/usr/src/sys/dev/pci/if_bwfm

Bug Summary

File:	dev/pci/if_bwfm_pci.c
Warning:	line 847, column 4 3rd function call argument is an uninitialized value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name if_bwfm_pci.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/pci/if_bwfm_pci.c
1/*	$OpenBSD: if_bwfm_pci.c,v 1.75 2022/12/30 14:10:17 kettenis Exp $	*/
2/*
* Copyright (c) 2010-2016 Broadcom Corporation
* Copyright (c) 2017 Patrick Wildt <patrick@blueri.se>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19#include "bpfilter.h"

21#include <sys/param.h>
22#include <sys/systm.h>
23#include <sys/buf.h>
24#include <sys/kernel.h>
25#include <sys/malloc.h>
26#include <sys/device.h>
27#include <sys/queue.h>
28#include <sys/socket.h>

30#if defined(__HAVE_FDT)
31#include <machine/fdt.h>
32#include <dev/ofw/openfirm.h>
33#endif

35#if NBPFILTER1 > 0
36#include <net/bpf.h>
37#endif
38#include <net/if.h>
39#include <net/if_dl.h>
40#include <net/if_media.h>

42#include <netinet/in.h>
43#include <netinet/if_ether.h>

45#include <net80211/ieee80211_var.h>

47#include <machine/bus.h>

49#include <dev/pci/pcireg.h>
50#include <dev/pci/pcivar.h>
51#include <dev/pci/pcidevs.h>

53#include <dev/ic/bwfmvar.h>
54#include <dev/ic/bwfmreg.h>
55#include <dev/pci/if_bwfm_pci.h>

57#define BWFM_DMA_D2H_SCRATCH_BUF_LEN8		8
58#define BWFM_DMA_D2H_RINGUPD_BUF_LEN1024		1024
59#define BWFM_DMA_H2D_IOCTL_BUF_LEN1518		ETHER_MAX_LEN1518

61#define BWFM_NUM_TX_MSGRINGS2			2
62#define BWFM_NUM_RX_MSGRINGS3			3

64#define BWFM_NUM_IOCTL_PKTIDS8			8
65#define BWFM_NUM_TX_PKTIDS2048			2048
66#define BWFM_NUM_RX_PKTIDS1024			1024

68#define BWFM_NUM_IOCTL_DESCS1			1
69#define BWFM_NUM_TX_DESCS1			1
70#define BWFM_NUM_RX_DESCS1			1

72#ifdef BWFM_DEBUG
73#define DPRINTF(x)do { ; } while (0)	do { if (bwfm_debug > 0) printf x; } while (0)
74#define DPRINTFN(n, x)do { ; } while (0)	do { if (bwfm_debug >= (n)) printf x; } while (0)
75static int bwfm_debug = 2;
76#else
77#define DPRINTF(x)do { ; } while (0)	do { ; } while (0)
78#define DPRINTFN(n, x)do { ; } while (0)	do { ; } while (0)
79#endif

81#define DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname)	((sc)->sc_sc.sc_dev.dv_xname)

83enum ring_status {
RING_CLOSED,
RING_CLOSING,
RING_OPEN,
RING_OPENING,
88};

90struct bwfm_pci_msgring {
uint32_t		 w_idx_addr;
uint32_t		 r_idx_addr;
uint32_t		 w_ptr;
uint32_t		 r_ptr;
int			 nitem;
int			 itemsz;
enum ring_status	 status;
struct bwfm_pci_dmamem	*ring;
struct mbuf		*m;

int			 fifo;
uint8_t			 mac[ETHER_ADDR_LEN6];
103};

105struct bwfm_pci_ioctl {
uint16_t		 transid;
uint16_t		 retlen;
int16_t			 status;
struct mbuf		*m;
TAILQ_ENTRY(bwfm_pci_ioctl)struct { struct bwfm_pci_ioctl *tqe_next; struct bwfm_pci_ioctl
 **tqe_prev; } next;
111};

113struct bwfm_pci_buf {
bus_dmamap_t	 bb_map;
struct mbuf	*bb_m;
116};

118struct bwfm_pci_pkts {
struct bwfm_pci_buf	*pkts;
uint32_t		 npkt;
int			 last;
122};

124struct bwfm_pci_softc {
struct bwfm_softc	 sc_sc;
pci_chipset_tag_t	 sc_pc;
pcitag_t		 sc_tag;
pcireg_t		 sc_id;
void 			*sc_ih;

int			 sc_initialized;

bus_space_tag_t		 sc_reg_iot;
bus_space_handle_t	 sc_reg_ioh;
bus_size_t		 sc_reg_ios;

bus_space_tag_t		 sc_tcm_iot;
bus_space_handle_t	 sc_tcm_ioh;
bus_size_t		 sc_tcm_ios;

bus_dma_tag_t		 sc_dmat;

uint32_t		 sc_shared_address;
uint32_t		 sc_shared_flags;
uint8_t			 sc_shared_version;

uint8_t			 sc_dma_idx_sz;
struct bwfm_pci_dmamem	*sc_dma_idx_buf;
size_t			 sc_dma_idx_bufsz;

uint16_t		 sc_max_rxbufpost;
uint32_t		 sc_rx_dataoffset;
uint32_t		 sc_htod_mb_data_addr;
uint32_t		 sc_dtoh_mb_data_addr;
uint32_t		 sc_ring_info_addr;

uint32_t		 sc_console_base_addr;
uint32_t		 sc_console_buf_addr;
uint32_t		 sc_console_buf_size;
uint32_t		 sc_console_readidx;

uint16_t		 sc_max_flowrings;
uint16_t		 sc_max_submissionrings;
uint16_t		 sc_max_completionrings;

struct bwfm_pci_msgring	 sc_ctrl_submit;
struct bwfm_pci_msgring	 sc_rxpost_submit;
struct bwfm_pci_msgring	 sc_ctrl_complete;
struct bwfm_pci_msgring	 sc_tx_complete;
struct bwfm_pci_msgring	 sc_rx_complete;
struct bwfm_pci_msgring	*sc_flowrings;

struct bwfm_pci_dmamem	*sc_scratch_buf;
struct bwfm_pci_dmamem	*sc_ringupd_buf;

TAILQ_HEAD(, bwfm_pci_ioctl)struct { struct bwfm_pci_ioctl *tqh_first; struct bwfm_pci_ioctl
 **tqh_last; } sc_ioctlq;
uint16_t		 sc_ioctl_transid;

struct if_rxring	 sc_ioctl_ring;
struct if_rxring	 sc_event_ring;
struct if_rxring	 sc_rxbuf_ring;

struct bwfm_pci_pkts	 sc_ioctl_pkts;
struct bwfm_pci_pkts	 sc_rx_pkts;
struct bwfm_pci_pkts	 sc_tx_pkts;
int			 sc_tx_pkts_full;

uint8_t			 sc_mbdata_done;
uint8_t			 sc_pcireg64;
uint8_t			 sc_mb_via_ctl;
191};

193struct bwfm_pci_dmamem {
bus_dmamap_t		bdm_map;
bus_dma_segment_t	bdm_seg;
size_t			bdm_size;
caddr_t			bdm_kva;
198};

200#define BWFM_PCI_DMA_MAP(_bdm)((_bdm)->bdm_map)	((_bdm)->bdm_map)
201#define BWFM_PCI_DMA_LEN(_bdm)((_bdm)->bdm_size)	((_bdm)->bdm_size)
202#define BWFM_PCI_DMA_DVA(_bdm)((uint64_t)(_bdm)->bdm_map->dm_segs[0].ds_addr)	((uint64_t)(_bdm)->bdm_map->dm_segs[0].ds_addr)
203#define BWFM_PCI_DMA_KVA(_bdm)((void *)(_bdm)->bdm_kva)	((void *)(_bdm)->bdm_kva)

205int		 bwfm_pci_match(struct device *, void *, void *);
206void		 bwfm_pci_attach(struct device *, struct device *, void *);
207int		 bwfm_pci_detach(struct device *, int);
208int		 bwfm_pci_activate(struct device *, int);
209void		 bwfm_pci_cleanup(struct bwfm_pci_softc *);

211#if defined(__HAVE_FDT)
212int		 bwfm_pci_read_otp(struct bwfm_pci_softc *);
213void		 bwfm_pci_process_otp_tuple(struct bwfm_pci_softc *, uint8_t,
    uint8_t, uint8_t *);
215#endif

217int		 bwfm_pci_intr(void *);
218void		 bwfm_pci_intr_enable(struct bwfm_pci_softc *);
219void		 bwfm_pci_intr_disable(struct bwfm_pci_softc *);
220uint32_t	 bwfm_pci_intr_status(struct bwfm_pci_softc *);
221void		 bwfm_pci_intr_ack(struct bwfm_pci_softc *, uint32_t);
222uint32_t	 bwfm_pci_intmask(struct bwfm_pci_softc *);
223void		 bwfm_pci_hostready(struct bwfm_pci_softc *);
224int		 bwfm_pci_load_microcode(struct bwfm_pci_softc *, const u_char *,
    size_t, const u_char *, size_t);
226void		 bwfm_pci_select_core(struct bwfm_pci_softc *, int );

228struct bwfm_pci_dmamem *
 bwfm_pci_dmamem_alloc(struct bwfm_pci_softc *, bus_size_t,
    bus_size_t);
231void		 bwfm_pci_dmamem_free(struct bwfm_pci_softc *, struct bwfm_pci_dmamem *);
232int		 bwfm_pci_pktid_avail(struct bwfm_pci_softc *,
    struct bwfm_pci_pkts *);
234int		 bwfm_pci_pktid_new(struct bwfm_pci_softc *,
    struct bwfm_pci_pkts *, struct mbuf *,
    uint32_t *, paddr_t *);
237struct mbuf *	 bwfm_pci_pktid_free(struct bwfm_pci_softc *,
    struct bwfm_pci_pkts *, uint32_t);
239void		 bwfm_pci_fill_rx_ioctl_ring(struct bwfm_pci_softc *,
    struct if_rxring *, uint32_t);
241void		 bwfm_pci_fill_rx_buf_ring(struct bwfm_pci_softc *);
242void		 bwfm_pci_fill_rx_rings(struct bwfm_pci_softc *);
243int		 bwfm_pci_setup_ring(struct bwfm_pci_softc *, struct bwfm_pci_msgring *,
    int, size_t, uint32_t, uint32_t, int, uint32_t, uint32_t *);
245int		 bwfm_pci_setup_flowring(struct bwfm_pci_softc *, struct bwfm_pci_msgring *,
    int, size_t);

248void		 bwfm_pci_ring_bell(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
250void		 bwfm_pci_ring_update_rptr(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
252void		 bwfm_pci_ring_update_wptr(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
254void		 bwfm_pci_ring_write_rptr(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
256void		 bwfm_pci_ring_write_wptr(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
258void *		 bwfm_pci_ring_write_reserve(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
260void *		 bwfm_pci_ring_write_reserve_multi(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *, int, int *);
262void *		 bwfm_pci_ring_read_avail(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *, int *);
264void		 bwfm_pci_ring_read_commit(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *, int);
266void		 bwfm_pci_ring_write_commit(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *);
268void		 bwfm_pci_ring_write_cancel(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *, int);

271void		 bwfm_pci_ring_rx(struct bwfm_pci_softc *,
    struct bwfm_pci_msgring *, struct mbuf_list *);
273void		 bwfm_pci_msg_rx(struct bwfm_pci_softc *, void *,
    struct mbuf_list *);

276uint32_t	 bwfm_pci_buscore_read(struct bwfm_softc *, uint32_t);
277void		 bwfm_pci_buscore_write(struct bwfm_softc *, uint32_t,
    uint32_t);
279int		 bwfm_pci_buscore_prepare(struct bwfm_softc *);
280int		 bwfm_pci_buscore_reset(struct bwfm_softc *);
281void		 bwfm_pci_buscore_activate(struct bwfm_softc *, uint32_t);

283int		 bwfm_pci_flowring_lookup(struct bwfm_pci_softc *,
     struct mbuf *);
285void		 bwfm_pci_flowring_create(struct bwfm_pci_softc *,
     struct mbuf *);
287void		 bwfm_pci_flowring_create_cb(struct bwfm_softc *, void *);
288void		 bwfm_pci_flowring_delete(struct bwfm_pci_softc *, int);
289void		 bwfm_pci_flowring_delete_cb(struct bwfm_softc *, void *);

291int		 bwfm_pci_preinit(struct bwfm_softc *);
292void		 bwfm_pci_stop(struct bwfm_softc *);
293int		 bwfm_pci_txcheck(struct bwfm_softc *);
294int		 bwfm_pci_txdata(struct bwfm_softc *, struct mbuf *);

296int		 bwfm_pci_send_mb_data(struct bwfm_pci_softc *, uint32_t);
297void		 bwfm_pci_handle_mb_data(struct bwfm_pci_softc *);

299#ifdef BWFM_DEBUG
300void		 bwfm_pci_debug_console(struct bwfm_pci_softc *);
301#endif

303int		 bwfm_pci_msgbuf_query_dcmd(struct bwfm_softc *, int,
    int, char *, size_t *);
305int		 bwfm_pci_msgbuf_set_dcmd(struct bwfm_softc *, int,
    int, char *, size_t);
307void		 bwfm_pci_msgbuf_rxioctl(struct bwfm_pci_softc *,
    struct msgbuf_ioctl_resp_hdr *);
309int		 bwfm_pci_msgbuf_h2d_mb_write(struct bwfm_pci_softc *,
    uint32_t);

312struct bwfm_buscore_ops bwfm_pci_buscore_ops = {
.bc_read = bwfm_pci_buscore_read,
.bc_write = bwfm_pci_buscore_write,
.bc_prepare = bwfm_pci_buscore_prepare,
.bc_reset = bwfm_pci_buscore_reset,
.bc_setup = NULL((void *)0),
.bc_activate = bwfm_pci_buscore_activate,
319};

321struct bwfm_bus_ops bwfm_pci_bus_ops = {
.bs_preinit = bwfm_pci_preinit,
.bs_stop = bwfm_pci_stop,
.bs_txcheck = bwfm_pci_txcheck,
.bs_txdata = bwfm_pci_txdata,
.bs_txctl = NULL((void *)0),
327};

329struct bwfm_proto_ops bwfm_pci_msgbuf_ops = {
.proto_query_dcmd = bwfm_pci_msgbuf_query_dcmd,
.proto_set_dcmd = bwfm_pci_msgbuf_set_dcmd,
.proto_rx = NULL((void *)0),
.proto_rxctl = NULL((void *)0),
334};

336const struct cfattach bwfm_pci_ca = {
sizeof(struct bwfm_pci_softc),
bwfm_pci_match,
bwfm_pci_attach,
bwfm_pci_detach,
bwfm_pci_activate,
342};

344static const struct pci_matchid bwfm_pci_devices[] = {
{ PCI_VENDOR_BROADCOM0x14e4, PCI_PRODUCT_BROADCOM_BCM43500x43a3 },
{ PCI_VENDOR_BROADCOM0x14e4, PCI_PRODUCT_BROADCOM_BCM43560x43ec },
{ PCI_VENDOR_BROADCOM0x14e4, PCI_PRODUCT_BROADCOM_BCM436020x43ba },
{ PCI_VENDOR_BROADCOM0x14e4, PCI_PRODUCT_BROADCOM_BCM43710x440d },
{ PCI_VENDOR_BROADCOM0x14e4, PCI_PRODUCT_BROADCOM_BCM43780x4425 },
{ PCI_VENDOR_BROADCOM0x14e4, PCI_PRODUCT_BROADCOM_BCM43870x4433 },
351};

353int
354bwfm_pci_match(struct device *parent, void *match, void *aux)
355{
return (pci_matchbyid(aux, bwfm_pci_devices,
   nitems(bwfm_pci_devices)(sizeof((bwfm_pci_devices)) / sizeof((bwfm_pci_devices)[0]))));
358}

