 	}
1130 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1131 	return (NULL);
1132 }
1133 
1134 static int
1135 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1136 {
1137 #define	BWN_GET_TXHDRCACHE(slot)					\
1138 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1139 	struct bwn_dma *dma = &mac->mac_method.dma;
1140 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1141 	struct bwn_dmadesc_generic *desc;
1142 	struct bwn_dmadesc_meta *mt;
1143 	struct bwn_softc *sc = mac->mac_sc;
1144 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1145 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1146 
1147 	BWN_ASSERT_LOCKED(sc);
1148 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1149 
1150 	/* XXX send after DTIM */
1151 
1152 	slot = bwn_dma_getslot(dr);
1153 	dr->getdesc(dr, slot, &desc, &mt);
1154 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1155 	    ("%s:%d: fail", __func__, __LINE__));
1156 
1157 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1158 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1159 	    BWN_DMA_COOKIE(dr, slot));
1160 	if (error)
1161 		goto fail;
1162 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1163 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1164 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1165 	if (error) {
1166 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1167 		    __func__, error);
1168 		goto fail;
1169 	}
1170 	if (mt->mt_paddr == 0) {
1171 		device_printf(sc->sc_dev,
1172 		    "%s: can't load TX buffer within segment constraints (1)\n",
1173 		    __func__);
1174 		goto fail;
1175 	}
1176 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1177 	    BUS_DMASYNC_PREWRITE);
1178 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1179 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1180 	    BUS_DMASYNC_PREWRITE);
1181 
1182 	slot = bwn_dma_getslot(dr);
1183 	dr->getdesc(dr, slot, &desc, &mt);
1184 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1185 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1186 	mt->mt_m = m;
1187 	mt->mt_ni = ni;
1188 
1189 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1190 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1191 	if (error && error != EFBIG) {
1192 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1193 		    __func__, error);
1194 		goto fail;
1195 	}
1196 	if (error) {    /* error == EFBIG */
1197 		struct mbuf *m_new;
1198 
1199 		m_new = m_defrag(m, M_NOWAIT);
1200 		if (m_new == NULL) {
1201 			device_printf(sc->sc_dev,
1202 			    "%s: can't defrag TX buffer\n",
1203 			    __func__);
1204 			error = ENOBUFS;
1205 			goto fail;
1206 		} else {
1207 			m = m_new;
1208 		}
1209 
1210 		mt->mt_m = m;
1211 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1212 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1213 		if (error) {
1214 			device_printf(sc->sc_dev,
1215 			    "%s: can't load TX buffer (2) %d\n",
1216 			    __func__, error);
1217 			goto fail;
1218 		}
1219 	}
1220 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1221 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1222 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1223 	    BUS_DMASYNC_PREWRITE);
1224 
1225 	/* XXX send after DTIM */
1226 
1227 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1228 	return (0);
1229 fail:
1230 	dr->dr_curslot = backup[0];
1231 	dr->dr_usedslot = backup[1];
1232 	return (error);
1233 #undef BWN_GET_TXHDRCACHE
1234 }
1235 
1236 static void
1237 bwn_watchdog(void *arg)
1238 {
1239 	struct bwn_softc *sc = arg;
1240 
1241 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1242 		device_printf(sc->sc_dev, "device timeout\n");
1243 #if defined(__DragonFly__)
1244 		++sc->sc_ic.ic_oerrors;
1245 #else
1246 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1247 #endif
1248 	}
1249 #if defined(__DragonFly__)
1250 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1251 #else
1252 	callout_schedule(&sc->sc_watchdog_ch, hz);
1253 #endif
1254 }
1255 
1256 static int
1257 bwn_attach_core(struct bwn_mac *mac)
1258 {
1259 	struct bwn_softc *sc = mac->mac_sc;
1260 	int error, have_bg = 0, have_a = 0;
1261 	uint32_t high;
1262 
1263 	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1264 	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1265 
1266 	siba_powerup(sc->sc_dev, 0);
1267 
1268 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1269 	bwn_reset_core(mac, !!(high & BWN_TGSHIGH_HAVE_2GHZ));
1270 	error = bwn_phy_getinfo(mac, high);
1271 	if (error)
1272 		goto fail;
1273 
1274 	/* XXX need bhnd */
1275 	if (bwn_is_bus_siba(mac)) {
1276 		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1277 		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1278 	} else {
1279 		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1280 		error = ENXIO;
1281 		goto fail;
1282 	}
1283 
1284 #if 0
1285 	device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1286 	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1287 	    __func__,
1288 	    high,
1289 	    have_a,
1290 	    have_bg,
1291 	    siba_get_pci_device(sc->sc_dev),
1292 	    siba_get_chipid(sc->sc_dev));
1293 #endif
1294 
1295 	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1296 	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1297 	    siba_get_pci_device(sc->sc_dev) != 0x4324) {
1298 		have_a = have_bg = 0;
1299 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1300 			have_a = 1;
1301 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1302 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1303 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1304 			have_bg = 1;
1305 		else
1306 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1307 			    mac->mac_phy.type));
1308 	}
1309 	/* XXX turns off PHY A because it's not supported */
1310 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1311 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1312 		have_a = 0;
1313 		have_bg = 1;
1314 	}
1315 
1316 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1317 		mac->mac_phy.attach = bwn_phy_g_attach;
1318 		mac->mac_phy.detach = bwn_phy_g_detach;
1319 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1320 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1321 		mac->mac_phy.init = bwn_phy_g_init;
1322 		mac->mac_phy.exit = bwn_phy_g_exit;
1323 		mac->mac_phy.phy_read = bwn_phy_g_read;
1324 		mac->mac_phy.phy_write = bwn_phy_g_write;
1325 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1326 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1327 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1328 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1329 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1330 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1331 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1332 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1333 		mac->mac_phy.set_im = bwn_phy_g_im;
1334 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1335 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1336 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1337 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1338 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1339 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1340 		mac->mac_phy.init = bwn_phy_lp_init;
1341 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1342 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1343 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1344 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1345 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1346 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1347 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1348 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1349 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1350 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1351 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1352 	} else {
1353 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1354 		    mac->mac_phy.type);
1355 		error = ENXIO;
1356 		goto fail;
1357 	}
1358 
1359 	mac->mac_phy.gmode = have_bg;
1360 	if (mac->mac_phy.attach != NULL) {
1361 		error = mac->mac_phy.attach(mac);
1362 		if (error) {
1363 			device_printf(sc->sc_dev, "failed\n");
1364 			goto fail;
1365 		}
1366 	}
1367 
1368 	bwn_reset_core(mac, have_bg);
1369 
1370 	error = bwn_chiptest(mac);
1371 	if (error)
1372 		goto fail;
1373 	error = bwn_setup_channels(mac, have_bg, have_a);
1374 	if (error) {
1375 		device_printf(sc->sc_dev, "failed to setup channels\n");
1376 		goto fail;
1377 	}
1378 
1379 	if (sc->sc_curmac == NULL)
1380 		sc->sc_curmac = mac;
1381 
1382 	error = bwn_dma_attach(mac);
1383 	if (error != 0) {
1384 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1385 		goto fail;
1386 	}
1387 
1388 	mac->mac_phy.switch_analog(mac, 0);
1389 
1390 	siba_dev_down(sc->sc_dev, 0);
1391 fail:
1392 	siba_powerdown(sc->sc_dev);
1393 	return (error);
1394 }
1395 
1396 /*
1397  * Reset - SIBA.
1398  *
1399  * XXX TODO: implement BCMA version!
1400  */
1401 void
1402 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1403 {
1404 	struct bwn_softc *sc = mac->mac_sc;
1405 	uint32_t low, ctl;
1406 	uint32_t flags = 0;
1407 
1408 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1409 
1410 	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1411 	if (g_mode)
1412 		flags |= BWN_TGSLOW_SUPPORT_G;
1413 
1414 	/* XXX N-PHY only; and hard-code to 20MHz for now */
1415 	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1416 		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1417 
1418 	siba_dev_up(sc->sc_dev, flags);
1419 	DELAY(2000);
1420 
1421 	/* Take PHY out of reset */
1422 	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1423 	    ~BWN_TGSLOW_PHYRESET;
1424 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1425 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1426 	DELAY(1000);
1427 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low & ~SIBA_TGSLOW_FGC);
1428 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1429 	DELAY(1000);
1430 
1431 	if (mac->mac_phy.switch_analog != NULL)
1432 		mac->mac_phy.switch_analog(mac, 1);
1433 
1434 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1435 	if (g_mode)
1436 		ctl |= BWN_MACCTL_GMODE;
1437 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1438 }
1439 
1440 static int
1441 bwn_phy_getinfo(struct bwn_mac *mac, int tgshigh)
1442 {
1443 	struct bwn_phy *phy = &mac->mac_phy;
1444 	struct bwn_softc *sc = mac->mac_sc;
1445 	uint32_t tmp;
1446 
1447 	/* PHY */
1448 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1449 	phy->gmode = !! (tgshigh & BWN_TGSHIGH_HAVE_2GHZ);
1450 	phy->rf_on = 1;
1451 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1452 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1453 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1454 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1455 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1456 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1457 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1458 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1459 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1460 		goto unsupphy;
1461 
1462 	/* RADIO */
1463 	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1464 		if (siba_get_chiprev(sc->sc_dev) == 0)
1465 			tmp = 0x3205017f;
1466 		else if (siba_get_chiprev(sc->sc_dev) == 1)
1467 			tmp = 0x4205017f;
1468 		else
1469 			tmp = 0x5205017f;
1470 	} else {
1471 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1472 		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1473 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1474 		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1475 	}
1476 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1477 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1478 	phy->rf_manuf = (tmp & 0x00000fff);
1479 
1480 	/*
1481 	 * For now, just always do full init (ie, what bwn has traditionally
1482 	 * done)
1483 	 */
1484 	phy->phy_do_full_init = 1;
1485 
1486 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1487 		goto unsupradio;
1488 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1489 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1490 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1491 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1492 	    (phy->type == BWN_PHYTYPE_N &&
1493 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1494 	    (phy->type == BWN_PHYTYPE_LP &&
1495 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1496 		goto unsupradio;
1497 
1498 	return (0);
1499 unsupphy:
1500 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1501 	    "analog %#x)\n",
1502 	    phy->type, phy->rev, phy->analog);
1503 	return (ENXIO);
1504 unsupradio:
1505 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1506 	    "rev %#x)\n",
1507 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1508 	return (ENXIO);
1509 }
1510 
1511 static int
1512 bwn_chiptest(struct bwn_mac *mac)
1513 {
1514 #define	TESTVAL0	0x55aaaa55
1515 #define	TESTVAL1	0xaa5555aa
1516 	struct bwn_softc *sc = mac->mac_sc;
1517 	uint32_t v, backup;
1518 
1519 	BWN_LOCK(sc);
1520 
1521 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1522 
1523 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1524 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1525 		goto error;
1526 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1527 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1528 		goto error;
1529 
1530 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1531 
1532 	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1533 	    (siba_get_revid(sc->sc_dev) <= 10)) {
1534 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1535 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1536 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1537 			goto error;
1538 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1539 			goto error;
1540 	}
1541 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1542 
1543 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1544 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1545 		goto error;
1546 
1547 	BWN_UNLOCK(sc);
1548 	return (0);
1549 error:
1550 	BWN_UNLOCK(sc);
1551 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1552 	return (ENODEV);
1553 }
1554 
1555 #define	IEEE80211_CHAN_HTG	(IEEE80211_CHAN_HT | IEEE80211_CHAN_G)
1556 #define	IEEE80211_CHAN_HTA	(IEEE80211_CHAN_HT | IEEE80211_CHAN_A)
1557 
1558 static int
1559 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1560 {
1561 	struct bwn_softc *sc = mac->mac_sc;
1562 	struct ieee80211com *ic = &sc->sc_ic;
1563 
1564 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1565 	ic->ic_nchans = 0;
1566 
1567 	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1568 	    __func__,
1569 	    have_bg,
1570 	    have_a);
1571 
1572 	if (have_bg)
1573 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1574 		    &ic->ic_nchans, &bwn_chantable_bg, IEEE80211_CHAN_G);
1575 #if 0
1576 	if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1577 		if (have_a)
1578 			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1579 			    &ic->ic_nchans, &bwn_chantable_n,
1580 			    IEEE80211_CHAN_HTA);
1581 	} else {
1582 		if (have_a)
1583 			bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1584 			    &ic->ic_nchans, &bwn_chantable_a,
1585 			    IEEE80211_CHAN_A);
1586 	}
1587 #endif
1588 	if (have_a)
1589 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1590 		    &ic->ic_nchans, &bwn_chantable_a,
1591 		    IEEE80211_CHAN_A);
1592 
1593 	mac->mac_phy.supports_2ghz = have_bg;
1594 	mac->mac_phy.supports_5ghz = have_a;
1595 
1596 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1597 }
1598 
1599 uint32_t
1600 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1601 {
1602 	uint32_t ret;
1603 
1604 	BWN_ASSERT_LOCKED(mac->mac_sc);
1605 
1606 	if (way == BWN_SHARED) {
1607 		KASSERT((offset & 0x0001) == 0,
1608 		    ("%s:%d warn", __func__, __LINE__));
1609 		if (offset & 0x0003) {
1610 			bwn_shm_ctlword(mac, way, offset >> 2);
1611 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1612 			ret <<= 16;
1613 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1614 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1615 			goto out;
1616 		}
1617 		offset >>= 2;
1618 	}
1619 	bwn_shm_ctlword(mac, way, offset);
1620 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1621 out:
1622 	return (ret);
1623 }
1624 
1625 uint16_t
1626 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1627 {
1628 	uint16_t ret;
1629 
1630 	BWN_ASSERT_LOCKED(mac->mac_sc);
1631 
1632 	if (way == BWN_SHARED) {
1633 		KASSERT((offset & 0x0001) == 0,
1634 		    ("%s:%d warn", __func__, __LINE__));
1635 		if (offset & 0x0003) {
1636 			bwn_shm_ctlword(mac, way, offset >> 2);
1637 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1638 			goto out;
1639 		}
1640 		offset >>= 2;
1641 	}
1642 	bwn_shm_ctlword(mac, way, offset);
1643 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1644 out:
1645 
1646 	return (ret);
1647 }
1648 
1649 static void
1650 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1651     uint16_t offset)
1652 {
1653 	uint32_t control;
1654 
1655 	control = way;
1656 	control <<= 16;
1657 	control |= offset;
1658 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1659 }
1660 
1661 void
1662 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1663     uint32_t value)
1664 {
1665 	BWN_ASSERT_LOCKED(mac->mac_sc);
1666 
1667 	if (way == BWN_SHARED) {
1668 		KASSERT((offset & 0x0001) == 0,
1669 		    ("%s:%d warn", __func__, __LINE__));
1670 		if (offset & 0x0003) {
1671 			bwn_shm_ctlword(mac, way, offset >> 2);
1672 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1673 				    (value >> 16) & 0xffff);
1674 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1675 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1676 			return;
1677 		}
1678 		offset >>= 2;
1679 	}
1680 	bwn_shm_ctlword(mac, way, offset);
1681 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1682 }
1683 
1684 void
1685 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1686     uint16_t value)
1687 {
1688 	BWN_ASSERT_LOCKED(mac->mac_sc);
1689 
1690 	if (way == BWN_SHARED) {
1691 		KASSERT((offset & 0x0001) == 0,
1692 		    ("%s:%d warn", __func__, __LINE__));
1693 		if (offset & 0x0003) {
1694 			bwn_shm_ctlword(mac, way, offset >> 2);
1695 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1696 			return;
1697 		}
1698 		offset >>= 2;
1699 	}
1700 	bwn_shm_ctlword(mac, way, offset);
1701 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1702 }
1703 
1704 static void
1705 bwn_addchan(struct ieee80211_channel *c, int freq, int flags, int ieee,
1706     int txpow)
1707 {
1708 
1709 	c->ic_freq = freq;
1710 	c->ic_flags = flags;
1711 	c->ic_ieee = ieee;
1712 	c->ic_minpower = 0;
1713 	c->ic_maxpower = 2 * txpow;
1714 	c->ic_maxregpower = txpow;
1715 }
1716 
1717 static void
1718 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1719     const struct bwn_channelinfo *ci, int flags)
1720 {
1721 	struct ieee80211_channel *c;
1722 	int i;
1723 
1724 	c = &chans[*nchans];
1725 
1726 	for (i = 0; i < ci->nchannels; i++) {
1727 		const struct bwn_channel *hc;
1728 
1729 		hc = &ci->channels[i];
1730 		if (*nchans >= maxchans)
1731 			break;
1732 		bwn_addchan(c, hc->freq, flags, hc->ieee, hc->maxTxPow);
1733 		c++, (*nchans)++;
1734 		if (flags == IEEE80211_CHAN_G || flags == IEEE80211_CHAN_HTG) {
1735 			/* g channel have a separate b-only entry */
1736 			if (*nchans >= maxchans)
1737 				break;
1738 			c[0] = c[-1];
1739 			c[-1].ic_flags = IEEE80211_CHAN_B;
1740 			c++, (*nchans)++;
1741 		}
1742 		if (flags == IEEE80211_CHAN_HTG) {
1743 			/* HT g channel have a separate g-only entry */
1744 			if (*nchans >= maxchans)
1745 				break;
1746 			c[-1].ic_flags = IEEE80211_CHAN_G;
1747 			c[0] = c[-1];
1748 			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1749 			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1750 			c++, (*nchans)++;
1751 		}
1752 		if (flags == IEEE80211_CHAN_HTA) {
1753 			/* HT a channel have a separate a-only entry */
1754 			if (*nchans >= maxchans)
1755 				break;
1756 			c[-1].ic_flags = IEEE80211_CHAN_A;
1757 			c[0] = c[-1];
1758 			c[0].ic_flags &= ~IEEE80211_CHAN_HT;
1759 			c[0].ic_flags |= IEEE80211_CHAN_HT20;	/* HT20 */
1760 			c++, (*nchans)++;
1761 		}
1762 	}
1763 }
1764 
1765 static int
1766 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1767 	const struct ieee80211_bpf_params *params)
1768 {
1769 	struct ieee80211com *ic = ni->ni_ic;
1770 	struct bwn_softc *sc = ic->ic_softc;
1771 	struct bwn_mac *mac = sc->sc_curmac;
1772 	int error;
1773 
1774 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1775 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1776 		m_freem(m);
1777 		return (ENETDOWN);
1778 	}
1779 
1780 	BWN_LOCK(sc);
1781 	if (bwn_tx_isfull(sc, m)) {
1782 		m_freem(m);
1783 		BWN_UNLOCK(sc);
1784 		return (ENOBUFS);
1785 	}
1786 
1787 	error = bwn_tx_start(sc, ni, m);
1788 	if (error == 0)
1789 		sc->sc_watchdog_timer = 5;
1790 	BWN_UNLOCK(sc);
1791 	return (error);
1792 }
1793 
1794 /*
1795  * Callback from the 802.11 layer to update the slot time
1796  * based on the current setting.  We use it to notify the
1797  * firmware of ERP changes and the f/w takes care of things
1798  * like slot time and preamble.
1799  */
1800 static void
1801 bwn_updateslot(struct ieee80211com *ic)
1802 {
1803 	struct bwn_softc *sc = ic->ic_softc;
1804 	struct bwn_mac *mac;
1805 
1806 	BWN_LOCK(sc);
1807 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1808 		mac = (struct bwn_mac *)sc->sc_curmac;
1809 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1810 	}
1811 	BWN_UNLOCK(sc);
1812 }
1813 
1814 /*
1815  * Callback from the 802.11 layer after a promiscuous mode change.
1816  * Note this interface does not check the operating mode as this
1817  * is an internal callback and we are expected to honor the current
1818  * state (e.g. this is used for setting the interface in promiscuous
1819  * mode when operating in hostap mode to do ACS).
1820  */
1821 static void
1822 bwn_update_promisc(struct ieee80211com *ic)
1823 {
1824 	struct bwn_softc *sc = ic->ic_softc;
1825 	struct bwn_mac *mac = sc->sc_curmac;
1826 
1827 	BWN_LOCK(sc);
1828 	mac = sc->sc_curmac;
1829 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1830 		if (ic->ic_promisc > 0)
1831 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1832 		else
1833 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1834 		bwn_set_opmode(mac);
1835 	}
1836 	BWN_UNLOCK(sc);
1837 }
1838 
1839 /*
1840  * Callback from the 802.11 layer to update WME parameters.