360void
361bwfm_pci_attach(struct device *parent, struct device *self, void *aux)
362{
struct bwfm_pci_softc *sc = (struct bwfm_pci_softc *)self;
struct pci_attach_args *pa = (struct pci_attach_args *)aux;
const char *intrstr;
pci_intr_handle_t ih;

if (pci_mapreg_map(pa, PCI_MAPREG_START0x10 + 0x08,
   PCI_MAPREG_MEM_TYPE_64BIT0x00000004, 0, &sc->sc_tcm_iot, &sc->sc_tcm_ioh,
   NULL((void *)0), &sc->sc_tcm_ios, 0)) {
printf(": can't map bar1\n");
return;
}

if (pci_mapreg_map(pa, PCI_MAPREG_START0x10 + 0x00,
   PCI_MAPREG_MEM_TYPE_64BIT0x00000004, 0, &sc->sc_reg_iot, &sc->sc_reg_ioh,
   NULL((void *)0), &sc->sc_reg_ios, 0)) {
printf(": can't map bar0\n");
goto bar1;
}

sc->sc_pc = pa->pa_pc;
sc->sc_tag = pa->pa_tag;
sc->sc_id = pa->pa_id;
sc->sc_dmat = pa->pa_dmat;

/* Map and establish the interrupt. */
if (pci_intr_map_msi(pa, &ih) != 0 && pci_intr_map(pa, &ih) != 0) {
printf(": couldn't map interrupt\n");
goto bar0;
}
intrstr = pci_intr_string(pa->pa_pc, ih);

sc->sc_ih = pci_intr_establish(pa->pa_pc, ih, IPL_NET0x4,
   bwfm_pci_intr, sc, DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
if (sc->sc_ih == NULL((void *)0)) {
printf(": couldn't establish interrupt");
if (intrstr != NULL((void *)0))
	printf(" at %s", intrstr);
printf("\n");
goto bar1;
}
printf(": %s\n", intrstr);

405#if defined(__HAVE_FDT)
sc->sc_sc.sc_node = PCITAG_NODE(pa->pa_tag);
if (sc->sc_sc.sc_node) {
if (OF_getproplen(sc->sc_sc.sc_node, "brcm,cal-blob") > 0) {
	sc->sc_sc.sc_calsize = OF_getproplen(sc->sc_sc.sc_node,
	    "brcm,cal-blob");
	sc->sc_sc.sc_cal = malloc(sc->sc_sc.sc_calsize,
	    M_DEVBUF2, M_WAITOK0x0001);
	OF_getprop(sc->sc_sc.sc_node, "brcm,cal-blob",
	    sc->sc_sc.sc_cal, sc->sc_sc.sc_calsize);
}
}
417#endif

sc->sc_sc.sc_bus_ops = &bwfm_pci_bus_ops;
sc->sc_sc.sc_proto_ops = &bwfm_pci_msgbuf_ops;
bwfm_attach(&sc->sc_sc);
config_mountroot(self, bwfm_attachhook);
return;

425bar0:
bus_space_unmap(sc->sc_reg_iot, sc->sc_reg_ioh, sc->sc_reg_ios);
427bar1:
bus_space_unmap(sc->sc_tcm_iot, sc->sc_tcm_ioh, sc->sc_tcm_ios);
429}

431int
432bwfm_pci_preinit(struct bwfm_softc *bwfm)
433{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct bwfm_pci_ringinfo ringinfo;
const char *chip = NULL((void *)0);
u_char *ucode, *nvram;
size_t size, nvsize, nvlen;
uint32_t d2h_w_idx_ptr, d2h_r_idx_ptr;
uint32_t h2d_w_idx_ptr, h2d_r_idx_ptr;
uint32_t idx_offset, reg;
int i;

if (sc->sc_initialized)
1
Assuming field 'sc_initialized' is 0→
2
←
Taking false branch→
return 0;

sc->sc_sc.sc_buscore_ops = &bwfm_pci_buscore_ops;
if (bwfm_chip_attach(&sc->sc_sc) != 0) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
printf("%s: cannot attach chip\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return 1;
}

453#if defined(__HAVE_FDT)
if (bwfm_pci_read_otp(sc)) {
printf("%s: cannot read OTP\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return 1;
}
458#endif

bwfm_pci_select_core(sc, BWFM_AGENT_CORE_PCIE20x83C);
5
←
Calling 'bwfm_pci_select_core'→
9
←
Returning from 'bwfm_pci_select_core'→
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x120)
, (0x4e0)))
   BWFM_PCI_PCIE2REG_CONFIGADDR, 0x4e0)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x120)
, (0x4e0)));
reg = bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x124))
)
   BWFM_PCI_PCIE2REG_CONFIGDATA)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x124))
);
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x124)
, (reg)))
   BWFM_PCI_PCIE2REG_CONFIGDATA, reg)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x124)
, (reg)));

switch (bwfm->sc_chip.ch_chip) {
10
←
Control jumps to 'case 17287:'  at line 502→
case BRCM_CC_4350_CHIP_ID0x4350:
if (bwfm->sc_chip.ch_chiprev <= 7)
	chip = "4350c2";
else
	chip = "4350";
break;
case BRCM_CC_4355_CHIP_ID0x4355:
chip = "4355c1";
break;
case BRCM_CC_4356_CHIP_ID0x4356:
chip = "4356";
break;
case BRCM_CC_4364_CHIP_ID0x4364:
if (bwfm->sc_chip.ch_chiprev <= 3)
	chip = "4364b2";
else
	chip = "4364b3";
break;
case BRCM_CC_43602_CHIP_ID43602:
chip = "43602";
break;
case BRCM_CC_4371_CHIP_ID0x4371:
chip = "4371";
break;
case BRCM_CC_4377_CHIP_ID0x4377:
chip = "4377b3";
break;
case BRCM_CC_4378_CHIP_ID0x4378:
if (bwfm->sc_chip.ch_chiprev <= 3)
	chip = "4378b1";
else
	chip = "4378b3";
break;
case BRCM_CC_4387_CHIP_ID0x4387:
chip = "4387c2";
break;
default:
printf("%s: unknown firmware for chip %s\n",
    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), bwfm->sc_chip.ch_name);
return 1;
}

if (bwfm_loadfirmware(bwfm, chip, "-pcie", &ucode, &size,
11
←
 Execution continues on line 511→
12
←
Assuming the condition is false→
13
←
Taking false branch→
   &nvram, &nvsize, &nvlen) != 0)
return 1;

/* Retrieve RAM size from firmware. */
if (size >= BWFM_RAMSIZE0x6c + 8) {
14
←
Assuming the condition is false→
15
←
Taking false branch→
uint32_t *ramsize = (uint32_t *)&ucode[BWFM_RAMSIZE0x6c];
if (letoh32(ramsize[0])((__uint32_t)(ramsize[0])) == BWFM_RAMSIZE_MAGIC0x534d4152)
	bwfm->sc_chip.ch_ramsize = letoh32(ramsize[1])((__uint32_t)(ramsize[1]));
}

if (bwfm_pci_load_microcode(sc, ucode, size, nvram, nvlen) != 0) {
16
←
Calling 'bwfm_pci_load_microcode'→
printf("%s: could not load microcode\n",
    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
free(ucode, M_DEVBUF2, size);
free(nvram, M_DEVBUF2, nvsize);
return 1;
}
free(ucode, M_DEVBUF2, size);
free(nvram, M_DEVBUF2, nvsize);

sc->sc_shared_flags = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x000)))
   sc->sc_shared_address + BWFM_SHARED_INFO)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x000)));
sc->sc_shared_version = sc->sc_shared_flags;
if (sc->sc_shared_version > BWFM_SHARED_INFO_MAX_VERSION7 ||
   sc->sc_shared_version < BWFM_SHARED_INFO_MIN_VERSION5) {
printf("%s: PCIe version %d unsupported\n",
    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), sc->sc_shared_version);
return 1;
}

if (sc->sc_shared_version >= 6) {
uint32_t host_cap;

if ((sc->sc_shared_flags & BWFM_SHARED_INFO_USE_MAILBOX0x2000000) == 0)
	sc->sc_mb_via_ctl = 1;

host_cap = sc->sc_shared_version;
if (sc->sc_shared_flags & BWFM_SHARED_INFO_HOSTRDY_DB10x10000000)
	host_cap |= BWFM_SHARED_HOST_CAP_H2D_ENABLE_HOSTRDY0x00000400;
if (sc->sc_shared_flags & BWFM_SHARED_INFO_SHARED_DAR0x80000000)
	host_cap |= BWFM_SHARED_HOST_CAP_H2D_DAR0x00010000;
host_cap |= BWFM_SHARED_HOST_CAP_DS_NO_OOB_DW0x00001000;

bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x54), (host_cap)))
    sc->sc_shared_address + BWFM_SHARED_HOST_CAP, host_cap)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x54), (host_cap)));
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x70), (0)))
    sc->sc_shared_address + BWFM_SHARED_HOST_CAP2, 0)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x70), (0)));
}

sc->sc_dma_idx_sz = 0;
if (sc->sc_shared_flags & BWFM_SHARED_INFO_DMA_INDEX0x10000) {
if (sc->sc_shared_flags & BWFM_SHARED_INFO_DMA_2B_IDX0x100000)
	sc->sc_dma_idx_sz = sizeof(uint16_t);
else
	sc->sc_dma_idx_sz = sizeof(uint32_t);
}

/* Maximum RX data buffers in the ring. */
sc->sc_max_rxbufpost = bus_space_read_2(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_2((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x22)))
   sc->sc_shared_address + BWFM_SHARED_MAX_RXBUFPOST)((sc->sc_tcm_iot)->read_2((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x22)));
if (sc->sc_max_rxbufpost == 0)
sc->sc_max_rxbufpost = BWFM_SHARED_MAX_RXBUFPOST_DEFAULT255;

/* Alternative offset of data in a packet */
sc->sc_rx_dataoffset = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x24)))
   sc->sc_shared_address + BWFM_SHARED_RX_DATAOFFSET)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x24)));

/* For Power Management */
sc->sc_htod_mb_data_addr = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x28)))
   sc->sc_shared_address + BWFM_SHARED_HTOD_MB_DATA_ADDR)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x28)));
sc->sc_dtoh_mb_data_addr = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x2c)))
   sc->sc_shared_address + BWFM_SHARED_DTOH_MB_DATA_ADDR)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x2c)));

/* Ring information */
sc->sc_ring_info_addr = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x30)))
   sc->sc_shared_address + BWFM_SHARED_RING_INFO_ADDR)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x30)));

/* Firmware's "dmesg" */
sc->sc_console_base_addr = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x14)))
   sc->sc_shared_address + BWFM_SHARED_CONSOLE_ADDR)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x14)));
sc->sc_console_buf_addr = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_console_base_addr + 0x08)))
   sc->sc_console_base_addr + BWFM_CONSOLE_BUFADDR)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_console_base_addr + 0x08)));
sc->sc_console_buf_size = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_console_base_addr + 0x0c)))
   sc->sc_console_base_addr + BWFM_CONSOLE_BUFSIZE)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_console_base_addr + 0x0c)));

/* Read ring information. */
bus_space_read_region_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_region_1((sc->sc_tcm_ioh), (
sc->sc_ring_info_addr), ((void *)&ringinfo), (sizeof(ringinfo
))))
   sc->sc_ring_info_addr, (void *)&ringinfo, sizeof(ringinfo))((sc->sc_tcm_iot)->read_region_1((sc->sc_tcm_ioh), (
sc->sc_ring_info_addr), ((void *)&ringinfo), (sizeof(ringinfo
))));

if (sc->sc_shared_version >= 6) {
sc->sc_max_submissionrings = le16toh(ringinfo.max_submissionrings)((__uint16_t)(ringinfo.max_submissionrings));
sc->sc_max_flowrings = le16toh(ringinfo.max_flowrings)((__uint16_t)(ringinfo.max_flowrings));
sc->sc_max_completionrings = le16toh(ringinfo.max_completionrings)((__uint16_t)(ringinfo.max_completionrings));
} else {
sc->sc_max_submissionrings = le16toh(ringinfo.max_flowrings)((__uint16_t)(ringinfo.max_flowrings));
sc->sc_max_flowrings = sc->sc_max_submissionrings -
    BWFM_NUM_TX_MSGRINGS2;
sc->sc_max_completionrings = BWFM_NUM_RX_MSGRINGS3;
}

if (sc->sc_dma_idx_sz == 0) {
d2h_w_idx_ptr = letoh32(ringinfo.d2h_w_idx_ptr)((__uint32_t)(ringinfo.d2h_w_idx_ptr));
d2h_r_idx_ptr = letoh32(ringinfo.d2h_r_idx_ptr)((__uint32_t)(ringinfo.d2h_r_idx_ptr));
h2d_w_idx_ptr = letoh32(ringinfo.h2d_w_idx_ptr)((__uint32_t)(ringinfo.h2d_w_idx_ptr));
h2d_r_idx_ptr = letoh32(ringinfo.h2d_r_idx_ptr)((__uint32_t)(ringinfo.h2d_r_idx_ptr));
idx_offset = sizeof(uint32_t);
} else {
uint64_t address;

/* Each TX/RX Ring has a Read and Write Ptr */
sc->sc_dma_idx_bufsz = (sc->sc_max_submissionrings +
    sc->sc_max_completionrings) * sc->sc_dma_idx_sz * 2;
sc->sc_dma_idx_buf = bwfm_pci_dmamem_alloc(sc,
    sc->sc_dma_idx_bufsz, 8);
if (sc->sc_dma_idx_buf == NULL((void *)0)) {
	/* XXX: Fallback to TCM? */
	printf("%s: cannot allocate idx buf\n",
	    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
	return 1;
}

idx_offset = sc->sc_dma_idx_sz;
h2d_w_idx_ptr = 0;
address = BWFM_PCI_DMA_DVA(sc->sc_dma_idx_buf)((uint64_t)(sc->sc_dma_idx_buf)->bdm_map->dm_segs[0]
.ds_addr);
ringinfo.h2d_w_idx_hostaddr_low =
    htole32(address & 0xffffffff)((__uint32_t)(address & 0xffffffff));
ringinfo.h2d_w_idx_hostaddr_high =
    htole32(address >> 32)((__uint32_t)(address >> 32));

h2d_r_idx_ptr = h2d_w_idx_ptr +
    sc->sc_max_submissionrings * idx_offset;
address += sc->sc_max_submissionrings * idx_offset;
ringinfo.h2d_r_idx_hostaddr_low =
    htole32(address & 0xffffffff)((__uint32_t)(address & 0xffffffff));
ringinfo.h2d_r_idx_hostaddr_high =
    htole32(address >> 32)((__uint32_t)(address >> 32));

d2h_w_idx_ptr = h2d_r_idx_ptr +
    sc->sc_max_submissionrings * idx_offset;
address += sc->sc_max_submissionrings * idx_offset;
ringinfo.d2h_w_idx_hostaddr_low =
    htole32(address & 0xffffffff)((__uint32_t)(address & 0xffffffff));
ringinfo.d2h_w_idx_hostaddr_high =
    htole32(address >> 32)((__uint32_t)(address >> 32));

d2h_r_idx_ptr = d2h_w_idx_ptr +
    sc->sc_max_completionrings * idx_offset;
address += sc->sc_max_completionrings * idx_offset;
ringinfo.d2h_r_idx_hostaddr_low =
    htole32(address & 0xffffffff)((__uint32_t)(address & 0xffffffff));
ringinfo.d2h_r_idx_hostaddr_high =
    htole32(address >> 32)((__uint32_t)(address >> 32));

bus_space_write_region_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_region_1((sc->sc_tcm_ioh), (
sc->sc_ring_info_addr), ((void *)&ringinfo), (sizeof(ringinfo
))))
    sc->sc_ring_info_addr, (void *)&ringinfo, sizeof(ringinfo))((sc->sc_tcm_iot)->write_region_1((sc->sc_tcm_ioh), (
sc->sc_ring_info_addr), ((void *)&ringinfo), (sizeof(ringinfo
))));
}

uint32_t ring_mem_ptr = letoh32(ringinfo.ringmem)((__uint32_t)(ringinfo.ringmem));
/* TX ctrl ring: Send ctrl buffers, send IOCTLs */
if (bwfm_pci_setup_ring(sc, &sc->sc_ctrl_submit, 64, 40,
   h2d_w_idx_ptr, h2d_r_idx_ptr, 0, idx_offset,
   &ring_mem_ptr))
goto cleanup;
/* TX rxpost ring: Send clean data mbufs for RX */
if (bwfm_pci_setup_ring(sc, &sc->sc_rxpost_submit, 1024, 32,
   h2d_w_idx_ptr, h2d_r_idx_ptr, 1, idx_offset,
   &ring_mem_ptr))
goto cleanup;
/* RX completion rings: recv our filled buffers back */
if (bwfm_pci_setup_ring(sc, &sc->sc_ctrl_complete, 64, 24,
   d2h_w_idx_ptr, d2h_r_idx_ptr, 0, idx_offset,
   &ring_mem_ptr))
goto cleanup;
if (bwfm_pci_setup_ring(sc, &sc->sc_tx_complete, 1024,
   sc->sc_shared_version >= 7 ? 24 : 16,
   d2h_w_idx_ptr, d2h_r_idx_ptr, 1, idx_offset,
   &ring_mem_ptr))
goto cleanup;
if (bwfm_pci_setup_ring(sc, &sc->sc_rx_complete, 1024,
   sc->sc_shared_version >= 7 ? 40 : 32,
   d2h_w_idx_ptr, d2h_r_idx_ptr, 2, idx_offset,
   &ring_mem_ptr))
goto cleanup;

/* Dynamic TX rings for actual data */
sc->sc_flowrings = malloc(sc->sc_max_flowrings *
   sizeof(struct bwfm_pci_msgring), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
for (i = 0; i < sc->sc_max_flowrings; i++) {
struct bwfm_pci_msgring *ring = &sc->sc_flowrings[i];
ring->w_idx_addr = h2d_w_idx_ptr + (i + 2) * idx_offset;
ring->r_idx_addr = h2d_r_idx_ptr + (i + 2) * idx_offset;
}

/* Scratch and ring update buffers for firmware */
if ((sc->sc_scratch_buf = bwfm_pci_dmamem_alloc(sc,
   BWFM_DMA_D2H_SCRATCH_BUF_LEN8, 8)) == NULL((void *)0))
goto cleanup;
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x38), (((uint64_t)(sc->sc_scratch_buf
)->bdm_map->dm_segs[0].ds_addr) & 0xffffffff)))
   sc->sc_shared_address + BWFM_SHARED_DMA_SCRATCH_ADDR_LOW,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x38), (((uint64_t)(sc->sc_scratch_buf
)->bdm_map->dm_segs[0].ds_addr) & 0xffffffff)))
   BWFM_PCI_DMA_DVA(sc->sc_scratch_buf) & 0xffffffff)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x38), (((uint64_t)(sc->sc_scratch_buf
)->bdm_map->dm_segs[0].ds_addr) & 0xffffffff)));
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x3c), (((uint64_t)(sc->sc_scratch_buf
)->bdm_map->dm_segs[0].ds_addr) >> 32)))
   sc->sc_shared_address + BWFM_SHARED_DMA_SCRATCH_ADDR_HIGH,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x3c), (((uint64_t)(sc->sc_scratch_buf
)->bdm_map->dm_segs[0].ds_addr) >> 32)))
   BWFM_PCI_DMA_DVA(sc->sc_scratch_buf) >> 32)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x3c), (((uint64_t)(sc->sc_scratch_buf
)->bdm_map->dm_segs[0].ds_addr) >> 32)));
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x34), (8)))
   sc->sc_shared_address + BWFM_SHARED_DMA_SCRATCH_LEN,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x34), (8)))
   BWFM_DMA_D2H_SCRATCH_BUF_LEN)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x34), (8)));

if ((sc->sc_ringupd_buf = bwfm_pci_dmamem_alloc(sc,
   BWFM_DMA_D2H_RINGUPD_BUF_LEN1024, 8)) == NULL((void *)0))
goto cleanup;
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x44), (((uint64_t)(sc->sc_ringupd_buf
)->bdm_map->dm_segs[0].ds_addr) & 0xffffffff)))
   sc->sc_shared_address + BWFM_SHARED_DMA_RINGUPD_ADDR_LOW,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x44), (((uint64_t)(sc->sc_ringupd_buf
)->bdm_map->dm_segs[0].ds_addr) & 0xffffffff)))
   BWFM_PCI_DMA_DVA(sc->sc_ringupd_buf) & 0xffffffff)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x44), (((uint64_t)(sc->sc_ringupd_buf
)->bdm_map->dm_segs[0].ds_addr) & 0xffffffff)));
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x48), (((uint64_t)(sc->sc_ringupd_buf
)->bdm_map->dm_segs[0].ds_addr) >> 32)))
   sc->sc_shared_address + BWFM_SHARED_DMA_RINGUPD_ADDR_HIGH,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x48), (((uint64_t)(sc->sc_ringupd_buf
)->bdm_map->dm_segs[0].ds_addr) >> 32)))
   BWFM_PCI_DMA_DVA(sc->sc_ringupd_buf) >> 32)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x48), (((uint64_t)(sc->sc_ringupd_buf
)->bdm_map->dm_segs[0].ds_addr) >> 32)));
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x40), (1024)))
   sc->sc_shared_address + BWFM_SHARED_DMA_RINGUPD_LEN,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x40), (1024)))
   BWFM_DMA_D2H_RINGUPD_BUF_LEN)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_shared_address + 0x40), (1024)));

bwfm_pci_select_core(sc, BWFM_AGENT_CORE_PCIE20x83C);
bwfm_pci_intr_enable(sc);
bwfm_pci_hostready(sc);

/* Maps RX mbufs to a packet id and back. */
sc->sc_rx_pkts.npkt = BWFM_NUM_RX_PKTIDS1024;
sc->sc_rx_pkts.pkts = malloc(BWFM_NUM_RX_PKTIDS1024 *
   sizeof(struct bwfm_pci_buf), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
for (i = 0; i < BWFM_NUM_RX_PKTIDS1024; i++)
bus_dmamap_create(sc->sc_dmat, MSGBUF_MAX_CTL_PKT_SIZE,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (8192
), (1), (8192), (0), (0x0000), (&sc->sc_rx_pkts.pkts[i
].bb_map))
    BWFM_NUM_RX_DESCS, MSGBUF_MAX_CTL_PKT_SIZE, 0, BUS_DMA_WAITOK,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (8192
), (1), (8192), (0), (0x0000), (&sc->sc_rx_pkts.pkts[i
].bb_map))
    &sc->sc_rx_pkts.pkts[i].bb_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (8192
), (1), (8192), (0), (0x0000), (&sc->sc_rx_pkts.pkts[i
].bb_map));

/* Maps TX mbufs to a packet id and back. */
sc->sc_tx_pkts.npkt = BWFM_NUM_TX_PKTIDS2048;
sc->sc_tx_pkts.pkts = malloc(BWFM_NUM_TX_PKTIDS2048
   * sizeof(struct bwfm_pci_buf), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
for (i = 0; i < BWFM_NUM_TX_PKTIDS2048; i++)
bus_dmamap_create(sc->sc_dmat, MSGBUF_MAX_PKT_SIZE,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (2048
), (1), (2048), (0), (0x0000), (&sc->sc_tx_pkts.pkts[i
].bb_map))
    BWFM_NUM_TX_DESCS, MSGBUF_MAX_PKT_SIZE, 0, BUS_DMA_WAITOK,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (2048
), (1), (2048), (0), (0x0000), (&sc->sc_tx_pkts.pkts[i
].bb_map))
    &sc->sc_tx_pkts.pkts[i].bb_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (2048
), (1), (2048), (0), (0x0000), (&sc->sc_tx_pkts.pkts[i
].bb_map));
sc->sc_tx_pkts_full = 0;

/* Maps IOCTL mbufs to a packet id and back. */
sc->sc_ioctl_pkts.npkt = BWFM_NUM_IOCTL_PKTIDS8;
sc->sc_ioctl_pkts.pkts = malloc(BWFM_NUM_IOCTL_PKTIDS8
   * sizeof(struct bwfm_pci_buf), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
for (i = 0; i < BWFM_NUM_IOCTL_PKTIDS8; i++)
bus_dmamap_create(sc->sc_dmat, MSGBUF_MAX_PKT_SIZE,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (2048
), (1), (2048), (0), (0x0000), (&sc->sc_ioctl_pkts.pkts
[i].bb_map))
    BWFM_NUM_IOCTL_DESCS, MSGBUF_MAX_PKT_SIZE, 0, BUS_DMA_WAITOK,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (2048
), (1), (2048), (0), (0x0000), (&sc->sc_ioctl_pkts.pkts
[i].bb_map))
    &sc->sc_ioctl_pkts.pkts[i].bb_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (2048
), (1), (2048), (0), (0x0000), (&sc->sc_ioctl_pkts.pkts
[i].bb_map));

/*
* For whatever reason, could also be a bug somewhere in this
* driver, the firmware needs a bunch of RX buffers otherwise
* it won't send any RX complete messages.
*/
if_rxr_init(&sc->sc_rxbuf_ring, min(256, sc->sc_max_rxbufpost),
   sc->sc_max_rxbufpost);
if_rxr_init(&sc->sc_ioctl_ring, 8, 8);
if_rxr_init(&sc->sc_event_ring, 8, 8);
bwfm_pci_fill_rx_rings(sc);

TAILQ_INIT(&sc->sc_ioctlq)do { (&sc->sc_ioctlq)->tqh_first = ((void *)0); (&
sc->sc_ioctlq)->tqh_last = &(&sc->sc_ioctlq)
->tqh_first; } while (0);

777#ifdef BWFM_DEBUG
sc->sc_console_readidx = 0;
bwfm_pci_debug_console(sc);
780#endif

sc->sc_initialized = 1;
return 0;

785cleanup:
if (sc->sc_ringupd_buf)
bwfm_pci_dmamem_free(sc, sc->sc_ringupd_buf);
if (sc->sc_scratch_buf)
bwfm_pci_dmamem_free(sc, sc->sc_scratch_buf);
if (sc->sc_rx_complete.ring)
bwfm_pci_dmamem_free(sc, sc->sc_rx_complete.ring);
if (sc->sc_tx_complete.ring)
bwfm_pci_dmamem_free(sc, sc->sc_tx_complete.ring);
if (sc->sc_ctrl_complete.ring)
bwfm_pci_dmamem_free(sc, sc->sc_ctrl_complete.ring);
if (sc->sc_rxpost_submit.ring)
bwfm_pci_dmamem_free(sc, sc->sc_rxpost_submit.ring);
if (sc->sc_ctrl_submit.ring)
bwfm_pci_dmamem_free(sc, sc->sc_ctrl_submit.ring);
if (sc->sc_dma_idx_buf)
bwfm_pci_dmamem_free(sc, sc->sc_dma_idx_buf);
return 1;
803}

805int
806bwfm_pci_load_microcode(struct bwfm_pci_softc *sc, const u_char *ucode, size_t size,
  const u_char *nvram, size_t nvlen)
808{
struct bwfm_softc *bwfm = (void *)sc;
struct bwfm_core *core;
struct bwfm_pci_random_seed_footer footer;
uint32_t addr, shared, written;
uint8_t *rndbuf;
int i;

if (bwfm->sc_chip.ch_chip == BRCM_CC_43602_CHIP_ID43602) {
17
←
Assuming field 'ch_chip' is not equal to BRCM_CC_43602_CHIP_ID→
18
←
Taking false branch→
bwfm_pci_select_core(sc, BWFM_AGENT_CORE_ARM_CR40x83E);
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x40),
 (5)))
    BWFM_PCI_ARMCR4REG_BANKIDX, 5)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x40),
 (5)));
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0)))
    BWFM_PCI_ARMCR4REG_BANKPDA, 0)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0)));
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x40),
 (7)))
    BWFM_PCI_ARMCR4REG_BANKIDX, 7)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x40),
 (7)));
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0)))
    BWFM_PCI_ARMCR4REG_BANKPDA, 0)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0)));
}

for (i = 0; i < size; i++)
19
←
Assuming 'i' is >= 'size'→
20
←
Loop condition is false. Execution continues on line 833→
bus_space_write_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + i), (ucode[i])))
    bwfm->sc_chip.ch_rambase + i, ucode[i])((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + i), (ucode[i])));

/* Firmware replaces this with a pointer once up. */
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4), (0)))
   bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4, 0)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4), (0)));

if (nvram) {
21
←
Assuming 'nvram' is non-null→
22
←
Taking true branch→
addr = bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize -
    nvlen;
for (i = 0; i < nvlen; i++)
23
←
Assuming 'i' is >= 'nvlen'→
24
←
Loop condition is false. Execution continues on line 843→
	bus_space_write_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (addr +
 i), (nvram[i])))
	    addr + i, nvram[i])((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (addr +
 i), (nvram[i])));

footer.length = htole32(BWFM_RANDOM_SEED_LENGTH)((__uint32_t)(0x100));
footer.magic = htole32(BWFM_RANDOM_SEED_MAGIC)((__uint32_t)(0xfeedc0de));
addr -= sizeof(footer);
for (i = 0; i < sizeof(footer); i++)
25
←
Loop condition is true.  Entering loop body→
26
←
The value 1 is assigned to 'i'→
27
←
Loop condition is true.  Entering loop body→
	bus_space_write_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (addr +
 i), (((uint8_t *)&footer)[i])))
28
←
3rd function call argument is an uninitialized value
	    addr + i, ((uint8_t *)&footer)[i])((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (addr +
 i), (((uint8_t *)&footer)[i])));

rndbuf = malloc(BWFM_RANDOM_SEED_LENGTH0x100, M_TEMP127, M_WAITOK0x0001);
arc4random_buf(rndbuf, BWFM_RANDOM_SEED_LENGTH0x100);
addr -= BWFM_RANDOM_SEED_LENGTH0x100;
for (i = 0; i < BWFM_RANDOM_SEED_LENGTH0x100; i++)
	bus_space_write_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (addr +
 i), (rndbuf[i])))
	    addr + i, rndbuf[i])((sc->sc_tcm_iot)->write_1((sc->sc_tcm_ioh), (addr +
 i), (rndbuf[i])));
free(rndbuf, M_TEMP127, BWFM_RANDOM_SEED_LENGTH0x100);
}

written = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4)))
   bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4)));