1841  */
1842 static int
1843 bwn_wme_update(struct ieee80211com *ic)
1844 {
1845 	struct bwn_softc *sc = ic->ic_softc;
1846 	struct bwn_mac *mac = sc->sc_curmac;
1847 	struct wmeParams *wmep;
1848 	int i;
1849 
1850 	BWN_LOCK(sc);
1851 	mac = sc->sc_curmac;
1852 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1853 		bwn_mac_suspend(mac);
1854 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1855 			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1856 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1857 		}
1858 		bwn_mac_enable(mac);
1859 	}
1860 	BWN_UNLOCK(sc);
1861 	return (0);
1862 }
1863 
1864 static void
1865 bwn_scan_start(struct ieee80211com *ic)
1866 {
1867 	struct bwn_softc *sc = ic->ic_softc;
1868 	struct bwn_mac *mac;
1869 
1870 	BWN_LOCK(sc);
1871 	mac = sc->sc_curmac;
1872 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1873 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1874 		bwn_set_opmode(mac);
1875 		/* disable CFP update during scan */
1876 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1877 	}
1878 	BWN_UNLOCK(sc);
1879 }
1880 
1881 static void
1882 bwn_scan_end(struct ieee80211com *ic)
1883 {
1884 	struct bwn_softc *sc = ic->ic_softc;
1885 	struct bwn_mac *mac;
1886 
1887 	BWN_LOCK(sc);
1888 	mac = sc->sc_curmac;
1889 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1890 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1891 		bwn_set_opmode(mac);
1892 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1893 	}
1894 	BWN_UNLOCK(sc);
1895 }
1896 
1897 static void
1898 bwn_set_channel(struct ieee80211com *ic)
1899 {
1900 	struct bwn_softc *sc = ic->ic_softc;
1901 	struct bwn_mac *mac = sc->sc_curmac;
1902 	struct bwn_phy *phy = &mac->mac_phy;
1903 	int chan, error;
1904 
1905 	BWN_LOCK(sc);
1906 
1907 	error = bwn_switch_band(sc, ic->ic_curchan);
1908 	if (error)
1909 		goto fail;
1910 	bwn_mac_suspend(mac);
1911 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1912 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1913 	if (chan != phy->chan)
1914 		bwn_switch_channel(mac, chan);
1915 
1916 	/* TX power level */
1917 	if (ic->ic_curchan->ic_maxpower != 0 &&
1918 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1919 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1920 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1921 		    BWN_TXPWR_IGNORE_TSSI);
1922 	}
1923 
1924 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1925 	if (phy->set_antenna)
1926 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1927 
1928 	if (sc->sc_rf_enabled != phy->rf_on) {
1929 		if (sc->sc_rf_enabled) {
1930 			bwn_rf_turnon(mac);
1931 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1932 				device_printf(sc->sc_dev,
1933 				    "please turn on the RF switch\n");
1934 		} else
1935 			bwn_rf_turnoff(mac);
1936 	}
1937 
1938 	bwn_mac_enable(mac);
1939 
1940 fail:
1941 	/*
1942 	 * Setup radio tap channel freq and flags
1943 	 */
1944 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1945 		htole16(ic->ic_curchan->ic_freq);
1946 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1947 		htole16(ic->ic_curchan->ic_flags & 0xffff);
1948 
1949 	BWN_UNLOCK(sc);
1950 }
1951 
1952 static struct ieee80211vap *
1953 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1954     enum ieee80211_opmode opmode, int flags,
1955     const uint8_t bssid[IEEE80211_ADDR_LEN],
1956     const uint8_t mac[IEEE80211_ADDR_LEN])
1957 {
1958 	struct ieee80211vap *vap;
1959 	struct bwn_vap *bvp;
1960 
1961 	switch (opmode) {
1962 	case IEEE80211_M_HOSTAP:
1963 	case IEEE80211_M_MBSS:
1964 	case IEEE80211_M_STA:
1965 	case IEEE80211_M_WDS:
1966 	case IEEE80211_M_MONITOR:
1967 	case IEEE80211_M_IBSS:
1968 	case IEEE80211_M_AHDEMO:
1969 		break;
1970 	default:
1971 		return (NULL);
1972 	}
1973 
1974 	bvp = kmalloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1975 	vap = &bvp->bv_vap;
1976 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1977 	/* override with driver methods */
1978 	bvp->bv_newstate = vap->iv_newstate;
1979 	vap->iv_newstate = bwn_newstate;
1980 
1981 	/* override max aid so sta's cannot assoc when we're out of sta id's */
1982 	vap->iv_max_aid = BWN_STAID_MAX;
1983 
1984 	ieee80211_ratectl_init(vap);
1985 
1986 	/* complete setup */
1987 	ieee80211_vap_attach(vap, ieee80211_media_change,
1988 	    ieee80211_media_status, mac);
1989 	return (vap);
1990 }
1991 
1992 static void
1993 bwn_vap_delete(struct ieee80211vap *vap)
1994 {
1995 	struct bwn_vap *bvp = BWN_VAP(vap);
1996 
1997 	ieee80211_ratectl_deinit(vap);
1998 	ieee80211_vap_detach(vap);
1999 	kfree(bvp, M_80211_VAP);
2000 }
2001 
2002 static int
2003 bwn_init(struct bwn_softc *sc)
2004 {
2005 	struct bwn_mac *mac;
2006 	int error;
2007 
2008 	BWN_ASSERT_LOCKED(sc);
2009 
2010 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2011 
2012 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2013 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2014 	sc->sc_filters = 0;
2015 	bwn_wme_clear(sc);
2016 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2017 	sc->sc_rf_enabled = 1;
2018 
2019 	mac = sc->sc_curmac;
2020 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2021 		error = bwn_core_init(mac);
2022 		if (error != 0)
2023 			return (error);
2024 	}
2025 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
2026 		bwn_core_start(mac);
2027 
2028 	bwn_set_opmode(mac);
2029 	bwn_set_pretbtt(mac);
2030 	bwn_spu_setdelay(mac, 0);
2031 	bwn_set_macaddr(mac);
2032 
2033 	sc->sc_flags |= BWN_FLAG_RUNNING;
2034 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2035 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2036 
2037 	return (0);
2038 }
2039 
2040 static void
2041 bwn_stop(struct bwn_softc *sc)
2042 {
2043 	struct bwn_mac *mac = sc->sc_curmac;
2044 
2045 	BWN_ASSERT_LOCKED(sc);
2046 
2047 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2048 
2049 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2050 		/* XXX FIXME opmode not based on VAP */
2051 		bwn_set_opmode(mac);
2052 		bwn_set_macaddr(mac);
2053 	}
2054 
2055 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2056 		bwn_core_stop(mac);
2057 
2058 	callout_stop(&sc->sc_led_blink_ch);
2059 	sc->sc_led_blinking = 0;
2060 
2061 	bwn_core_exit(mac);
2062 	sc->sc_rf_enabled = 0;
2063 
2064 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
2065 }
2066 
2067 static void
2068 bwn_wme_clear(struct bwn_softc *sc)
2069 {
2070 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
2071 	struct wmeParams *p;
2072 	unsigned int i;
2073 
2074 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2075 	    ("%s:%d: fail", __func__, __LINE__));
2076 
2077 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
2078 		p = &(sc->sc_wmeParams[i]);
2079 
2080 		switch (bwn_wme_shm_offsets[i]) {
2081 		case BWN_WME_VOICE:
2082 			p->wmep_txopLimit = 0;
2083 			p->wmep_aifsn = 2;
2084 			/* XXX FIXME: log2(cwmin) */
2085 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2086 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2087 			break;
2088 		case BWN_WME_VIDEO:
2089 			p->wmep_txopLimit = 0;
2090 			p->wmep_aifsn = 2;
2091 			/* XXX FIXME: log2(cwmin) */
2092 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2093 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2094 			break;
2095 		case BWN_WME_BESTEFFORT:
2096 			p->wmep_txopLimit = 0;
2097 			p->wmep_aifsn = 3;
2098 			/* XXX FIXME: log2(cwmin) */
2099 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2100 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2101 			break;
2102 		case BWN_WME_BACKGROUND:
2103 			p->wmep_txopLimit = 0;
2104 			p->wmep_aifsn = 7;
2105 			/* XXX FIXME: log2(cwmin) */
2106 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2107 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2108 			break;
2109 		default:
2110 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2111 		}
2112 	}
2113 }
2114 
2115 static int
2116 bwn_core_init(struct bwn_mac *mac)
2117 {
2118 	struct bwn_softc *sc = mac->mac_sc;
2119 	uint64_t hf;
2120 	int error;
2121 
2122 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2123 	    ("%s:%d: fail", __func__, __LINE__));
2124 
2125 	siba_powerup(sc->sc_dev, 0);
2126 	if (!siba_dev_isup(sc->sc_dev))
2127 		bwn_reset_core(mac, mac->mac_phy.gmode);
2128 
2129 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2130 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2131 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2132 	BWN_GETTIME(mac->mac_phy.nexttime);
2133 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2134 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2135 	mac->mac_stats.link_noise = -95;
2136 	mac->mac_reason_intr = 0;
2137 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2138 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2139 #ifdef BWN_DEBUG
2140 	if (sc->sc_debug & BWN_DEBUG_XMIT)
2141 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2142 #endif
2143 	mac->mac_suspended = 1;
2144 	mac->mac_task_state = 0;
2145 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2146 
2147 	mac->mac_phy.init_pre(mac);
2148 
2149 	siba_pcicore_intr(sc->sc_dev);
2150 
2151 	siba_fix_imcfglobug(sc->sc_dev);
2152 	bwn_bt_disable(mac);
2153 	if (mac->mac_phy.prepare_hw) {
2154 		error = mac->mac_phy.prepare_hw(mac);
2155 		if (error)
2156 			goto fail0;
2157 	}
2158 	error = bwn_chip_init(mac);
2159 	if (error)
2160 		goto fail0;
2161 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2162 	    siba_get_revid(sc->sc_dev));
2163 	hf = bwn_hf_read(mac);
2164 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2165 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2166 		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2167 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2168 		if (mac->mac_phy.rev == 1)
2169 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2170 	}
2171 	if (mac->mac_phy.rf_ver == 0x2050) {
2172 		if (mac->mac_phy.rf_rev < 6)
2173 			hf |= BWN_HF_FORCE_VCO_RECALC;
2174 		if (mac->mac_phy.rf_rev == 6)
2175 			hf |= BWN_HF_4318_TSSI;
2176 	}
2177 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2178 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2179 	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2180 	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2181 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2182 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2183 	bwn_hf_write(mac, hf);
2184 
2185 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2186 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2187 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2188 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2189 
2190 	bwn_rate_init(mac);
2191 	bwn_set_phytxctl(mac);
2192 
2193 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2194 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2195 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2196 
2197 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2198 		bwn_pio_init(mac);
2199 	else
2200 		bwn_dma_init(mac);
2201 	bwn_wme_init(mac);
2202 	bwn_spu_setdelay(mac, 1);
2203 	bwn_bt_enable(mac);
2204 
2205 	siba_powerup(sc->sc_dev,
2206 	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2207 	bwn_set_macaddr(mac);
2208 	bwn_crypt_init(mac);
2209 
2210 	/* XXX LED initializatin */
2211 
2212 	mac->mac_status = BWN_MAC_STATUS_INITED;
2213 
2214 	return (error);
2215 
2216 fail0:
2217 	siba_powerdown(sc->sc_dev);
2218 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2219 	    ("%s:%d: fail", __func__, __LINE__));
2220 	return (error);
2221 }
2222 
2223 static void
2224 bwn_core_start(struct bwn_mac *mac)
2225 {
2226 	struct bwn_softc *sc = mac->mac_sc;
2227 	uint32_t tmp;
2228 
2229 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2230 	    ("%s:%d: fail", __func__, __LINE__));
2231 
2232 	if (siba_get_revid(sc->sc_dev) < 5)
2233 		return;
2234 
2235 	while (1) {
2236 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2237 		if (!(tmp & 0x00000001))
2238 			break;
2239 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2240 	}
2241 
2242 	bwn_mac_enable(mac);
2243 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2244 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2245 
2246 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2247 }
2248 
2249 static void
2250 bwn_core_exit(struct bwn_mac *mac)
2251 {
2252 	struct bwn_softc *sc = mac->mac_sc;
2253 	uint32_t macctl;
2254 
2255 	BWN_ASSERT_LOCKED(mac->mac_sc);
2256 
2257 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2258 	    ("%s:%d: fail", __func__, __LINE__));
2259 
2260 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2261 		return;
2262 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2263 
2264 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2265 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2266 	macctl |= BWN_MACCTL_MCODE_JMP0;
2267 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2268 
2269 	bwn_dma_stop(mac);
2270 	bwn_pio_stop(mac);
2271 	bwn_chip_exit(mac);
2272 	mac->mac_phy.switch_analog(mac, 0);
2273 	siba_dev_down(sc->sc_dev, 0);
2274 	siba_powerdown(sc->sc_dev);
2275 }
2276 
2277 static void
2278 bwn_bt_disable(struct bwn_mac *mac)
2279 {
2280 	struct bwn_softc *sc = mac->mac_sc;
2281 
2282 	(void)sc;
2283 	/* XXX do nothing yet */
2284 }
2285 
2286 static int
2287 bwn_chip_init(struct bwn_mac *mac)
2288 {
2289 	struct bwn_softc *sc = mac->mac_sc;
2290 	struct bwn_phy *phy = &mac->mac_phy;
2291 	uint32_t macctl;
2292 	int error;
2293 
2294 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2295 	if (phy->gmode)
2296 		macctl |= BWN_MACCTL_GMODE;
2297 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2298 
2299 	error = bwn_fw_fillinfo(mac);
2300 	if (error)
2301 		return (error);
2302 	error = bwn_fw_loaducode(mac);
2303 	if (error)
2304 		return (error);
2305 
2306 	error = bwn_gpio_init(mac);
2307 	if (error)
2308 		return (error);
2309 
2310 	error = bwn_fw_loadinitvals(mac);
2311 	if (error) {
2312 		siba_gpio_set(sc->sc_dev, 0);
2313 		return (error);
2314 	}
2315 	phy->switch_analog(mac, 1);
2316 	error = bwn_phy_init(mac);
2317 	if (error) {
2318 		siba_gpio_set(sc->sc_dev, 0);
2319 		return (error);
2320 	}
2321 	if (phy->set_im)
2322 		phy->set_im(mac, BWN_IMMODE_NONE);
2323 	if (phy->set_antenna)
2324 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2325 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2326 
2327 	if (phy->type == BWN_PHYTYPE_B)
2328 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2329 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2330 	if (siba_get_revid(sc->sc_dev) < 5)
2331 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2332 
2333 	BWN_WRITE_4(mac, BWN_MACCTL,
2334 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2335 	BWN_WRITE_4(mac, BWN_MACCTL,
2336 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2337 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2338 
2339 	bwn_set_opmode(mac);
2340 	if (siba_get_revid(sc->sc_dev) < 3) {
2341 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2342 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2343 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2344 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2345 	} else {
2346 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2347 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2348 	}
2349 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2350 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001fc00);
2351 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2352 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2353 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2354 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2355 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2356 
2357 	bwn_mac_phy_clock_set(mac, TRUE);
2358 
2359 	/* SIBA powerup */
2360 	/* XXX TODO: BCMA powerup */
2361 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2362 	return (error);
2363 }
2364 
2365 /* read hostflags */
2366 uint64_t
2367 bwn_hf_read(struct bwn_mac *mac)
2368 {
2369 	uint64_t ret;
2370 
2371 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2372 	ret <<= 16;
2373 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2374 	ret <<= 16;
2375 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2376 	return (ret);
2377 }
2378 
2379 void
2380 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2381 {
2382 
2383 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2384 	    (value & 0x00000000ffffull));
2385 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2386 	    (value & 0x0000ffff0000ull) >> 16);
2387 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2388 	    (value & 0xffff00000000ULL) >> 32);
2389 }
2390 
2391 static void
2392 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2393 {
2394 
2395 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2396 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2397 }
2398 
2399 static void
2400 bwn_rate_init(struct bwn_mac *mac)
2401 {
2402 
2403 	switch (mac->mac_phy.type) {
2404 	case BWN_PHYTYPE_A:
2405 	case BWN_PHYTYPE_G:
2406 	case BWN_PHYTYPE_LP:
2407 	case BWN_PHYTYPE_N:
2408 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2409 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2410 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2411 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2412 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2413 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2414 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2415 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2416 			break;
2417 		/* FALLTHROUGH */
2418 	case BWN_PHYTYPE_B:
2419 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2420 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2421 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2422 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2423 		break;
2424 	default:
2425 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2426 	}
2427 }
2428 
2429 static void
2430 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2431 {
2432 	uint16_t offset;
2433 
2434 	if (ofdm) {
2435 		offset = 0x480;
2436 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2437 	} else {
2438 		offset = 0x4c0;
2439 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2440 	}
2441 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2442 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2443 }
2444 
2445 static uint8_t
2446 bwn_plcp_getcck(const uint8_t bitrate)
2447 {
2448 
2449 	switch (bitrate) {
2450 	case BWN_CCK_RATE_1MB:
2451 		return (0x0a);
2452 	case BWN_CCK_RATE_2MB:
2453 		return (0x14);
2454 	case BWN_CCK_RATE_5MB:
2455 		return (0x37);
2456 	case BWN_CCK_RATE_11MB:
2457 		return (0x6e);
2458 	}
2459 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2460 	return (0);
2461 }
2462 
2463 static uint8_t
2464 bwn_plcp_getofdm(const uint8_t bitrate)
2465 {
2466 
2467 	switch (bitrate) {
2468 	case BWN_OFDM_RATE_6MB:
2469 		return (0xb);
2470 	case BWN_OFDM_RATE_9MB:
2471 		return (0xf);
2472 	case BWN_OFDM_RATE_12MB:
2473 		return (0xa);
2474 	case BWN_OFDM_RATE_18MB:
2475 		return (0xe);
2476 	case BWN_OFDM_RATE_24MB:
2477 		return (0x9);
2478 	case BWN_OFDM_RATE_36MB:
2479 		return (0xd);
2480 	case BWN_OFDM_RATE_48MB:
2481 		return (0x8);
2482 	case BWN_OFDM_RATE_54MB:
2483 		return (0xc);
2484 	}
2485 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2486 	return (0);
2487 }
2488 
2489 static void
2490 bwn_set_phytxctl(struct bwn_mac *mac)
2491 {
2492 	uint16_t ctl;
2493 
2494 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2495 	    BWN_TX_PHY_TXPWR);
2496 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2497 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2498 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2499 }
2500 
2501 static void
2502 bwn_pio_init(struct bwn_mac *mac)
2503 {
2504 	struct bwn_pio *pio = &mac->mac_method.pio;
2505 
2506 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2507 	    & ~BWN_MACCTL_BIGENDIAN);
2508 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2509 
2510 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2511 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2512 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2513 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2514 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2515 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2516 }
2517 
2518 static void
2519 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2520     int index)
2521 {
2522 	struct bwn_pio_txpkt *tp;
2523 	struct bwn_softc *sc = mac->mac_sc;
2524 	unsigned int i;
2525 
2526 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2527 	tq->tq_index = index;
2528 
2529 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2530 	if (siba_get_revid(sc->sc_dev) >= 8)
2531 		tq->tq_size = 1920;
2532 	else {
2533 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2534 		tq->tq_size -= 80;
2535 	}
2536 
2537 	TAILQ_INIT(&tq->tq_pktlist);
2538 	for (i = 0; i < N(tq->tq_pkts); i++) {
2539 		tp = &(tq->tq_pkts[i]);
2540 		tp->tp_index = i;
2541 		tp->tp_queue = tq;
2542 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2543 	}
2544 }
2545 
2546 static uint16_t
2547 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2548 {
2549 	struct bwn_softc *sc = mac->mac_sc;
2550 	static const uint16_t bases[] = {
2551 		BWN_PIO_BASE0,
2552 		BWN_PIO_BASE1,
2553 		BWN_PIO_BASE2,
2554 		BWN_PIO_BASE3,
2555 		BWN_PIO_BASE4,
2556 		BWN_PIO_BASE5,
2557 		BWN_PIO_BASE6,
2558 		BWN_PIO_BASE7,
2559 	};
2560 	static const uint16_t bases_rev11[] = {
2561 		BWN_PIO11_BASE0,
2562 		BWN_PIO11_BASE1,
2563 		BWN_PIO11_BASE2,
2564 		BWN_PIO11_BASE3,
2565 		BWN_PIO11_BASE4,
2566 		BWN_PIO11_BASE5,
2567 	};
2568 
2569 	if (siba_get_revid(sc->sc_dev) >= 11) {
2570 		if (index >= N(bases_rev11))
2571 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2572 		return (bases_rev11[index]);
2573 	}
2574 	if (index >= N(bases))
2575 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2576 	return (bases[index]);
2577 }
2578 
2579 static void
2580 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2581     int index)
2582 {
2583 	struct bwn_softc *sc = mac->mac_sc;
2584 
2585 	prq->prq_mac = mac;
2586 	prq->prq_rev = siba_get_revid(sc->sc_dev);
2587 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2588 	bwn_dma_rxdirectfifo(mac, index, 1);
2589 }
2590 
2591 static void
2592 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2593 {
2594 	if (tq == NULL)
2595 		return;
2596 	bwn_pio_cancel_tx_packets(tq);
2597 }
2598 
2599 static void
2600 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2601 {
2602 
2603 	bwn_destroy_pioqueue_tx(pio);
2604 }
2605 
2606 static uint16_t
2607 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2608     uint16_t offset)
2609 {
2610 
2611 	return (BWN_READ_2(mac, tq->tq_base + offset));
2612 }
2613 
2614 static void
2615 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2616 {
2617 	uint32_t ctl;
2618 	int type;
2619 	uint16_t base;
2620 
2621 	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2622 	base = bwn_dma_base(type, idx);
2623 	if (type == BWN_DMA_64BIT) {
2624 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2625 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2626 		if (enable)
2627 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2628 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2629 	} else {
2630 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2631 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2632 		if (enable)
2633 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2634 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2635 	}
2636 }
2637 
2638 static uint64_t
2639 bwn_dma_mask(struct bwn_mac *mac)
2640 {
2641 	uint32_t tmp;
2642 	uint16_t base;
2643 
2644 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2645 	if (tmp & SIBA_TGSHIGH_DMA64)
2646 		return (BWN_DMA_BIT_MASK(64));
2647 	base = bwn_dma_base(0, 0);
2648 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2649 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2650 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2651 		return (BWN_DMA_BIT_MASK(32));
2652 
2653 	return (BWN_DMA_BIT_MASK(30));
2654 }
2655 
2656 static int
2657 bwn_dma_mask2type(uint64_t dmamask)
2658 {
2659 