/* Load reset vector from firmware and kickstart core. */
if (bwfm->sc_chip.ch_chip == BRCM_CC_43602_CHIP_ID43602) {
core = bwfm_chip_get_core(bwfm, BWFM_AGENT_INTERNAL_MEM0x80E);
bwfm->sc_chip.ch_core_reset(bwfm, core, 0, 0, 0);
}
bwfm_chip_set_active(bwfm, *(uint32_t *)ucode);

for (i = 0; i < 100; i++) {
delay(50 * 1000)(*delay_func)(50 * 1000);
shared = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4)))
    bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (bwfm->
sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4)));
if (shared != written)
	break;
}
if (shared == written) {
printf("%s: firmware did not come up\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return 1;
}
if (shared < bwfm->sc_chip.ch_rambase ||
   shared >= bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize) {
printf("%s: invalid shared RAM address 0x%08x\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname),
    shared);
return 1;
}

sc->sc_shared_address = shared;
return 0;
889}

891int
892bwfm_pci_detach(struct device *self, int flags)
893{
struct bwfm_pci_softc *sc = (struct bwfm_pci_softc *)self;

bwfm_detach(&sc->sc_sc, flags);
bwfm_pci_cleanup(sc);

return 0;
900}

902void
903bwfm_pci_cleanup(struct bwfm_pci_softc *sc)
904{
int i;

for (i = 0; i < BWFM_NUM_RX_PKTIDS1024; i++) {
bus_dmamap_destroy(sc->sc_dmat, sc->sc_rx_pkts.pkts[i].bb_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_rx_pkts.pkts[i].bb_map));
if (sc->sc_rx_pkts.pkts[i].bb_m)
	m_freem(sc->sc_rx_pkts.pkts[i].bb_m);
}
free(sc->sc_rx_pkts.pkts, M_DEVBUF2, BWFM_NUM_RX_PKTIDS1024 *
   sizeof(struct bwfm_pci_buf));

for (i = 0; i < BWFM_NUM_TX_PKTIDS2048; i++) {
bus_dmamap_destroy(sc->sc_dmat, sc->sc_tx_pkts.pkts[i].bb_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_tx_pkts.pkts[i].bb_map));
if (sc->sc_tx_pkts.pkts[i].bb_m)
	m_freem(sc->sc_tx_pkts.pkts[i].bb_m);
}
free(sc->sc_tx_pkts.pkts, M_DEVBUF2, BWFM_NUM_TX_PKTIDS2048 *
   sizeof(struct bwfm_pci_buf));

for (i = 0; i < BWFM_NUM_IOCTL_PKTIDS8; i++) {
bus_dmamap_destroy(sc->sc_dmat, sc->sc_ioctl_pkts.pkts[i].bb_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_ioctl_pkts.pkts[i].bb_map));
if (sc->sc_ioctl_pkts.pkts[i].bb_m)
	m_freem(sc->sc_ioctl_pkts.pkts[i].bb_m);
}
free(sc->sc_ioctl_pkts.pkts, M_DEVBUF2, BWFM_NUM_IOCTL_PKTIDS8 *
   sizeof(struct bwfm_pci_buf));

for (i = 0; i < sc->sc_max_flowrings; i++) {
if (sc->sc_flowrings[i].status >= RING_OPEN)
	bwfm_pci_dmamem_free(sc, sc->sc_flowrings[i].ring);
}
free(sc->sc_flowrings, M_DEVBUF2, sc->sc_max_flowrings *
   sizeof(struct bwfm_pci_msgring));

bwfm_pci_dmamem_free(sc, sc->sc_ringupd_buf);
bwfm_pci_dmamem_free(sc, sc->sc_scratch_buf);
bwfm_pci_dmamem_free(sc, sc->sc_rx_complete.ring);
bwfm_pci_dmamem_free(sc, sc->sc_tx_complete.ring);
bwfm_pci_dmamem_free(sc, sc->sc_ctrl_complete.ring);
bwfm_pci_dmamem_free(sc, sc->sc_rxpost_submit.ring);
bwfm_pci_dmamem_free(sc, sc->sc_ctrl_submit.ring);
if (sc->sc_dma_idx_buf) {
bwfm_pci_dmamem_free(sc, sc->sc_dma_idx_buf);
sc->sc_dma_idx_buf = NULL((void *)0);
}

sc->sc_initialized = 0;
951}

953int
954bwfm_pci_activate(struct device *self, int act)
955{
struct bwfm_pci_softc *sc = (struct bwfm_pci_softc *)self;
struct bwfm_softc *bwfm = (void *)sc;
int error = 0;

switch (act) {
case DVACT_QUIESCE2:
error = bwfm_activate(bwfm, act);
if (error)
	return error;
if (sc->sc_initialized) {
	sc->sc_mbdata_done = 0;
	error = bwfm_pci_send_mb_data(sc,
	    BWFM_PCI_H2D_HOST_D3_INFORM0x00000001);
	if (error)
		return error;
	tsleep_nsec(&sc->sc_mbdata_done, PCATCH0x100,
	    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), SEC_TO_NSEC(2));
	if (!sc->sc_mbdata_done)
		return ETIMEDOUT60;
}
break;
case DVACT_WAKEUP5:
if (sc->sc_initialized) {
	/* If device can't be resumed, re-init. */
	if (bwfm_pci_intmask(sc) == 0 ||
	    bwfm_pci_send_mb_data(sc,
	    BWFM_PCI_H2D_HOST_D0_INFORM0x00000010) != 0) {
		bwfm_cleanup(bwfm);
		bwfm_pci_cleanup(sc);
	} else {
		bwfm_pci_select_core(sc, BWFM_AGENT_CORE_PCIE20x83C);
		bwfm_pci_intr_enable(sc);
		bwfm_pci_hostready(sc);
	}
}
error = bwfm_activate(bwfm, act);
if (error)
	return error;
break;
default:
break;
}

return 0;
1000}

1002#if defined(__HAVE_FDT)
1003int
1004bwfm_pci_read_otp(struct bwfm_pci_softc *sc)
1005{
struct bwfm_softc *bwfm = (void *)sc;
struct bwfm_core *core;
uint32_t coreid, base, words;
uint32_t page, offset, sromctl;
uint8_t *otp;
int i;

switch (bwfm->sc_chip.ch_chip) {
case BRCM_CC_4355_CHIP_ID0x4355:
coreid = BWFM_AGENT_CORE_CHIPCOMMON0x800;
base = 0x8c0;
words = 0xb2;
break;
case BRCM_CC_4364_CHIP_ID0x4364:
coreid = BWFM_AGENT_CORE_CHIPCOMMON0x800;
base = 0x8c0;
words = 0x1a0;
break;
case BRCM_CC_4377_CHIP_ID0x4377:
case BRCM_CC_4378_CHIP_ID0x4378:
coreid = BWFM_AGENT_CORE_GCI0x840;
base = 0x1120;
words = 0x170;
break;
case BRCM_CC_4387_CHIP_ID0x4387:
coreid = BWFM_AGENT_CORE_GCI0x840;
base = 0x113c;
words = 0x170;
break;
default:
return 0;
}

core = bwfm_chip_get_core(bwfm, coreid);
if (core == NULL((void *)0))
return 1;

/* Map OTP to shadow area */
if (coreid == BWFM_AGENT_CORE_CHIPCOMMON0x800) {
bwfm_pci_select_core(sc, coreid);
sromctl = bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x00000190
)))
    BWFM_CHIP_REG_SROMCONTROL)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x00000190
)));

if (!(sromctl & BWFM_CHIP_REG_SROMCONTROL_OTP_PRESENT(1 << 5)))
	return 0;

bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000190
), (sromctl | (1 << 4))))
    BWFM_CHIP_REG_SROMCONTROL, sromctl |((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000190
), (sromctl | (1 << 4))))
    BWFM_CHIP_REG_SROMCONTROL_OTPSEL)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000190
), (sromctl | (1 << 4))));
}

/* Map bus window to SROM/OTP shadow area */
page = (core->co_base + base) & ~(BWFM_PCI_BAR0_REG_SIZE0x1000 - 1);
offset = (core->co_base + base) & (BWFM_PCI_BAR0_REG_SIZE0x1000 - 1);
pci_conf_write(sc->sc_pc, sc->sc_tag, BWFM_PCI_BAR0_WINDOW0x80, page);

otp = mallocarray(words, sizeof(uint16_t), M_TEMP127, M_WAITOK0x0001);
for (i = 0; i < words; i++)
((uint16_t *)otp)[i] = bus_space_read_2(sc->sc_reg_iot,((sc->sc_reg_iot)->read_2((sc->sc_reg_ioh), (offset +
 i * sizeof(uint16_t))))
    sc->sc_reg_ioh, offset + i * sizeof(uint16_t))((sc->sc_reg_iot)->read_2((sc->sc_reg_ioh), (offset +
 i * sizeof(uint16_t))));

/* Unmap OTP */
if (coreid == BWFM_AGENT_CORE_CHIPCOMMON0x800) {
bwfm_pci_select_core(sc, coreid);
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000190
), (sromctl)))
    BWFM_CHIP_REG_SROMCONTROL, sromctl)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000190
), (sromctl)));
}

for (i = 0; i < (words * sizeof(uint16_t)) - 1; i += otp[i + 1]) {
if (otp[i + 0] == 0)
	break;
if (i + otp[i + 1] > words * sizeof(uint16_t))
	break;
bwfm_pci_process_otp_tuple(sc, otp[i + 0], otp[i + 1],
    &otp[i + 2]);
}

free(otp, M_TEMP127, words * sizeof(uint16_t));
return 0;
1085}

1087void
1088bwfm_pci_process_otp_tuple(struct bwfm_pci_softc *sc, uint8_t type, uint8_t size,
  uint8_t *data)
1090{
struct bwfm_softc *bwfm = (void *)sc;
char chiprev[8] = "", module[8] = "", modrev[8] = "", vendor[8] = "", chip[8] = "";
char board_type[128] = "";
int len;

switch (type) {
case 0x15: /* system vendor OTP */
DPRINTF(("%s: system vendor OTP\n", DEVNAME(sc)))do { ; } while (0);
if (size < sizeof(uint32_t))
	return;
if (data[0] != 0x08 || data[1] != 0x00 ||
    data[2] != 0x00 || data[3] != 0x00)
	return;
size -= sizeof(uint32_t);
data += sizeof(uint32_t);
while (size) {
	/* reached end */
	if (data[0] == 0xff)
		break;
	for (len = 0; len < size; len++)
		if (data[len] == 0x00 || data[len] == ' ' ||
		    data[len] == 0xff)
			break;
	if (len < 3 || len > 9) /* X=abcdef */
		goto next;
	if (data[1] != '=')
		goto next;
	/* NULL-terminate string */
	if (data[len] == ' ')
		data[len] = '\0';
	switch (data[0]) {
	case 's':
		strlcpy(chiprev, &data[2], sizeof(chiprev));
		break;
	case 'M':
		strlcpy(module, &data[2], sizeof(module));
		break;
	case 'm':
		strlcpy(modrev, &data[2], sizeof(modrev));
		break;
	case 'V':
		strlcpy(vendor, &data[2], sizeof(vendor));
		break;
	}
1135next:
	/* skip content */
	data += len;
	size -= len;
	/* skip spacer tag */
	if (size) {
		data++;
		size--;
	}
}
snprintf(chip, sizeof(chip),
    bwfm->sc_chip.ch_chip > 40000 ? "%05d" : "%04x",
    bwfm->sc_chip.ch_chip);
if (sc->sc_sc.sc_node) {
	OF_getprop(sc->sc_sc.sc_node, "brcm,board-type",
	    board_type, sizeof(board_type));
	if (strncmp(board_type, "apple,", 6) == 0) {
		strlcpy(sc->sc_sc.sc_fwdir, "apple-bwfm/",
		    sizeof(sc->sc_sc.sc_fwdir));
	}
}
strlcpy(sc->sc_sc.sc_board_type, board_type,
    sizeof(sc->sc_sc.sc_board_type));
strlcpy(sc->sc_sc.sc_module, module,
    sizeof(sc->sc_sc.sc_module));
strlcpy(sc->sc_sc.sc_vendor, vendor,
    sizeof(sc->sc_sc.sc_vendor));
strlcpy(sc->sc_sc.sc_modrev, modrev,
    sizeof(sc->sc_sc.sc_modrev));
break;
case 0x80: /* Broadcom CIS */
DPRINTF(("%s: Broadcom CIS\n", DEVNAME(sc)))do { ; } while (0);
break;
default:
DPRINTF(("%s: unknown OTP tuple\n", DEVNAME(sc)))do { ; } while (0);
break;
}
1172}
1173#endif

1175/* DMA code */
1176struct bwfm_pci_dmamem *
1177bwfm_pci_dmamem_alloc(struct bwfm_pci_softc *sc, bus_size_t size, bus_size_t align)
1178{
struct bwfm_pci_dmamem *bdm;
int nsegs;

bdm = malloc(sizeof(*bdm), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
bdm->bdm_size = size;

if (bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0000 | 0x0002), (&bdm->bdm_map
))
   BUS_DMA_WAITOK | BUS_DMA_ALLOCNOW, &bdm->bdm_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0000 | 0x0002), (&bdm->bdm_map
)) != 0)
goto bdmfree;

if (bus_dmamem_alloc(sc->sc_dmat, size, align, 0, &bdm->bdm_seg, 1,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), (align), (0), (&bdm->bdm_seg), (1), (&nsegs), (
0x0000))
   &nsegs, BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), (align), (0), (&bdm->bdm_seg), (1), (&nsegs), (
0x0000)) != 0)
goto destroy;

if (bus_dmamem_map(sc->sc_dmat, &bdm->bdm_seg, nsegs, size,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&bdm
->bdm_seg), (nsegs), (size), (&bdm->bdm_kva), (0x0000
 | 0x0004))
   &bdm->bdm_kva, BUS_DMA_WAITOK | BUS_DMA_COHERENT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&bdm
->bdm_seg), (nsegs), (size), (&bdm->bdm_kva), (0x0000
 | 0x0004)) != 0)
goto free;

if (bus_dmamap_load(sc->sc_dmat, bdm->bdm_map, bdm->bdm_kva, size,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (bdm->
bdm_map), (bdm->bdm_kva), (size), (((void *)0)), (0x0000))
   NULL, BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (bdm->
bdm_map), (bdm->bdm_kva), (size), (((void *)0)), (0x0000)) != 0)
goto unmap;

bzero(bdm->bdm_kva, size)__builtin_bzero((bdm->bdm_kva), (size));

return (bdm);

1205unmap:
bus_dmamem_unmap(sc->sc_dmat, bdm->bdm_kva, size)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (bdm->
bdm_kva), (size));
1207free:
bus_dmamem_free(sc->sc_dmat, &bdm->bdm_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
bdm->bdm_seg), (1));
1209destroy:
bus_dmamap_destroy(sc->sc_dmat, bdm->bdm_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (bdm
->bdm_map));
1211bdmfree:
free(bdm, M_DEVBUF2, sizeof(*bdm));

return (NULL((void *)0));
1215}

1217void
1218bwfm_pci_dmamem_free(struct bwfm_pci_softc *sc, struct bwfm_pci_dmamem *bdm)
1219{
bus_dmamem_unmap(sc->sc_dmat, bdm->bdm_kva, bdm->bdm_size)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (bdm->
bdm_kva), (bdm->bdm_size));
bus_dmamem_free(sc->sc_dmat, &bdm->bdm_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
bdm->bdm_seg), (1));
bus_dmamap_destroy(sc->sc_dmat, bdm->bdm_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (bdm
->bdm_map));
free(bdm, M_DEVBUF2, sizeof(*bdm));
1224}

1226/*
* We need a simple mapping from a packet ID to mbufs, because when
* a transfer completed, we only know the ID so we have to look up
* the memory for the ID.  This simply looks for an empty slot.
*/
1231int
1232bwfm_pci_pktid_avail(struct bwfm_pci_softc *sc, struct bwfm_pci_pkts *pkts)
1233{
int i, idx;

idx = pkts->last + 1;
for (i = 0; i < pkts->npkt; i++) {
if (idx == pkts->npkt)
	idx = 0;
if (pkts->pkts[idx].bb_m == NULL((void *)0))
	return 0;
idx++;
}
return ENOBUFS55;
1245}