2660 	if (dmamask == BWN_DMA_BIT_MASK(30))
2661 		return (BWN_DMA_30BIT);
2662 	if (dmamask == BWN_DMA_BIT_MASK(32))
2663 		return (BWN_DMA_32BIT);
2664 	if (dmamask == BWN_DMA_BIT_MASK(64))
2665 		return (BWN_DMA_64BIT);
2666 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2667 	return (BWN_DMA_30BIT);
2668 }
2669 
2670 static void
2671 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2672 {
2673 	struct bwn_pio_txpkt *tp;
2674 	unsigned int i;
2675 
2676 	for (i = 0; i < N(tq->tq_pkts); i++) {
2677 		tp = &(tq->tq_pkts[i]);
2678 		if (tp->tp_m) {
2679 			m_freem(tp->tp_m);
2680 			tp->tp_m = NULL;
2681 		}
2682 	}
2683 }
2684 
2685 static uint16_t
2686 bwn_dma_base(int type, int controller_idx)
2687 {
2688 	static const uint16_t map64[] = {
2689 		BWN_DMA64_BASE0,
2690 		BWN_DMA64_BASE1,
2691 		BWN_DMA64_BASE2,
2692 		BWN_DMA64_BASE3,
2693 		BWN_DMA64_BASE4,
2694 		BWN_DMA64_BASE5,
2695 	};
2696 	static const uint16_t map32[] = {
2697 		BWN_DMA32_BASE0,
2698 		BWN_DMA32_BASE1,
2699 		BWN_DMA32_BASE2,
2700 		BWN_DMA32_BASE3,
2701 		BWN_DMA32_BASE4,
2702 		BWN_DMA32_BASE5,
2703 	};
2704 
2705 	if (type == BWN_DMA_64BIT) {
2706 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2707 		    ("%s:%d: fail", __func__, __LINE__));
2708 		return (map64[controller_idx]);
2709 	}
2710 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2711 	    ("%s:%d: fail", __func__, __LINE__));
2712 	return (map32[controller_idx]);
2713 }
2714 
2715 static void
2716 bwn_dma_init(struct bwn_mac *mac)
2717 {
2718 	struct bwn_dma *dma = &mac->mac_method.dma;
2719 
2720 	/* setup TX DMA channels. */
2721 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2722 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2723 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2724 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2725 	bwn_dma_setup(dma->mcast);
2726 	/* setup RX DMA channel. */
2727 	bwn_dma_setup(dma->rx);
2728 }
2729 
2730 static struct bwn_dma_ring *
2731 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2732     int for_tx, int type)
2733 {
2734 	struct bwn_dma *dma = &mac->mac_method.dma;
2735 	struct bwn_dma_ring *dr;
2736 	struct bwn_dmadesc_generic *desc;
2737 	struct bwn_dmadesc_meta *mt;
2738 	struct bwn_softc *sc = mac->mac_sc;
2739 	int error, i;
2740 
2741 	dr = kmalloc(sizeof(*dr), M_DEVBUF, M_INTWAIT | M_ZERO);
2742 	if (dr == NULL)
2743 		goto out;
2744 	dr->dr_numslots = BWN_RXRING_SLOTS;
2745 	if (for_tx)
2746 		dr->dr_numslots = BWN_TXRING_SLOTS;
2747 
2748 	dr->dr_meta = kmalloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2749 	    M_DEVBUF, M_INTWAIT | M_ZERO);
2750 	if (dr->dr_meta == NULL)
2751 		goto fail0;
2752 
2753 	dr->dr_type = type;
2754 	dr->dr_mac = mac;
2755 	dr->dr_base = bwn_dma_base(type, controller_index);
2756 	dr->dr_index = controller_index;
2757 	if (type == BWN_DMA_64BIT) {
2758 		dr->getdesc = bwn_dma_64_getdesc;
2759 		dr->setdesc = bwn_dma_64_setdesc;
2760 		dr->start_transfer = bwn_dma_64_start_transfer;
2761 		dr->suspend = bwn_dma_64_suspend;
2762 		dr->resume = bwn_dma_64_resume;
2763 		dr->get_curslot = bwn_dma_64_get_curslot;
2764 		dr->set_curslot = bwn_dma_64_set_curslot;
2765 	} else {
2766 		dr->getdesc = bwn_dma_32_getdesc;
2767 		dr->setdesc = bwn_dma_32_setdesc;
2768 		dr->start_transfer = bwn_dma_32_start_transfer;
2769 		dr->suspend = bwn_dma_32_suspend;
2770 		dr->resume = bwn_dma_32_resume;
2771 		dr->get_curslot = bwn_dma_32_get_curslot;
2772 		dr->set_curslot = bwn_dma_32_set_curslot;
2773 	}
2774 	if (for_tx) {
2775 		dr->dr_tx = 1;
2776 		dr->dr_curslot = -1;
2777 	} else {
2778 		if (dr->dr_index == 0) {
2779 			dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE;
2780 			dr->dr_frameoffset = BWN_DMA0_RX_FRAMEOFFSET;
2781 		} else
2782 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2783 	}
2784 
2785 	error = bwn_dma_allocringmemory(dr);
2786 	if (error)
2787 		goto fail1;
2788 
2789 	if (for_tx) {
2790 		/*
2791 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2792 		 * BWN_TX_SLOTS_PER_FRAME
2793 		 */
2794 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2795 		    ("%s:%d: fail", __func__, __LINE__));
2796 
2797 		dr->dr_txhdr_cache = contigmalloc(
2798 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2799 		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_WAITOK | M_ZERO,
2800 		    0, BUS_SPACE_MAXADDR, 2, 0);
2801 		if (dr->dr_txhdr_cache == NULL) {
2802 			device_printf(sc->sc_dev,
2803 			    "can't allocate TX header DMA memory\n");
2804 			goto fail1;
2805 		}
2806 
2807 		/*
2808 		 * Create TX ring DMA stuffs
2809 		 */
2810 		error = bus_dma_tag_create(dma->parent_dtag,
2811 				    1, 0,
2812 				    BUS_SPACE_MAXADDR,
2813 				    BUS_SPACE_MAXADDR,
2814 				    NULL, NULL,
2815 				    BWN_HDRSIZE(mac),
2816 				    1,
2817 				    BUS_SPACE_MAXSIZE_32BIT,
2818 				    0,
2819 #if !defined(__DragonFly__)
2820 				    NULL, NULL,
2821 #endif
2822 				    &dr->dr_txring_dtag);
2823 		if (error) {
2824 			device_printf(sc->sc_dev,
2825 			    "can't create TX ring DMA tag: TODO frees\n");
2826 			goto fail2;
2827 		}
2828 
2829 		for (i = 0; i < dr->dr_numslots; i += 2) {
2830 			dr->getdesc(dr, i, &desc, &mt);
2831 
2832 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2833 			mt->mt_m = NULL;
2834 			mt->mt_ni = NULL;
2835 			mt->mt_islast = 0;
2836 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2837 			    &mt->mt_dmap);
2838 			if (error) {
2839 				device_printf(sc->sc_dev,
2840 				     "can't create RX buf DMA map\n");
2841 				goto fail2;
2842 			}
2843 
2844 			dr->getdesc(dr, i + 1, &desc, &mt);
2845 
2846 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2847 			mt->mt_m = NULL;
2848 			mt->mt_ni = NULL;
2849 			mt->mt_islast = 1;
2850 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2851 			    &mt->mt_dmap);
2852 			if (error) {
2853 				device_printf(sc->sc_dev,
2854 				     "can't create RX buf DMA map\n");
2855 				goto fail2;
2856 			}
2857 		}
2858 	} else {
2859 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2860 		    &dr->dr_spare_dmap);
2861 		if (error) {
2862 			device_printf(sc->sc_dev,
2863 			    "can't create RX buf DMA map\n");
2864 			goto out;		/* XXX wrong! */
2865 		}
2866 
2867 		for (i = 0; i < dr->dr_numslots; i++) {
2868 			dr->getdesc(dr, i, &desc, &mt);
2869 
2870 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2871 			    &mt->mt_dmap);
2872 			if (error) {
2873 				device_printf(sc->sc_dev,
2874 				    "can't create RX buf DMA map\n");
2875 				goto out;	/* XXX wrong! */
2876 			}
2877 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2878 			if (error) {
2879 				device_printf(sc->sc_dev,
2880 				    "failed to allocate RX buf\n");
2881 				goto out;	/* XXX wrong! */
2882 			}
2883 		}
2884 
2885 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2886 		    BUS_DMASYNC_PREWRITE);
2887 
2888 		dr->dr_usedslot = dr->dr_numslots;
2889 	}
2890 
2891       out:
2892 	return (dr);
2893 
2894 fail2:
2895 	if (dr->dr_txhdr_cache != NULL) {
2896 		contigfree(dr->dr_txhdr_cache,
2897 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2898 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2899 	}
2900 fail1:
2901 	kfree(dr->dr_meta, M_DEVBUF);
2902 fail0:
2903 	kfree(dr, M_DEVBUF);
2904 	return (NULL);
2905 }
2906 
2907 static void
2908 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2909 {
2910 
2911 	if (dr == NULL)
2912 		return;
2913 
2914 	bwn_dma_free_descbufs(*dr);
2915 	bwn_dma_free_ringmemory(*dr);
2916 
2917 	if ((*dr)->dr_txhdr_cache != NULL) {
2918 		contigfree((*dr)->dr_txhdr_cache,
2919 		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2920 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2921 	}
2922 	kfree((*dr)->dr_meta, M_DEVBUF);
2923 	kfree(*dr, M_DEVBUF);
2924 
2925 	*dr = NULL;
2926 }
2927 
2928 static void
2929 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2930     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2931 {
2932 	struct bwn_dmadesc32 *desc;
2933 
2934 	*meta = &(dr->dr_meta[slot]);
2935 	desc = dr->dr_ring_descbase;
2936 	desc = &(desc[slot]);
2937 
2938 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2939 }
2940 
2941 static void
2942 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2943     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2944     int start, int end, int irq)
2945 {
2946 	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2947 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2948 	uint32_t addr, addrext, ctl;
2949 	int slot;
2950 
2951 	slot = (int)(&(desc->dma.dma32) - descbase);
2952 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2953 	    ("%s:%d: fail", __func__, __LINE__));
2954 
2955 	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2956 	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2957 	addr |= siba_dma_translation(sc->sc_dev);
2958 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2959 	if (slot == dr->dr_numslots - 1)
2960 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2961 	if (start)
2962 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2963 	if (end)
2964 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2965 	if (irq)
2966 		ctl |= BWN_DMA32_DCTL_IRQ;
2967 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2968 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2969 
2970 	desc->dma.dma32.control = htole32(ctl);
2971 	desc->dma.dma32.address = htole32(addr);
2972 }
2973 
2974 static void
2975 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2976 {
2977 
2978 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2979 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2980 }
2981 
2982 static void
2983 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2984 {
2985 
2986 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2987 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2988 }
2989 
2990 static void
2991 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2992 {
2993 
2994 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2995 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2996 }
2997 
2998 static int
2999 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3000 {
3001 	uint32_t val;
3002 
3003 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3004 	val &= BWN_DMA32_RXDPTR;
3005 
3006 	return (val / sizeof(struct bwn_dmadesc32));
3007 }
3008 
3009 static void
3010 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3011 {
3012 
3013 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3014 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3015 }
3016 
3017 static void
3018 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3019     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3020 {
3021 	struct bwn_dmadesc64 *desc;
3022 
3023 	*meta = &(dr->dr_meta[slot]);
3024 	desc = dr->dr_ring_descbase;
3025 	desc = &(desc[slot]);
3026 
3027 	*gdesc = (struct bwn_dmadesc_generic *)desc;
3028 }
3029 
3030 static void
3031 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3032     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3033     int start, int end, int irq)
3034 {
3035 	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
3036 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3037 	int slot;
3038 	uint32_t ctl0 = 0, ctl1 = 0;
3039 	uint32_t addrlo, addrhi;
3040 	uint32_t addrext;
3041 
3042 	slot = (int)(&(desc->dma.dma64) - descbase);
3043 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3044 	    ("%s:%d: fail", __func__, __LINE__));
3045 
3046 	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
3047 	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
3048 	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
3049 	    30;
3050 	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
3051 	if (slot == dr->dr_numslots - 1)
3052 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3053 	if (start)
3054 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3055 	if (end)
3056 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3057 	if (irq)
3058 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
3059 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3060 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3061 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
3062 
3063 	desc->dma.dma64.control0 = htole32(ctl0);
3064 	desc->dma.dma64.control1 = htole32(ctl1);
3065 	desc->dma.dma64.address_low = htole32(addrlo);
3066 	desc->dma.dma64.address_high = htole32(addrhi);
3067 }
3068 
3069 static void
3070 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3071 {
3072 
3073 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3074 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3075 }
3076 
3077 static void
3078 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3079 {
3080 
3081 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3082 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3083 }
3084 
3085 static void
3086 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3087 {
3088 
3089 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3090 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3091 }
3092 
3093 static int
3094 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3095 {
3096 	uint32_t val;
3097 
3098 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3099 	val &= BWN_DMA64_RXSTATDPTR;
3100 
3101 	return (val / sizeof(struct bwn_dmadesc64));
3102 }
3103 
3104 static void
3105 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3106 {
3107 
3108 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3109 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3110 }
3111 
3112 static int
3113 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3114 {
3115 	struct bwn_mac *mac = dr->dr_mac;
3116 	struct bwn_dma *dma = &mac->mac_method.dma;
3117 	struct bwn_softc *sc = mac->mac_sc;
3118 	int error;
3119 
3120 	error = bus_dma_tag_create(dma->parent_dtag,
3121 			    BWN_ALIGN, 0,
3122 			    BUS_SPACE_MAXADDR,
3123 			    BUS_SPACE_MAXADDR,
3124 			    NULL, NULL,
3125 			    BWN_DMA_RINGMEMSIZE,
3126 			    1,
3127 			    BUS_SPACE_MAXSIZE_32BIT,
3128 			    0,
3129 #if !defined(__DragonFly__)
3130 			    NULL, NULL,
3131 #endif
3132 			    &dr->dr_ring_dtag);
3133 	if (error) {
3134 		device_printf(sc->sc_dev,
3135 		    "can't create TX ring DMA tag: TODO frees\n");
3136 		return (-1);
3137 	}
3138 
3139 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3140 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3141 	    &dr->dr_ring_dmap);
3142 	if (error) {
3143 		device_printf(sc->sc_dev,
3144 		    "can't allocate DMA mem: TODO frees\n");
3145 		return (-1);
3146 	}
3147 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3148 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3149 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3150 	if (error || dr->dr_ring_dmabase == 0) {
3151 		device_printf(sc->sc_dev,
3152 		    "can't load DMA mem: TODO free\n");
3153 		return (-1);
3154 	}
3155 
3156 	return (0);
3157 }
3158 
3159 static void
3160 bwn_dma_setup(struct bwn_dma_ring *dr)
3161 {
3162 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3163 	uint64_t ring64;
3164 	uint32_t addrext, ring32, value;
3165 	uint32_t trans = siba_dma_translation(sc->sc_dev);
3166 
3167 	if (dr->dr_tx) {
3168 		dr->dr_curslot = -1;
3169 
3170 		if (dr->dr_type == BWN_DMA_64BIT) {
3171 			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3172 			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3173 			    >> 30;
3174 			value = BWN_DMA64_TXENABLE;
3175 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3176 			    & BWN_DMA64_TXADDREXT_MASK;
3177 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3178 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3179 			    (ring64 & 0xffffffff));
3180 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3181 			    ((ring64 >> 32) &
3182 			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3183 		} else {
3184 			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3185 			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3186 			value = BWN_DMA32_TXENABLE;
3187 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3188 			    & BWN_DMA32_TXADDREXT_MASK;
3189 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3190 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3191 			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3192 		}
3193 		return;
3194 	}
3195 
3196 	/*
3197 	 * set for RX
3198 	 */
3199 	dr->dr_usedslot = dr->dr_numslots;
3200 
3201 	if (dr->dr_type == BWN_DMA_64BIT) {
3202 		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3203 		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3204 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3205 		value |= BWN_DMA64_RXENABLE;
3206 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3207 		    & BWN_DMA64_RXADDREXT_MASK;
3208 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3209 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3210 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3211 		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3212 		    | (trans << 1));
3213 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3214 		    sizeof(struct bwn_dmadesc64));
3215 	} else {
3216 		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3217 		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3218 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3219 		value |= BWN_DMA32_RXENABLE;
3220 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3221 		    & BWN_DMA32_RXADDREXT_MASK;
3222 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3223 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3224 		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3225 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3226 		    sizeof(struct bwn_dmadesc32));
3227 	}
3228 }
3229 
3230 static void
3231 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3232 {
3233 
3234 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3235 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3236 	    dr->dr_ring_dmap);
3237 }
3238 
3239 static void
3240 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3241 {
3242 
3243 	if (dr->dr_tx) {
3244 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3245 		if (dr->dr_type == BWN_DMA_64BIT) {
3246 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3247 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3248 		} else
3249 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3250 	} else {
3251 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3252 		if (dr->dr_type == BWN_DMA_64BIT) {
3253 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3254 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3255 		} else
3256 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3257 	}
3258 }
3259 
3260 static void
3261 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3262 {
3263 	struct bwn_dmadesc_generic *desc;
3264 	struct bwn_dmadesc_meta *meta;
3265 	struct bwn_mac *mac = dr->dr_mac;
3266 	struct bwn_dma *dma = &mac->mac_method.dma;
3267 	struct bwn_softc *sc = mac->mac_sc;
3268 	int i;
3269 
3270 	if (!dr->dr_usedslot)
3271 		return;
3272 	for (i = 0; i < dr->dr_numslots; i++) {
3273 		dr->getdesc(dr, i, &desc, &meta);
3274 
3275 		if (meta->mt_m == NULL) {
3276 			if (!dr->dr_tx)
3277 				device_printf(sc->sc_dev, "%s: not TX?\n",
3278 				    __func__);
3279 			continue;
3280 		}
3281 		if (dr->dr_tx) {
3282 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER) {
3283 				bus_dmamap_unload(dr->dr_txring_dtag,
3284 				    meta->mt_dmap);
3285 			} else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY) {
3286 				bus_dmamap_unload(dma->txbuf_dtag,
3287 				    meta->mt_dmap);
3288 			}
3289 		} else
3290 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3291 		bwn_dma_free_descbuf(dr, meta);
3292 	}
3293 }
3294 
3295 static int
3296 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3297     int type)
3298 {
3299 	struct bwn_softc *sc = mac->mac_sc;
3300 	uint32_t value;
3301 	int i;
3302 	uint16_t offset;
3303 
3304 	for (i = 0; i < 10; i++) {
3305 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3306 		    BWN_DMA32_TXSTATUS;
3307 		value = BWN_READ_4(mac, base + offset);
3308 		if (type == BWN_DMA_64BIT) {
3309 			value &= BWN_DMA64_TXSTAT;
3310 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3311 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3312 			    value == BWN_DMA64_TXSTAT_STOPPED)
3313 				break;
3314 		} else {
3315 			value &= BWN_DMA32_TXSTATE;
3316 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3317 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3318 			    value == BWN_DMA32_TXSTAT_STOPPED)
3319 				break;
3320 		}
3321 		DELAY(1000);
3322 	}
3323 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3324 	BWN_WRITE_4(mac, base + offset, 0);
3325 	for (i = 0; i < 10; i++) {
3326 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3327 						   BWN_DMA32_TXSTATUS;
3328 		value = BWN_READ_4(mac, base + offset);
3329 		if (type == BWN_DMA_64BIT) {
3330 			value &= BWN_DMA64_TXSTAT;
3331 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3332 				i = -1;
3333 				break;
3334 			}
3335 		} else {
3336 			value &= BWN_DMA32_TXSTATE;
3337 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3338 				i = -1;
3339 				break;
3340 			}
3341 		}
3342 		DELAY(1000);
3343 	}
3344 	if (i != -1) {
3345 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3346 		return (ENODEV);
3347 	}
3348 	DELAY(1000);
3349 
3350 	return (0);
3351 }
3352 
3353 static int
3354 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3355     int type)
3356 {
3357 	struct bwn_softc *sc = mac->mac_sc;
3358 	uint32_t value;
3359 	int i;
3360 	uint16_t offset;
3361 
3362 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3363 	BWN_WRITE_4(mac, base + offset, 0);
3364 	for (i = 0; i < 10; i++) {
3365 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3366 		    BWN_DMA32_RXSTATUS;
3367 		value = BWN_READ_4(mac, base + offset);
3368 		if (type == BWN_DMA_64BIT) {
3369 			value &= BWN_DMA64_RXSTAT;
3370 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3371 				i = -1;
3372 				break;
3373 			}
3374 		} else {
3375 			value &= BWN_DMA32_RXSTATE;
3376 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3377 				i = -1;
3378 				break;
3379 			}
3380 		}
3381 		DELAY(1000);
3382 	}
3383 	if (i != -1) {
3384 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3385 		return (ENODEV);
3386 	}
3387 
3388 	return (0);
3389 }
3390 
3391 static void
3392 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3393     struct bwn_dmadesc_meta *meta)
3394 {
3395 
3396 	if (meta->mt_m != NULL) {
3397 		m_freem(meta->mt_m);
3398 		meta->mt_m = NULL;
3399 	}
3400 	if (meta->mt_ni != NULL) {
3401 		ieee80211_free_node(meta->mt_ni);
3402 		meta->mt_ni = NULL;
3403 	}
3404 }
3405 
3406 static void
3407 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3408 {
3409 	struct bwn_rxhdr4 *rxhdr;
3410 	unsigned char *frame;
3411 
3412 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3413 	rxhdr->frame_len = 0;
3414 
3415 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3416 	    sizeof(struct bwn_plcp6) + 2,
3417 	    ("%s:%d: fail", __func__, __LINE__));
3418 	frame = mtod(m, char *) + dr->dr_frameoffset;
3419 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3420 }
3421 
3422 static uint8_t
3423 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3424 {
3425 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3426 
3427 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3428 	    == 0xff);
3429 }
3430 
3431 static void
3432 bwn_wme_init(struct bwn_mac *mac)
3433 {
3434 
3435 	bwn_wme_load(mac);
3436 
3437 	/* enable WME support. */
3438 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3439 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3440 	    BWN_IFSCTL_USE_EDCF);
3441 }
3442 
3443 static void
3444 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3445 {
3446 	struct bwn_softc *sc = mac->mac_sc;
3447 	struct ieee80211com *ic = &sc->sc_ic;
3448 	uint16_t delay;	/* microsec */
3449 
3450 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3451 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3452 		delay = 500;
3453 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3454 		delay = max(delay, (uint16_t)2400);
3455 
3456 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3457 }
3458 