1247int
1248bwfm_pci_pktid_new(struct bwfm_pci_softc *sc, struct bwfm_pci_pkts *pkts,
  struct mbuf *m, uint32_t *pktid, paddr_t *paddr)
1250{
int i, idx;

idx = pkts->last + 1;
for (i = 0; i < pkts->npkt; i++) {
if (idx == pkts->npkt)
	idx = 0;
if (pkts->pkts[idx].bb_m == NULL((void *)0)) {
	if (bus_dmamap_load_mbuf(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
pkts->pkts[idx].bb_map), (m), (0x0001))
	    pkts->pkts[idx].bb_map, m, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
pkts->pkts[idx].bb_map), (m), (0x0001)) != 0) {
		if (m_defrag(m, M_DONTWAIT0x0002))
			return EFBIG27;
		if (bus_dmamap_load_mbuf(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
pkts->pkts[idx].bb_map), (m), (0x0001))
		    pkts->pkts[idx].bb_map, m, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
pkts->pkts[idx].bb_map), (m), (0x0001)) != 0)
			return EFBIG27;
	}
	bus_dmamap_sync(sc->sc_dmat, pkts->pkts[idx].bb_map,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pkts->
pkts[idx].bb_map), (0), (pkts->pkts[idx].bb_map->dm_mapsize
), (0x01 | 0x04))
	    0, pkts->pkts[idx].bb_map->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pkts->
pkts[idx].bb_map), (0), (pkts->pkts[idx].bb_map->dm_mapsize
), (0x01 | 0x04))
	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pkts->
pkts[idx].bb_map), (0), (pkts->pkts[idx].bb_map->dm_mapsize
), (0x01 | 0x04));
	pkts->last = idx;
	pkts->pkts[idx].bb_m = m;
	*pktid = idx;
	*paddr = pkts->pkts[idx].bb_map->dm_segs[0].ds_addr;
	return 0;
}
idx++;
}
return ENOBUFS55;
1278}

1280struct mbuf *
1281bwfm_pci_pktid_free(struct bwfm_pci_softc *sc, struct bwfm_pci_pkts *pkts,
  uint32_t pktid)
1283{
struct mbuf *m;

if (pktid >= pkts->npkt || pkts->pkts[pktid].bb_m == NULL((void *)0))
return NULL((void *)0);
bus_dmamap_sync(sc->sc_dmat, pkts->pkts[pktid].bb_map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pkts->
pkts[pktid].bb_map), (0), (pkts->pkts[pktid].bb_map->dm_mapsize
), (0x02 | 0x08))
   pkts->pkts[pktid].bb_map->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pkts->
pkts[pktid].bb_map), (0), (pkts->pkts[pktid].bb_map->dm_mapsize
), (0x02 | 0x08))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pkts->
pkts[pktid].bb_map), (0), (pkts->pkts[pktid].bb_map->dm_mapsize
), (0x02 | 0x08));
bus_dmamap_unload(sc->sc_dmat, pkts->pkts[pktid].bb_map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (pkts
->pkts[pktid].bb_map));
m = pkts->pkts[pktid].bb_m;
pkts->pkts[pktid].bb_m = NULL((void *)0);
return m;
1295}

1297void
1298bwfm_pci_fill_rx_rings(struct bwfm_pci_softc *sc)
1299{
bwfm_pci_fill_rx_buf_ring(sc);
bwfm_pci_fill_rx_ioctl_ring(sc, &sc->sc_ioctl_ring,
   MSGBUF_TYPE_IOCTLRESP_BUF_POST0xB);
bwfm_pci_fill_rx_ioctl_ring(sc, &sc->sc_event_ring,
   MSGBUF_TYPE_EVENT_BUF_POST0xD);
1305}

1307void
1308bwfm_pci_fill_rx_ioctl_ring(struct bwfm_pci_softc *sc, struct if_rxring *rxring,
  uint32_t msgtype)
1310{
struct msgbuf_rx_ioctl_resp_or_event *req;
struct mbuf *m;
uint32_t pktid;
paddr_t paddr;
int s, slots;

s = splnet()splraise(0x4);
for (slots = if_rxr_get(rxring, 8); slots > 0; slots--) {
if (bwfm_pci_pktid_avail(sc, &sc->sc_rx_pkts))
	break;
req = bwfm_pci_ring_write_reserve(sc, &sc->sc_ctrl_submit);
if (req == NULL((void *)0))
	break;
m = MCLGETL(NULL, M_DONTWAIT, MSGBUF_MAX_CTL_PKT_SIZE)m_clget((((void *)0)), (0x0002), (8192));
if (m == NULL((void *)0)) {
	bwfm_pci_ring_write_cancel(sc, &sc->sc_ctrl_submit, 1);
	break;
}
m->m_lenm_hdr.mh_len = m->m_pkthdrM_dat.MH.MH_pkthdr.len = MSGBUF_MAX_CTL_PKT_SIZE8192;
if (bwfm_pci_pktid_new(sc, &sc->sc_rx_pkts, m, &pktid, &paddr)) {
	bwfm_pci_ring_write_cancel(sc, &sc->sc_ctrl_submit, 1);
	m_freem(m);
	break;
}
memset(req, 0, sizeof(*req))__builtin_memset((req), (0), (sizeof(*req)));
req->msg.msgtype = msgtype;
req->msg.request_id = htole32(pktid)((__uint32_t)(pktid));
req->host_buf_len = htole16(MSGBUF_MAX_CTL_PKT_SIZE)((__uint16_t)(8192));
req->host_buf_addr.high_addr = htole32((uint64_t)paddr >> 32)((__uint32_t)((uint64_t)paddr >> 32));
req->host_buf_addr.low_addr = htole32(paddr & 0xffffffff)((__uint32_t)(paddr & 0xffffffff));
bwfm_pci_ring_write_commit(sc, &sc->sc_ctrl_submit);
}
if_rxr_put(rxring, slots)do { (rxring)->rxr_alive -= (slots); } while (0);
splx(s)spllower(s);
1345}

1347void
1348bwfm_pci_fill_rx_buf_ring(struct bwfm_pci_softc *sc)
1349{
struct msgbuf_rx_bufpost *req;
struct mbuf *m;
uint32_t pktid;
paddr_t paddr;
int s, slots;

s = splnet()splraise(0x4);
for (slots = if_rxr_get(&sc->sc_rxbuf_ring, sc->sc_max_rxbufpost);
   slots > 0; slots--) {
if (bwfm_pci_pktid_avail(sc, &sc->sc_rx_pkts))
	break;
req = bwfm_pci_ring_write_reserve(sc, &sc->sc_rxpost_submit);
if (req == NULL((void *)0))
	break;
m = MCLGETL(NULL, M_DONTWAIT, MSGBUF_MAX_PKT_SIZE)m_clget((((void *)0)), (0x0002), (2048));
if (m == NULL((void *)0)) {
	bwfm_pci_ring_write_cancel(sc, &sc->sc_rxpost_submit, 1);
	break;
}
m->m_lenm_hdr.mh_len = m->m_pkthdrM_dat.MH.MH_pkthdr.len = MSGBUF_MAX_PKT_SIZE2048;
if (bwfm_pci_pktid_new(sc, &sc->sc_rx_pkts, m, &pktid, &paddr)) {
	bwfm_pci_ring_write_cancel(sc, &sc->sc_rxpost_submit, 1);
	m_freem(m);
	break;
}
memset(req, 0, sizeof(*req))__builtin_memset((req), (0), (sizeof(*req)));
req->msg.msgtype = MSGBUF_TYPE_RXBUF_POST0x11;
req->msg.request_id = htole32(pktid)((__uint32_t)(pktid));
req->data_buf_len = htole16(MSGBUF_MAX_PKT_SIZE)((__uint16_t)(2048));
req->data_buf_addr.high_addr = htole32((uint64_t)paddr >> 32)((__uint32_t)((uint64_t)paddr >> 32));
req->data_buf_addr.low_addr = htole32(paddr & 0xffffffff)((__uint32_t)(paddr & 0xffffffff));
bwfm_pci_ring_write_commit(sc, &sc->sc_rxpost_submit);
}
if_rxr_put(&sc->sc_rxbuf_ring, slots)do { (&sc->sc_rxbuf_ring)->rxr_alive -= (slots); } while
 (0);
splx(s)spllower(s);
1385}

1387int
1388bwfm_pci_setup_ring(struct bwfm_pci_softc *sc, struct bwfm_pci_msgring *ring,
  int nitem, size_t itemsz, uint32_t w_idx, uint32_t r_idx,
  int idx, uint32_t idx_off, uint32_t *ring_mem)
1391{
ring->w_idx_addr = w_idx + idx * idx_off;
ring->r_idx_addr = r_idx + idx * idx_off;
ring->w_ptr = 0;
ring->r_ptr = 0;
ring->nitem = nitem;
ring->itemsz = itemsz;
bwfm_pci_ring_write_rptr(sc, ring);
bwfm_pci_ring_write_wptr(sc, ring);

ring->ring = bwfm_pci_dmamem_alloc(sc, nitem * itemsz, 8);
if (ring->ring == NULL((void *)0))
return ENOMEM12;
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (*ring_mem
 + 0x08), (((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) & 0xffffffff)))
   *ring_mem + BWFM_RING_MEM_BASE_ADDR_LOW,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (*ring_mem
 + 0x08), (((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) & 0xffffffff)))
   BWFM_PCI_DMA_DVA(ring->ring) & 0xffffffff)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (*ring_mem
 + 0x08), (((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) & 0xffffffff)));
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (*ring_mem
 + 0x0c), (((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) >> 32)))
   *ring_mem + BWFM_RING_MEM_BASE_ADDR_HIGH,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (*ring_mem
 + 0x0c), (((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) >> 32)))
   BWFM_PCI_DMA_DVA(ring->ring) >> 32)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (*ring_mem
 + 0x0c), (((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) >> 32)));
bus_space_write_2(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (*ring_mem
 + 0x04), (nitem)))
   *ring_mem + BWFM_RING_MAX_ITEM, nitem)((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (*ring_mem
 + 0x04), (nitem)));
bus_space_write_2(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (*ring_mem
 + 0x06), (itemsz)))
   *ring_mem + BWFM_RING_LEN_ITEMS, itemsz)((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (*ring_mem
 + 0x06), (itemsz)));
*ring_mem = *ring_mem + BWFM_RING_MEM_SZ16;
return 0;
1416}

1418int
1419bwfm_pci_setup_flowring(struct bwfm_pci_softc *sc, struct bwfm_pci_msgring *ring,
  int nitem, size_t itemsz)
1421{
ring->w_ptr = 0;
ring->r_ptr = 0;
ring->nitem = nitem;
ring->itemsz = itemsz;
bwfm_pci_ring_write_rptr(sc, ring);
bwfm_pci_ring_write_wptr(sc, ring);

ring->ring = bwfm_pci_dmamem_alloc(sc, nitem * itemsz, 8);
if (ring->ring == NULL((void *)0))
return ENOMEM12;
return 0;
1433}

1435/* Ring helpers */
1436void
1437bwfm_pci_ring_bell(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1439{
if (sc->sc_shared_flags & BWFM_SHARED_INFO_SHARED_DAR0x80000000)
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xA20)
, (1)))
    BWFM_PCI_64_PCIE2REG_H2D_MAILBOX_0, 1)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xA20)
, (1)));
else
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x140)
, (1)))
    BWFM_PCI_PCIE2REG_H2D_MAILBOX_0, 1)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x140)
, (1)));
1446}

1448void
1449bwfm_pci_ring_update_rptr(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1451{
if (sc->sc_dma_idx_sz == 0) {
ring->r_ptr = bus_space_read_2(sc->sc_tcm_iot,((sc->sc_tcm_iot)->read_2((sc->sc_tcm_ioh), (ring->
r_idx_addr)))
    sc->sc_tcm_ioh, ring->r_idx_addr)((sc->sc_tcm_iot)->read_2((sc->sc_tcm_ioh), (ring->
r_idx_addr)));
} else {
bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->r_idx_addr), (sizeof
(uint16_t)), (0x02 | 0x08))
    BWFM_PCI_DMA_MAP(sc->sc_dma_idx_buf), ring->r_idx_addr,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->r_idx_addr), (sizeof
(uint16_t)), (0x02 | 0x08))
    sizeof(uint16_t), BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->r_idx_addr), (sizeof
(uint16_t)), (0x02 | 0x08));
ring->r_ptr = *(uint16_t *)(BWFM_PCI_DMA_KVA(sc->sc_dma_idx_buf)((void *)(sc->sc_dma_idx_buf)->bdm_kva)
    + ring->r_idx_addr);
}
1462}

1464void
1465bwfm_pci_ring_update_wptr(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1467{
if (sc->sc_dma_idx_sz == 0) {
ring->w_ptr = bus_space_read_2(sc->sc_tcm_iot,((sc->sc_tcm_iot)->read_2((sc->sc_tcm_ioh), (ring->
w_idx_addr)))
    sc->sc_tcm_ioh, ring->w_idx_addr)((sc->sc_tcm_iot)->read_2((sc->sc_tcm_ioh), (ring->
w_idx_addr)));
} else {
bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->w_idx_addr), (sizeof
(uint16_t)), (0x02 | 0x08))
    BWFM_PCI_DMA_MAP(sc->sc_dma_idx_buf), ring->w_idx_addr,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->w_idx_addr), (sizeof
(uint16_t)), (0x02 | 0x08))
    sizeof(uint16_t), BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->w_idx_addr), (sizeof
(uint16_t)), (0x02 | 0x08));
ring->w_ptr = *(uint16_t *)(BWFM_PCI_DMA_KVA(sc->sc_dma_idx_buf)((void *)(sc->sc_dma_idx_buf)->bdm_kva)
    + ring->w_idx_addr);
}
1478}

1480void
1481bwfm_pci_ring_write_rptr(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1483{
if (sc->sc_dma_idx_sz == 0) {
bus_space_write_2(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (ring->
r_idx_addr), (ring->r_ptr)))
    ring->r_idx_addr, ring->r_ptr)((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (ring->
r_idx_addr), (ring->r_ptr)));
} else {
*(uint16_t *)(BWFM_PCI_DMA_KVA(sc->sc_dma_idx_buf)((void *)(sc->sc_dma_idx_buf)->bdm_kva)
    + ring->r_idx_addr) = ring->r_ptr;
bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->r_idx_addr), (sizeof
(uint16_t)), (0x01 | 0x04))
    BWFM_PCI_DMA_MAP(sc->sc_dma_idx_buf), ring->r_idx_addr,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->r_idx_addr), (sizeof
(uint16_t)), (0x01 | 0x04))
    sizeof(uint16_t), BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->r_idx_addr), (sizeof
(uint16_t)), (0x01 | 0x04));
}
1494}

1496void
1497bwfm_pci_ring_write_wptr(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1499{
if (sc->sc_dma_idx_sz == 0) {
bus_space_write_2(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (ring->
w_idx_addr), (ring->w_ptr)))
    ring->w_idx_addr, ring->w_ptr)((sc->sc_tcm_iot)->write_2((sc->sc_tcm_ioh), (ring->
w_idx_addr), (ring->w_ptr)));
} else {
*(uint16_t *)(BWFM_PCI_DMA_KVA(sc->sc_dma_idx_buf)((void *)(sc->sc_dma_idx_buf)->bdm_kva)
    + ring->w_idx_addr) = ring->w_ptr;
bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->w_idx_addr), (sizeof
(uint16_t)), (0x01 | 0x04))
    BWFM_PCI_DMA_MAP(sc->sc_dma_idx_buf), ring->w_idx_addr,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->w_idx_addr), (sizeof
(uint16_t)), (0x01 | 0x04))
    sizeof(uint16_t), BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_dma_idx_buf)->bdm_map)), (ring->w_idx_addr), (sizeof
(uint16_t)), (0x01 | 0x04));
}
1510}