3459 static void
3460 bwn_bt_enable(struct bwn_mac *mac)
3461 {
3462 	struct bwn_softc *sc = mac->mac_sc;
3463 	uint64_t hf;
3464 
3465 	if (bwn_bluetooth == 0)
3466 		return;
3467 	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3468 		return;
3469 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3470 		return;
3471 
3472 	hf = bwn_hf_read(mac);
3473 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3474 		hf |= BWN_HF_BT_COEXISTALT;
3475 	else
3476 		hf |= BWN_HF_BT_COEXIST;
3477 	bwn_hf_write(mac, hf);
3478 }
3479 
3480 static void
3481 bwn_set_macaddr(struct bwn_mac *mac)
3482 {
3483 
3484 	bwn_mac_write_bssid(mac);
3485 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3486 	    mac->mac_sc->sc_ic.ic_macaddr);
3487 }
3488 
3489 static void
3490 bwn_clear_keys(struct bwn_mac *mac)
3491 {
3492 	int i;
3493 
3494 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3495 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3496 		    ("%s:%d: fail", __func__, __LINE__));
3497 
3498 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3499 		    NULL, BWN_SEC_KEYSIZE, NULL);
3500 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3501 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3502 			    NULL, BWN_SEC_KEYSIZE, NULL);
3503 		}
3504 		mac->mac_key[i].keyconf = NULL;
3505 	}
3506 }
3507 
3508 static void
3509 bwn_crypt_init(struct bwn_mac *mac)
3510 {
3511 	struct bwn_softc *sc = mac->mac_sc;
3512 
3513 	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3514 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3515 	    ("%s:%d: fail", __func__, __LINE__));
3516 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3517 	mac->mac_ktp *= 2;
3518 	if (siba_get_revid(sc->sc_dev) >= 5)
3519 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3520 	bwn_clear_keys(mac);
3521 }
3522 
3523 static void
3524 bwn_chip_exit(struct bwn_mac *mac)
3525 {
3526 	struct bwn_softc *sc = mac->mac_sc;
3527 
3528 	bwn_phy_exit(mac);
3529 	siba_gpio_set(sc->sc_dev, 0);
3530 }
3531 
3532 static int
3533 bwn_fw_fillinfo(struct bwn_mac *mac)
3534 {
3535 	int error;
3536 
3537 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3538 	if (error == 0)
3539 		return (0);
3540 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3541 	if (error == 0)
3542 		return (0);
3543 	return (error);
3544 }
3545 
3546 static int
3547 bwn_gpio_init(struct bwn_mac *mac)
3548 {
3549 	struct bwn_softc *sc = mac->mac_sc;
3550 	uint32_t mask = 0x1f, set = 0xf, value;
3551 
3552 	BWN_WRITE_4(mac, BWN_MACCTL,
3553 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3554 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3555 	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3556 
3557 	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3558 		mask |= 0x0060;
3559 		set |= 0x0060;
3560 	}
3561 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3562 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3563 		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3564 		mask |= 0x0200;
3565 		set |= 0x0200;
3566 	}
3567 	if (siba_get_revid(sc->sc_dev) >= 2)
3568 		mask |= 0x0010;
3569 
3570 	value = siba_gpio_get(sc->sc_dev);
3571 	if (value == -1)
3572 		return (0);
3573 	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3574 
3575 	return (0);
3576 }
3577 
3578 static int
3579 bwn_fw_loadinitvals(struct bwn_mac *mac)
3580 {
3581 #define	GETFWOFFSET(fwp, offset)				\
3582 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3583 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3584 	const struct bwn_fwhdr *hdr;
3585 	struct bwn_fw *fw = &mac->mac_fw;
3586 	int error;
3587 
3588 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3589 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3590 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3591 	if (error)
3592 		return (error);
3593 	if (fw->initvals_band.fw) {
3594 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3595 		error = bwn_fwinitvals_write(mac,
3596 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3597 		    be32toh(hdr->size),
3598 		    fw->initvals_band.fw->datasize - hdr_len);
3599 	}
3600 	return (error);
3601 #undef GETFWOFFSET
3602 }
3603 
3604 static int
3605 bwn_phy_init(struct bwn_mac *mac)
3606 {
3607 	struct bwn_softc *sc = mac->mac_sc;
3608 	int error;
3609 
3610 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3611 	mac->mac_phy.rf_onoff(mac, 1);
3612 	error = mac->mac_phy.init(mac);
3613 	if (error) {
3614 		device_printf(sc->sc_dev, "PHY init failed\n");
3615 		goto fail0;
3616 	}
3617 	error = bwn_switch_channel(mac,
3618 	    mac->mac_phy.get_default_chan(mac));
3619 	if (error) {
3620 		device_printf(sc->sc_dev,
3621 		    "failed to switch default channel\n");
3622 		goto fail1;
3623 	}
3624 	return (0);
3625 fail1:
3626 	if (mac->mac_phy.exit)
3627 		mac->mac_phy.exit(mac);
3628 fail0:
3629 	mac->mac_phy.rf_onoff(mac, 0);
3630 
3631 	return (error);
3632 }
3633 
3634 static void
3635 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3636 {
3637 	uint16_t ant;
3638 	uint16_t tmp;
3639 
3640 	ant = bwn_ant2phy(antenna);
3641 
3642 	/* For ACK/CTS */
3643 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3644 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3645 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3646 	/* For Probe Resposes */
3647 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3648 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3649 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3650 }
3651 
3652 static void
3653 bwn_set_opmode(struct bwn_mac *mac)
3654 {
3655 	struct bwn_softc *sc = mac->mac_sc;
3656 	struct ieee80211com *ic = &sc->sc_ic;
3657 	uint32_t ctl;
3658 	uint16_t cfp_pretbtt;
3659 
3660 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3661 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3662 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3663 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3664 	ctl |= BWN_MACCTL_STA;
3665 
3666 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3667 	    ic->ic_opmode == IEEE80211_M_MBSS)
3668 		ctl |= BWN_MACCTL_HOSTAP;
3669 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3670 		ctl &= ~BWN_MACCTL_STA;
3671 	ctl |= sc->sc_filters;
3672 
3673 	if (siba_get_revid(sc->sc_dev) <= 4)
3674 		ctl |= BWN_MACCTL_PROMISC;
3675 
3676 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3677 
3678 	cfp_pretbtt = 2;
3679 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3680 		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3681 		    siba_get_chiprev(sc->sc_dev) == 3)
3682 			cfp_pretbtt = 100;
3683 		else
3684 			cfp_pretbtt = 50;
3685 	}
3686 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3687 }
3688 
3689 static int
3690 bwn_dma_gettype(struct bwn_mac *mac)
3691 {
3692 	uint32_t tmp;
3693 	uint16_t base;
3694 
3695 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3696 	if (tmp & SIBA_TGSHIGH_DMA64)
3697 		return (BWN_DMA_64BIT);
3698 	base = bwn_dma_base(0, 0);
3699 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3700 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3701 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3702 		return (BWN_DMA_32BIT);
3703 
3704 	return (BWN_DMA_30BIT);
3705 }
3706 
3707 static void
3708 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3709 {
3710 	if (error) {
3711 		*((bus_addr_t *)arg) = 0;
3712 	} else {
3713 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3714 		*((bus_addr_t *)arg) = seg->ds_addr;
3715 	}
3716 }
3717 
3718 void
3719 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3720 {
3721 	struct bwn_phy *phy = &mac->mac_phy;
3722 	struct bwn_softc *sc = mac->mac_sc;
3723 	unsigned int i, max_loop;
3724 	uint16_t value;
3725 	uint32_t buffer[5] = {
3726 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3727 	};
3728 
3729 	if (ofdm) {
3730 		max_loop = 0x1e;
3731 		buffer[0] = 0x000201cc;
3732 	} else {
3733 		max_loop = 0xfa;
3734 		buffer[0] = 0x000b846e;
3735 	}
3736 
3737 	BWN_ASSERT_LOCKED(mac->mac_sc);
3738 
3739 	for (i = 0; i < 5; i++)
3740 		bwn_ram_write(mac, i * 4, buffer[i]);
3741 
3742 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3743 	BWN_WRITE_2(mac, 0x07c0,
3744 	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3745 
3746 	value = (ofdm ? 0x41 : 0x40);
3747 	BWN_WRITE_2(mac, 0x050c, value);
3748 
3749 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3750 	    phy->type == BWN_PHYTYPE_LCN)
3751 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3752 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3753 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3754 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3755 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3756 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3757 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3758 
3759 	/* XXX TODO: n phy pa override? */
3760 
3761 	switch (phy->type) {
3762 	case BWN_PHYTYPE_N:
3763 	case BWN_PHYTYPE_LCN:
3764 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3765 		break;
3766 	case BWN_PHYTYPE_LP:
3767 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3768 		break;
3769 	default:
3770 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3771 		break;
3772 	}
3773 
3774 	/* flush */
3775 	BWN_READ_2(mac, 0x0502);
3776 
3777 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3778 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3779 	for (i = 0x00; i < max_loop; i++) {
3780 		value = BWN_READ_2(mac, 0x050e);
3781 		if (value & 0x0080)
3782 			break;
3783 		DELAY(10);
3784 	}
3785 	for (i = 0x00; i < 0x0a; i++) {
3786 		value = BWN_READ_2(mac, 0x050e);
3787 		if (value & 0x0400)
3788 			break;
3789 		DELAY(10);
3790 	}
3791 	for (i = 0x00; i < 0x19; i++) {
3792 		value = BWN_READ_2(mac, 0x0690);
3793 		if (!(value & 0x0100))
3794 			break;
3795 		DELAY(10);
3796 	}
3797 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3798 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3799 }
3800 
3801 void
3802 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3803 {
3804 	uint32_t macctl;
3805 
3806 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3807 
3808 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3809 	if (macctl & BWN_MACCTL_BIGENDIAN)
3810 		kprintf("TODO: need swap\n");
3811 
3812 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3813 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3814 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3815 }
3816 
3817 void
3818 bwn_mac_suspend(struct bwn_mac *mac)
3819 {
3820 	struct bwn_softc *sc = mac->mac_sc;
3821 	int i;
3822 	uint32_t tmp;
3823 
3824 	KASSERT(mac->mac_suspended >= 0,
3825 	    ("%s:%d: fail", __func__, __LINE__));
3826 
3827 	if (mac->mac_suspended == 0) {
3828 		bwn_psctl(mac, BWN_PS_AWAKE);
3829 		BWN_WRITE_4(mac, BWN_MACCTL,
3830 			    BWN_READ_4(mac, BWN_MACCTL)
3831 			    & ~BWN_MACCTL_ON);
3832 		BWN_READ_4(mac, BWN_MACCTL);
3833 		for (i = 35; i; i--) {
3834 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3835 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3836 				goto out;
3837 			DELAY(10);
3838 		}
3839 		for (i = 40; i; i--) {
3840 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3841 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3842 				goto out;
3843 			DELAY(1000);
3844 		}
3845 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3846 	}
3847 out:
3848 	mac->mac_suspended++;
3849 }
3850 
3851 void
3852 bwn_mac_enable(struct bwn_mac *mac)
3853 {
3854 	struct bwn_softc *sc = mac->mac_sc;
3855 	uint16_t state;
3856 
3857 	state = bwn_shm_read_2(mac, BWN_SHARED,
3858 	    BWN_SHARED_UCODESTAT);
3859 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3860 	    state != BWN_SHARED_UCODESTAT_SLEEP)
3861 		device_printf(sc->sc_dev, "warn: firmware state (%d)\n", state);
3862 
3863 	mac->mac_suspended--;
3864 	KASSERT(mac->mac_suspended >= 0,
3865 	    ("%s:%d: fail", __func__, __LINE__));
3866 	if (mac->mac_suspended == 0) {
3867 		BWN_WRITE_4(mac, BWN_MACCTL,
3868 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3869 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3870 		BWN_READ_4(mac, BWN_MACCTL);
3871 		BWN_READ_4(mac, BWN_INTR_REASON);
3872 		bwn_psctl(mac, 0);
3873 	}
3874 }
3875 
3876 void
3877 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3878 {
3879 	struct bwn_softc *sc = mac->mac_sc;
3880 	int i;
3881 	uint16_t ucstat;
3882 
3883 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3884 	    ("%s:%d: fail", __func__, __LINE__));
3885 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3886 	    ("%s:%d: fail", __func__, __LINE__));
3887 
3888 	/* XXX forcibly awake and hwps-off */
3889 
3890 	BWN_WRITE_4(mac, BWN_MACCTL,
3891 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3892 	    ~BWN_MACCTL_HWPS);
3893 	BWN_READ_4(mac, BWN_MACCTL);
3894 	if (siba_get_revid(sc->sc_dev) >= 5) {
3895 		for (i = 0; i < 100; i++) {
3896 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3897 			    BWN_SHARED_UCODESTAT);
3898 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3899 				break;
3900 			DELAY(10);
3901 		}
3902 	}
3903 }
3904 
3905 static int
3906 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3907 {
3908 	struct bwn_softc *sc = mac->mac_sc;
3909 	struct bwn_fw *fw = &mac->mac_fw;
3910 	const uint8_t rev = siba_get_revid(sc->sc_dev);
3911 	const char *filename;
3912 	uint32_t high;
3913 	int error;
3914 
3915 	/* microcode */
3916 	filename = NULL;
3917 	switch (rev) {
3918 	case 42:
3919 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3920 			filename = "ucode42";
3921 		break;
3922 	case 40:
3923 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3924 			filename = "ucode40";
3925 		break;
3926 	case 33:
3927 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3928 			filename = "ucode33_lcn40";
3929 		break;
3930 	case 30:
3931 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3932 			filename = "ucode30_mimo";
3933 		break;
3934 	case 29:
3935 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3936 			filename = "ucode29_mimo";
3937 		break;
3938 	case 26:
3939 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3940 			filename = "ucode26_mimo";
3941 		break;
3942 	case 28:
3943 	case 25:
3944 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3945 			filename = "ucode25_mimo";
3946 		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3947 			filename = "ucode25_lcn";
3948 		break;
3949 	case 24:
3950 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3951 			filename = "ucode24_lcn";
3952 		break;
3953 	case 23:
3954 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3955 			filename = "ucode16_mimo";
3956 		break;
3957 	case 16:
3958 	case 17:
3959 	case 18:
3960 	case 19:
3961 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3962 			filename = "ucode16_mimo";
3963 		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3964 			filename = "ucode16_lp";
3965 		break;
3966 	case 15:
3967 		filename = "ucode15";
3968 		break;
3969 	case 14:
3970 		filename = "ucode14";
3971 		break;
3972 	case 13:
3973 		filename = "ucode13";
3974 		break;
3975 	case 12:
3976 	case 11:
3977 		filename = "ucode11";
3978 		break;
3979 	case 10:
3980 	case 9:
3981 	case 8:
3982 	case 7:
3983 	case 6:
3984 	case 5:
3985 		filename = "ucode5";
3986 		break;
3987 	default:
3988 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3989 		bwn_release_firmware(mac);
3990 		return (EOPNOTSUPP);
3991 	}
3992 
3993 	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3994 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3995 	if (error) {
3996 		bwn_release_firmware(mac);
3997 		return (error);
3998 	}
3999 
4000 	/* PCM */
4001 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
4002 	if (rev >= 5 && rev <= 10) {
4003 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
4004 		if (error == ENOENT)
4005 			fw->no_pcmfile = 1;
4006 		else if (error) {
4007 			bwn_release_firmware(mac);
4008 			return (error);
4009 		}
4010 	} else if (rev < 11) {
4011 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
4012 		return (EOPNOTSUPP);
4013 	}
4014 
4015 	/* initvals */
4016 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
4017 	switch (mac->mac_phy.type) {
4018 	case BWN_PHYTYPE_A:
4019 		if (rev < 5 || rev > 10)
4020 			goto fail1;
4021 		if (high & BWN_TGSHIGH_HAVE_2GHZ)
4022 			filename = "a0g1initvals5";
4023 		else
4024 			filename = "a0g0initvals5";
4025 		break;
4026 	case BWN_PHYTYPE_G:
4027 		if (rev >= 5 && rev <= 10)
4028 			filename = "b0g0initvals5";
4029 		else if (rev >= 13)
4030 			filename = "b0g0initvals13";
4031 		else
4032 			goto fail1;
4033 		break;
4034 	case BWN_PHYTYPE_LP:
4035 		if (rev == 13)
4036 			filename = "lp0initvals13";
4037 		else if (rev == 14)
4038 			filename = "lp0initvals14";
4039 		else if (rev >= 15)
4040 			filename = "lp0initvals15";
4041 		else
4042 			goto fail1;
4043 		break;
4044 	case BWN_PHYTYPE_N:
4045 		if (rev == 30)
4046 			filename = "n16initvals30";
4047 		else if (rev == 28 || rev == 25)
4048 			filename = "n0initvals25";
4049 		else if (rev == 24)
4050 			filename = "n0initvals24";
4051 		else if (rev == 23)
4052 			filename = "n0initvals16";
4053 		else if (rev >= 16 && rev <= 18)
4054 			filename = "n0initvals16";
4055 		else if (rev >= 11 && rev <= 12)
4056 			filename = "n0initvals11";
4057 		else
4058 			goto fail1;
4059 		break;
4060 	default:
4061 		goto fail1;
4062 	}
4063 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
4064 	if (error) {
4065 		bwn_release_firmware(mac);
4066 		return (error);
4067 	}
4068 
4069 	/* bandswitch initvals */
4070 	switch (mac->mac_phy.type) {
4071 	case BWN_PHYTYPE_A:
4072 		if (rev >= 5 && rev <= 10) {
4073 			if (high & BWN_TGSHIGH_HAVE_2GHZ)
4074 				filename = "a0g1bsinitvals5";
4075 			else
4076 				filename = "a0g0bsinitvals5";
4077 		} else if (rev >= 11)
4078 			filename = NULL;
4079 		else
4080 			goto fail1;
4081 		break;
4082 	case BWN_PHYTYPE_G:
4083 		if (rev >= 5 && rev <= 10)
4084 			filename = "b0g0bsinitvals5";
4085 		else if (rev >= 11)
4086 			filename = NULL;
4087 		else
4088 			goto fail1;
4089 		break;
4090 	case BWN_PHYTYPE_LP:
4091 		if (rev == 13)
4092 			filename = "lp0bsinitvals13";
4093 		else if (rev == 14)
4094 			filename = "lp0bsinitvals14";
4095 		else if (rev >= 15)
4096 			filename = "lp0bsinitvals15";
4097 		else
4098 			goto fail1;
4099 		break;
4100 	case BWN_PHYTYPE_N:
4101 		if (rev == 30)
4102 			filename = "n16bsinitvals30";
4103 		else if (rev == 28 || rev == 25)
4104 			filename = "n0bsinitvals25";
4105 		else if (rev == 24)
4106 			filename = "n0bsinitvals24";
4107 		else if (rev == 23)
4108 			filename = "n0bsinitvals16";
4109 		else if (rev >= 16 && rev <= 18)
4110 			filename = "n0bsinitvals16";
4111 		else if (rev >= 11 && rev <= 12)
4112 			filename = "n0bsinitvals11";
4113 		else
4114 			goto fail1;
4115 		break;
4116 	default:
4117 		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4118 		    mac->mac_phy.type);
4119 		goto fail1;
4120 	}
4121 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4122 	if (error) {
4123 		bwn_release_firmware(mac);
4124 		return (error);
4125 	}
4126 	return (0);
4127 fail1:
4128 	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4129 	    rev, mac->mac_phy.type);
4130 	bwn_release_firmware(mac);
4131 	return (EOPNOTSUPP);
4132 }
4133 
4134 static int
4135 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4136     const char *name, struct bwn_fwfile *bfw)
4137 {
4138 	const struct bwn_fwhdr *hdr;
4139 	struct bwn_softc *sc = mac->mac_sc;
4140 	const struct firmware *fw;
4141 	char namebuf[64];
4142 
4143 	if (name == NULL) {
4144 		bwn_do_release_fw(bfw);
4145 		return (0);
4146 	}
4147 	if (bfw->filename != NULL) {
4148 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4149 			return (0);
4150 		bwn_do_release_fw(bfw);
4151 	}
4152 
4153 	ksnprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4154 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4155 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4156 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4157 	fw = firmware_get(namebuf);
4158 	if (fw == NULL) {
4159 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4160 		    namebuf);
4161 		return (ENOENT);
4162 	}
4163 	if (fw->datasize < sizeof(struct bwn_fwhdr))
4164 		goto fail;
4165 	hdr = (const struct bwn_fwhdr *)(fw->data);
4166 	switch (hdr->type) {
4167 	case BWN_FWTYPE_UCODE:
4168 	case BWN_FWTYPE_PCM:
4169 		if (be32toh(hdr->size) !=
4170 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4171 			goto fail;
4172 		/* FALLTHROUGH */
4173 	case BWN_FWTYPE_IV:
4174 		if (hdr->ver != 1)
4175 			goto fail;
4176 		break;
4177 	default:
4178 		goto fail;
4179 	}
4180 	bfw->filename = name;
4181 	bfw->fw = fw;
4182 	bfw->type = type;
4183 	return (0);
4184 fail:
4185 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4186 	if (fw != NULL)
4187 		firmware_put(fw, FIRMWARE_UNLOAD);
4188 	return (EPROTO);
4189 }
4190 
4191 static void
4192 bwn_release_firmware(struct bwn_mac *mac)
4193 {
4194 
4195 	bwn_do_release_fw(&mac->mac_fw.ucode);
4196 	bwn_do_release_fw(&mac->mac_fw.pcm);
4197 	bwn_do_release_fw(&mac->mac_fw.initvals);
4198 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4199 }
4200 
4201 static void
4202 bwn_do_release_fw(struct bwn_fwfile *bfw)
4203 {
4204 
4205 	if (bfw->fw != NULL)
4206 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4207 	bfw->fw = NULL;
4208 	bfw->filename = NULL;
4209 }
4210 
4211 static int
4212 bwn_fw_loaducode(struct bwn_mac *mac)
4213 {
4214 #define	GETFWOFFSET(fwp, offset)	\
4215 	((const uint32_t *)((const char *)fwp.fw->data + offset))
4216 #define	GETFWSIZE(fwp, offset)	\
4217 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4218 	struct bwn_softc *sc = mac->mac_sc;
4219 	const uint32_t *data;
4220 	unsigned int i;
4221 	uint32_t ctl;
4222 	uint16_t date, fwcaps, time;
4223 	int error = 0;
4224 
4225 	ctl = BWN_READ_4(mac, BWN_MACCTL);
4226 	ctl |= BWN_MACCTL_MCODE_JMP0;
4227 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4228 	    __LINE__));
4229 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4230 	for (i = 0; i < 64; i++)
4231 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4232 	for (i = 0; i < 4096; i += 2)
4233 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4234 
4235 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4236 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4237 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4238 	     i++) {
4239 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4240 		DELAY(10);
4241 	}
4242 
4243 	if (mac->mac_fw.pcm.fw) {
4244 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4245 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4246 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4247 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4248 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4249 		    sizeof(struct bwn_fwhdr)); i++) {
4250 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4251 			DELAY(10);
4252 		}
4253 	}
4254 
4255 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4256 	BWN_WRITE_4(mac, BWN_MACCTL,
4257 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4258 	    BWN_MACCTL_MCODE_RUN);
4259 
4260 	for (i = 0; i < 21; i++) {
4261 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4262 			break;
4263 		if (i >= 20) {
4264 			device_printf(sc->sc_dev, "ucode timeout\n");
4265 			error = ENXIO;
4266 			goto error;
4267 		}
4268 		DELAY(50000);
4269 	}
4270 	BWN_READ_4(mac, BWN_INTR_REASON);
4271 
4272 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4273 	if (mac->mac_fw.rev <= 0x128) {
4274 		device_printf(sc->sc_dev, "the firmware is too old\n");
4275 		error = EOPNOTSUPP;
4276 		goto error;
4277 	}
4278 
4279 	/*
4280 	 * Determine firmware header version; needed for TX/RX packet
4281 	 * handling.
4282 	 */
4283 	if (mac->mac_fw.rev >= 598)
4284 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4285 	else if (mac->mac_fw.rev >= 410)
4286 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4287 	else
4288 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4289 
4290 	/*
4291 	 * We don't support rev 598 or later; that requires
4292 	 * another round of changes to the TX/RX descriptor
4293 	 * and status layout.
4294 	 *
4295 	 * So, complain this is the case and exit out, rather
4296 	 * than attaching and then failing.