1512/*
* Retrieve a free descriptor to put new stuff in, but don't commit
* to it yet so we can rollback later if any error occurs.
*/
1516void *
1517bwfm_pci_ring_write_reserve(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1519{
int available;
char *ret;

bwfm_pci_ring_update_rptr(sc, ring);

if (ring->r_ptr > ring->w_ptr)
available = ring->r_ptr - ring->w_ptr;
else
available = ring->r_ptr + (ring->nitem - ring->w_ptr);

if (available <= 1)
return NULL((void *)0);

ret = BWFM_PCI_DMA_KVA(ring->ring)((void *)(ring->ring)->bdm_kva) + (ring->w_ptr * ring->itemsz);
ring->w_ptr += 1;
if (ring->w_ptr == ring->nitem)
ring->w_ptr = 0;
return ret;
1538}

1540void *
1541bwfm_pci_ring_write_reserve_multi(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring, int count, int *avail)
1543{
int available;
char *ret;

bwfm_pci_ring_update_rptr(sc, ring);

if (ring->r_ptr > ring->w_ptr)
available = ring->r_ptr - ring->w_ptr;
else
available = ring->r_ptr + (ring->nitem - ring->w_ptr);

if (available <= 1)
return NULL((void *)0);

ret = BWFM_PCI_DMA_KVA(ring->ring)((void *)(ring->ring)->bdm_kva) + (ring->w_ptr * ring->itemsz);
*avail = min(count, available - 1);
if (*avail + ring->w_ptr > ring->nitem)
*avail = ring->nitem - ring->w_ptr;
ring->w_ptr += *avail;
if (ring->w_ptr == ring->nitem)
ring->w_ptr = 0;
return ret;
1565}

1567/*
* Read number of descriptors available (submitted by the firmware)
* and retrieve pointer to first descriptor.
*/
1571void *
1572bwfm_pci_ring_read_avail(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring, int *avail)
1574{
bwfm_pci_ring_update_wptr(sc, ring);

if (ring->w_ptr >= ring->r_ptr)
*avail = ring->w_ptr - ring->r_ptr;
else
*avail = ring->nitem - ring->r_ptr;

if (*avail == 0)
return NULL((void *)0);

bus_dmamap_sync(sc->sc_dmat, BWFM_PCI_DMA_MAP(ring->ring),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((ring
->ring)->bdm_map)), (ring->r_ptr * ring->itemsz),
 (*avail * ring->itemsz), (0x02 | 0x08))
   ring->r_ptr * ring->itemsz, *avail * ring->itemsz,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((ring
->ring)->bdm_map)), (ring->r_ptr * ring->itemsz),
 (*avail * ring->itemsz), (0x02 | 0x08))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((ring
->ring)->bdm_map)), (ring->r_ptr * ring->itemsz),
 (*avail * ring->itemsz), (0x02 | 0x08));
return BWFM_PCI_DMA_KVA(ring->ring)((void *)(ring->ring)->bdm_kva) + (ring->r_ptr * ring->itemsz);
1589}

1591/*
* Let firmware know we read N descriptors.
*/
1594void
1595bwfm_pci_ring_read_commit(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring, int nitem)
1597{
ring->r_ptr += nitem;
if (ring->r_ptr == ring->nitem)
ring->r_ptr = 0;
bwfm_pci_ring_write_rptr(sc, ring);
1602}

1604/*
* Let firmware know that we submitted some descriptors.
*/
1607void
1608bwfm_pci_ring_write_commit(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring)
1610{
bus_dmamap_sync(sc->sc_dmat, BWFM_PCI_DMA_MAP(ring->ring),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((ring
->ring)->bdm_map)), (0), (((ring->ring)->bdm_size
)), (0x01 | 0x04))
   0, BWFM_PCI_DMA_LEN(ring->ring), BUS_DMASYNC_PREREAD |(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((ring
->ring)->bdm_map)), (0), (((ring->ring)->bdm_size
)), (0x01 | 0x04))
   BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((ring
->ring)->bdm_map)), (0), (((ring->ring)->bdm_size
)), (0x01 | 0x04));
bwfm_pci_ring_write_wptr(sc, ring);
bwfm_pci_ring_bell(sc, ring);
1616}

1618/*
* Rollback N descriptors in case we don't actually want
* to commit to it.
*/
1622void
1623bwfm_pci_ring_write_cancel(struct bwfm_pci_softc *sc,
  struct bwfm_pci_msgring *ring, int nitem)
1625{
if (ring->w_ptr == 0)
ring->w_ptr = ring->nitem - nitem;
else
ring->w_ptr -= nitem;
1630}

1632/*
* Foreach written descriptor on the ring, pass the descriptor to
* a message handler and let the firmware know we handled it.
*/
1636void
1637bwfm_pci_ring_rx(struct bwfm_pci_softc *sc, struct bwfm_pci_msgring *ring,
  struct mbuf_list *ml)
1639{
void *buf;
int avail, processed;

1643again:
buf = bwfm_pci_ring_read_avail(sc, ring, &avail);
if (buf == NULL((void *)0))
return;

processed = 0;
while (avail) {
bwfm_pci_msg_rx(sc, buf + sc->sc_rx_dataoffset, ml);
buf += ring->itemsz;
processed++;
if (processed == 48) {
	bwfm_pci_ring_read_commit(sc, ring, processed);
	processed = 0;
}
avail--;
}
if (processed)
bwfm_pci_ring_read_commit(sc, ring, processed);
if (ring->r_ptr == 0)
goto again;
1663}

1665void
1666bwfm_pci_msg_rx(struct bwfm_pci_softc *sc, void *buf, struct mbuf_list *ml)
1667{
struct ifnet *ifp = &sc->sc_sc.sc_ic.ic_ific_ac.ac_if;
struct msgbuf_ioctl_resp_hdr *resp;
struct msgbuf_tx_status *tx;
struct msgbuf_rx_complete *rx;
struct msgbuf_rx_event *event;
struct msgbuf_d2h_mailbox_data *d2h;
struct msgbuf_common_hdr *msg;
struct msgbuf_flowring_create_resp *fcr;
struct msgbuf_flowring_delete_resp *fdr;
struct bwfm_cmd_flowring_create fdcmd;
struct bwfm_pci_msgring *ring;
struct mbuf *m;
int flowid;

msg = (struct msgbuf_common_hdr *)buf;
switch (msg->msgtype)
{
case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT0x4:
fcr = (struct msgbuf_flowring_create_resp *)buf;
flowid = letoh16(fcr->compl_hdr.flow_ring_id)((__uint16_t)(fcr->compl_hdr.flow_ring_id));
if (flowid < 2)
	break;
flowid -= 2;
if (flowid >= sc->sc_max_flowrings)
	break;
ring = &sc->sc_flowrings[flowid];
if (ring->status != RING_OPENING)
	break;
if (fcr->compl_hdr.status) {
	printf("%s: failed to open flowring %d\n",
	    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), flowid);
	ring->status = RING_CLOSED;
	if (ring->m) {
		m_freem(ring->m);
		ring->m = NULL((void *)0);
	}
	ifq_restart(&ifp->if_snd);
	break;
}
ring->status = RING_OPEN;
if (ring->m != NULL((void *)0)) {
	m = ring->m;
	ring->m = NULL((void *)0);
	if (bwfm_pci_txdata(&sc->sc_sc, m))
		m_freem(ring->m);
}
ifq_restart(&ifp->if_snd);
break;
case MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT0x6:
fdr = (struct msgbuf_flowring_delete_resp *)buf;
flowid = letoh16(fdr->compl_hdr.flow_ring_id)((__uint16_t)(fdr->compl_hdr.flow_ring_id));
if (flowid < 2)
	break;
flowid -= 2;
if (flowid >= sc->sc_max_flowrings)
	break;
ring = &sc->sc_flowrings[flowid];
if (ring->status != RING_CLOSING)
	break;
if (fdr->compl_hdr.status) {
	printf("%s: failed to delete flowring %d\n",
	    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), flowid);
	break;
}
fdcmd.flowid = flowid;
bwfm_do_async(&sc->sc_sc, bwfm_pci_flowring_delete_cb,
    &fdcmd, sizeof(fdcmd));
break;
case MSGBUF_TYPE_IOCTLPTR_REQ_ACK0xA:
m = bwfm_pci_pktid_free(sc, &sc->sc_ioctl_pkts,
    letoh32(msg->request_id)((__uint32_t)(msg->request_id)));
if (m == NULL((void *)0))
	break;
m_freem(m);
break;
case MSGBUF_TYPE_IOCTL_CMPLT0xC:
resp = (struct msgbuf_ioctl_resp_hdr *)buf;
bwfm_pci_msgbuf_rxioctl(sc, resp);
if_rxr_put(&sc->sc_ioctl_ring, 1)do { (&sc->sc_ioctl_ring)->rxr_alive -= (1); } while
 (0);
bwfm_pci_fill_rx_rings(sc);
break;
case MSGBUF_TYPE_WL_EVENT0xE:
event = (struct msgbuf_rx_event *)buf;
m = bwfm_pci_pktid_free(sc, &sc->sc_rx_pkts,
    letoh32(event->msg.request_id)((__uint32_t)(event->msg.request_id)));
if (m == NULL((void *)0))
	break;
m_adj(m, sc->sc_rx_dataoffset);
m->m_lenm_hdr.mh_len = m->m_pkthdrM_dat.MH.MH_pkthdr.len = letoh16(event->event_data_len)((__uint16_t)(event->event_data_len));
bwfm_rx(&sc->sc_sc, m, ml);
if_rxr_put(&sc->sc_event_ring, 1)do { (&sc->sc_event_ring)->rxr_alive -= (1); } while
 (0);
bwfm_pci_fill_rx_rings(sc);
break;
case MSGBUF_TYPE_TX_STATUS0x10:
tx = (struct msgbuf_tx_status *)buf;
m = bwfm_pci_pktid_free(sc, &sc->sc_tx_pkts,
    letoh32(tx->msg.request_id)((__uint32_t)(tx->msg.request_id)) - 1);
if (m == NULL((void *)0))
	break;
m_freem(m);
if (sc->sc_tx_pkts_full) {
	sc->sc_tx_pkts_full = 0;
	ifq_restart(&ifp->if_snd);
}
break;
case MSGBUF_TYPE_RX_CMPLT0x12:
rx = (struct msgbuf_rx_complete *)buf;
m = bwfm_pci_pktid_free(sc, &sc->sc_rx_pkts,
    letoh32(rx->msg.request_id)((__uint32_t)(rx->msg.request_id)));
if (m == NULL((void *)0))
	break;
if (letoh16(rx->data_offset)((__uint16_t)(rx->data_offset)))
	m_adj(m, letoh16(rx->data_offset)((__uint16_t)(rx->data_offset)));
else if (sc->sc_rx_dataoffset)
	m_adj(m, sc->sc_rx_dataoffset);
m->m_lenm_hdr.mh_len = m->m_pkthdrM_dat.MH.MH_pkthdr.len = letoh16(rx->data_len)((__uint16_t)(rx->data_len));
bwfm_rx(&sc->sc_sc, m, ml);
if_rxr_put(&sc->sc_rxbuf_ring, 1)do { (&sc->sc_rxbuf_ring)->rxr_alive -= (1); } while
 (0);
bwfm_pci_fill_rx_rings(sc);
break;
case MSGBUF_TYPE_D2H_MAILBOX_DATA0x24:
d2h = (struct msgbuf_d2h_mailbox_data *)buf;
if (d2h->data & BWFM_PCI_D2H_DEV_D3_ACK0x00000001) {
	sc->sc_mbdata_done = 1;
	wakeup(&sc->sc_mbdata_done);
}
break;
default:
printf("%s: msgtype 0x%08x\n", __func__, msg->msgtype);
break;
}
1799}

1801/* Bus core helpers */
1802void
1803bwfm_pci_select_core(struct bwfm_pci_softc *sc, int id)
1804{
struct bwfm_softc *bwfm = (void *)sc;
struct bwfm_core *core;

core = bwfm_chip_get_core(bwfm, id);
if (core == NULL((void *)0)) {
6
←
Assuming 'core' is equal to NULL→
7
←
Taking true branch→
printf("%s: could not find core to select", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
8
←
Value assigned to field 'ch_chip', which participates in a condition later→
return;
}

pci_conf_write(sc->sc_pc, sc->sc_tag,
   BWFM_PCI_BAR0_WINDOW0x80, core->co_base);
if (pci_conf_read(sc->sc_pc, sc->sc_tag,
   BWFM_PCI_BAR0_WINDOW0x80) != core->co_base)
pci_conf_write(sc->sc_pc, sc->sc_tag,
    BWFM_PCI_BAR0_WINDOW0x80, core->co_base);
1820}

1822uint32_t
1823bwfm_pci_buscore_read(struct bwfm_softc *bwfm, uint32_t reg)
1824{
struct bwfm_pci_softc *sc = (void *)bwfm;
uint32_t page, offset;

page = reg & ~(BWFM_PCI_BAR0_REG_SIZE0x1000 - 1);
offset = reg & (BWFM_PCI_BAR0_REG_SIZE0x1000 - 1);
pci_conf_write(sc->sc_pc, sc->sc_tag, BWFM_PCI_BAR0_WINDOW0x80, page);
return bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh, offset)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (offset)
));
1832}

1834void
1835bwfm_pci_buscore_write(struct bwfm_softc *bwfm, uint32_t reg, uint32_t val)
1836{
struct bwfm_pci_softc *sc = (void *)bwfm;
uint32_t page, offset;

page = reg & ~(BWFM_PCI_BAR0_REG_SIZE0x1000 - 1);
offset = reg & (BWFM_PCI_BAR0_REG_SIZE0x1000 - 1);
pci_conf_write(sc->sc_pc, sc->sc_tag, BWFM_PCI_BAR0_WINDOW0x80, page);
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh, offset, val)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (offset
), (val)));
1844}

1846int
1847bwfm_pci_buscore_prepare(struct bwfm_softc *bwfm)
1848{
return 0;
1850}

1852int
1853bwfm_pci_buscore_reset(struct bwfm_softc *bwfm)
1854{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct bwfm_core *core;
uint32_t reg;
int i;

bwfm_pci_select_core(sc, BWFM_AGENT_CORE_PCIE20x83C);
reg = pci_conf_read(sc->sc_pc, sc->sc_tag,
   BWFM_PCI_CFGREG_LINK_STATUS_CTRL0x0BC);
pci_conf_write(sc->sc_pc, sc->sc_tag, BWFM_PCI_CFGREG_LINK_STATUS_CTRL0x0BC,
   reg & ~BWFM_PCI_CFGREG_LINK_STATUS_CTRL_ASPM_ENAB0x3);

bwfm_pci_select_core(sc, BWFM_AGENT_CORE_CHIPCOMMON0x800);
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000080
), (4)))
   BWFM_CHIP_REG_WATCHDOG, 4)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x00000080
), (4)));
delay(100 * 1000)(*delay_func)(100 * 1000);

bwfm_pci_select_core(sc, BWFM_AGENT_CORE_PCIE20x83C);
pci_conf_write(sc->sc_pc, sc->sc_tag,
   BWFM_PCI_CFGREG_LINK_STATUS_CTRL0x0BC, reg);

core = bwfm_chip_get_core(bwfm, BWFM_AGENT_CORE_PCIE20x83C);
if (core->co_rev <= 13) {
uint16_t cfg_offset[] = {
    BWFM_PCI_CFGREG_STATUS_CMD0x004,
    BWFM_PCI_CFGREG_PM_CSR0x04C,
    BWFM_PCI_CFGREG_MSI_CAP0x058,
    BWFM_PCI_CFGREG_MSI_ADDR_L0x05C,
    BWFM_PCI_CFGREG_MSI_ADDR_H0x060,
    BWFM_PCI_CFGREG_MSI_DATA0x064,
    BWFM_PCI_CFGREG_LINK_STATUS_CTRL20x0DC,
    BWFM_PCI_CFGREG_RBAR_CTRL0x228,
    BWFM_PCI_CFGREG_PML1_SUB_CTRL10x248,
    BWFM_PCI_CFGREG_REG_BAR2_CONFIG0x4E0,
    BWFM_PCI_CFGREG_REG_BAR3_CONFIG0x4F4,
};

for (i = 0; i < nitems(cfg_offset)(sizeof((cfg_offset)) / sizeof((cfg_offset)[0])); i++) {
	bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x120)
, (cfg_offset[i])))
	    BWFM_PCI_PCIE2REG_CONFIGADDR, cfg_offset[i])((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x120)
, (cfg_offset[i])));
	reg = bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x124))
)
	    BWFM_PCI_PCIE2REG_CONFIGDATA)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x124))
);
	DPRINTFN(3, ("%s: config offset 0x%04x, value 0x%04x\n",do { ; } while (0)
	    DEVNAME(sc), cfg_offset[i], reg))do { ; } while (0);
	bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x124)
, (reg)))
	    BWFM_PCI_PCIE2REG_CONFIGDATA, reg)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x124)
, (reg)));
}
}
if (core->co_rev >= 64)
sc->sc_pcireg64 = 1;

reg = bwfm_pci_intr_status(sc);
if (reg != 0xffffffff)
bwfm_pci_intr_ack(sc, reg);

return 0;
1910}

1912void
1913bwfm_pci_buscore_activate(struct bwfm_softc *bwfm, uint32_t rstvec)
1914{
struct bwfm_pci_softc *sc = (void *)bwfm;
bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh, 0, rstvec)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (0), (rstvec
)));
1917}

1919static int bwfm_pci_prio2fifo[8] = {
0, /* best effort */
1, /* IPTOS_PREC_IMMEDIATE */
1, /* IPTOS_PREC_PRIORITY */
0, /* IPTOS_PREC_FLASH */
2, /* IPTOS_PREC_FLASHOVERRIDE */
2, /* IPTOS_PREC_CRITIC_ECP */
3, /* IPTOS_PREC_INTERNETCONTROL */
3, /* IPTOS_PREC_NETCONTROL */
1928};

1930int
1931bwfm_pci_flowring_lookup(struct bwfm_pci_softc *sc, struct mbuf *m)
1932{
struct ieee80211com *ic = &sc->sc_sc.sc_ic;
1934#ifndef IEEE80211_STA_ONLY
uint8_t *da = mtod(m, uint8_t *)((uint8_t *)((m)->m_hdr.mh_data));
1936#endif
int flowid, prio, fifo;
int i, found;

prio = ieee80211_classify(ic, m);
fifo = bwfm_pci_prio2fifo[prio];

switch (ic->ic_opmode)
{
case IEEE80211_M_STA:
flowid = fifo;
break;
1948#ifndef IEEE80211_STA_ONLY
case IEEE80211_M_HOSTAP:
if (ETHER_IS_MULTICAST(da)(*(da) & 0x01))
	da = etherbroadcastaddr;
flowid = da[5] * 2 + fifo;
break;
1954#endif
default:
printf("%s: state not supported\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return ENOBUFS55;
}

found = 0;
flowid = flowid % sc->sc_max_flowrings;
for (i = 0; i < sc->sc_max_flowrings; i++) {
if (ic->ic_opmode == IEEE80211_M_STA &&
    sc->sc_flowrings[flowid].status >= RING_OPEN &&
    sc->sc_flowrings[flowid].fifo == fifo) {
	found = 1;
	break;
}
1969#ifndef IEEE80211_STA_ONLY
if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
    sc->sc_flowrings[flowid].status >= RING_OPEN &&
    sc->sc_flowrings[flowid].fifo == fifo &&
    !memcmp(sc->sc_flowrings[flowid].mac, da, ETHER_ADDR_LEN)__builtin_memcmp((sc->sc_flowrings[flowid].mac), (da), (6)
)) {
	found = 1;
	break;
}
1977#endif
flowid = (flowid + 1) % sc->sc_max_flowrings;
}

if (found)
return flowid;

return -1;
1985}

1987void
1988bwfm_pci_flowring_create(struct bwfm_pci_softc *sc, struct mbuf *m)
1989{
struct ieee80211com *ic = &sc->sc_sc.sc_ic;
struct bwfm_cmd_flowring_create cmd;
1992#ifndef IEEE80211_STA_ONLY
uint8_t *da = mtod(m, uint8_t *)((uint8_t *)((m)->m_hdr.mh_data));
1994#endif
struct bwfm_pci_msgring *ring;
int flowid, prio, fifo;
int i, found;

prio = ieee80211_classify(ic, m);
fifo = bwfm_pci_prio2fifo[prio];

switch (ic->ic_opmode)
{
case IEEE80211_M_STA:
flowid = fifo;
break;
2007#ifndef IEEE80211_STA_ONLY
case IEEE80211_M_HOSTAP:
if (ETHER_IS_MULTICAST(da)(*(da) & 0x01))
	da = etherbroadcastaddr;
flowid = da[5] * 2 + fifo;
break;
2013#endif
default:
printf("%s: state not supported\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return;
}

found = 0;
flowid = flowid % sc->sc_max_flowrings;
for (i = 0; i < sc->sc_max_flowrings; i++) {
ring = &sc->sc_flowrings[flowid];
if (ring->status == RING_CLOSED) {
	ring->status = RING_OPENING;
	found = 1;
	break;
}
flowid = (flowid + 1) % sc->sc_max_flowrings;
}

/*
* We cannot recover from that so far.  Only a stop/init
* cycle can revive this if it ever happens at all.
*/
if (!found) {
printf("%s: no flowring available\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return;
}

cmd.m = m;
cmd.prio = prio;
cmd.flowid = flowid;
bwfm_do_async(&sc->sc_sc, bwfm_pci_flowring_create_cb, &cmd, sizeof(cmd));
2044}

2046void
2047bwfm_pci_flowring_create_cb(struct bwfm_softc *bwfm, void *arg)
2048{
struct bwfm_pci_softc *sc = (void *)bwfm;
2050#ifndef IEEE80211_STA_ONLY
struct ieee80211com *ic = &sc->sc_sc.sc_ic;
2052#endif
struct bwfm_cmd_flowring_create *cmd = arg;
struct msgbuf_tx_flowring_create_req *req;
struct bwfm_pci_msgring *ring;
uint8_t *da, *sa;
int s;

da = mtod(cmd->m, char *)((char *)((cmd->m)->m_hdr.mh_data)) + 0 * ETHER_ADDR_LEN6;
sa = mtod(cmd->m, char *)((char *)((cmd->m)->m_hdr.mh_data)) + 1 * ETHER_ADDR_LEN6;

ring = &sc->sc_flowrings[cmd->flowid];
if (ring->status != RING_OPENING) {
printf("%s: flowring not opening\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return;
}

if (bwfm_pci_setup_flowring(sc, ring, 512, 48)) {
printf("%s: cannot setup flowring\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return;
}

s = splnet()splraise(0x4);
req = bwfm_pci_ring_write_reserve(sc, &sc->sc_ctrl_submit);
if (req == NULL((void *)0)) {
printf("%s: cannot reserve for flowring\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
splx(s)spllower(s);
return;
}

ring->status = RING_OPENING;
ring->fifo = bwfm_pci_prio2fifo[cmd->prio];
ring->m = cmd->m;
memcpy(ring->mac, da, ETHER_ADDR_LEN)__builtin_memcpy((ring->mac), (da), (6));
2085#ifndef IEEE80211_STA_ONLY
if (ic->ic_opmode == IEEE80211_M_HOSTAP && ETHER_IS_MULTICAST(da)(*(da) & 0x01))
memcpy(ring->mac, etherbroadcastaddr, ETHER_ADDR_LEN)__builtin_memcpy((ring->mac), (etherbroadcastaddr), (6));
2088#endif

req->msg.msgtype = MSGBUF_TYPE_FLOW_RING_CREATE0x3;
req->msg.ifidx = 0;
req->msg.request_id = 0;
req->tid = bwfm_pci_prio2fifo[cmd->prio];
req->flow_ring_id = letoh16(cmd->flowid + 2)((__uint16_t)(cmd->flowid + 2));
memcpy(req->da, da, ETHER_ADDR_LEN)__builtin_memcpy((req->da), (da), (6));
memcpy(req->sa, sa, ETHER_ADDR_LEN)__builtin_memcpy((req->sa), (sa), (6));
req->flow_ring_addr.high_addr =
   letoh32(BWFM_PCI_DMA_DVA(ring->ring) >> 32)((__uint32_t)(((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) >> 32));
req->flow_ring_addr.low_addr =
   letoh32(BWFM_PCI_DMA_DVA(ring->ring) & 0xffffffff)((__uint32_t)(((uint64_t)(ring->ring)->bdm_map->dm_segs
[0].ds_addr) & 0xffffffff));
req->max_items = letoh16(512)((__uint16_t)(512));
req->len_item = letoh16(48)((__uint16_t)(48));

bwfm_pci_ring_write_commit(sc, &sc->sc_ctrl_submit);
splx(s)spllower(s);
2106}

2108void
2109bwfm_pci_flowring_delete(struct bwfm_pci_softc *sc, int flowid)
2110{
struct msgbuf_tx_flowring_delete_req *req;
struct bwfm_pci_msgring *ring;
int s;

ring = &sc->sc_flowrings[flowid];
if (ring->status != RING_OPEN) {
printf("%s: flowring not open\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
return;
}

s = splnet()splraise(0x4);
req = bwfm_pci_ring_write_reserve(sc, &sc->sc_ctrl_submit);
if (req == NULL((void *)0)) {
printf("%s: cannot reserve for flowring\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
splx(s)spllower(s);
return;
}

ring->status = RING_CLOSING;

req->msg.msgtype = MSGBUF_TYPE_FLOW_RING_DELETE0x5;
req->msg.ifidx = 0;
req->msg.request_id = 0;
req->flow_ring_id = letoh16(flowid + 2)((__uint16_t)(flowid + 2));
req->reason = 0;

bwfm_pci_ring_write_commit(sc, &sc->sc_ctrl_submit);
splx(s)spllower(s);

tsleep_nsec(ring, PCATCH0x100, DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), SEC_TO_NSEC(2));
if (ring->status != RING_CLOSED)
printf("%s: flowring not closing\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
2143}

2145void
2146bwfm_pci_flowring_delete_cb(struct bwfm_softc *bwfm, void *arg)
2147{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct bwfm_cmd_flowring_create *cmd = arg;
struct bwfm_pci_msgring *ring;

ring = &sc->sc_flowrings[cmd->flowid];
bwfm_pci_dmamem_free(sc, ring->ring);
ring->status = RING_CLOSED;
wakeup(ring);
2156}

2158void
2159bwfm_pci_stop(struct bwfm_softc *bwfm)
2160{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct bwfm_pci_msgring *ring;
int i;

for (i = 0; i < sc->sc_max_flowrings; i++) {
ring = &sc->sc_flowrings[i];
if (ring->status == RING_OPEN)
	bwfm_pci_flowring_delete(sc, i);
}
2170}

2172int
2173bwfm_pci_txcheck(struct bwfm_softc *bwfm)
2174{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct bwfm_pci_msgring *ring;
int i;

/* If we are transitioning, we cannot send. */
for (i = 0; i < sc->sc_max_flowrings; i++) {
ring = &sc->sc_flowrings[i];
if (ring->status == RING_OPENING)
	return ENOBUFS55;
}

if (bwfm_pci_pktid_avail(sc, &sc->sc_tx_pkts)) {
sc->sc_tx_pkts_full = 1;
return ENOBUFS55;
}

return 0;
2192}

2194int
2195bwfm_pci_txdata(struct bwfm_softc *bwfm, struct mbuf *m)
2196{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct bwfm_pci_msgring *ring;
struct msgbuf_tx_msghdr *tx;
uint32_t pktid;
paddr_t paddr;
int flowid, ret;

flowid = bwfm_pci_flowring_lookup(sc, m);
if (flowid < 0) {
/*
 * We cannot send the packet right now as there is
 * no flowring yet.  The flowring will be created
 * asynchronously.  While the ring is transitioning
 * the TX check will tell the upper layers that we
 * cannot send packets right now.  When the flowring
 * is created the queue will be restarted and this
 * mbuf will be transmitted.
 */
bwfm_pci_flowring_create(sc, m);
return 0;
}

ring = &sc->sc_flowrings[flowid];
if (ring->status == RING_OPENING ||
   ring->status == RING_CLOSING) {
printf("%s: tried to use a flow that was "
    "transitioning in status %d\n",
    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), ring->status);
return ENOBUFS55;
}

tx = bwfm_pci_ring_write_reserve(sc, ring);
if (tx == NULL((void *)0))
return ENOBUFS55;

memset(tx, 0, sizeof(*tx))__builtin_memset((tx), (0), (sizeof(*tx)));
tx->msg.msgtype = MSGBUF_TYPE_TX_POST0xF;
tx->msg.ifidx = 0;
tx->flags = BWFM_MSGBUF_PKT_FLAGS_FRAME_802_3(1 << 0);
tx->flags |= ieee80211_classify(&sc->sc_sc.sc_ic, m) <<
   BWFM_MSGBUF_PKT_FLAGS_PRIO_SHIFT5;
tx->seg_cnt = 1;
memcpy(tx->txhdr, mtod(m, char *), ETHER_HDR_LEN)__builtin_memcpy((tx->txhdr), (((char *)((m)->m_hdr.mh_data
))), (((6 * 2) + 2)));

ret = bwfm_pci_pktid_new(sc, &sc->sc_tx_pkts, m, &pktid, &paddr);
if (ret) {
if (ret == ENOBUFS55) {
	printf("%s: no pktid available for TX\n",
	    DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname));
	sc->sc_tx_pkts_full = 1;
}
bwfm_pci_ring_write_cancel(sc, ring, 1);
return ret;
}
paddr += ETHER_HDR_LEN((6 * 2) + 2);

tx->msg.request_id = htole32(pktid + 1)((__uint32_t)(pktid + 1));
tx->data_len = htole16(m->m_len - ETHER_HDR_LEN)((__uint16_t)(m->m_hdr.mh_len - ((6 * 2) + 2)));
tx->data_buf_addr.high_addr = htole32((uint64_t)paddr >> 32)((__uint32_t)((uint64_t)paddr >> 32));
tx->data_buf_addr.low_addr = htole32(paddr & 0xffffffff)((__uint32_t)(paddr & 0xffffffff));

bwfm_pci_ring_write_commit(sc, ring);
return 0;
2260}

2262int
2263bwfm_pci_send_mb_data(struct bwfm_pci_softc *sc, uint32_t htod_mb_data)
2264{
struct bwfm_softc *bwfm = (void *)sc;
struct bwfm_core *core;
uint32_t reg;
int i;

if (sc->sc_mb_via_ctl)
return bwfm_pci_msgbuf_h2d_mb_write(sc, htod_mb_data);

for (i = 0; i < 100; i++) {
reg = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_htod_mb_data_addr)))
    sc->sc_htod_mb_data_addr)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_htod_mb_data_addr)));
if (reg == 0)
	break;
delay(10 * 1000)(*delay_func)(10 * 1000);
}
if (i == 100) {
DPRINTF(("%s: MB transaction already pending\n", DEVNAME(sc)))do { ; } while (0);
return EIO5;
}

bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_htod_mb_data_addr), (htod_mb_data)))
   sc->sc_htod_mb_data_addr, htod_mb_data)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_htod_mb_data_addr), (htod_mb_data)));
pci_conf_write(sc->sc_pc, sc->sc_tag, BWFM_PCI_REG_SBMBX0x98, 1);

core = bwfm_chip_get_core(bwfm, BWFM_AGENT_CORE_PCIE20x83C);
if (core->co_rev <= 13)
pci_conf_write(sc->sc_pc, sc->sc_tag, BWFM_PCI_REG_SBMBX0x98, 1);

return 0;
2294}

2296void
2297bwfm_pci_handle_mb_data(struct bwfm_pci_softc *sc)
2298{
uint32_t reg;

reg = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_dtoh_mb_data_addr)))
   sc->sc_dtoh_mb_data_addr)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_dtoh_mb_data_addr)));
if (reg == 0)
return;

bus_space_write_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_dtoh_mb_data_addr), (0)))
   sc->sc_dtoh_mb_data_addr, 0)((sc->sc_tcm_iot)->write_4((sc->sc_tcm_ioh), (sc->
sc_dtoh_mb_data_addr), (0)));

if (reg & BWFM_PCI_D2H_DEV_D3_ACK0x00000001) {
sc->sc_mbdata_done = 1;
wakeup(&sc->sc_mbdata_done);
}