4297 	 */
4298 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4299 		device_printf(sc->sc_dev,
4300 		    "firmware is too new (>=598); not supported\n");
4301 		error = EOPNOTSUPP;
4302 		goto error;
4303 	}
4304 
4305 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4306 	    BWN_SHARED_UCODE_PATCH);
4307 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4308 	mac->mac_fw.opensource = (date == 0xffff);
4309 	if (bwn_wme != 0)
4310 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4311 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4312 
4313 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4314 	if (mac->mac_fw.opensource == 0) {
4315 		device_printf(sc->sc_dev,
4316 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4317 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4318 		if (mac->mac_fw.no_pcmfile)
4319 			device_printf(sc->sc_dev,
4320 			    "no HW crypto acceleration due to pcm5\n");
4321 	} else {
4322 		mac->mac_fw.patch = time;
4323 		fwcaps = bwn_fwcaps_read(mac);
4324 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4325 			device_printf(sc->sc_dev,
4326 			    "disabling HW crypto acceleration\n");
4327 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4328 		}
4329 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4330 			device_printf(sc->sc_dev, "disabling WME support\n");
4331 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4332 		}
4333 	}
4334 
4335 	if (BWN_ISOLDFMT(mac))
4336 		device_printf(sc->sc_dev, "using old firmware image\n");
4337 
4338 	return (0);
4339 
4340 error:
4341 	BWN_WRITE_4(mac, BWN_MACCTL,
4342 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4343 	    BWN_MACCTL_MCODE_JMP0);
4344 
4345 	return (error);
4346 #undef GETFWSIZE
4347 #undef GETFWOFFSET
4348 }
4349 
4350 /* OpenFirmware only */
4351 static uint16_t
4352 bwn_fwcaps_read(struct bwn_mac *mac)
4353 {
4354 
4355 	KASSERT(mac->mac_fw.opensource == 1,
4356 	    ("%s:%d: fail", __func__, __LINE__));
4357 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4358 }
4359 
4360 static int
4361 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4362     size_t count, size_t array_size)
4363 {
4364 #define	GET_NEXTIV16(iv)						\
4365 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4366 	    sizeof(uint16_t) + sizeof(uint16_t)))
4367 #define	GET_NEXTIV32(iv)						\
4368 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4369 	    sizeof(uint16_t) + sizeof(uint32_t)))
4370 	struct bwn_softc *sc = mac->mac_sc;
4371 	const struct bwn_fwinitvals *iv;
4372 	uint16_t offset;
4373 	size_t i;
4374 	uint8_t bit32;
4375 
4376 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4377 	    ("%s:%d: fail", __func__, __LINE__));
4378 	iv = ivals;
4379 	for (i = 0; i < count; i++) {
4380 		if (array_size < sizeof(iv->offset_size))
4381 			goto fail;
4382 		array_size -= sizeof(iv->offset_size);
4383 		offset = be16toh(iv->offset_size);
4384 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4385 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4386 		if (offset >= 0x1000)
4387 			goto fail;
4388 		if (bit32) {
4389 			if (array_size < sizeof(iv->data.d32))
4390 				goto fail;
4391 			array_size -= sizeof(iv->data.d32);
4392 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4393 			iv = GET_NEXTIV32(iv);
4394 		} else {
4395 
4396 			if (array_size < sizeof(iv->data.d16))
4397 				goto fail;
4398 			array_size -= sizeof(iv->data.d16);
4399 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4400 
4401 			iv = GET_NEXTIV16(iv);
4402 		}
4403 	}
4404 	if (array_size != 0)
4405 		goto fail;
4406 	return (0);
4407 fail:
4408 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4409 	return (EPROTO);
4410 #undef GET_NEXTIV16
4411 #undef GET_NEXTIV32
4412 }
4413 
4414 int
4415 bwn_switch_channel(struct bwn_mac *mac, int chan)
4416 {
4417 	struct bwn_phy *phy = &(mac->mac_phy);
4418 	struct bwn_softc *sc = mac->mac_sc;
4419 	struct ieee80211com *ic = &sc->sc_ic;
4420 	uint16_t channelcookie, savedcookie;
4421 	int error;
4422 
4423 	if (chan == 0xffff)
4424 		chan = phy->get_default_chan(mac);
4425 
4426 	channelcookie = chan;
4427 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4428 		channelcookie |= 0x100;
4429 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4430 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4431 	error = phy->switch_channel(mac, chan);
4432 	if (error)
4433 		goto fail;
4434 
4435 	mac->mac_phy.chan = chan;
4436 	DELAY(8000);
4437 	return (0);
4438 fail:
4439 	device_printf(sc->sc_dev, "failed to switch channel\n");
4440 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4441 	return (error);
4442 }
4443 
4444 static uint16_t
4445 bwn_ant2phy(int antenna)
4446 {
4447 
4448 	switch (antenna) {
4449 	case BWN_ANT0:
4450 		return (BWN_TX_PHY_ANT0);
4451 	case BWN_ANT1:
4452 		return (BWN_TX_PHY_ANT1);
4453 	case BWN_ANT2:
4454 		return (BWN_TX_PHY_ANT2);
4455 	case BWN_ANT3:
4456 		return (BWN_TX_PHY_ANT3);
4457 	case BWN_ANTAUTO:
4458 		return (BWN_TX_PHY_ANT01AUTO);
4459 	}
4460 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4461 	return (0);
4462 }
4463 
4464 static void
4465 bwn_wme_load(struct bwn_mac *mac)
4466 {
4467 	struct bwn_softc *sc = mac->mac_sc;
4468 	int i;
4469 
4470 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4471 	    ("%s:%d: fail", __func__, __LINE__));
4472 
4473 	bwn_mac_suspend(mac);
4474 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4475 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4476 		    bwn_wme_shm_offsets[i]);
4477 	bwn_mac_enable(mac);
4478 }
4479 
4480 static void
4481 bwn_wme_loadparams(struct bwn_mac *mac,
4482     const struct wmeParams *p, uint16_t shm_offset)
4483 {
4484 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4485 	struct bwn_softc *sc = mac->mac_sc;
4486 	uint16_t params[BWN_NR_WMEPARAMS];
4487 	int slot, tmp;
4488 	unsigned int i;
4489 
4490 	slot = BWN_READ_2(mac, BWN_RNG) &
4491 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4492 
4493 	memset(&params, 0, sizeof(params));
4494 
4495 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4496 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4497 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4498 
4499 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4500 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4501 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4502 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4503 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4504 	params[BWN_WMEPARAM_BSLOTS] = slot;
4505 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4506 
4507 	for (i = 0; i < N(params); i++) {
4508 		if (i == BWN_WMEPARAM_STATUS) {
4509 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4510 			    shm_offset + (i * 2));
4511 			tmp |= 0x100;
4512 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4513 			    tmp);
4514 		} else {
4515 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4516 			    params[i]);
4517 		}
4518 	}
4519 }
4520 
4521 static void
4522 bwn_mac_write_bssid(struct bwn_mac *mac)
4523 {
4524 	struct bwn_softc *sc = mac->mac_sc;
4525 	uint32_t tmp;
4526 	int i;
4527 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4528 
4529 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4530 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4531 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4532 	    IEEE80211_ADDR_LEN);
4533 
4534 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4535 		tmp = (uint32_t) (mac_bssid[i + 0]);
4536 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4537 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4538 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4539 		bwn_ram_write(mac, 0x20 + i, tmp);
4540 	}
4541 }
4542 
4543 static void
4544 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4545     const uint8_t *macaddr)
4546 {
4547 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4548 	uint16_t data;
4549 
4550 	if (!mac)
4551 		macaddr = zero;
4552 
4553 	offset |= 0x0020;
4554 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4555 
4556 	data = macaddr[0];
4557 	data |= macaddr[1] << 8;
4558 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4559 	data = macaddr[2];
4560 	data |= macaddr[3] << 8;
4561 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4562 	data = macaddr[4];
4563 	data |= macaddr[5] << 8;
4564 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4565 }
4566 
4567 static void
4568 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4569     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4570 {
4571 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4572 	uint8_t per_sta_keys_start = 8;
4573 
4574 	if (BWN_SEC_NEWAPI(mac))
4575 		per_sta_keys_start = 4;
4576 
4577 	KASSERT(index < mac->mac_max_nr_keys,
4578 	    ("%s:%d: fail", __func__, __LINE__));
4579 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4580 	    ("%s:%d: fail", __func__, __LINE__));
4581 
4582 	if (index >= per_sta_keys_start)
4583 		bwn_key_macwrite(mac, index, NULL);
4584 	if (key)
4585 		memcpy(buf, key, key_len);
4586 	bwn_key_write(mac, index, algorithm, buf);
4587 	if (index >= per_sta_keys_start)
4588 		bwn_key_macwrite(mac, index, mac_addr);
4589 
4590 	mac->mac_key[index].algorithm = algorithm;
4591 }
4592 
4593 static void
4594 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4595 {
4596 	struct bwn_softc *sc = mac->mac_sc;
4597 	uint32_t addrtmp[2] = { 0, 0 };
4598 	uint8_t start = 8;
4599 
4600 	if (BWN_SEC_NEWAPI(mac))
4601 		start = 4;
4602 
4603 	KASSERT(index >= start,
4604 	    ("%s:%d: fail", __func__, __LINE__));
4605 	index -= start;
4606 
4607 	if (addr) {
4608 		addrtmp[0] = addr[0];
4609 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4610 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4611 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4612 		addrtmp[1] = addr[4];
4613 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4614 	}
4615 
4616 	if (siba_get_revid(sc->sc_dev) >= 5) {
4617 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4618 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4619 	} else {
4620 		if (index >= 8) {
4621 			bwn_shm_write_4(mac, BWN_SHARED,
4622 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4623 			bwn_shm_write_2(mac, BWN_SHARED,
4624 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4625 		}
4626 	}
4627 }
4628 
4629 static void
4630 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4631     const uint8_t *key)
4632 {
4633 	unsigned int i;
4634 	uint32_t offset;
4635 	uint16_t kidx, value;
4636 
4637 	kidx = BWN_SEC_KEY2FW(mac, index);
4638 	bwn_shm_write_2(mac, BWN_SHARED,
4639 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4640 
4641 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4642 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4643 		value = key[i];
4644 		value |= (uint16_t)(key[i + 1]) << 8;
4645 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4646 	}
4647 }
4648 
4649 static void
4650 bwn_phy_exit(struct bwn_mac *mac)
4651 {
4652 
4653 	mac->mac_phy.rf_onoff(mac, 0);
4654 	if (mac->mac_phy.exit != NULL)
4655 		mac->mac_phy.exit(mac);
4656 }
4657 
4658 static void
4659 bwn_dma_free(struct bwn_mac *mac)
4660 {
4661 	struct bwn_dma *dma;
4662 
4663 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4664 		return;
4665 	dma = &mac->mac_method.dma;
4666 
4667 	bwn_dma_ringfree(&dma->rx);
4668 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4669 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4670 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4671 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4672 	bwn_dma_ringfree(&dma->mcast);
4673 }
4674 
4675 static void
4676 bwn_core_stop(struct bwn_mac *mac)
4677 {
4678 	struct bwn_softc *sc = mac->mac_sc;
4679 
4680 	BWN_ASSERT_LOCKED(sc);
4681 
4682 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4683 		return;
4684 
4685 	callout_stop(&sc->sc_rfswitch_ch);
4686 	callout_stop(&sc->sc_task_ch);
4687 	callout_stop(&sc->sc_watchdog_ch);
4688 	sc->sc_watchdog_timer = 0;
4689 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4690 	BWN_READ_4(mac, BWN_INTR_MASK);
4691 	bwn_mac_suspend(mac);
4692 
4693 	mac->mac_status = BWN_MAC_STATUS_INITED;
4694 }
4695 
4696 static int
4697 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4698 {
4699 	struct bwn_mac *up_dev = NULL;
4700 	struct bwn_mac *down_dev;
4701 	struct bwn_mac *mac;
4702 	int err, status;
4703 	uint8_t gmode;
4704 
4705 	BWN_ASSERT_LOCKED(sc);
4706 
4707 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4708 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4709 		    mac->mac_phy.supports_2ghz) {
4710 			up_dev = mac;
4711 			gmode = 1;
4712 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4713 		    mac->mac_phy.supports_5ghz) {
4714 			up_dev = mac;
4715 			gmode = 0;
4716 		} else {
4717 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4718 			return (EINVAL);
4719 		}
4720 		if (up_dev != NULL)
4721 			break;
4722 	}
4723 	if (up_dev == NULL) {
4724 		device_printf(sc->sc_dev, "Could not find a device\n");
4725 		return (ENODEV);
4726 	}
4727 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4728 		return (0);
4729 
4730 	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4731 	    "switching to %s-GHz band\n",
4732 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4733 
4734 	down_dev = sc->sc_curmac;
4735 	status = down_dev->mac_status;
4736 	if (status >= BWN_MAC_STATUS_STARTED)
4737 		bwn_core_stop(down_dev);
4738 	if (status >= BWN_MAC_STATUS_INITED)
4739 		bwn_core_exit(down_dev);
4740 
4741 	if (down_dev != up_dev)
4742 		bwn_phy_reset(down_dev);
4743 
4744 	up_dev->mac_phy.gmode = gmode;
4745 	if (status >= BWN_MAC_STATUS_INITED) {
4746 		err = bwn_core_init(up_dev);
4747 		if (err) {
4748 			device_printf(sc->sc_dev,
4749 			    "fatal: failed to initialize for %s-GHz\n",
4750 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4751 			goto fail;
4752 		}
4753 	}
4754 	if (status >= BWN_MAC_STATUS_STARTED)
4755 		bwn_core_start(up_dev);
4756 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4757 	sc->sc_curmac = up_dev;
4758 
4759 	return (0);
4760 fail:
4761 	sc->sc_curmac = NULL;
4762 	return (err);
4763 }
4764 
4765 static void
4766 bwn_rf_turnon(struct bwn_mac *mac)
4767 {
4768 
4769 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4770 
4771 	bwn_mac_suspend(mac);
4772 	mac->mac_phy.rf_onoff(mac, 1);
4773 	mac->mac_phy.rf_on = 1;
4774 	bwn_mac_enable(mac);
4775 }
4776 
4777 static void
4778 bwn_rf_turnoff(struct bwn_mac *mac)
4779 {
4780 
4781 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4782 
4783 	bwn_mac_suspend(mac);
4784 	mac->mac_phy.rf_onoff(mac, 0);
4785 	mac->mac_phy.rf_on = 0;
4786 	bwn_mac_enable(mac);
4787 }
4788 
4789 /*
4790  * SSB PHY reset.
4791  *
4792  * XXX TODO: BCMA PHY reset.
4793  */
4794 static void
4795 bwn_phy_reset(struct bwn_mac *mac)
4796 {
4797 	struct bwn_softc *sc = mac->mac_sc;
4798 
4799 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4800 	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4801 	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4802 	DELAY(1000);
4803 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4804 	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4805 	DELAY(1000);
4806 }
4807 
4808 static int
4809 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4810 {
4811 	struct bwn_vap *bvp = BWN_VAP(vap);
4812 	struct ieee80211com *ic= vap->iv_ic;
4813 	enum ieee80211_state ostate = vap->iv_state;
4814 	struct bwn_softc *sc = ic->ic_softc;
4815 	struct bwn_mac *mac = sc->sc_curmac;
4816 	int error;
4817 
4818 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4819 	    ieee80211_state_name[vap->iv_state],
4820 	    ieee80211_state_name[nstate]);
4821 
4822 	error = bvp->bv_newstate(vap, nstate, arg);
4823 	if (error != 0)
4824 		return (error);
4825 
4826 	BWN_LOCK(sc);
4827 
4828 	bwn_led_newstate(mac, nstate);
4829 
4830 	/*
4831 	 * Clear the BSSID when we stop a STA
4832 	 */
4833 	if (vap->iv_opmode == IEEE80211_M_STA) {
4834 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4835 			/*
4836 			 * Clear out the BSSID.  If we reassociate to
4837 			 * the same AP, this will reinialize things
4838 			 * correctly...
4839 			 */
4840 			if (ic->ic_opmode == IEEE80211_M_STA &&
4841 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4842 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4843 				bwn_set_macaddr(mac);
4844 			}
4845 		}
4846 	}
4847 
4848 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4849 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4850 		/* XXX nothing to do? */
4851 	} else if (nstate == IEEE80211_S_RUN) {
4852 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4853 		bwn_set_opmode(mac);
4854 		bwn_set_pretbtt(mac);
4855 		bwn_spu_setdelay(mac, 0);
4856 		bwn_set_macaddr(mac);
4857 	}
4858 
4859 	BWN_UNLOCK(sc);
4860 
4861 	return (error);
4862 }
4863 
4864 static void
4865 bwn_set_pretbtt(struct bwn_mac *mac)
4866 {
4867 	struct bwn_softc *sc = mac->mac_sc;
4868 	struct ieee80211com *ic = &sc->sc_ic;
4869 	uint16_t pretbtt;
4870 
4871 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4872 		pretbtt = 2;
4873 	else
4874 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4875 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4876 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4877 }
4878 
4879 #if defined(__DragonFly__)
4880 static void
4881 bwn_intr(void *arg)
4882 #else
4883 static int
4884 bwn_intr(void *arg)
4885 #endif
4886 {
4887 	struct bwn_mac *mac = arg;
4888 	struct bwn_softc *sc = mac->mac_sc;
4889 	uint32_t reason;
4890 
4891 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4892 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4893 #if defined(__DragonFly__)
4894 		return;
4895 #else
4896 		return (FILTER_STRAY);
4897 #endif
4898 	}
4899 
4900 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4901 	if (reason == 0xffffffff) {	/* shared IRQ */
4902 #if defined(__DragonFly__)
4903 		return;
4904 #else
4905 		return (FILTER_STRAY);
4906 #endif
4907 	}
4908 	reason &= mac->mac_intr_mask;
4909 	if (reason == 0) {
4910 #if defined(__DragonFly__)
4911 		return;
4912 #else
4913 		return (FILTER_HANDLED);
4914 #endif
4915 	}
4916 
4917 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001fc00;
4918 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4919 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4920 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4921 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4922 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4923 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4924 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4925 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4926 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4927 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4928 
4929 	/* Disable interrupts. */
4930 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4931 
4932 	mac->mac_reason_intr = reason;
4933 
4934 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4935 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4936 
4937 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4938 #if !defined(__DragonFly__)
4939 	return (FILTER_HANDLED);
4940 #endif
4941 }
4942 
4943 static void
4944 bwn_intrtask(void *arg, int npending)
4945 {
4946 	struct bwn_mac *mac = arg;
4947 	struct bwn_softc *sc = mac->mac_sc;
4948 	uint32_t merged = 0;
4949 	int i, tx = 0, rx = 0;
4950 
4951 	BWN_LOCK(sc);
4952 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4953 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4954 		BWN_UNLOCK(sc);
4955 		return;
4956 	}
4957 
4958 	for (i = 0; i < N(mac->mac_reason); i++)
4959 		merged |= mac->mac_reason[i];
4960 
4961 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4962 		device_printf(sc->sc_dev, "MAC trans error\n");
4963 
4964 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4965 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4966 		mac->mac_phy.txerrors--;
4967 		if (mac->mac_phy.txerrors == 0) {
4968 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4969 			bwn_restart(mac, "PHY TX errors");
4970 		}
4971 	}
4972 
4973 	if (merged & BWN_DMAINTR_FATALMASK) {
4974 		device_printf(sc->sc_dev,
4975 		    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4976 		    mac->mac_reason[0], mac->mac_reason[1],
4977 		    mac->mac_reason[2], mac->mac_reason[3],
4978 		    mac->mac_reason[4], mac->mac_reason[5]);
4979 		bwn_restart(mac, "DMA error");
4980 		BWN_UNLOCK(sc);
4981 		return;
4982 	}
4983 
4984 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4985 		bwn_intr_ucode_debug(mac);
4986 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4987 		bwn_intr_tbtt_indication(mac);
4988 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4989 		bwn_intr_atim_end(mac);
4990 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4991 		bwn_intr_beacon(mac);
4992 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4993 		bwn_intr_pmq(mac);
4994 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4995 		bwn_intr_noise(mac);
4996 
4997 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4998 		if (mac->mac_reason[0] & BWN_DMAINTR_RDESC_UFLOW) {
4999 			device_printf(sc->sc_dev, "RX descriptor overflow\n");
5000 			bwn_dma_rx_handle_overflow(mac->mac_method.dma.rx);
5001 		}
5002 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
5003 			bwn_dma_rx(mac->mac_method.dma.rx);
5004 			rx = 1;
5005 		}
5006 	} else
5007 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
5008 
5009 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5010 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5011 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5012 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5013 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5014 
5015 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
5016 		bwn_intr_txeof(mac);
5017 		tx = 1;
5018 	}
5019 
5020 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
5021 
5022 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
5023 		int evt = BWN_LED_EVENT_NONE;
5024 
5025 		if (tx && rx) {
5026 			if (sc->sc_rx_rate > sc->sc_tx_rate)
5027 				evt = BWN_LED_EVENT_RX;
5028 			else
5029 				evt = BWN_LED_EVENT_TX;
5030 		} else if (tx) {
5031 			evt = BWN_LED_EVENT_TX;
5032 		} else if (rx) {
5033 			evt = BWN_LED_EVENT_RX;
5034 		} else if (rx == 0) {
5035 			evt = BWN_LED_EVENT_POLL;
5036 		}
5037 
5038 		if (evt != BWN_LED_EVENT_NONE)
5039 			bwn_led_event(mac, evt);
5040        }
5041 
5042 	if (mbufq_first(&sc->sc_snd) != NULL)
5043 		bwn_start(sc);
5044 
5045 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
5046 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
5047 
5048 	BWN_UNLOCK(sc);
5049 }
5050 
5051 static void
5052 bwn_restart(struct bwn_mac *mac, const char *msg)
5053 {
5054 	struct bwn_softc *sc = mac->mac_sc;
5055 	struct ieee80211com *ic = &sc->sc_ic;
5056 
5057 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
5058 		return;
5059 
5060 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5061 	ieee80211_runtask(ic, &mac->mac_hwreset);
5062 }
5063 
5064 static void
5065 bwn_intr_ucode_debug(struct bwn_mac *mac)
5066 {
5067 	struct bwn_softc *sc = mac->mac_sc;
5068 	uint16_t reason;
5069 
5070 	if (mac->mac_fw.opensource == 0)
5071 		return;
5072 
5073 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5074 	switch (reason) {
5075 	case BWN_DEBUGINTR_PANIC:
5076 		bwn_handle_fwpanic(mac);
5077 		break;
5078 	case BWN_DEBUGINTR_DUMP_SHM:
5079 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5080 		break;
5081 	case BWN_DEBUGINTR_DUMP_REGS:
5082 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5083 		break;
5084 	case BWN_DEBUGINTR_MARKER:
5085 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5086 		break;
5087 	default:
5088 		device_printf(sc->sc_dev,
5089 		    "ucode debug unknown reason: %#x\n", reason);
5090 	}
5091 
5092 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5093 	    BWN_DEBUGINTR_ACK);
5094 }
5095 
5096 static void