/* TODO: support more events */
if (reg & ~BWFM_PCI_D2H_DEV_D3_ACK0x00000001)
printf("%s: handle MB data 0x%08x\n", DEVNAME(sc)((sc)->sc_sc.sc_dev.dv_xname), reg);
2317}

2319#ifdef BWFM_DEBUG
2320void
2321bwfm_pci_debug_console(struct bwfm_pci_softc *sc)
2322{
uint32_t newidx = bus_space_read_4(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_console_base_addr + 0x10)))
   sc->sc_console_base_addr + BWFM_CONSOLE_WRITEIDX)((sc->sc_tcm_iot)->read_4((sc->sc_tcm_ioh), (sc->
sc_console_base_addr + 0x10)));

if (newidx != sc->sc_console_readidx)
DPRINTFN(3, ("BWFM CONSOLE: "))do { ; } while (0);
while (newidx != sc->sc_console_readidx) {
uint8_t ch = bus_space_read_1(sc->sc_tcm_iot, sc->sc_tcm_ioh,((sc->sc_tcm_iot)->read_1((sc->sc_tcm_ioh), (sc->
sc_console_buf_addr + sc->sc_console_readidx)))
    sc->sc_console_buf_addr + sc->sc_console_readidx)((sc->sc_tcm_iot)->read_1((sc->sc_tcm_ioh), (sc->
sc_console_buf_addr + sc->sc_console_readidx)));
sc->sc_console_readidx++;
if (sc->sc_console_readidx == sc->sc_console_buf_size)
	sc->sc_console_readidx = 0;
if (ch == '\r')
	continue;
DPRINTFN(3, ("%c", ch))do { ; } while (0);
}
2338}
2339#endif

2341int
2342bwfm_pci_intr(void *v)
2343{
struct bwfm_pci_softc *sc = (void *)v;
struct ifnet *ifp = &sc->sc_sc.sc_ic.ic_ific_ac.ac_if;
struct mbuf_list ml = MBUF_LIST_INITIALIZER(){ ((void *)0), ((void *)0), 0 };
uint32_t status, mask;

if (!sc->sc_initialized)
return 0;

status = bwfm_pci_intr_status(sc);
/* FIXME: interrupt status seems to be zero? */
if (status == 0 && sc->sc_pcireg64)
status |= BWFM_PCI_64_PCIE2REG_MAILBOXMASK_INT_D2H_DB(1 | 2 | 4 | 8 | 0x10 | 0x20 | 0x40 | 0x80 | 0x100 | 0x200 | 0x400
 | 0x800 | 0x1000 | 0x2000 | 0x4000 | 0x8000);
if (status == 0)
return 0;

bwfm_pci_intr_disable(sc);
bwfm_pci_intr_ack(sc, status);

if (!sc->sc_pcireg64 &&
   (status & (BWFM_PCI_PCIE2REG_MAILBOXMASK_INT_FN0_00x0100 |
   BWFM_PCI_PCIE2REG_MAILBOXMASK_INT_FN0_10x0200)))
bwfm_pci_handle_mb_data(sc);

mask = BWFM_PCI_PCIE2REG_MAILBOXMASK_INT_D2H_DB(0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000 | 0x200000 |
 0x400000 | 0x800000);
if (sc->sc_pcireg64)
mask = BWFM_PCI_64_PCIE2REG_MAILBOXMASK_INT_D2H_DB(1 | 2 | 4 | 8 | 0x10 | 0x20 | 0x40 | 0x80 | 0x100 | 0x200 | 0x400
 | 0x800 | 0x1000 | 0x2000 | 0x4000 | 0x8000);

if (status & mask) {
bwfm_pci_ring_rx(sc, &sc->sc_rx_complete, &ml);
bwfm_pci_ring_rx(sc, &sc->sc_tx_complete, &ml);
bwfm_pci_ring_rx(sc, &sc->sc_ctrl_complete, &ml);

if (ifiq_input(&ifp->if_rcv, &ml))
	if_rxr_livelocked(&sc->sc_rxbuf_ring);
}

2380#ifdef BWFM_DEBUG
bwfm_pci_debug_console(sc);
2382#endif

bwfm_pci_intr_enable(sc);
return 1;
2386}

2388void
2389bwfm_pci_intr_enable(struct bwfm_pci_softc *sc)
2390{
if (sc->sc_pcireg64)
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC34)
, ((1 | 2 | 4 | 8 | 0x10 | 0x20 | 0x40 | 0x80 | 0x100 | 0x200
 | 0x400 | 0x800 | 0x1000 | 0x2000 | 0x4000 | 0x8000))))
    BWFM_PCI_64_PCIE2REG_MAILBOXMASK,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC34)
, ((1 | 2 | 4 | 8 | 0x10 | 0x20 | 0x40 | 0x80 | 0x100 | 0x200
 | 0x400 | 0x800 | 0x1000 | 0x2000 | 0x4000 | 0x8000))))
    BWFM_PCI_64_PCIE2REG_MAILBOXMASK_INT_D2H_DB)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC34)
, ((1 | 2 | 4 | 8 | 0x10 | 0x20 | 0x40 | 0x80 | 0x100 | 0x200
 | 0x400 | 0x800 | 0x1000 | 0x2000 | 0x4000 | 0x8000))));
else
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0x0100 | 0x0200 | (0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000
 | 0x200000 | 0x400000 | 0x800000))))
    BWFM_PCI_PCIE2REG_MAILBOXMASK,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0x0100 | 0x0200 | (0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000
 | 0x200000 | 0x400000 | 0x800000))))
    BWFM_PCI_PCIE2REG_MAILBOXMASK_INT_FN0_0 |((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0x0100 | 0x0200 | (0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000
 | 0x200000 | 0x400000 | 0x800000))))
    BWFM_PCI_PCIE2REG_MAILBOXMASK_INT_FN0_1 |((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0x0100 | 0x0200 | (0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000
 | 0x200000 | 0x400000 | 0x800000))))
    BWFM_PCI_PCIE2REG_MAILBOXMASK_INT_D2H_DB)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0x0100 | 0x0200 | (0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000
 | 0x200000 | 0x400000 | 0x800000))));
2401}

2403void
2404bwfm_pci_intr_disable(struct bwfm_pci_softc *sc)
2405{
if (sc->sc_pcireg64)
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC34)
, (0)))
    BWFM_PCI_64_PCIE2REG_MAILBOXMASK, 0)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC34)
, (0)));
else
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0)))
    BWFM_PCI_PCIE2REG_MAILBOXMASK, 0)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x4C),
 (0)));
2412}

2414uint32_t
2415bwfm_pci_intr_status(struct bwfm_pci_softc *sc)
2416{
if (sc->sc_pcireg64)
return bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0xC30))
)
    BWFM_PCI_64_PCIE2REG_MAILBOXINT)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0xC30))
);
else
return bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x48)))
    BWFM_PCI_PCIE2REG_MAILBOXINT)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x48)));
2423}

2425void
2426bwfm_pci_intr_ack(struct bwfm_pci_softc *sc, uint32_t status)
2427{
if (sc->sc_pcireg64)
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC30)
, (status)))
    BWFM_PCI_64_PCIE2REG_MAILBOXINT, status)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xC30)
, (status)));
else
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x48),
 (status)))
    BWFM_PCI_PCIE2REG_MAILBOXINT, status)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x48),
 (status)));
2434}

2436uint32_t
2437bwfm_pci_intmask(struct bwfm_pci_softc *sc)
2438{
if (sc->sc_pcireg64)
return bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0xC14))
)
    BWFM_PCI_64_PCIE2REG_INTMASK)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0xC14))
);
else
return bus_space_read_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x24)))
    BWFM_PCI_PCIE2REG_INTMASK)((sc->sc_reg_iot)->read_4((sc->sc_reg_ioh), (0x24)));
2445}

2447void
2448bwfm_pci_hostready(struct bwfm_pci_softc *sc)
2449{
if ((sc->sc_shared_flags & BWFM_SHARED_INFO_HOSTRDY_DB10x10000000) == 0)
return;

if (sc->sc_shared_flags & BWFM_SHARED_INFO_SHARED_DAR0x80000000)
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xA24)
, (1)))
    BWFM_PCI_64_PCIE2REG_H2D_MAILBOX_1, 1)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0xA24)
, (1)));
else
bus_space_write_4(sc->sc_reg_iot, sc->sc_reg_ioh,((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x144)
, (1)))
    BWFM_PCI_PCIE2REG_H2D_MAILBOX_1, 1)((sc->sc_reg_iot)->write_4((sc->sc_reg_ioh), (0x144)
, (1)));
2459}

2461/* Msgbuf protocol implementation */
2462int
2463bwfm_pci_msgbuf_query_dcmd(struct bwfm_softc *bwfm, int ifidx,
  int cmd, char *buf, size_t *len)
2465{
struct bwfm_pci_softc *sc = (void *)bwfm;
struct msgbuf_ioctl_req_hdr *req;
struct bwfm_pci_ioctl *ctl;
struct mbuf *m;
uint32_t pktid;
paddr_t paddr;
size_t buflen;
int s;

buflen = min(*len, BWFM_DMA_H2D_IOCTL_BUF_LEN1518);
m = MCLGETL(NULL, M_DONTWAIT, buflen)m_clget((((void *)0)), (0x0002), (buflen));
if (m == NULL((void *)0))
return 1;
m->m_lenm_hdr.mh_len = m->m_pkthdrM_dat.MH.MH_pkthdr.len = buflen;

if (buf)
memcpy(mtod(m, char *), buf, buflen)__builtin_memcpy((((char *)((m)->m_hdr.mh_data))), (buf), (
buflen));
else
memset(mtod(m, char *), 0, buflen)__builtin_memset((((char *)((m)->m_hdr.mh_data))), (0), (buflen
));

s = splnet()splraise(0x4);
req = bwfm_pci_ring_write_reserve(sc, &sc->sc_ctrl_submit);
if (req == NULL((void *)0)) {
splx(s)spllower(s);
m_freem(m);
return 1;
}

if (bwfm_pci_pktid_new(sc, &sc->sc_ioctl_pkts, m, &pktid, &paddr)) {
bwfm_pci_ring_write_cancel(sc, &sc->sc_ctrl_submit, 1);
splx(s)spllower(s);
m_freem(m);
return 1;
}

ctl = malloc(sizeof(*ctl), M_TEMP127, M_WAITOK0x0001|M_ZERO0x0008);
ctl->transid = sc->sc_ioctl_transid++;
TAILQ_INSERT_TAIL(&sc->sc_ioctlq, ctl, next)do { (ctl)->next.tqe_next = ((void *)0); (ctl)->next.tqe_prev
 = (&sc->sc_ioctlq)->tqh_last; *(&sc->sc_ioctlq
)->tqh_last = (ctl); (&sc->sc_ioctlq)->tqh_last =
 &(ctl)->next.tqe_next; } while (0);

req->msg.msgtype = MSGBUF_TYPE_IOCTLPTR_REQ0x9;
req->msg.ifidx = 0;
req->msg.flags = 0;
req->msg.request_id = htole32(pktid)((__uint32_t)(pktid));
req->cmd = htole32(cmd)((__uint32_t)(cmd));
req->output_buf_len = htole16(*len)((__uint16_t)(*len));
req->trans_id = htole16(ctl->transid)((__uint16_t)(ctl->transid));

req->input_buf_len = htole16(m->m_len)((__uint16_t)(m->m_hdr.mh_len));
req->req_buf_addr.high_addr = htole32((uint64_t)paddr >> 32)((__uint32_t)((uint64_t)paddr >> 32));
req->req_buf_addr.low_addr = htole32(paddr & 0xffffffff)((__uint32_t)(paddr & 0xffffffff));

bwfm_pci_ring_write_commit(sc, &sc->sc_ctrl_submit);
splx(s)spllower(s);

tsleep_nsec(ctl, PWAIT32, "bwfm", SEC_TO_NSEC(5));
TAILQ_REMOVE(&sc->sc_ioctlq, ctl, next)do { if (((ctl)->next.tqe_next) != ((void *)0)) (ctl)->
next.tqe_next->next.tqe_prev = (ctl)->next.tqe_prev; else
 (&sc->sc_ioctlq)->tqh_last = (ctl)->next.tqe_prev
; *(ctl)->next.tqe_prev = (ctl)->next.tqe_next; ((ctl)->
next.tqe_prev) = ((void *)-1); ((ctl)->next.tqe_next) = ((
void *)-1); } while (0);

if (ctl->m == NULL((void *)0)) {
free(ctl, M_TEMP127, sizeof(*ctl));
return 1;
}

*len = min(ctl->retlen, m->m_lenm_hdr.mh_len);
*len = min(*len, buflen);
if (buf)
m_copydata(ctl->m, 0, *len, buf);
m_freem(ctl->m);

if (ctl->status < 0) {
free(ctl, M_TEMP127, sizeof(*ctl));
return 1;
}

free(ctl, M_TEMP127, sizeof(*ctl));
return 0;
2541}

2543int
2544bwfm_pci_msgbuf_set_dcmd(struct bwfm_softc *bwfm, int ifidx,
  int cmd, char *buf, size_t len)
2546{
return bwfm_pci_msgbuf_query_dcmd(bwfm, ifidx, cmd, buf, &len);
2548}

2550void
2551bwfm_pci_msgbuf_rxioctl(struct bwfm_pci_softc *sc,
  struct msgbuf_ioctl_resp_hdr *resp)
2553{
struct bwfm_pci_ioctl *ctl, *tmp;
struct mbuf *m;

m = bwfm_pci_pktid_free(sc, &sc->sc_rx_pkts,
   letoh32(resp->msg.request_id)((__uint32_t)(resp->msg.request_id)));

TAILQ_FOREACH_SAFE(ctl, &sc->sc_ioctlq, next, tmp)for ((ctl) = ((&sc->sc_ioctlq)->tqh_first); (ctl) !=
 ((void *)0) && ((tmp) = ((ctl)->next.tqe_next), 1
); (ctl) = (tmp)) {
if (ctl->transid != letoh16(resp->trans_id)((__uint16_t)(resp->trans_id)))
	continue;
ctl->m = m;
ctl->retlen = letoh16(resp->resp_len)((__uint16_t)(resp->resp_len));
ctl->status = letoh16(resp->compl_hdr.status)((__uint16_t)(resp->compl_hdr.status));
wakeup(ctl);
return;
}

m_freem(m);
2571}

2573int
2574bwfm_pci_msgbuf_h2d_mb_write(struct bwfm_pci_softc *sc, uint32_t data)
2575{
struct msgbuf_h2d_mailbox_data *req;
int s;

s = splnet()splraise(0x4);
req = bwfm_pci_ring_write_reserve(sc, &sc->sc_ctrl_submit);
if (req == NULL((void *)0)) {
splx(s)spllower(s);
return ENOBUFS55;
}

req->msg.msgtype = MSGBUF_TYPE_H2D_MAILBOX_DATA0x23;
req->msg.ifidx = -1;
req->msg.flags = 0;
req->msg.request_id = 0;
req->data = data;

bwfm_pci_ring_write_commit(sc, &sc->sc_ctrl_submit);
splx(s)spllower(s);

return 0;
2596}