5097 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5098 {
5099 	struct bwn_softc *sc = mac->mac_sc;
5100 	struct ieee80211com *ic = &sc->sc_ic;
5101 
5102 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5103 		bwn_psctl(mac, 0);
5104 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5105 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5106 }
5107 
5108 static void
5109 bwn_intr_atim_end(struct bwn_mac *mac)
5110 {
5111 
5112 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5113 		BWN_WRITE_4(mac, BWN_MACCMD,
5114 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5115 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5116 	}
5117 }
5118 
5119 static void
5120 bwn_intr_beacon(struct bwn_mac *mac)
5121 {
5122 	struct bwn_softc *sc = mac->mac_sc;
5123 	struct ieee80211com *ic = &sc->sc_ic;
5124 	uint32_t cmd, beacon0, beacon1;
5125 
5126 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5127 	    ic->ic_opmode == IEEE80211_M_MBSS)
5128 		return;
5129 
5130 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5131 
5132 	cmd = BWN_READ_4(mac, BWN_MACCMD);
5133 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5134 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5135 
5136 	if (beacon0 && beacon1) {
5137 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5138 		mac->mac_intr_mask |= BWN_INTR_BEACON;
5139 		return;
5140 	}
5141 
5142 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5143 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5144 		bwn_load_beacon0(mac);
5145 		bwn_load_beacon1(mac);
5146 		cmd = BWN_READ_4(mac, BWN_MACCMD);
5147 		cmd |= BWN_MACCMD_BEACON0_VALID;
5148 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5149 	} else {
5150 		if (!beacon0) {
5151 			bwn_load_beacon0(mac);
5152 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5153 			cmd |= BWN_MACCMD_BEACON0_VALID;
5154 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5155 		} else if (!beacon1) {
5156 			bwn_load_beacon1(mac);
5157 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5158 			cmd |= BWN_MACCMD_BEACON1_VALID;
5159 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5160 		}
5161 	}
5162 }
5163 
5164 static void
5165 bwn_intr_pmq(struct bwn_mac *mac)
5166 {
5167 	uint32_t tmp;
5168 
5169 	while (1) {
5170 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5171 		if (!(tmp & 0x00000008))
5172 			break;
5173 	}
5174 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5175 }
5176 
5177 static void
5178 bwn_intr_noise(struct bwn_mac *mac)
5179 {
5180 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5181 	uint16_t tmp;
5182 	uint8_t noise[4];
5183 	uint8_t i, j;
5184 	int32_t average;
5185 
5186 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5187 		return;
5188 
5189 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5190 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5191 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5192 	    noise[3] == 0x7f)
5193 		goto new;
5194 
5195 	KASSERT(mac->mac_noise.noi_nsamples < 8,
5196 	    ("%s:%d: fail", __func__, __LINE__));
5197 	i = mac->mac_noise.noi_nsamples;
5198 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5199 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5200 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5201 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5202 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5203 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5204 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5205 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5206 	mac->mac_noise.noi_nsamples++;
5207 	if (mac->mac_noise.noi_nsamples == 8) {
5208 		average = 0;
5209 		for (i = 0; i < 8; i++) {
5210 			for (j = 0; j < 4; j++)
5211 				average += mac->mac_noise.noi_samples[i][j];
5212 		}
5213 		average = (((average / 32) * 125) + 64) / 128;
5214 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5215 		if (tmp >= 8)
5216 			average += 2;
5217 		else
5218 			average -= 25;
5219 		average -= (tmp == 8) ? 72 : 48;
5220 
5221 		mac->mac_stats.link_noise = average;
5222 		mac->mac_noise.noi_running = 0;
5223 		return;
5224 	}
5225 new:
5226 	bwn_noise_gensample(mac);
5227 }
5228 
5229 static int
5230 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5231 {
5232 	struct bwn_mac *mac = prq->prq_mac;
5233 	struct bwn_softc *sc = mac->mac_sc;
5234 	unsigned int i;
5235 
5236 	BWN_ASSERT_LOCKED(sc);
5237 
5238 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5239 		return (0);
5240 
5241 	for (i = 0; i < 5000; i++) {
5242 		if (bwn_pio_rxeof(prq) == 0)
5243 			break;
5244 	}
5245 	if (i >= 5000)
5246 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5247 	return ((i > 0) ? 1 : 0);
5248 }
5249 
5250 static void
5251 bwn_dma_rx_handle_overflow(struct bwn_dma_ring *dr)
5252 {
5253 	int curslot, prevslot;
5254 
5255 	curslot = dr->get_curslot(dr);
5256 	if (curslot == 0)
5257 		prevslot = dr->dr_numslots - 1;
5258 	else
5259 		prevslot = curslot - 1;
5260 	dr->set_curslot(dr, prevslot);
5261 }
5262 
5263 static void
5264 bwn_dma_rx(struct bwn_dma_ring *dr)
5265 {
5266 	int slot, curslot;
5267 
5268 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5269 	curslot = dr->get_curslot(dr);
5270 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5271 	    ("%s:%d: fail", __func__, __LINE__));
5272 
5273 	slot = dr->dr_curslot;
5274 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5275 		bwn_dma_rxeof(dr, &slot);
5276 
5277 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5278 	    BUS_DMASYNC_PREWRITE);
5279 
5280 	dr->set_curslot(dr, slot);
5281 	dr->dr_curslot = slot;
5282 }
5283 
5284 static void
5285 bwn_intr_txeof(struct bwn_mac *mac)
5286 {
5287 	struct bwn_txstatus stat;
5288 	uint32_t stat0, stat1;
5289 	uint16_t tmp;
5290 
5291 	BWN_ASSERT_LOCKED(mac->mac_sc);
5292 
5293 	while (1) {
5294 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5295 		if (!(stat0 & 0x00000001))
5296 			break;
5297 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5298 
5299 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5300 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5301 		    __func__,
5302 		    stat0,
5303 		    stat1);
5304 
5305 		stat.cookie = (stat0 >> 16);
5306 		stat.seq = (stat1 & 0x0000ffff);
5307 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5308 		tmp = (stat0 & 0x0000ffff);
5309 		stat.framecnt = ((tmp & 0xf000) >> 12);
5310 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5311 		stat.sreason = ((tmp & 0x001c) >> 2);
5312 		stat.pm = (tmp & 0x0080) ? 1 : 0;
5313 		stat.im = (tmp & 0x0040) ? 1 : 0;
5314 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5315 		stat.ack = (tmp & 0x0002) ? 1 : 0;
5316 
5317 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5318 		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5319 		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5320 		    __func__,
5321 		    stat.cookie,
5322 		    stat.seq,
5323 		    stat.phy_stat,
5324 		    stat.framecnt,
5325 		    stat.rtscnt,
5326 		    stat.sreason,
5327 		    stat.pm,
5328 		    stat.im,
5329 		    stat.ampdu,
5330 		    stat.ack);
5331 
5332 		bwn_handle_txeof(mac, &stat);
5333 	}
5334 }
5335 
5336 static void
5337 bwn_hwreset(void *arg, int npending)
5338 {
5339 	struct bwn_mac *mac = arg;
5340 	struct bwn_softc *sc = mac->mac_sc;
5341 	int error = 0;
5342 	int prev_status;
5343 
5344 	BWN_LOCK(sc);
5345 
5346 	prev_status = mac->mac_status;
5347 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5348 		bwn_core_stop(mac);
5349 	if (prev_status >= BWN_MAC_STATUS_INITED)
5350 		bwn_core_exit(mac);
5351 
5352 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5353 		error = bwn_core_init(mac);
5354 		if (error)
5355 			goto out;
5356 	}
5357 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5358 		bwn_core_start(mac);
5359 out:
5360 	if (error) {
5361 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5362 		sc->sc_curmac = NULL;
5363 	}
5364 	BWN_UNLOCK(sc);
5365 }
5366 
5367 static void
5368 bwn_handle_fwpanic(struct bwn_mac *mac)
5369 {
5370 	struct bwn_softc *sc = mac->mac_sc;
5371 	uint16_t reason;
5372 
5373 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5374 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5375 
5376 	if (reason == BWN_FWPANIC_RESTART)
5377 		bwn_restart(mac, "ucode panic");
5378 }
5379 
5380 static void
5381 bwn_load_beacon0(struct bwn_mac *mac)
5382 {
5383 
5384 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5385 }
5386 
5387 static void
5388 bwn_load_beacon1(struct bwn_mac *mac)
5389 {
5390 
5391 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5392 }
5393 
5394 static uint32_t
5395 bwn_jssi_read(struct bwn_mac *mac)
5396 {
5397 	uint32_t val = 0;
5398 
5399 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5400 	val <<= 16;
5401 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5402 
5403 	return (val);
5404 }
5405 
5406 static void
5407 bwn_noise_gensample(struct bwn_mac *mac)
5408 {
5409 	uint32_t jssi = 0x7f7f7f7f;
5410 
5411 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5412 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5413 	BWN_WRITE_4(mac, BWN_MACCMD,
5414 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5415 }
5416 
5417 static int
5418 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5419 {
5420 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5421 
5422 	return (dr->dr_numslots - dr->dr_usedslot);
5423 }
5424 
5425 static int
5426 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5427 {
5428 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5429 
5430 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5431 	    ("%s:%d: fail", __func__, __LINE__));
5432 	if (slot == dr->dr_numslots - 1)
5433 		return (0);
5434 	return (slot + 1);
5435 }
5436 
5437 static void
5438 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5439 {
5440 	struct bwn_mac *mac = dr->dr_mac;
5441 	struct bwn_softc *sc = mac->mac_sc;
5442 	struct bwn_dma *dma = &mac->mac_method.dma;
5443 	struct bwn_dmadesc_generic *desc;
5444 	struct bwn_dmadesc_meta *meta;
5445 	struct bwn_rxhdr4 *rxhdr;
5446 	struct mbuf *m;
5447 	uint32_t macstat;
5448 	int32_t tmp;
5449 	int cnt = 0;
5450 	uint16_t len;
5451 
5452 	dr->getdesc(dr, *slot, &desc, &meta);
5453 
5454 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5455 	m = meta->mt_m;
5456 
5457 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5458 #if defined(__DragonFly__)
5459 		++sc->sc_ic.ic_ierrors;
5460 #else
5461 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5462 #endif
5463 		return;
5464 	}
5465 
5466 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5467 	len = le16toh(rxhdr->frame_len);
5468 	if (len <= 0) {
5469 #if defined(__DragonFly__)
5470 		++sc->sc_ic.ic_ierrors;
5471 #else
5472 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5473 #endif
5474 		return;
5475 	}
5476 	if (bwn_dma_check_redzone(dr, m)) {
5477 		device_printf(sc->sc_dev, "redzone error.\n");
5478 		bwn_dma_set_redzone(dr, m);
5479 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5480 		    BUS_DMASYNC_PREWRITE);
5481 		return;
5482 	}
5483 	if (len > dr->dr_rx_bufsize) {
5484 		tmp = len;
5485 		while (1) {
5486 			dr->getdesc(dr, *slot, &desc, &meta);
5487 			bwn_dma_set_redzone(dr, meta->mt_m);
5488 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5489 			    BUS_DMASYNC_PREWRITE);
5490 			*slot = bwn_dma_nextslot(dr, *slot);
5491 			cnt++;
5492 			tmp -= dr->dr_rx_bufsize;
5493 			if (tmp <= 0)
5494 				break;
5495 		}
5496 		device_printf(sc->sc_dev, "too small buffer "
5497 		       "(len %u buffer %u dropped %d)\n",
5498 		       len, dr->dr_rx_bufsize, cnt);
5499 		return;
5500 	}
5501 	macstat = le32toh(rxhdr->mac_status);
5502 	if (macstat & BWN_RX_MAC_FCSERR) {
5503 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5504 			device_printf(sc->sc_dev, "RX drop\n");
5505 			return;
5506 		}
5507 	}
5508 
5509 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5510 	m_adj(m, dr->dr_frameoffset);
5511 
5512 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5513 }
5514 
5515 static void
5516 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5517 {
5518 	struct bwn_softc *sc = mac->mac_sc;
5519 	struct bwn_stats *stats = &mac->mac_stats;
5520 
5521 	BWN_ASSERT_LOCKED(mac->mac_sc);
5522 
5523 	if (status->im)
5524 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5525 	if (status->ampdu)
5526 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5527 	if (status->rtscnt) {
5528 		if (status->rtscnt == 0xf)
5529 			stats->rtsfail++;
5530 		else
5531 			stats->rts++;
5532 	}
5533 
5534 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5535 		bwn_dma_handle_txeof(mac, status);
5536 	} else {
5537 		bwn_pio_handle_txeof(mac, status);
5538 	}
5539 
5540 	bwn_phy_txpower_check(mac, 0);
5541 }
5542 
5543 static uint8_t
5544 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5545 {
5546 	struct bwn_mac *mac = prq->prq_mac;
5547 	struct bwn_softc *sc = mac->mac_sc;
5548 	struct bwn_rxhdr4 rxhdr;
5549 	struct mbuf *m;
5550 	uint32_t ctl32, macstat, v32;
5551 	unsigned int i, padding;
5552 	uint16_t ctl16, len, totlen, v16;
5553 	unsigned char *mp;
5554 	char *data;
5555 
5556 	memset(&rxhdr, 0, sizeof(rxhdr));
5557 
5558 	if (prq->prq_rev >= 8) {
5559 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5560 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5561 			return (0);
5562 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5563 		    BWN_PIO8_RXCTL_FRAMEREADY);
5564 		for (i = 0; i < 10; i++) {
5565 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5566 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5567 				goto ready;
5568 			DELAY(10);
5569 		}
5570 	} else {
5571 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5572 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5573 			return (0);
5574 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5575 		    BWN_PIO_RXCTL_FRAMEREADY);
5576 		for (i = 0; i < 10; i++) {
5577 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5578 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5579 				goto ready;
5580 			DELAY(10);
5581 		}
5582 	}
5583 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5584 	return (1);
5585 ready:
5586 	if (prq->prq_rev >= 8)
5587 		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5588 		    prq->prq_base + BWN_PIO8_RXDATA);
5589 	else
5590 		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5591 		    prq->prq_base + BWN_PIO_RXDATA);
5592 	len = le16toh(rxhdr.frame_len);
5593 	if (len > 0x700) {
5594 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5595 		goto error;
5596 	}
5597 	if (len == 0) {
5598 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5599 		goto error;
5600 	}
5601 
5602 	macstat = le32toh(rxhdr.mac_status);
5603 	if (macstat & BWN_RX_MAC_FCSERR) {
5604 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5605 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5606 			goto error;
5607 		}
5608 	}
5609 
5610 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5611 	totlen = len + padding;
5612 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5613 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5614 	if (m == NULL) {
5615 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5616 		goto error;
5617 	}
5618 	mp = mtod(m, unsigned char *);
5619 	if (prq->prq_rev >= 8) {
5620 		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5621 		    prq->prq_base + BWN_PIO8_RXDATA);
5622 		if (totlen & 3) {
5623 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5624 			data = &(mp[totlen - 1]);
5625 			switch (totlen & 3) {
5626 			case 3:
5627 				*data = (v32 >> 16);
5628 				data--;
5629 			case 2:
5630 				*data = (v32 >> 8);
5631 				data--;
5632 			case 1:
5633 				*data = v32;
5634 			}
5635 		}
5636 	} else {
5637 		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5638 		    prq->prq_base + BWN_PIO_RXDATA);
5639 		if (totlen & 1) {
5640 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5641 			mp[totlen - 1] = v16;
5642 		}
5643 	}
5644 
5645 	m->m_len = m->m_pkthdr.len = totlen;
5646 
5647 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5648 
5649 	return (1);
5650 error:
5651 	if (prq->prq_rev >= 8)
5652 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5653 		    BWN_PIO8_RXCTL_DATAREADY);
5654 	else
5655 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5656 	return (1);
5657 }
5658 
5659 static int
5660 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5661     struct bwn_dmadesc_meta *meta, int init)
5662 {
5663 	struct bwn_mac *mac = dr->dr_mac;
5664 	struct bwn_dma *dma = &mac->mac_method.dma;
5665 	struct bwn_rxhdr4 *hdr;
5666 	bus_dmamap_t map;
5667 	bus_addr_t paddr;
5668 	struct mbuf *m;
5669 	int error;
5670 
5671 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5672 	if (m == NULL) {
5673 		error = ENOBUFS;
5674 
5675 		/*
5676 		 * If the NIC is up and running, we need to:
5677 		 * - Clear RX buffer's header.
5678 		 * - Restore RX descriptor settings.
5679 		 */
5680 		if (init)
5681 			return (error);
5682 		else
5683 			goto back;
5684 	}
5685 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5686 
5687 	bwn_dma_set_redzone(dr, m);
5688 
5689 	/*
5690 	 * Try to load RX buf into temporary DMA map
5691 	 */
5692 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5693 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5694 	if (error) {
5695 		m_freem(m);
5696 
5697 		/*
5698 		 * See the comment above
5699 		 */
5700 		if (init)
5701 			return (error);
5702 		else
5703 			goto back;
5704 	}
5705 
5706 	if (!init)
5707 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5708 	meta->mt_m = m;
5709 	meta->mt_paddr = paddr;
5710 
5711 	/*
5712 	 * Swap RX buf's DMA map with the loaded temporary one
5713 	 */
5714 	map = meta->mt_dmap;
5715 	meta->mt_dmap = dr->dr_spare_dmap;
5716 	dr->dr_spare_dmap = map;
5717 
5718 back:
5719 	/*
5720 	 * Clear RX buf header
5721 	 */
5722 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5723 	bzero(hdr, sizeof(*hdr));
5724 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5725 	    BUS_DMASYNC_PREWRITE);
5726 
5727 	/*
5728 	 * Setup RX buf descriptor
5729 	 */
5730 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5731 	    sizeof(*hdr), 0, 0, 0);
5732 	return (error);
5733 }
5734 
5735 static void
5736 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5737 		 bus_size_t mapsz __unused, int error)
5738 {
5739 
5740 	if (!error) {
5741 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5742 		*((bus_addr_t *)arg) = seg->ds_addr;
5743 	}
5744 }
5745 
5746 static int
5747 bwn_hwrate2ieeerate(int rate)
5748 {
5749 
5750 	switch (rate) {
5751 	case BWN_CCK_RATE_1MB:
5752 		return (2);
5753 	case BWN_CCK_RATE_2MB:
5754 		return (4);
5755 	case BWN_CCK_RATE_5MB:
5756 		return (11);
5757 	case BWN_CCK_RATE_11MB:
5758 		return (22);
5759 	case BWN_OFDM_RATE_6MB:
5760 		return (12);
5761 	case BWN_OFDM_RATE_9MB:
5762 		return (18);
5763 	case BWN_OFDM_RATE_12MB:
5764 		return (24);
5765 	case BWN_OFDM_RATE_18MB:
5766 		return (36);
5767 	case BWN_OFDM_RATE_24MB:
5768 		return (48);
5769 	case BWN_OFDM_RATE_36MB:
5770 		return (72);
5771 	case BWN_OFDM_RATE_48MB:
5772 		return (96);
5773 	case BWN_OFDM_RATE_54MB:
5774 		return (108);
5775 	default:
5776 		kprintf("Ooops\n");
5777 		return (0);
5778 	}
5779 }
5780 
5781 /*
5782  * Post process the RX provided RSSI.
5783  *
5784  * Valid for A, B, G, LP PHYs.
5785  */
5786 static int8_t
5787 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5788     int ofdm, int adjust_2053, int adjust_2050)
5789 {
5790 	struct bwn_phy *phy = &mac->mac_phy;
5791 	struct bwn_phy_g *gphy = &phy->phy_g;
5792 	int tmp;
5793 
5794 	switch (phy->rf_ver) {
5795 	case 0x2050:
5796 		if (ofdm) {
5797 			tmp = in_rssi;
5798 			if (tmp > 127)
5799 				tmp -= 256;
5800 			tmp = tmp * 73 / 64;
5801 			if (adjust_2050)
5802 				tmp += 25;
5803 			else
5804 				tmp -= 3;
5805 		} else {
5806 			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5807 			    & BWN_BFL_RSSI) {
5808 				if (in_rssi > 63)
5809 					in_rssi = 63;
5810 				tmp = gphy->pg_nrssi_lt[in_rssi];
5811 				tmp = (31 - tmp) * -131 / 128 - 57;
5812 			} else {
5813 				tmp = in_rssi;
5814 				tmp = (31 - tmp) * -149 / 128 - 68;
5815 			}
5816 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5817 				tmp += 25;
5818 		}
5819 		break;
5820 	case 0x2060:
5821 		if (in_rssi > 127)
5822 			tmp = in_rssi - 256;
5823 		else
5824 			tmp = in_rssi;
5825 		break;
5826 	default:
5827 		tmp = in_rssi;
5828 		tmp = (tmp - 11) * 103 / 64;
5829 		if (adjust_2053)
5830 			tmp -= 109;
5831 		else
5832 			tmp -= 83;
5833 	}
5834 
5835 	return (tmp);
5836 }
5837 
5838 static void
5839 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5840 {
5841 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5842 	struct bwn_plcp6 *plcp;
5843 	struct bwn_softc *sc = mac->mac_sc;
5844 	struct ieee80211_frame_min *wh;
5845 	struct ieee80211_node *ni;
5846 	struct ieee80211com *ic = &sc->sc_ic;
5847 	uint32_t macstat;
5848 	int padding, rate, rssi = 0, noise = 0, type;
5849 	uint16_t phytype, phystat0, phystat3, chanstat;
5850 	unsigned char *mp = mtod(m, unsigned char *);
5851 	static int rx_mac_dec_rpt = 0;
5852 
5853 	BWN_ASSERT_LOCKED(sc);
5854 
5855 	phystat0 = le16toh(rxhdr->phy_status0);
5856 	phystat3 = le16toh(rxhdr->phy_status3);
5857 
5858 	/* XXX Note: mactime, macstat, chanstat need fixing for fw 598 */
5859 	macstat = le32toh(rxhdr->mac_status);
5860 	chanstat = le16toh(rxhdr->channel);
5861 
5862 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5863 
5864 	if (macstat & BWN_RX_MAC_FCSERR)
5865 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5866 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5867 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5868 	if (macstat & BWN_RX_MAC_DECERR)
5869 		goto drop;
5870 
5871 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5872 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5873 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5874 		    m->m_pkthdr.len);
5875 		goto drop;
5876 	}
5877 	plcp = (struct bwn_plcp6 *)(mp + padding);
5878 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5879 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5880 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5881 		    m->m_pkthdr.len);
5882 		goto drop;
5883 	}
5884 	wh = mtod(m, struct ieee80211_frame_min *);
5885 
5886 	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5887 		device_printf(sc->sc_dev,
5888 		    "RX decryption attempted (old %d keyidx %#x)\n",
5889 		    BWN_ISOLDFMT(mac),
5890 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5891 
5892 	if (phystat0 & BWN_RX_PHYST0_OFDM)
5893 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5894 		    phytype == BWN_PHYTYPE_A);
5895 	else
5896 		rate = bwn_plcp_get_cckrate(mac, plcp);
5897 	if (rate == -1) {
5898 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5899 			goto drop;
5900 	}
5901 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5902 
5903 	/* rssi/noise */
5904 	switch (phytype) {
5905 	case BWN_PHYTYPE_A:
5906 	case BWN_PHYTYPE_B:
5907 	case BWN_PHYTYPE_G:
5908 	case BWN_PHYTYPE_LP:
5909 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5910 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5911 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5912 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5913 		break;
5914 	case BWN_PHYTYPE_N:
5915 		/* Broadcom has code for min/avg, but always used max */
5916 		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5917 			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5918 		else
5919 			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5920 #if 0
5921 		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5922 		    "%s: power0=%d, power1=%d, power2=%d\n",
5923 		    __func__,
5924 		    rxhdr->phy.n.power0,
5925 		    rxhdr->phy.n.power1,
5926 		    rxhdr->ps2.n.power2);
5927 #endif
5928 		break;
5929 	default:
5930 		/* XXX TODO: implement rssi for other PHYs */
5931 		break;
5932 	}
5933 
5934 	/*
5935 	 * RSSI here is absolute, not relative to the noise floor.
5936 	 */
5937 	noise = mac->mac_stats.link_noise;
5938 	rssi = rssi - noise;
5939 
5940 	/* RX radio tap */
5941 	if (ieee80211_radiotap_active(ic))
5942 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5943 	m_adj(m, -IEEE80211_CRC_LEN);
5944 
5945 	BWN_UNLOCK(sc);
5946 
5947 	ni = ieee80211_find_rxnode(ic, wh);
5948 	if (ni != NULL) {
5949 		type = ieee80211_input(ni, m, rssi, noise);
5950 		ieee80211_free_node(ni);
5951 	} else
5952 		type = ieee80211_input_all(ic, m, rssi, noise);
5953 
5954 	BWN_LOCK(sc);
5955 	return;
5956 drop:
5957 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5958 }
5959 
5960 static void
5961 bwn_dma_handle_txeof(struct bwn_mac *mac,
5962     const struct bwn_txstatus *status)
5963 {
5964 	struct bwn_dma *dma = &mac->mac_method.dma;
5965 	struct bwn_dma_ring *dr;
5966 	struct bwn_dmadesc_generic *desc;
5967 	struct bwn_dmadesc_meta *meta;
5968 	struct bwn_softc *sc = mac->mac_sc;
5969 	int slot;
5970 	int retrycnt = 0;
5971 
5972 	BWN_ASSERT_LOCKED(sc);
5973 
5974 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5975 	if (dr == NULL) {
5976 		device_printf(sc->sc_dev, "failed to parse cookie\n");
5977 		return;
5978 	}
5979 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5980 
5981 	while (1) {
5982 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5983 		    ("%s:%d: fail", __func__, __LINE__));
5984 		dr->getdesc(dr, slot, &desc, &meta);
5985 
5986 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER) {
5987 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5988 		} else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY) {
5989 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5990 		}
5991 
5992 		if (meta->mt_islast) {
5993 			KASSERT(meta->mt_m != NULL,
5994 			    ("%s:%d: fail", __func__, __LINE__));
5995 
5996 			/*
5997 			 * If we don't get an ACK, then we should log the
5998 			 * full framecnt.  That may be 0 if it's a PHY
5999 			 * failure, so ensure that gets logged as some
6000 			 * retry attempt.
6001 			 */
6002 			if (status->ack) {
6003 				retrycnt = status->framecnt - 1;
6004 			} else {
6005 				retrycnt = status->framecnt;
6006 				if (retrycnt == 0)
6007 					retrycnt = 1;
6008 			}
6009 			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
6010 			    status->ack ?
6011 			      IEEE80211_RATECTL_TX_SUCCESS :
6012 			      IEEE80211_RATECTL_TX_FAILURE,
6013 			    &retrycnt, 0);
6014 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
6015 			meta->mt_ni = NULL;
6016 			meta->mt_m = NULL;
6017 		} else
6018 			KASSERT(meta->mt_m == NULL,
6019 			    ("%s:%d: fail", __func__, __LINE__));
6020 
6021 		dr->dr_usedslot--;
6022 		if (meta->mt_islast)
6023 			break;
6024 		slot = bwn_dma_nextslot(dr, slot);
6025 	}
6026 	sc->sc_watchdog_timer = 0;
6027 	if (dr->dr_stop) {
6028 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
6029 		    ("%s:%d: fail", __func__, __LINE__));
6030 		dr->dr_stop = 0;
6031 	}
6032 }
6033 
6034 static void
6035 bwn_pio_handle_txeof(struct bwn_mac *mac,
6036     const struct bwn_txstatus *status)
6037 {
6038 	struct bwn_pio_txqueue *tq;
6039 	struct bwn_pio_txpkt *tp = NULL;
6040 	struct bwn_softc *sc = mac->mac_sc;
6041 	int retrycnt = 0;
6042 
6043 	BWN_ASSERT_LOCKED(sc);
6044 
6045 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6046 	if (tq == NULL)
6047 		return;
6048 
6049 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6050 	tq->tq_free++;
6051 
6052 	if (tp->tp_ni != NULL) {
6053 		/*
6054 		 * Do any tx complete callback.  Note this must
6055 		 * be done before releasing the node reference.
6056 		 */
6057 
6058 		/*
6059 		 * If we don't get an ACK, then we should log the
6060 		 * full framecnt.  That may be 0 if it's a PHY
6061 		 * failure, so ensure that gets logged as some
6062 		 * retry attempt.
6063 		 */
6064 		if (status->ack) {
6065 			retrycnt = status->framecnt - 1;
6066 		} else {
6067 			retrycnt = status->framecnt;
6068 			if (retrycnt == 0)
6069 				retrycnt = 1;
6070 		}
6071 		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6072 		    status->ack ?
6073 		      IEEE80211_RATECTL_TX_SUCCESS :
6074 		      IEEE80211_RATECTL_TX_FAILURE,
6075 		    &retrycnt, 0);
6076 
6077 		if (tp->tp_m->m_flags & M_TXCB)
6078 			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6079 		ieee80211_free_node(tp->tp_ni);
6080 		tp->tp_ni = NULL;
6081 	}
6082 	m_freem(tp->tp_m);
6083 	tp->tp_m = NULL;
6084 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6085 
6086 	sc->sc_watchdog_timer = 0;
6087 }
6088 
6089 static void
6090 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6091 {
6092 	struct bwn_softc *sc = mac->mac_sc;
6093 	struct bwn_phy *phy = &mac->mac_phy;
6094 	struct ieee80211com *ic = &sc->sc_ic;
6095 	unsigned long now;
6096 	bwn_txpwr_result_t result;
6097 
6098 	BWN_GETTIME(now);
6099 
6100 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6101 		return;
6102 	phy->nexttime = now + 2 * 1000;
6103 
6104 	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6105 	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6106 		return;
6107 
6108 	if (phy->recalc_txpwr != NULL) {
6109 		result = phy->recalc_txpwr(mac,
6110 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6111 		if (result == BWN_TXPWR_RES_DONE)
6112 			return;
6113 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6114 		    ("%s: fail", __func__));
6115 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6116 
6117 		ieee80211_runtask(ic, &mac->mac_txpower);
6118 	}
6119 }
6120 
6121 static uint16_t
6122 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6123 {
6124 
6125 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6126 }
6127 
6128 static uint32_t
6129 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6130 {
6131 
6132 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6133 }
6134 
6135 static void
6136 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6137 {
6138 
6139 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6140 }
6141 
6142 static void
6143 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6144 {
6145 
6146 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6147 }
6148 
6149 static int
6150 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6151 {
6152 
6153 	switch (rate) {
6154 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6155 	case 12:
6156 		return (BWN_OFDM_RATE_6MB);
6157 	case 18:
6158 		return (BWN_OFDM_RATE_9MB);
6159 	case 24:
6160 		return (BWN_OFDM_RATE_12MB);
6161 	case 36:
6162 		return (BWN_OFDM_RATE_18MB);
6163 	case 48:
6164 		return (BWN_OFDM_RATE_24MB);
6165 	case 72:
6166 		return (BWN_OFDM_RATE_36MB);
6167 	case 96:
6168 		return (BWN_OFDM_RATE_48MB);
6169 	case 108:
6170 		return (BWN_OFDM_RATE_54MB);
6171 	/* CCK rates (NB: not IEEE std, device-specific) */
6172 	case 2:
6173 		return (BWN_CCK_RATE_1MB);
6174 	case 4:
6175 		return (BWN_CCK_RATE_2MB);
6176 	case 11:
6177 		return (BWN_CCK_RATE_5MB);
6178 	case 22:
6179 		return (BWN_CCK_RATE_11MB);
6180 	}
6181 
6182 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6183 	return (BWN_CCK_RATE_1MB);
6184 }
6185 
6186 static uint16_t
6187 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6188 {
6189 	struct bwn_phy *phy = &mac->mac_phy;
6190 	uint16_t control = 0;
6191 	uint16_t bw;
6192 
6193 	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6194 	bw = BWN_TXH_PHY1_BW_20;
6195 
6196 	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6197 		control = bw;
6198 	} else {
6199 		control = bw;
6200 		/* Figure out coding rate and modulation */
6201 		/* XXX TODO: table-ize, for MCS transmit */
6202 		/* Note: this is BWN_*_RATE values */
6203 		switch (bitrate) {
6204 		case BWN_CCK_RATE_1MB:
6205 			control |= 0;
6206 			break;
6207 		case BWN_CCK_RATE_2MB:
6208 			control |= 1;
6209 			break;
6210 		case BWN_CCK_RATE_5MB:
6211 			control |= 2;
6212 			break;
6213 		case BWN_CCK_RATE_11MB:
6214 			control |= 3;
6215 			break;
6216 		case BWN_OFDM_RATE_6MB:
6217 			control |= BWN_TXH_PHY1_CRATE_1_2;
6218 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6219 			break;
6220 		case BWN_OFDM_RATE_9MB:
6221 			control |= BWN_TXH_PHY1_CRATE_3_4;
6222 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6223 			break;
6224 		case BWN_OFDM_RATE_12MB:
6225 			control |= BWN_TXH_PHY1_CRATE_1_2;
6226 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6227 			break;
6228 		case BWN_OFDM_RATE_18MB:
6229 			control |= BWN_TXH_PHY1_CRATE_3_4;
6230 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6231 			break;
6232 		case BWN_OFDM_RATE_24MB:
6233 			control |= BWN_TXH_PHY1_CRATE_1_2;
6234 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6235 			break;
6236 		case BWN_OFDM_RATE_36MB:
6237 			control |= BWN_TXH_PHY1_CRATE_3_4;
6238 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6239 			break;
6240 		case BWN_OFDM_RATE_48MB:
6241 			control |= BWN_TXH_PHY1_CRATE_1_2;
6242 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6243 			break;
6244 		case BWN_OFDM_RATE_54MB:
6245 			control |= BWN_TXH_PHY1_CRATE_3_4;
6246 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6247 			break;
6248 		default:
6249 			break;
6250 		}
6251 		control |= BWN_TXH_PHY1_MODE_SISO;
6252 	}
6253 
6254 	return control;
6255 }
6256 
6257 static int
6258 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6259     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6260 {
6261 	const struct bwn_phy *phy = &mac->mac_phy;
6262 	struct bwn_softc *sc = mac->mac_sc;
6263 	struct ieee80211_frame *wh;
6264 	struct ieee80211_frame *protwh;
6265 	struct ieee80211_frame_cts *cts;
6266 	struct ieee80211_frame_rts *rts;
6267 	const struct ieee80211_txparam *tp;
6268 	struct ieee80211vap *vap = ni->ni_vap;
6269 	struct ieee80211com *ic = &sc->sc_ic;
6270 	struct mbuf *mprot;
6271 	unsigned int len;
6272 	uint32_t macctl = 0;
6273 	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6274 	uint16_t phyctl = 0;
6275 	uint8_t rate, rate_fb;
6276 	int fill_phy_ctl1 = 0;
6277 
6278 	wh = mtod(m, struct ieee80211_frame *);
6279 	memset(txhdr, 0, sizeof(*txhdr));
6280 
6281 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6282 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6283 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6284 
6285 	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6286 	    || (phy->type == BWN_PHYTYPE_HT))
6287 		fill_phy_ctl1 = 1;
6288 
6289 	/*
6290 	 * Find TX rate
6291 	 */
6292 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6293 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6294 		rate = rate_fb = tp->mgmtrate;
6295 	else if (ismcast)
6296 		rate = rate_fb = tp->mcastrate;
6297 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6298 		rate = rate_fb = tp->ucastrate;
6299 	else {
6300 		/* XXX TODO: don't fall back to CCK rates for OFDM */
6301 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6302 		rate = ni->ni_txrate;
6303 
6304 		if (rix > 0)
6305 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6306 			    IEEE80211_RATE_VAL;
6307 		else
6308 			rate_fb = rate;
6309 	}
6310 
6311 	sc->sc_tx_rate = rate;
6312 
6313 	/* Note: this maps the select ieee80211 rate to hardware rate */
6314 	rate = bwn_ieeerate2hwrate(sc, rate);
6315 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6316 
6317 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6318 	    bwn_plcp_getcck(rate);
6319 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6320 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6321 
6322 	/* XXX rate/rate_fb is the hardware rate */
6323 	if ((rate_fb == rate) ||
6324 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6325 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6326 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6327 	else
6328 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6329 		    m->m_pkthdr.len, rate, isshort);
6330 
6331 	/* XXX TX encryption */
6332 	bwn_plcp_genhdr(BWN_ISOLDFMT(mac) ?
6333 	    (struct bwn_plcp4 *)(&txhdr->body.old.plcp) :
6334 	    (struct bwn_plcp4 *)(&txhdr->body.new.plcp),
6335 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6336 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6337 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6338 
6339 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6340 	    BWN_TX_EFT_FB_CCK;
6341 	txhdr->chan = phy->chan;
6342 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6343 	    BWN_TX_PHY_ENC_CCK;
6344 	/* XXX preamble? obey net80211 */
6345 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6346 	     rate == BWN_CCK_RATE_11MB))
6347 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6348 
6349 	if (! phy->gmode)
6350 		macctl |= BWN_TX_MAC_5GHZ;
6351 
6352 	/* XXX TX antenna selection */
6353 
6354 	switch (bwn_antenna_sanitize(mac, 0)) {
6355 	case 0:
6356 		phyctl |= BWN_TX_PHY_ANT01AUTO;
6357 		break;
6358 	case 1:
6359 		phyctl |= BWN_TX_PHY_ANT0;
6360 		break;
6361 	case 2:
6362 		phyctl |= BWN_TX_PHY_ANT1;
6363 		break;
6364 	case 3:
6365 		phyctl |= BWN_TX_PHY_ANT2;
6366 		break;
6367 	case 4:
6368 		phyctl |= BWN_TX_PHY_ANT3;
6369 		break;
6370 	default:
6371 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6372 	}
6373 
6374 	if (!ismcast)
6375 		macctl |= BWN_TX_MAC_ACK;
6376 
6377 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6378 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6379 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6380 		macctl |= BWN_TX_MAC_LONGFRAME;
6381 
6382 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6383 		/* XXX RTS rate is always 1MB??? */
6384 		/* XXX TODO: don't fall back to CCK rates for OFDM */
6385 		rts_rate = BWN_CCK_RATE_1MB;
6386 		rts_rate_fb = bwn_get_fbrate(rts_rate);
6387 
6388 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6389 		protdur = ieee80211_compute_duration(ic->ic_rt,
6390 		    m->m_pkthdr.len, rate, isshort) +
6391 		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6392 
6393 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6394 			cts = (struct ieee80211_frame_cts *)(BWN_ISOLDFMT(mac) ?
6395 			    (txhdr->body.old.rts_frame) :
6396 			    (txhdr->body.new.rts_frame));
6397 			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6398 			    protdur);
6399 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6400 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6401 			    mprot->m_pkthdr.len);
6402 			m_freem(mprot);
6403 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6404 			len = sizeof(struct ieee80211_frame_cts);
6405 		} else {
6406 			rts = (struct ieee80211_frame_rts *)(BWN_ISOLDFMT(mac) ?
6407 			    (txhdr->body.old.rts_frame) :
6408 			    (txhdr->body.new.rts_frame));
6409 			/* XXX rate/rate_fb is the hardware rate */
6410 			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6411 			    isshort);
6412 			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6413 			    wh->i_addr2, protdur);
6414 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6415 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6416 			    mprot->m_pkthdr.len);
6417 			m_freem(mprot);
6418 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6419 			len = sizeof(struct ieee80211_frame_rts);
6420 		}
6421 		len += IEEE80211_CRC_LEN;
6422 		bwn_plcp_genhdr((struct bwn_plcp4 *)((BWN_ISOLDFMT(mac)) ?
6423 		    &txhdr->body.old.rts_plcp :
6424 		    &txhdr->body.new.rts_plcp), len, rts_rate);
6425 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6426 		    rts_rate_fb);
6427 
6428 		protwh = (struct ieee80211_frame *)(BWN_ISOLDFMT(mac) ?
6429 		    (&txhdr->body.old.rts_frame) :
6430 		    (&txhdr->body.new.rts_frame));
6431 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6432 
6433 		if (BWN_ISOFDMRATE(rts_rate)) {
6434 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6435 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6436 		} else {
6437 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6438 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6439 		}
6440 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6441 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6442 
6443 		if (fill_phy_ctl1) {
6444 			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6445 			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6446 		}
6447 	}
6448 
6449 	if (fill_phy_ctl1) {
6450 		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6451 		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6452 	}
6453 
6454 	if (BWN_ISOLDFMT(mac))
6455 		txhdr->body.old.cookie = htole16(cookie);
6456 	else
6457 		txhdr->body.new.cookie = htole16(cookie);
6458 
6459 	txhdr->macctl = htole32(macctl);
6460 	txhdr->phyctl = htole16(phyctl);
6461 
6462 	/*
6463 	 * TX radio tap
6464 	 */
6465 	if (ieee80211_radiotap_active_vap(vap)) {
6466 		sc->sc_tx_th.wt_flags = 0;
6467 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6468 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6469 		if (isshort &&
6470 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6471 		     rate == BWN_CCK_RATE_11MB))
6472 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6473 		sc->sc_tx_th.wt_rate = rate;
6474 
6475 		ieee80211_radiotap_tx(vap, m);
6476 	}
6477 
6478 	return (0);
6479 }
6480 
6481 static void
6482 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6483     const uint8_t rate)
6484 {
6485 	uint32_t d, plen;
6486 	uint8_t *raw = plcp->o.raw;
6487 
6488 	if (BWN_ISOFDMRATE(rate)) {
6489 		d = bwn_plcp_getofdm(rate);
6490 		KASSERT(!(octets & 0xf000),
6491 		    ("%s:%d: fail", __func__, __LINE__));
6492 		d |= (octets << 5);
6493 		plcp->o.data = htole32(d);
6494 	} else {
6495 		plen = octets * 16 / rate;
6496 		if ((octets * 16 % rate) > 0) {
6497 			plen++;
6498 			if ((rate == BWN_CCK_RATE_11MB)
6499 			    && ((octets * 8 % 11) < 4)) {
6500 				raw[1] = 0x84;
6501 			} else
6502 				raw[1] = 0x04;
6503 		} else
6504 			raw[1] = 0x04;
6505 		plcp->o.data |= htole32(plen << 16);
6506 		raw[0] = bwn_plcp_getcck(rate);
6507 	}
6508 }
6509 
6510 static uint8_t
6511 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6512 {
6513 	struct bwn_softc *sc = mac->mac_sc;
6514 	uint8_t mask;
6515 
6516 	if (n == 0)
6517 		return (0);
6518 	if (mac->mac_phy.gmode)
6519 		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6520 	else
6521 		mask = siba_sprom_get_ant_a(sc->sc_dev);
6522 	if (!(mask & (1 << (n - 1))))
6523 		return (0);
6524 	return (n);
6525 }
6526 
6527 /*
6528  * Return a fallback rate for the given rate.
6529  *
6530  * Note: Don't fall back from OFDM to CCK.
6531  */
6532 static uint8_t
6533 bwn_get_fbrate(uint8_t bitrate)
6534 {
6535 	switch (bitrate) {
6536 	/* CCK */
6537 	case BWN_CCK_RATE_1MB:
6538 		return (BWN_CCK_RATE_1MB);
6539 	case BWN_CCK_RATE_2MB:
6540 		return (BWN_CCK_RATE_1MB);
6541 	case BWN_CCK_RATE_5MB:
6542 		return (BWN_CCK_RATE_2MB);
6543 	case BWN_CCK_RATE_11MB:
6544 		return (BWN_CCK_RATE_5MB);
6545 
6546 	/* OFDM */
6547 	case BWN_OFDM_RATE_6MB:
6548 		return (BWN_OFDM_RATE_6MB);
6549 	case BWN_OFDM_RATE_9MB:
6550 		return (BWN_OFDM_RATE_6MB);
6551 	case BWN_OFDM_RATE_12MB:
6552 		return (BWN_OFDM_RATE_9MB);
6553 	case BWN_OFDM_RATE_18MB:
6554 		return (BWN_OFDM_RATE_12MB);
6555 	case BWN_OFDM_RATE_24MB:
6556 		return (BWN_OFDM_RATE_18MB);
6557 	case BWN_OFDM_RATE_36MB:
6558 		return (BWN_OFDM_RATE_24MB);
6559 	case BWN_OFDM_RATE_48MB:
6560 		return (BWN_OFDM_RATE_36MB);
6561 	case BWN_OFDM_RATE_54MB:
6562 		return (BWN_OFDM_RATE_48MB);
6563 	}
6564 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6565 	return (0);
6566 }
6567 
6568 static uint32_t
6569 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6570     uint32_t ctl, const void *_data, int len)
6571 {
6572 	struct bwn_softc *sc = mac->mac_sc;
6573 	uint32_t value = 0;
6574 	const uint8_t *data = _data;
6575 
6576 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6577 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6578 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6579 
6580 	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6581 	    tq->tq_base + BWN_PIO8_TXDATA);
6582 	if (len & 3) {
6583 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6584 		    BWN_PIO8_TXCTL_24_31);
6585 		data = &(data[len - 1]);
6586 		switch (len & 3) {
6587 		case 3:
6588 			ctl |= BWN_PIO8_TXCTL_16_23;
6589 			value |= (uint32_t)(*data) << 16;
6590 			data--;
6591 		case 2:
6592 			ctl |= BWN_PIO8_TXCTL_8_15;
6593 			value |= (uint32_t)(*data) << 8;
6594 			data--;
6595 		case 1:
6596 			value |= (uint32_t)(*data);
6597 		}
6598 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6599 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6600 	}
6601 
6602 	return (ctl);
6603 }
6604 
6605 static void
6606 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6607     uint16_t offset, uint32_t value)
6608 {
6609 
6610 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6611 }
6612 
6613 static uint16_t
6614 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6615     uint16_t ctl, const void *_data, int len)
6616 {
6617 	struct bwn_softc *sc = mac->mac_sc;
6618 	const uint8_t *data = _data;
6619 
6620 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6621 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6622 
6623 	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6624 	    tq->tq_base + BWN_PIO_TXDATA);
6625 	if (len & 1) {
6626 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6627 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6628 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6629 	}
6630 
6631 	return (ctl);
6632 }
6633 
6634 static uint16_t
6635 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6636     uint16_t ctl, struct mbuf *m0)
6637 {
6638 	int i, j = 0;
6639 	uint16_t data = 0;
6640 	const uint8_t *buf;
6641 	struct mbuf *m = m0;
6642 
6643 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6644 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6645 
6646 	for (; m != NULL; m = m->m_next) {
6647 		buf = mtod(m, const uint8_t *);
6648 		for (i = 0; i < m->m_len; i++) {
6649 			if (!((j++) % 2))
6650 				data |= buf[i];
6651 			else {
6652 				data |= (buf[i] << 8);
6653 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6654 				data = 0;
6655 			}
6656 		}
6657 	}
6658 	if (m0->m_pkthdr.len % 2) {
6659 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6660 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6661 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6662 	}
6663 
6664 	return (ctl);
6665 }
6666 
6667 static void
6668 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6669 {
6670 
6671 	/* XXX should exit if 5GHz band .. */
6672 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6673 		return;
6674 
6675 	BWN_WRITE_2(mac, 0x684, 510 + time);
6676 	/* Disabled in Linux b43, can adversely effect performance */
6677 #if 0
6678 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6679 #endif
6680 }
6681 
6682 static struct bwn_dma_ring *
6683 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6684 {
6685 
6686 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6687 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6688 
6689 	switch (prio) {
6690 	case 3:
6691 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6692 	case 2:
6693 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6694 	case 0:
6695 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6696 	case 1:
6697 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6698 	}
6699 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6700 	return (NULL);
6701 }
6702 
6703 static int
6704 bwn_dma_getslot(struct bwn_dma_ring *dr)
6705 {
6706 	int slot;
6707 
6708 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6709 
6710 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6711 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6712 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6713 
6714 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6715 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6716 	dr->dr_curslot = slot;
6717 	dr->dr_usedslot++;
6718 
6719 	return (slot);
6720 }
6721 
6722 static struct bwn_pio_txqueue *
6723 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6724     struct bwn_pio_txpkt **pack)
6725 {
6726 	struct bwn_pio *pio = &mac->mac_method.pio;
6727 	struct bwn_pio_txqueue *tq = NULL;
6728 	unsigned int index;
6729 
6730 	switch (cookie & 0xf000) {
6731 	case 0x1000:
6732 		tq = &pio->wme[WME_AC_BK];
6733 		break;
6734 	case 0x2000:
6735 		tq = &pio->wme[WME_AC_BE];
6736 		break;
6737 	case 0x3000:
6738 		tq = &pio->wme[WME_AC_VI];
6739 		break;
6740 	case 0x4000:
6741 		tq = &pio->wme[WME_AC_VO];
6742 		break;
6743 	case 0x5000:
6744 		tq = &pio->mcast;
6745 		break;
6746 	}
6747 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6748 	if (tq == NULL)
6749 		return (NULL);
6750 	index = (cookie & 0x0fff);
6751 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6752 	if (index >= N(tq->tq_pkts))
6753 		return (NULL);
6754 	*pack = &tq->tq_pkts[index];
6755 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6756 	return (tq);
6757 }
6758 
6759 static void
6760 bwn_txpwr(void *arg, int npending)
6761 {
6762 	struct bwn_mac *mac = arg;
6763 	struct bwn_softc *sc = mac->mac_sc;
6764 
6765 	BWN_LOCK(sc);
6766 	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6767 	    mac->mac_phy.set_txpwr != NULL)
6768 		mac->mac_phy.set_txpwr(mac);
6769 	BWN_UNLOCK(sc);
6770 }
6771 
6772 static void
6773 bwn_task_15s(struct bwn_mac *mac)
6774 {
6775 	uint16_t reg;
6776 
6777 	if (mac->mac_fw.opensource) {
6778 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6779 		if (reg) {
6780 			bwn_restart(mac, "fw watchdog");
6781 			return;
6782 		}
6783 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6784 	}
6785 	if (mac->mac_phy.task_15s)
6786 		mac->mac_phy.task_15s(mac);
6787 
6788 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6789 }
6790 
6791 static void
6792 bwn_task_30s(struct bwn_mac *mac)
6793 {
6794 
6795 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6796 		return;
6797 	mac->mac_noise.noi_running = 1;
6798 	mac->mac_noise.noi_nsamples = 0;
6799 
6800 	bwn_noise_gensample(mac);
6801 }
6802 
6803 static void
6804 bwn_task_60s(struct bwn_mac *mac)
6805 {
6806 
6807 	if (mac->mac_phy.task_60s)
6808 		mac->mac_phy.task_60s(mac);
6809 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6810 }
6811 
6812 static void
6813 bwn_tasks(void *arg)
6814 {
6815 	struct bwn_mac *mac = arg;
6816 	struct bwn_softc *sc = mac->mac_sc;
6817 
6818 	BWN_ASSERT_LOCKED(sc);
6819 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6820 		return;
6821 
6822 	if (mac->mac_task_state % 4 == 0)
6823 		bwn_task_60s(mac);
6824 	if (mac->mac_task_state % 2 == 0)
6825 		bwn_task_30s(mac);
6826 	bwn_task_15s(mac);
6827 
6828 	mac->mac_task_state++;
6829 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6830 }
6831 
6832 static int
6833 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6834 {
6835 	struct bwn_softc *sc = mac->mac_sc;
6836 
6837 	KASSERT(a == 0, ("not support APHY\n"));
6838 
6839 	switch (plcp->o.raw[0] & 0xf) {
6840 	case 0xb:
6841 		return (BWN_OFDM_RATE_6MB);
6842 	case 0xf:
6843 		return (BWN_OFDM_RATE_9MB);
6844 	case 0xa:
6845 		return (BWN_OFDM_RATE_12MB);
6846 	case 0xe:
6847 		return (BWN_OFDM_RATE_18MB);
6848 	case 0x9:
6849 		return (BWN_OFDM_RATE_24MB);
6850 	case 0xd:
6851 		return (BWN_OFDM_RATE_36MB);
6852 	case 0x8:
6853 		return (BWN_OFDM_RATE_48MB);
6854 	case 0xc:
6855 		return (BWN_OFDM_RATE_54MB);
6856 	}
6857 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6858 	    plcp->o.raw[0] & 0xf);
6859 	return (-1);
6860 }
6861 
6862 static int
6863 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6864 {
6865 	struct bwn_softc *sc = mac->mac_sc;
6866 
6867 	switch (plcp->o.raw[0]) {
6868 	case 0x0a:
6869 		return (BWN_CCK_RATE_1MB);
6870 	case 0x14:
6871 		return (BWN_CCK_RATE_2MB);
6872 	case 0x37:
6873 		return (BWN_CCK_RATE_5MB);
6874 	case 0x6e:
6875 		return (BWN_CCK_RATE_11MB);
6876 	}
6877 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6878 	return (-1);
6879 }
6880 
6881 static void
6882 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6883     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6884     int rssi, int noise)
6885 {
6886 	struct bwn_softc *sc = mac->mac_sc;
6887 	const struct ieee80211_frame_min *wh;
6888 	uint64_t tsf;
6889 	uint16_t low_mactime_now;
6890 
6891 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6892 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6893 
6894 	wh = mtod(m, const struct ieee80211_frame_min *);
6895 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6896 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6897 
6898 	bwn_tsf_read(mac, &tsf);
6899 	low_mactime_now = tsf;
6900 	tsf = tsf & ~0xffffULL;
6901 	tsf += le16toh(rxhdr->mac_time);
6902 	if (low_mactime_now < le16toh(rxhdr->mac_time))
6903 		tsf -= 0x10000;
6904 
6905 	sc->sc_rx_th.wr_tsf = tsf;
6906 	sc->sc_rx_th.wr_rate = rate;
6907 	sc->sc_rx_th.wr_antsignal = rssi;
6908 	sc->sc_rx_th.wr_antnoise = noise;
6909 }
6910 
6911 static void
6912 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6913 {
6914 	uint32_t low, high;
6915 
6916 	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6917 	    ("%s:%d: fail", __func__, __LINE__));
6918 
6919 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6920 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6921 	*tsf = high;
6922 	*tsf <<= 32;
6923 	*tsf |= low;
6924 }
6925 
6926 static int
6927 bwn_dma_attach(struct bwn_mac *mac)
6928 {
6929 	struct bwn_dma *dma = &mac->mac_method.dma;
6930 	struct bwn_softc *sc = mac->mac_sc;
6931 	bus_addr_t lowaddr = 0;
6932 	int error;
6933 
6934 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6935 		return (0);
6936 
6937 	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6938 
6939 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6940 
6941 	dma->dmatype = bwn_dma_gettype(mac);
6942 	if (dma->dmatype == BWN_DMA_30BIT)
6943 		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6944 	else if (dma->dmatype == BWN_DMA_32BIT)
6945 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6946 	else
6947 		lowaddr = BUS_SPACE_MAXADDR;
6948 
6949 	/*
6950 	 * Create top level DMA tag
6951 	 */
6952 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6953 			       BWN_ALIGN, 0,		/* alignment, bounds */
6954 			       lowaddr,			/* lowaddr */
6955 			       BUS_SPACE_MAXADDR,	/* highaddr */
6956 			       NULL, NULL,		/* filter, filterarg */
6957 			       BUS_SPACE_MAXSIZE,	/* maxsize */
6958 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6959 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6960 			       0,			/* flags */
6961 #if !defined(__DragonFly__)
6962 			       NULL, NULL,		/* lockfunc, lockarg */
6963 #endif
6964 			       &dma->parent_dtag);
6965 	if (error) {
6966 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6967 		return (error);
6968 	}
6969 
6970 	/*
6971 	 * Create TX/RX mbuf DMA tag
6972 	 */
6973 	error = bus_dma_tag_create(dma->parent_dtag,
6974 				1,
6975 				0,
6976 				BUS_SPACE_MAXADDR,
6977 				BUS_SPACE_MAXADDR,
6978 				NULL, NULL,
6979 				MCLBYTES,
6980 				1,
6981 				BUS_SPACE_MAXSIZE_32BIT,
6982 				0,
6983 #if !defined(__DragonFly__)
6984 				NULL, NULL,
6985 #endif
6986 				&dma->rxbuf_dtag);
6987 	if (error) {
6988 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6989 		goto fail0;
6990 	}
6991 	error = bus_dma_tag_create(dma->parent_dtag,
6992 				1,
6993 				0,
6994 				BUS_SPACE_MAXADDR,
6995 				BUS_SPACE_MAXADDR,
6996 				NULL, NULL,
6997 				MCLBYTES,
6998 				1,
6999 				BUS_SPACE_MAXSIZE_32BIT,
7000 				0,
7001 #if !defined(__DragonFly__)
7002 				NULL, NULL,
7003 #endif
7004 				&dma->txbuf_dtag);
7005 	if (error) {
7006 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7007 		goto fail1;
7008 	}
7009 
7010 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7011 	if (!dma->wme[WME_AC_BK])
7012 		goto fail2;
7013 
7014 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7015 	if (!dma->wme[WME_AC_BE])
7016 		goto fail3;
7017 
7018 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7019 	if (!dma->wme[WME_AC_VI])
7020 		goto fail4;
7021 
7022 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7023 	if (!dma->wme[WME_AC_VO])
7024 		goto fail5;
7025 
7026 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7027 	if (!dma->mcast)
7028 		goto fail6;
7029 	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7030 	if (!dma->rx)
7031 		goto fail7;
7032 
7033 	return (error);
7034 
7035 fail7:	bwn_dma_ringfree(&dma->mcast);
7036 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7037 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7038 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7039 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7040 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7041 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7042 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7043 	return (error);
7044 }
7045 
7046 static struct bwn_dma_ring *
7047 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7048     uint16_t cookie, int *slot)
7049 {
7050 	struct bwn_dma *dma = &mac->mac_method.dma;
7051 	struct bwn_dma_ring *dr;
7052 	struct bwn_softc *sc = mac->mac_sc;
7053 
7054 	BWN_ASSERT_LOCKED(mac->mac_sc);
7055 
7056 	switch (cookie & 0xf000) {
7057 	case 0x1000:
7058 		dr = dma->wme[WME_AC_BK];
7059 		break;
7060 	case 0x2000:
7061 		dr = dma->wme[WME_AC_BE];
7062 		break;
7063 	case 0x3000:
7064 		dr = dma->wme[WME_AC_VI];
7065 		break;
7066 	case 0x4000:
7067 		dr = dma->wme[WME_AC_VO];
7068 		break;
7069 	case 0x5000:
7070 		dr = dma->mcast;
7071 		break;
7072 	default:
7073 		dr = NULL;
7074 		KASSERT(0 == 1,
7075 		    ("invalid cookie value %d", cookie & 0xf000));
7076 	}
7077 	*slot = (cookie & 0x0fff);
7078 	if (*slot < 0 || *slot >= dr->dr_numslots) {
7079 		/*
7080 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7081 		 * that it occurs events which have same H/W sequence numbers.
7082 		 * When it's occurred just prints a WARNING msgs and ignores.
7083 		 */
7084 		KASSERT(status->seq == dma->lastseq,
7085 		    ("%s:%d: fail", __func__, __LINE__));
7086 		device_printf(sc->sc_dev,
7087 		    "out of slot ranges (0 < %d < %d)\n", *slot,
7088 		    dr->dr_numslots);
7089 		return (NULL);
7090 	}
7091 	dma->lastseq = status->seq;
7092 	return (dr);
7093 }
7094 
7095 static void
7096 bwn_dma_stop(struct bwn_mac *mac)
7097 {
7098 	struct bwn_dma *dma;
7099 
7100 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7101 		return;
7102 	dma = &mac->mac_method.dma;
7103 
7104 	bwn_dma_ringstop(&dma->rx);
7105 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7106 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7107 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7108 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7109 	bwn_dma_ringstop(&dma->mcast);
7110 }
7111 
7112 static void
7113 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7114 {
7115 
7116 	if (dr == NULL)
7117 		return;
7118 
7119 	bwn_dma_cleanup(*dr);
7120 }
7121 
7122 static void
7123 bwn_pio_stop(struct bwn_mac *mac)
7124 {
7125 	struct bwn_pio *pio;
7126 
7127 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7128 		return;
7129 	pio = &mac->mac_method.pio;
7130 
7131 	bwn_destroy_queue_tx(&pio->mcast);
7132 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7133 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7134 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7135 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7136 }
7137 
7138 static void
7139 bwn_led_attach(struct bwn_mac *mac)
7140 {
7141 	struct bwn_softc *sc = mac->mac_sc;
7142 	const uint8_t *led_act = NULL;
7143 	uint16_t val[BWN_LED_MAX];
7144 	int i;
7145 
7146 	sc->sc_led_idle = (2350 * hz) / 1000;
7147 	sc->sc_led_blink = 1;
7148 
7149 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7150 		if (siba_get_pci_subvendor(sc->sc_dev) ==
7151 		    bwn_vendor_led_act[i].vid) {
7152 			led_act = bwn_vendor_led_act[i].led_act;
7153 			break;
7154 		}
7155 	}
7156 	if (led_act == NULL)
7157 		led_act = bwn_default_led_act;
7158 
7159 	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7160 	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7161 	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7162 	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7163 
7164 	for (i = 0; i < BWN_LED_MAX; ++i) {
7165 		struct bwn_led *led = &sc->sc_leds[i];
7166 
7167 		if (val[i] == 0xff) {
7168 			led->led_act = led_act[i];
7169 		} else {
7170 			if (val[i] & BWN_LED_ACT_LOW)
7171 				led->led_flags |= BWN_LED_F_ACTLOW;
7172 			led->led_act = val[i] & BWN_LED_ACT_MASK;
7173 		}
7174 		led->led_mask = (1 << i);
7175 
7176 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7177 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7178 		    led->led_act == BWN_LED_ACT_BLINK) {
7179 			led->led_flags |= BWN_LED_F_BLINK;
7180 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7181 				led->led_flags |= BWN_LED_F_POLLABLE;
7182 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7183 				led->led_flags |= BWN_LED_F_SLOW;
7184 
7185 			if (sc->sc_blink_led == NULL) {
7186 				sc->sc_blink_led = led;
7187 				if (led->led_flags & BWN_LED_F_SLOW)
7188 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7189 			}
7190 		}
7191 
7192 		DPRINTF(sc, BWN_DEBUG_LED,
7193 		    "%dth led, act %d, lowact %d\n", i,
7194 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7195 	}
7196 #if defined(__DragonFly__)
7197 	callout_init_lk(&sc->sc_led_blink_ch, &sc->sc_lk);
7198 #else
7199 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7200 #endif
7201 }
7202 
7203 static __inline uint16_t
7204 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7205 {
7206 
7207 	if (led->led_flags & BWN_LED_F_ACTLOW)
7208 		on = !on;
7209 	if (on)
7210 		val |= led->led_mask;
7211 	else
7212 		val &= ~led->led_mask;
7213 	return val;
7214 }
7215 
7216 static void
7217 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7218 {
7219 	struct bwn_softc *sc = mac->mac_sc;
7220 	struct ieee80211com *ic = &sc->sc_ic;
7221 	uint16_t val;
7222 	int i;
7223 
7224 	if (nstate == IEEE80211_S_INIT) {
7225 		callout_stop(&sc->sc_led_blink_ch);
7226 		sc->sc_led_blinking = 0;
7227 	}
7228 
7229 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7230 		return;
7231 
7232 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7233 	for (i = 0; i < BWN_LED_MAX; ++i) {
7234 		struct bwn_led *led = &sc->sc_leds[i];
7235 		int on;
7236 
7237 		if (led->led_act == BWN_LED_ACT_UNKN ||
7238 		    led->led_act == BWN_LED_ACT_NULL)
7239 			continue;
7240 
7241 		if ((led->led_flags & BWN_LED_F_BLINK) &&
7242 		    nstate != IEEE80211_S_INIT)
7243 			continue;
7244 
7245 		switch (led->led_act) {
7246 		case BWN_LED_ACT_ON:    /* Always on */
7247 			on = 1;
7248 			break;
7249 		case BWN_LED_ACT_OFF:   /* Always off */
7250 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7251 			on = 0;
7252 			break;
7253 		default:
7254 			on = 1;
7255 			switch (nstate) {
7256 			case IEEE80211_S_INIT:
7257 				on = 0;
7258 				break;
7259 			case IEEE80211_S_RUN:
7260 				if (led->led_act == BWN_LED_ACT_11G &&
7261 				    ic->ic_curmode != IEEE80211_MODE_11G)
7262 					on = 0;
7263 				break;
7264 			default:
7265 				if (led->led_act == BWN_LED_ACT_ASSOC)
7266 					on = 0;
7267 				break;
7268 			}
7269 			break;
7270 		}
7271 
7272 		val = bwn_led_onoff(led, val, on);
7273 	}
7274 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7275 }
7276 
7277 static void
7278 bwn_led_event(struct bwn_mac *mac, int event)
7279 {
7280 	struct bwn_softc *sc = mac->mac_sc;
7281 	struct bwn_led *led = sc->sc_blink_led;
7282 	int rate;
7283 
7284 	if (event == BWN_LED_EVENT_POLL) {
7285 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7286 			return;
7287 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7288 			return;
7289 	}
7290 
7291 	sc->sc_led_ticks = ticks;
7292 	if (sc->sc_led_blinking)
7293 		return;
7294 
7295 	switch (event) {
7296 	case BWN_LED_EVENT_RX:
7297 		rate = sc->sc_rx_rate;
7298 		break;
7299 	case BWN_LED_EVENT_TX:
7300 		rate = sc->sc_tx_rate;
7301 		break;
7302 	case BWN_LED_EVENT_POLL:
7303 		rate = 0;
7304 		break;
7305 	default:
7306 		panic("unknown LED event %d\n", event);
7307 		break;
7308 	}
7309 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7310 	    bwn_led_duration[rate].off_dur);
7311 }
7312 
7313 static void
7314 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7315 {
7316 	struct bwn_softc *sc = mac->mac_sc;
7317 	struct bwn_led *led = sc->sc_blink_led;
7318 	uint16_t val;
7319 
7320 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7321 	val = bwn_led_onoff(led, val, 1);
7322 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7323 
7324 	if (led->led_flags & BWN_LED_F_SLOW) {
7325 		BWN_LED_SLOWDOWN(on_dur);
7326 		BWN_LED_SLOWDOWN(off_dur);
7327 	}
7328 
7329 	sc->sc_led_blinking = 1;
7330 	sc->sc_led_blink_offdur = off_dur;
7331 
7332 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7333 }
7334 
7335 static void
7336 bwn_led_blink_next(void *arg)
7337 {
7338 	struct bwn_mac *mac = arg;
7339 	struct bwn_softc *sc = mac->mac_sc;
7340 	uint16_t val;
7341 
7342 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7343 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7344 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7345 
7346 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7347 	    bwn_led_blink_end, mac);
7348 }
7349 
7350 static void
7351 bwn_led_blink_end(void *arg)
7352 {
7353 	struct bwn_mac *mac = arg;
7354 	struct bwn_softc *sc = mac->mac_sc;
7355 
7356 	sc->sc_led_blinking = 0;
7357 }
7358 
7359 static int
7360 bwn_suspend(device_t dev)
7361 {
7362 	struct bwn_softc *sc = device_get_softc(dev);
7363 
7364 	BWN_LOCK(sc);
7365 	bwn_stop(sc);
7366 	BWN_UNLOCK(sc);
7367 	return (0);
7368 }
7369 
7370 static int
7371 bwn_resume(device_t dev)
7372 {
7373 	struct bwn_softc *sc = device_get_softc(dev);
7374 	int error = EDOOFUS;
7375 
7376 	BWN_LOCK(sc);
7377 	if (sc->sc_ic.ic_nrunning > 0)
7378 		error = bwn_init(sc);
7379 	BWN_UNLOCK(sc);
7380 	if (error == 0)
7381 		ieee80211_start_all(&sc->sc_ic);
7382 	return (0);
7383 }
7384 
7385 static void
7386 bwn_rfswitch(void *arg)
7387 {
7388 	struct bwn_softc *sc = arg;
7389 	struct bwn_mac *mac = sc->sc_curmac;
7390 	int cur = 0, prev = 0;
7391 
7392 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7393 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7394 
7395 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7396 	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7397 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7398 			& BWN_RF_HWENABLED_HI_MASK))
7399 			cur = 1;
7400 	} else {
7401 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7402 		    & BWN_RF_HWENABLED_LO_MASK)
7403 			cur = 1;
7404 	}
7405 
7406 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7407 		prev = 1;
7408 
7409 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7410 	    __func__, cur, prev);
7411 
7412 	if (cur != prev) {
7413 		if (cur)
7414 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7415 		else
7416 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7417 
7418 		device_printf(sc->sc_dev,
7419 		    "status of RF switch is changed to %s\n",
7420 		    cur ? "ON" : "OFF");
7421 		if (cur != mac->mac_phy.rf_on) {
7422 			if (cur)
7423 				bwn_rf_turnon(mac);
7424 			else
7425 				bwn_rf_turnoff(mac);
7426 		}
7427 	}
7428 
7429 #if defined(__DragonFly__)
7430 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
7431 #else
7432 	callout_schedule(&sc->sc_rfswitch_ch, hz);
7433 #endif
7434 }
7435 
7436 static void
7437 bwn_sysctl_node(struct bwn_softc *sc)
7438 {
7439 	device_t dev = sc->sc_dev;
7440 	struct bwn_mac *mac;
7441 	struct bwn_stats *stats;
7442 
7443 	/* XXX assume that count of MAC is only 1. */
7444 
7445 	if ((mac = sc->sc_curmac) == NULL)
7446 		return;
7447 	stats = &mac->mac_stats;
7448 
7449 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7450 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7451 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7452 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7453 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7455 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7456 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7457 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7458 
7459 #ifdef BWN_DEBUG
7460 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7461 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7462 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7463 #endif
7464 }
7465 
7466 static device_method_t bwn_methods[] = {
7467 	/* Device interface */
7468 	DEVMETHOD(device_probe,		bwn_probe),
7469 	DEVMETHOD(device_attach,	bwn_attach),
7470 	DEVMETHOD(device_detach,	bwn_detach),
7471 	DEVMETHOD(device_suspend,	bwn_suspend),
7472 	DEVMETHOD(device_resume,	bwn_resume),
7473 	DEVMETHOD_END
7474 };
7475 static driver_t bwn_driver = {
7476 	"bwn",
7477 	bwn_methods,
7478 	sizeof(struct bwn_softc)
7479 };
7480 static devclass_t bwn_devclass;
7481 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, NULL, NULL);
7482 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7483 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7484 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7485 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7486 MODULE_VERSION(bwn, 1);
7487